Heineken Premium Award 2017 "New Edition " (Heineken Scam + Email Leak)

Dear Benficiary,

This is to inform you that we Heineken Company Collaboration with Euro-
Million Lotto Draw on online Sweepstake Promotion Held on 20th
January,2017.

We are pleased to notify you that your email address was among the Email
Address selected randomly through our computer ballot system from world
Email Directories.

These are the lucky Numbers: 34,38,8,23 Bonus 3.
Your winning pin code: Hein/XX/5UNMS/2/17.

you are requested to contact our fiduciary agent for more information and
instructions, Below is the information to contact,

Contact Person: Mr Williams Walker
Office Email: williamswalker160@gmail.com
Website: http://www.heineken.com

Email analysis :

NOTE : tes@aplog.co
NOTE : williamswalker160@gmail.com
NOTE : Received : from zbmboxldap.aplog.co

Email leak :

jswaglord@yahoo.com, pleasefillintheblank@hotmail.com, mizra9062@gmail.com, hugoferreiracamargo@gmail.com, hector.rowles@gmail.com, fisherm@sgaweb.net, mattallegra@mail.com, jasminedelancey@gmail.com, chelleanderson12@gmail.com, pegidaunited@outlook.com, frederic@hotmail.com, cherrybree289@gmail.com, cruise19allyson@gmail.com, rhejean16@gmail.com, lucy04anderson@gmail.com, happyatlast0@yahoo.co.uk, bsartstudios@outlook.com, aaronreid@windowslive.com, bofasaur@gmail.com, sergeikurkov@yahoo.co.uk, dionnex18@hotmail.co.uk, harrold.fiducious@gmail.com, johnnyjones101@mail.com, cj96050@gmail.com, fransi@fransimalin.co.uk, drachenlords1510@live.de, engr.hanks@yahoo.co.za, Webinis123@gmail.com, jessicapierce318@gmail.com, marjac1997@gmail.com, meandcecilia@gmail.com, jw508328@gmail.com, whiter958@gmail.com, reverendtomjones@gmail.com, Jerry.fring@yahoo.com, Salamallikki@hotmail.com, cartoonherodude@gmail.com, richiecool84@hotmail.com, laurenmachan@hotmail.com, garywelburn@hotmail.com, realtopdocument@outlook.com, whiter958@msn.com, rob.karhu@gmail.com, keithspr3@hotmail.com, bill.martins@hotmail.com, rich.dude.swag@gmail.com

Verification Required #* Mise à jour de vos coordonnèes. (Phishing Banque Populaire)

Banque populaire Cyberplus
gérez vos Opération bancaires en ligne

Chér(e) client(e)

- Nous tenons a vous informer que vous avez un nouveau message de la part de votre conseiller :

. Veuillez procéder a la validation de Votre PassCyberPlus

- Pour confirmer votre code veuillez cliqes sur le lien ci-dessous:

https://www.icgauth.banquepopulaire.fr/WebSSo-BP/_13907/index.html

Nous vous remerions de votre confiance .

Cordialement

Banque Populaire

Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de son ou ses destinataires. Si vous avez reçu ce message par erreur, merci d'en avertir immédiatement l'émetteur et de détruire le message. Toute modification, édition, utilisation ou diffusion non autorisée est interdite. L'émetteur décline toute responsabilité au titre de ce message s'il a été modifié, déformé, falsifié, infecté par un virus ou encore édité ou diffusé sans autorisation.***********************************************************************************************Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de son ou ses destinataires. Si vous avez reçu ce message par erreur, merci d'en avertir immédiatement l'émetteur et de détruire le message. Toute modification, édition, utilisation ou diffusion non autorisée est interdite. L'émetteur décline toute responsabilité au titre de ce message s'il a été modifié, déformé, falsifié, infecté par un virus ou encore édité ou diffusé sans autorisation. *********************************************************************************************** This message and any attachments are confidential and intended for the named addressee(s) only. If you have received this message in error, please notify immediately the sender, then delete the message. Any unauthorized modification, edition, use or dissemination is prohibited. The sender shall not be liable for this message if it has been modified, altered, falsified, infected by a virus or even edited or disseminated without authorization. ***********************************************************************************************

Screenshot of the email :

Email analysis :

NOTE : votre-service-cyberplus@web.de
NOTE : Received : from wu548652416341 ([52.164.213.191])
NOTE : by mrelayeu.kundenserver.de (mreue002 [212.227.15.168])

Phishing analysis :

CLICK : https://www.icgauth.banquepopulaire.fr/WebSSo-BP/_13907/index.html
OPEN : http://freelabel.net/css/bootstrap4/ola/cyber
REDIRECT : http://www.icgauth.banquepopulaire.fr.websso-bp.13907.serveur-cyberplus-data.com/populaire/index/*
RESULT : Phishing was removed.

