Hello Dear

Dear Friend,

Your contact came to me through a friend who does international business between countries.

I am Ms Ashley William, of the Ministry of Health in Mauritius proposing a beneficial transaction to you.I am relying on your genuineness and sincerity,in all aspects of this proposal.

The transaction in question of which I am about to reveal to you,emanated from over-invoicing(COMMISSION) of contract awarded in my ministry for the supplies of medical equipment and quality health programs.The Contract payment were completed on the directives of Nicholas west: knowing fully that my commission will be paid out as agreed to a receiving vault as deposited valuables.

please kindly respond to my email addresses below for full details:
ashleywilliamz2000@hotmail.com

Thanks,
Ms Ashley Williams

Email analysis :

NOTE : ashleywilliamz2000@hotmail.com
NOTE : Shashi@studentmail.siit.tu.ac.th
NOTE : X-Mailer : Zimbra 8.6.0_GA_1194 (zclient/8.6.0_GA_1194)
NOTE : X-Originating-Ip : [166.88.123.62]

NOTE : Received : from mail.studentmail.siit.tu.ac.th
NOTE : (mail.studentmail.siit.tu.ac.th [103.253.75.124])
NOTE : by mail.studentmail.siit.tu.ac.th

NOTE : account Shashi
NOTE : siit.tu.ac.th

NOTE : mail.studentmail.siit.tu.ac.th server was used to relay this scam.

Contact Diplomat John Now

We wish to inform you that the diplomatic agent conveying the consignment box valued at the sum of $2.5 Million is currently at John F Kennedy International Airport. We required you to reconfirm the following information below so that he can deliver your consignment box to you today. Contact Diplomat John DeJohn and also make sure that you forward your Code Number registration to him because it is very important to enable him locate your address.

I require your urgent response to this email with below stated information

Full Name=========
Home Address=======
City==========
Country========
ID============
Telephone =========

Bank REGISTRATION NO :EG58945
Bank CODE NUMBER: 0140479

Make sure you don't let the agent know the content of the consignment box for security purposes and i want this to be within you and us to avoid another person contacting the agent over your fund. Immediately you contact him, he will deliver your consignment box to you.

Contact Email ; dejohnjohnm@gmail.com
Mobile Number:(+1 646 513 5132)

Best Regards

Director Albert F. Cuthbert
Foreign Operation department
United State Embassy West Africa
+22962329600

Email analysis :

NOTE : albertcuthbert@yahoo.com
NOTE : dejohnjohnm@gmail.com
NOTE : "www."@gaea.ocn.ne.jp
NOTE : Fedex
NOTE : Mr Albert Cuthbert
NOTE : X-Originating-Ip : [41.86.234.171]

RE: CHARITY WORK AND NEEDY....

My Dear Beloved ,

Greetings and many thanks my dear for your urgent response to my proposal. I will also thank you for your concern. Am in Scotland now receiving my treatment, I have been here for pass Two years and Eight Months. From my proposal you can understand what i am going through.I have been bed-ridden for a very longtime now. I only need someone whom i will trust this fund so that it will be used the way i want.. I will also send you the certificate of deposit and the bank will educate you more concerning the fund, am old woman seeking for your help before i die because i don't want to lose the fund with the bank.

If you can assist me to receive this fund , you should give me your full name and address with your ID CARD, your telephone And Your Age for easy communication so that i will send it to the Bank to enable them change all the documentations to your name as the beneficiary of the fund. The above documents will stand you as the beneficiary to the fund and will empower the Bank to send the funds to you without any delay.

I was restricted by the doctors from using phone because of my health. But I will be communicating with you regularly through mail because i know that with your honesty and trust, the funds will get to you within three workers days from now.

Thanks and my regards,

Madam Elizabeth Benedicta

Email analysis :

NOTE : elizabethbenedicta@yahoo.com
NOTE : elizybe343322@hotmail.com
NOTE : Received : from User (unknown [197.211.56.16])

NOTE : by macareo.pucp.edu.pe

NOTE : pucp.edu.pe

NOTE : macareo.pucp.edu.pe server was used to relay this scam.

PayPal & Bank - haccking Transfer (+10.000 usd daily)

Western Union, Bank, Paypal transfer - Haacking and Caarding transfer. Maximum 9.999$ daily.

