Tuesday, August 15, 2017

Is it a scam ? ( Vol 1 )


I received numerous questions on scam.cz. The most interesting is : "Is it a scam ?"

The answer is always the same.

Muqthar Ahmed


Subject : my number 9866900701 has been se;ected for 3.35crore BMW PROMO
Message : SIR WHAT SHOULD I DO TO CLAIM THIS OPPRUTNITY IF THIS IS NOT FAKE
Answer from Scam.cz : This is a fake.

Robert Siemen


Subject : uba atm center 4
Message : There is a Mark Gray who is working on setting up a atm card for me and wants my account numbers here so he can send my my atm card and join it with mine sounds not right so I am checking on this Please get back to me on this matter.THANK YOU Robert SIEMEN
Answer from Scam.cz : This is a scam.

Katja Aaltonen


Subject : got this kind of e-mail today. It was from "Mrs.......
Message : I got this kind of e-mail today. It was from "Mrs. Mary Bustamante". She asked to contact Barrister George Patropoulus (Esq), whose e-mail address is barristergeorgepetropoulos@gmail.com. This message came to me from e-mail address "www."@cube.ocn.ne.jp
Answer from Scam.cz : This is a scam.

Carol Domingos


Subject : WHEN CAN I GET THIS DELIVERED
Message : I WILL SEND THE MONEY. PLEASE CONTACT ME AT 2148087453
Answer from Scam.cz : This is a scam.

Muhamamd Irsyadi


Subject : i have fun in uba bank usd $8,500,000.00 it,s true?
Message : give me information asap.
Answer from Scam.cz : This is a scam.

Rita D Crumpton

Subject : do i rita crumpton have a cleared imf certificate signed by Christine Lagarde and being held for customs taxes?
Message : total tax is 95,000 and I owe 60000.I have paid 3000 for certificate clearance.Am I dealing with the cia?
Answer from Scam.cz : This is a scam.

FWD:TR:RE (Phishing attempt Société Générale)

SOCIETE GENERALE

Cher client,

Le département technique de Société Générale procède à une mise à jour de logiciel programmée de façon à améliorer la qualité des services bancaires.

Nous vous demandons avec bienveillance de cliquer sur le lien ci-dessous et de confirmer vos détails bancaires.

https://www.societegenerale.fr/customercare/banque/confprocedure.asp

Nous nous excusons pour tout désagrément et vous remercions pour votre coopération.

© Société Générale 2017

Phishing screenshot :


Email analysis :

NOTE : natalia1@telus.net
NOTE : Natalia Toroshenko
NOTE : X-Mailer : Zimbra 8.6.0_GA_1211 (zclient/8.6.0_GA_1211)
NOTE : X-Originating-Ip : [160.163.161.144]


Phishing analysis :

CLICK : https://www.societegenerale.fr/customercare/banque/confprocedure.asp
OPEN : http://www.cfa-sport.fr/wp-includes/Text/theme/
REDIRECT : http://www.anti-laser.at/wp-includes/css/theme/
NOTE : Not Found 404 / You are connected from a remote location.
RESULT : Phishing attempt.

Wednesday, August 9, 2017

RE: REPLY. Thoreen (US ARMY)

I seek your assistance to safe keep two military trunk boxes of values
that is of great benefit to we both. Do not panic as i do not pose any
threat to you neither do i mean harm on you whatsoever. Be patient to
hear details as soon as i see your reply to this my direct Email: caseythoreen2017@yandex.com

Email analysis :

NOTE : Thoreen (US ARMY)
NOTE : casey@fancy.ocn.ne.jp
NOTE : ME@mf-smf-ucb010.ocn.ad.jp
NOTE : casey2017thoreen@yandex.com
NOTE : Received : from User (p4220005-ipngn24501marunouchi.tokyo.ocn.ne.jp [118.8.137.5])


NOTE : by vcfancy.ocn.ne.jp (Postfix)

Tuesday, August 8, 2017

Rép : (BSN Solution Scam)

Hello,

On behalf of BSN Solution we want to take this opportunity to advertise our loan offer to those who need urgent financial assistance. I am a loan adviser for BSN Solution; and we seek for beneficial projects for the organizations; seeking means of expanding and relocating our business interest abroad in the following sectors: textile/garment manufacturing, oil/gas, banking, real estate, stock speculation and mining, transportation, health sector and tobacco, communication services, agriculture forestry & fishing; thus any sector. We are ready to fund projects in and out of the country in the form of 'Soft Loan'. We grant loan to both corporate and private entities at a very low interest rate of 3.00% ROI per annum. The terms are very flexible and interesting. If you are interested in our offer, please contact us for details.