Please verify your Apple ID. (Apple Phishing)

Dear Customer,

Your AppIe lD has been disabled for security reasons ! To confirm your informations please click on the link below or copy and paste it to your browser then follow the instructions.

https://www.medfuture.com.au/Verification-iTunes/

Once you have update your account records, your information will be confirmed and your account will start to work as normal once again. If you have any questions, or require further assistance, please contact us.

Best Regards,
The AppIe Support Team

Contact Us | Affilaite Program | 1 Infinite Loop, Cupertino, CA 95014

Privacy Policy | Terms of Service | Terms of Sale

Phishing screenshot :

Email analysis :

NOTE : Mime-Version : 1.0
NOTE : Content-Type : text/html; charset="iso-8859-1"
NOTE : Return-Path :
NOTE : X-Priority : 1
NOTE : X-Mailer : PHPMailer (phpmailer.sourceforge.net) [version ]
NOTE : Received : from server2.com ([180.210.203.65])
NOTE : Received : by server2.com (Postfix, from userid 48)
NOTE : Message-Id : < *@jobcom.sg >
NOTE : client-ip=180.210.203.65;
NOTE : Content-Transfer-Encoding : 8bit
NOTE : Please verify your Apple ID.

Phishing analysis :

CLICK : https://www.medfuture.com.au/Verification-iTunes/
OPEN : https://www.medfuture.com.au/Verification-iTunes/
REDIRECT : https://www.medfuture.com.au/Verification-iTunes/*/CheckAuth.php?caseID=*&accLocked_websc=*c&processing_unverified?true=*
SCREENSHOT :

VALIDATE : FORM
SCREENSHOT :

RESULT : Phishing

Whois analysis :

Domain Name : medfuture.com.au
Registrant : Thiruchenthoran Sarvanantharaja
Registrant ID : ABN 72260916560
Eligibility Type : Sole Trader
Registrant Contact Name : Niraj Chenthoran
Tech Contact ID : CR210807141
Tech Contact Name : Niraj Chenthoran
Name Server : ns1.medfuture.com.au
Name Server IP : 166.62.39.20
Name Server : ns2.medfuture.com.au

URGENT REPLY

Hello, Dear

I am Hasher Al Maktoum, Chairman of the Dubai International Holding Company.

I am seeking your partnership in going into a private investment venture. I am interested in investing in your country, so I will like us to begin our acquaintance through this medium so we can discuss more.

I hope to hear from you soon.

Regards
Hasher Al Maktoum
Reply Re

Email analysis :

NOTE : hasheralmaktoum22@gmail.com
NOTE : hasheralmaktoum7@outlook.com
NOTE : Received : from HK2PR0401MB1377.apcprd04.prod.outlook.com ([10.165.180.23])

Compliment" Info From Benson

Compliment,

I am a politician representing my constituency at just concluded election in Ghana and also a member of Ghana's executive committee on contract awards. My Name is Mr. Benson Kwaku. The reason of relating to you is to aid me in securing some money oversea for protected custody which I deliberately reserved for funding of my parliamentary elections campaign under the party leadership of the National Democratic Congress (NDC) last year December 7th 2016, regrettably for me I lost the parliamentary seat to the opposition party of The New Patriotic Party (NPP).

As an executive member on contract award committee, I was able to dump some kickback money emanated from award of contracts awarded to Japanese and German companies in a security vault with a commercial bank in Ghana pending when I will found a reliable individual to budge out the fund from Ghana to offshore bank account for a company venture.

Contacting you arose from the fact that the present-elect government vowed to crack down on our administrative functionaries of (NDC) and will trace all the resources that was made through contract awards and other mouth watering deals during our tenure in the office from the year 2008 to 2016, if they succeed in tracing this fund to me, they will confiscate it and thereby devastating my life time opportunities.

It become paramount for me to move this fund in a foreigner's name to keep away from any trace. What I require from you is a promise that you can hold the total sum involved (US$19.5M) Nineteen Million, Five Hundred Thousand United State Dollars contentedly and that I can also have confidence you.

I want you to instantly inform me of your readiness in supporting and co-operating with me in receiving the above sum in your account, That will enable me send you complete details of this business deal.

Thanks
Benson Kwaku

Email analysis :

NOTE : benson.kwaku@poczta.onet.pl
NOTE : test@imamatjome.com
NOTE : Received : from User by mail.imamatjome.com (MDaemon PRO v14.5.2)

RE: Hello Friend

Hello Friend

I am representing an investment interest from Thailand interested in overseas investment involving large volume of funds, for which we seek your participation as an overseas representative to handle the investment. My client, who is a native of Thailand, has some money from his business savings he wants to invest under qualified foreign partnership. If you feel disposed towards the solicited role, please indicate by prompt response, so that I may provide you further details of the cooperation. Bear in mind however, that this is a legitimate transaction and I look forward to your prompt response to my private email below:

Regards, email: helpthaiinvest@hotmail.com

Email analysis :

