Monday, December 19, 2016

Your account will be blocked!!! (Dropbox Phishing)

Dear User,

Your Mail Storage Limit has exceeded you might not be able to send or receive new messages; Click or Copy the link below onto your browser to verify your email and increase storage limit.

http://www.powerline.or.kr/zboard/data/dpbx/index.php

Note: Failure to heed strictly to this notification will lead to Email Account deletion thereby causing lost of files.

Thank you for using our mail system

Mail Administrator

Email analysis :

NOTE : hr@mail.com
NOTE : Received : from User (unknown [104.194.2.16])
NOTE : (Authenticated sender: admin) by mail.vps.com (Postfix)

Phishing analysis :

CLICK : http://www.powerline.or.kr/zboard/data/dpbx/index.php
OPEN : http://www.powerline.or.kr/zboard/data/dpbx/index.php
SCREENSHOT :


RESULT : Dropbox phishing
CLICK : Other Emails
SCREENSHOT :


CLICK : Submit
REDIRECT : https://www.dropbox.com/

Here is the information;MTCN; 2133097115

your first payment $5,000.00 sent to your name today and Here is the information;MTCN; 2133097115 SENDER NAME:Marcel Kimelman , track it now (www.westernunion.com) I told him to keep sending you $5,000.00 daily until the payment of ($1.200.000.00 usd dollars) is completed transfer to you and again forward them your Telephone number and adress so that they will be sure.
Contact Person:Dr.BERNARD ANDRE
E-mail (westeruniontransfer65@gmail.com)
Phone Number: +229-99060543
Thanks and hope to read from you soon,
PASTOR FRED WILSON
hope to read from you soon

Email analysis :

NOTE : westeruniontransfer65@gmail.com
NOTE : "W.W.W."@movie.ocn.ne.jp
NOTE : X-Originating-Ip : [64.134.96.77]

Friday, December 16, 2016

Attention. Beneficiary Your fund {$2.5,Million USD

Attention. Beneficiary Your fund {$2.5,Million USD

I write to inform you that your inheritance fund worth US$2.5,000.000.00 which has been delayed by these officers who claim to be in position,Now i write to inform you that the fund file has been transferred and confirms here in our Bank,and it has Approved today to issue out ATM CARD in your favor and send to you which is the easier way you can receive your fund in any atm machine all over the world,

Therefore you are warned to stop any further communication with anybody to avoid distraction on receiving your ATM CARD your inheritance fund to avoid distraction because they will lie and get money from you.All we need now to start up the process is your information.

Full Name:__________
Delivery Address:_
Country:_______
City:_______
Occupation:_____
Phone Number:____
Age:______
sex:______

Sincerely
Mis, Angela Kenneth
Tel Phone +229 66873450
Email/ atmcarddepartment53@yahoo.fr

Email analysis :

NOTE : atmcarddepartment53@yahoo.fr
NOTE : "www."@eos.ocn.ne.jp
NOTE : X-Originating-Ip : [41.216.50.78]

Dear friend

Dear Friend,

We have concluded to effect your payment of $1.8Million, through western union, but the maximum amount you will be receiving each day starting from tomorrow is $5000 daily until the funds is completely transferred.

The transfer department has started processing the transfer of your $1.8 Million Either by Bank to Bank wire transfer/ ATM Card or Diplomatic Means. If you inquire to know more about this transaction, It is all about the funds that have been due for transfer to some beneficiaries over the years that was unsuccessful, and we have been authorized to review and ensure that every beneficiary is being paid the due amount.

Our attorney will go to the Inland Revenue tax office to obtain a letter of administration tax clearance approval on your behalf from high Court.

Endeavor to send the following information to Transfer Officer Smith Qualen for the activation of this payment above in the right data.

Kindly Contact Western Union Transfer Officer;
Mr; Smith Qualen
Email; (squalen8@gmail.com)

Also reconfirm your information below

YOUR NAME----------------------
YOUR ADDRESS-----------
YOUR PHONE-------------
OCCUPATION-----------------

Thank you.
Mrs. Lisa Carson.

Email analysis :

NOTE : squalen8@gmail.com
NOTE : jndife1@yahoo.com

Thursday, December 15, 2016

Xmas loan

RELIABLE LOAN OFFERS AT CHEAP RATE, FOR MORE INFORMATION CONTACT OUR PRIVATE EMAIL : dicksonfinance2016@gmail.com

NAME:
AMOUNT:
LOAN DURATION:
COUNTRY:
PHONE NUMBER:

WARM REGARDS
MR.MICHAEL DICKSON

Email analysis :

NOTE : dicksonfinance2016@gmail.com
NOTE : dicksonfinance2017@gmail.com
NOTE : Received : from [197.210.226.141]

Tuesday, December 13, 2016

How are you today?

Attention My Dear

I have registered your winning Price of $4.5USD with DHL Express Company with registration code of ( DCJKT00617G). please Contact with your delivery information such as, Your Name, Your Address ID CARD COPY and Your Telephone Number:

DHL Express Company Office:
Contact Person: Mr. David Candy
E-mail: dhlcourircompany@gmail.com
PHONE: NO+229-636 90 566

I have paid for the Security fee.The only fee you have to pay is their Insurance & Delivery fee only.Please indicate the registration Number and ask Him how much is their Insurance & Delivery fee so that you can pay it.