Sincerely,
Management.

Email analysis :

NOTE : bsn-solution-ltd@rogers.com
NOTE : lyrivera@justicia.pr.gov
NOTE : Received : from owa.justicia.pr.gov (doj-exch1.justicia.pr.gov. [66.129.175.188])

FWD:RE (Phishing Société Générale)

Decouvrez Le Pass Securite

Afin de prevenir l'utilisation frauduleuse des cartes bancaire sur Internet, Societe Generale est dotee d'un dispositif de controle des paiements. Ce service est entierement gratuit

Notre systeme a detecte que vous n'avez pas active Pass securite

Cliquez ici Pour activez ce service

NOUVEAU: Votre identifiant evolue
NOTE : Ne pas repondre a ce courrier electronique car il est emis
automatiquement depuis une adresse technique

Cordialement
Alexandre krivine
Directeur de la relation clients

Merci pour choisire SOCIETE GENERALE!

Copyright ©2017 Societe Generale. Tous droits réservés.
Numéro d'immatriculation FSASociete Generale: 226056.

Apply Now >

Facebook
Twitter
Instagram
RSS
Appstore
Android

This message was sent to ilyass-maradona@live.fr
If you would like to update your email address, please click here.

To unsubscribe from emails, please log in to your Mint account
where you can manage your email and mobile alerts setting.

©2007—2017 Mint Software, Inc. | All Rights Reserved.
Mint.com 2632 Marine Way, Mountain View, CA 94043
Privacy Policy | Terms and Conditions

Phishing screenshot :


Email analysis :

NOTE : ing22@telus.net
NOTE : ilyass-maradona@live.fr
NOTE : Received : from cmta16.telus.net ([209.171.16.89])
NOTE : Received : from mtlp000023.email.telus.net ([172.20.100.250])
NOTE : by cmsmtp with SMTP
NOTE : X-Originating-Ip : [105.149.30.122]


Phishing anaylsis :

CLICK : Cliquez ici Pour activez ce service
OPEN : http://www.goingesten.se/wp-snapshots/tmp/
REDIRECT : http://se.nickelmountain.se/wp-includes/theme/9f24e/Action.php?*
SCREENSHOT :


CLICK : VALIDATE WRONG CODE
REDIRECT : http://se.nickelmountain.se/wp-includes/theme/9f24e/dcr-web/
SCREENSHOT :


VALIDATE : FORM
REDIRECT : http://se.nickelmountain.se/wp-includes/theme/9f24e/dcr-web/deconnecter.php?date=0000000000&crd=0000&date-ex=00&year-ex=0000&cv=000&numo=0000000000&zob1=00000000&zob2=000000
REDIRECT : http://societegenerale.fr/

Monday, August 7, 2017

Payment Notification, (Western Union Scam)

Dear Western Union Customer,

You have been awarded with the sum of $360,000.00 USD. in the western
union money transfer program s one of our customers who use Western
Union in their daily business transaction,Please provide Mr.Dennis Woods
with the following details below so that your fund will be remitted to
you through Western Union Transfer.

(1)Names:
(2)Address:
(3)Phone Number:
(4)Sex:
(5)Age:
(6)Country:
(7)Occupation:

Mr.Dennis Woods
(Western Union Online coordinator)
E-mail: wu.moneytransfer_online1117@live.com
(Help Line: +254-7801-02173)

As soon as these details are received and verified, your
fund will be transferred to you. Thank you, for using
western union.