NOTE : a*.s*@ext.uni.lu
NOTE : helpthaiinvest@hotmail.com
NOTE : Received : from hercules.uni.lu (hercules.uni.lu. [158.64.76.33])

NOTE : hercules.uni.lu
NOTE : www.uni.lu

NOTE : X-Originating-Ip : [10.34.0.8]

Arthur Wolfe

Sind Sie in irgendeiner Art von finanziellen Schwierigkeiten? Brauchen Sie ein Darlehen, um Ihre Schulden klar? Sind Sie ein Geschäftsmann oder eine Frau, die sein Geschäft ausweiten will? Wir bieten Darlehen aller Art an Einzelpersonen, Firmen und Kooperationsorganisationen, die einen Kredit mit einem niedrigen Zinssatz von 3% benötigen, kontaktieren Sie uns heute

Name des Bewerbers:
Benötigte Menge:
Land:
Telefon:
Darlehenslaufzeit:

Email analysis :

NOTE : arthurwolfeloans2@outlook.com
NOTE : soaring2@singnet.com.sg
NOTE : X-Client-Ip : IPv4[197.210.28.130]

Juan Basilio Tahay Aguilar

I am sorry i sent you this mail which came as unsolicited E-mail in your junk Folder, i just want to inform you that Mr Graham Nelson is currently offering 3% Loan to every one. if you are interested contact email: grahamloanfirm01@gmail.com

Fill And Return...

Name:
Country:
Mobile number:
Amount needed as loan:
Loan duration:
Age:
Sex:

ALL REPLIES SHOULD BE SENT TO THIS EMAIL : : grahamloanfirm01@gmail.com

Email analysis :

NOTE : grahamloanfirm01@gmail.com
NOTE : jtahay@mineduc.gob.gt
NOTE : Received : from mail03.mineduc.gob.gt (unknown [172.16.0.2])
NOTE : by mineducantispam.mineduc.gob.gt

NOTE : mineduc.gob.gt server was used to relay this scam.

From: Dr. Emmanuel Ibe Kachikwu (GMD) Nnpc Towers Garki, Abuja.2017:

Nnpc Towers, Central Business District, Herbert Macaulay way, P.m.b. 190, Garki, Abuja.

From: Dr. Emmanuel Ibe Kachikwu (GMD)

Email: nnpcexecutorintrust@gmail.com

Attn. Ceo,

I know that this proposal may come to you as a surprise especially having to come from someone you have not met before I got you information from your country chamber of commerce here in Nigeria.

My name is Dr. Emmanuel Ibe Kachikwu, Group Managing Director of the Nigerian National Petroleum Corporation (NNPC). Be informed that my partner Dr. Maikanti Baru and I awarded a contract to a foreign firm (Sheng Yang Contraction Company) with contract Ref No: NNPC/PED/1462/KADREF/92) for the maintenance of the Nigeria petroleum-chemical complex located at Kaduna, Nigeria.

I know that this proposal may come to you as a surprise especially having to come from someone you have not met before, but I would like you to co-operate with me so that this U$D98, 000,000.00 will be released and transferred into your account, It is my profound intention to contact you for this very important and highly confidential transaction for the transfer of (U$D98, 000,000.00 Ninety Eight Million United State Dollars Only into your bank account.

The contract has been successfully executed by the contractors and their contract sum has been paid to them, leaving our overestimated balance of (U$D98, 000,000.00 Ninety Eight Million United State Dollars Only) still pending at the bank. Right now, we are left with this overestimated balance of (U$D98, 000,000.00) which is still floating at the escrow account in the Central Bank of Nigeria (CBN) waiting for final payment to any reliable foreign bank account you may provide.

We, as government officials, are not permitted to own or operate foreign bank account. therefore we need reliable person who will provide us with a foreign account where to transfer and deposit this US$98,000,000.00, that is the reason we are soliciting for your sincere assistance to provide us with an account where to transfer this money .all moralities for the easy transfer of this money is now in place, the period of this transaction is only two weeks from the day we receive your bank account details.

Note that 10% of our share will be invested in your country, as we propose to give you 30% of the U$D98, 000,000.00, my partners and I will get 60% of the money.

The balance of 10% will be allocated to cover all expenses uncured by both partners, be informed that this proposal is urgent and confidential, Please send to me your bank account details and full address of company name and address, your private phone and fax number for easy communication which will be used in securing all the necessary documents for easy transfer of the fund.

Awaiting your urgent response.

Best regards.

Dr. Emmanuel Ibe Kachikwu.
Group Managing Director of the Nigerian National Petroleum Corporation (NNPC)

Email analysis :

NOTE : nnpccexecutorintrust95@hotmail.com
NOTE : nnpcexecutorintrust@gmail.com
NOTE : Received : from User (unknown [192.69.89.116])

NOTE : by mail.akdgroup.co.bw (Postfix)