More details on our underground market:
http://***.cc/showthread.php?tid=1201

Email analysis :

NOTE : X-Msmail-Priority : Normal
NOTE : Return-Path : < admin@black-hack.su >
NOTE : X-Mimeole : Produced By Microsoft MimeOLE V15.4.3538.513
NOTE : X-Remote : 66.42.85.200 (keevan.fire2wire.com)
NOTE : Organization : DarkMarket
NOTE : Mime-Version : 1.0
NOTE : X-Priority : 3
NOTE : X-Mailer : Microsoft Windows Live Mail 15.4.3538.513
NOTE : Received : from keevan.fire2wire.com (66.42.85.200)

NOTE : Received : from [155.133.82.113] (helo=155.133.82.113)

NOTE : by keevan.fire2wire.com with esmtpsa (TLSv1:AES256-SHA:256)
NOTE : (Exim 4.69) (envelope-from < admin@black-hack.su >)
NOTE : PayPal & Bank - haccking Transfer (+10.000 usd daily)

New incoming Fax from 908.8325722

You Have a new Fax message
From: 908.8145483
Receiving date: November 28, 2016
Pages: 3

You can view your message on our website:
https://service.ringcentral.com/ messages/download.aspx?fax_id=1805802

Thank you for using RingCentral.

Link analysis :

CLICK : https://service.ringcentral.com/ messages/download.aspx?fax_id=1805802
OPEN : http://787.vn/wp-content/themes/tourpackage-v1-02/backup/get.php?id=dGVzdEB0ZXN0LmNvbQ==
DOWNLOAD : fax_test.doc

File analysis :

OPEN : fax_test.doc
SHA256 : c0b3934b594a23dd88a42c0e96ccbbf7f88c633a19d82833d6d9bbf47630a0c1
RESULT : fax_test.doc is a virus

Virus analysis :

Avast : VBA:Downloader-DSL [Trj]
ClamAV : Doc.Dropper.Agent-1847249
Kaspersky : Trojan-Downloader.MSWord.Agent.avj
Qihoo-360 : virus.office.gen.70
Sophos : Troj/DocDl-FTZ
Symantec : W97M.Downloader

Email analysis :

NOTE : ringcentral@faxmessage.com
NOTE : 74.143.65.242 (rrcs-74-143-65-242.central.biz.rr.com)

NOTE : Mime-Version : 1.0

Compensation Payment,

Attn: Beneficiary

I wish to inform you were among the scam victims listed to be released their overdue funds by the UNITED NATIONS in conjunction with the International Monetary Fund (IMF) after the last encounter we held concerning your funds. As directed by UN secretary General Ban Ki-Moon in collaborations with the IRS, I wish to state categorically that a transfer of $10,500,000.00 will be made to your bank account as almost 99% cost associated with the transfer of your funds has been prepaid by the U.S. Government. The only fee you will pay is the cost of processing a "Fund Clearance Certificate" by the paying bank. The "Fund Clearance Certificate" is required in accordance with the U.S. Monetary Transfer or deposit Policy and it is the only fee you will have to pay before your funds can be transferred to your account. After you have paid for the above mentioned certificate, the paying bank will process it and send a copy of it to you for your perusal.

Note once again that your overdue payment will be credited into your account you will furnish with the Bank without any delay as approved by United Nations, International Monetary Fund, World Bank, and United States Government.

However, this is to inform you that we have been mandated by the United Nations Compensation Commission (UNCC) department through the Financial Crimes Enforcement Network (FinCEN) of the United States Department of the Treasury to release your overdue funds directly from the United Nations Compensation Fund Account via Telegraphic Transfer into your designated bank account. Note that the above sum is the payment of compensation awarded to you for losses and trauma resulting directly from scam committed against you in line with the Resolution 1483 (2012) adopted by the United Nations Security Council Headquarters in New York following series of complaints by the victims of scam.

Urgently respond with your full name, full address, copy of identification and direct phone number so that I will furnish you with the contact information of the paying bank. Remember, they will instruct you on how to send the money to them as soon as you contact them.

Yours Sincerely,

Ms. Heidi Mendoza
Head Of United Nations Under-Secretary- General
For Internal Oversight Services.

Email analysis :

NOTE : office1001967@gmail.com
NOTE : mra0@un.org
NOTE : Received : from User (host-185-13-247-42.razorblue.net.uk [185.13.247.42])

NOTE : by mx-out-b.razorblue.net.uk (Postfix)