Email analysis :

NOTE : ECOLE MATERNELLE PUBLIQUE ROBERT DEBRE - SAINT-LOUIS
NOTE : ce.9740750X@ac-reunion.fr
NOTE : wu.moneytransfer_online11@msn.com
NOTE : Received : from [172.31.186.125] (Forwarded-For: 154.123.121.136)


NOTE : by store1.in.ac-reunion.fr (mshttpd);
NOTE : Received : from ac-reunion.fr (store1.ac-reunion.fr [172.31.186.61])


NOTE : by smtpout2.ac-reunion.fr (Postfix)
NOTE : client-ip=195.98.231.113;
NOTE : @educationfrance : Western Union Scam relayed from ce.9740750X / ac-reunion

Monday, July 31, 2017

FWD:RE (Phishing Société Générale)

En ce qui concerne les informations relatives à votre compte bancaire:
Cher client:

Notre systeme a detecte que vous n'avez pas active Pass securite (Societe Generale):

Decouvrez Le Pass Securite

Afin de prevenir l'utilisation frauduleuse des cartes bancaire sur Internet, Societe Generale est dotee d'un dispositif de controle des paiements. Ce service est entierement gratuit.

Cliquez ici Pour activez ce service

Merci pour choisire SOCIETE GENERALE!

Copyright ©2017 Societe Generale. Tous droits réservés.
Numéro d'immatriculation FSASociete Generale: 226056.

Mon compte
Téléphone
Facebook
Instagram
Twitter
Pinterest
Youtube
Magazine

MENTIONS LÉGALES
PROTECTION DES DONNÉES
CGV

SE DÉSINSCRIRE DE LA NEWSLETTER

Phishing screenshot :


Email analysis :

NOTE : kaizenqm@telus.net
NOTE : Cmm-Sender-Ip : 209.171.16.90


NOTE : X-Mailer : Zimbra 8.6.0_GA_1211 (zclient/8.6.0_GA_1211)
NOTE : Received : from mtlp000003.email.telus.net ([172.20.100.250])

Phishing analysis :

CLICK : Cliquez ici Pour activez ce service
OPEN : http://kombiringen.se/wp-content/theme/
REDIRECT : http://www.goingesten.se/wp-content/theme/
REDIRECT : http://www.goingesten.se/wp-content/theme/*/service.php?*


RESULT : Phishing Société Générale

Votre-Paiement-En ligne (Phishing attempt)

Bonjour,

Afin de prévenir l'utilisation frauduleuse des cartes bancaires Internet,

Votre Service Générale, est dotée d'un dispositif de controle des paiements.

Ce service est entierement gratuit Notre Systeme a detecte que vous n'avez pas active -Pass-Service-sécurite

Service sécurite

Banque-Générale

Nous vous remercions de votre Confiance.

Cordielement

Email analysis :

NOTE : INFO@news.promovacances.com
NOTE : Received : by footcenter.fr (Postfix, from userid 33)
NOTE : Received : from footcenter.fr ([165.227.79.193])
NOTE : X-Php-Originating-Script : 0:nel.php
NOTE : Message-Id : < *.*@footcenter.fr >
NOTE : Votre-Paiement-En ligne

Phishing screenshot :


Phishing analysis :

CLICK : Service sécurite
OPEN : http://sirlwad.gear.host/s52.html
SCREENSHOT :


RESULT : Phishing attempt.

Information about this phishing

SCRIPT : nel.php
HACKED RELAY : footcenter.fr
OPEN REDIRECT : sirlwad.gear.host
SPOOFED EMAIL : INFO@news.promovacances.com
PHISHING : Société Générale

Camelot

You have Won $680,000

Email analysis :

NOTE : camelot.group@gmx.co.uk
NOTE : Received : from [192.168.0.100] (unknown [43.240.7.1])


NOTE : by spamwall.quilmes.gov.ar (Postfix)
NOTE : Received : from spamwall.quilmes.gov.ar
NOTE : (spamwall.quilmes.gov.ar. [190.120.191.6])


NOTE : The quilmes.gov.ar server was hacked to relay this scam.
NOTE : @QuilmesMuni was contacted