Best Regards,
Mrs. Jolie Davis

Email analysis :

NOTE : dhlcourircompany@gmail.com
NOTE : micaela@speedy.com.ar
NOTE : X-Origin : 41.79.217.134

Monday, December 12, 2016

Attention Winner,

World Lottery Association (WLA)
Basel CH-4002,
Switzerland

Attention Winner,

This is to inform you that your One Million Five Thousand United States Dollar ($1.5M) Lottery Win will be send to you via ATM MASTER CARD or Certified bank draft Cheque so that there will not be any delay or much tax's as this lottery organizer want you to receive your winning prize within 30 days before the expiring date of the bank draft. The total amount mentioned above was awarded to your Facebook email address for winning a first category in the 2016 draw; your payment is available at one of the PRIME Bank here in Benin Republic where your payment file was allocated (NAME OF THE BANK WITH HOLD FOR SECURITY REASON).

It was decided to use ATM VISA CARD or Certified Bank Draft payment to pay our winners which you are one of them to avoid difficulties in receiving winning funds; this award came to you Curtsy of FACEBOOK and GOOGLE. Note that your ATM VISA CARD was powered by Gold MasterCard which is accepted at over 900,000 Automated Teller Machines payment centers in over 210 countries worldwide and the CARD withdrawal daily limit is $10,000USD until you withdraw all your total winner amount of $1,500,000.00USD, And note that the only and last money you are going to pay to receive your payment is $99USD courier shipment charges. To receive your winning payment,you are advised to contact the Fiduciary with your following information

Your Receiving Name..: Your Receiving Address..: Your Country..: Your Tel..: Your Sex..: Your Age..: Your Occupation..:

Note: the Ninety nine dollars is the last and only fee associated to this delivery of your package,(IMPORTANT) Winners are mandated to keep this notification private to avoid fraudulent claim pending the transfer.

Contact your payment fiduciary at: (info70857@gmail.com )

Yours Faithfully; WLA ANNOUNCING TEAM, SWITZERLAND

Email analysis :

NOTE : info70857@gmail.com
NOTE : "www."@beetle.ocn.ne.jp
NOTE : X-Originating-Ip : [84.53.238.158]

Thursday, December 8, 2016

Message notification *@gmail.com (Link to virus)


Google

Nddcole Watddson (Google Support) just sent you a message:

06/12/2016

Undeliverable messages (*@gmail.com).

Get more information

Don't want occasional updates about Gmail activity? Change what email Google Team sends you.

Email analysis :

NOTE : Received : from server.oeirasdigital.pt
NOTE : (server.oeirasdigital.pt. [213.229.111.207])
NOTE : client-ip=213.229.111.207;


NOTE : X-Php-Originating-Script : 10000:bisend.php

Link analysis :

CLICK : Get more information
OPEN : http://projetomac.org/wp/Undeliverable_messages.html
DOWNLOAD A FILE : Undeliverable_messages.zip
INFORMATION : Undeliverable_messages.zip is a virus
SHA256 : be0908fbf059517f8ea204d1636e00a7810146fb9c920fc01bb4315b8e8e0067

Virus analysis :

AegisLab Troj.Downloader.Script!c
Arcabit HEUR.JS.Trojan.ba
Cyren JS/Nemucod.EY!Eldorado
F-Prot JS/Nemucod.EY!Eldorado
Fortinet Malware_Generic.P0
K7AntiVirus Trojan ( 004dfe6d1 )
K7GW Trojan ( 004dfe6d1 ) 20161208
Kaspersky HEUR:Trojan-Downloader.Script.Generic
Sophos Mal/DrodZp-A

Exposing virus :

PASTEBIN : http://pastebin.com/20PLKDCB
RAW : http://pastebin.com/raw/20PLKDCB



Hello/Urgent

Dear Friend,

I am Barrister Obinna Jude, a Solicitor and the Personal attorney to Mr. Hoel Paul Edouard, a national of France, who died in a Plane crash on Monday 2nd September 1998 GMT 14:22 UK while they were flying from New York to Geneva. You can see the news or report on the below site.

http://www.cnn.com/WORLD/9809/swissair.victims.list/index.html

My client his wife and three children lost their lives on that plane crash.Since then,i have made several enquiries to the embassy to locate anyof my clients extended relatives, this has proved unsuccessful. After several unsuccessful attempts, I decided to trace his relatives over the internet, so as to locate any member of his family but to no avail.

I have contacted you to assist in repatriating the money that belonged to my late client before they get confiscated or declared as unserviceable by the bank where this huge deposit were lodged. Particularly, the Bank where the deceased had an account valued at about US$15 Million Dollars, has issued me a notice to provide the next of kin or have the account confiscated within the next ten official working days.

Since i have been unsuccessful in locating the relatives for over 3 years now therefore, I have decided to seek your consent to present you as the next of kin of the deceased, so that the proceeds of this account valued at US$15 Million Dollars, can be paid to you and then you and me can share the money 50% to me and 45% to you, while 5% will be mapped out for any expenses during the process or tax as your government may require. I have the certificate of deposit that can be used to back up any claim we may make.All I require is your honest cooperation to enable us see the deal
through.

I guarantee that this will be executed under a legitimate arrangement that will protect you from any breach of the law. Please get in touch with me strictly via this email (obinna.jude@yandex.com) to enable us discuss further.

Best regards.
Obinna Jude
Principal Attorney.

Email analysis :

NOTE : obinna.jude@yandex.com
NOTE : ludo@fcvnet.net
NOTE : Received : from [104.247.196.21]
NOTE : (unknown [104.247.196.21])


NOTE : by mail.fcvnet.net (Postfix)