Friday, January 30, 2015

"GREETINGS"

I am sending you this mail in good faith, My name is Jeffrey M Berman. I have just been informed by my doctor that I only have few months to live due to cancer illness and I am about to end the race like this without a child. I have decided WILL/DONATE 6,000,000.00 Pounds to you to promote charity works. God bless you. Waiting to hear from you

Humbly and sincerely
Mr. Jeffrey M Berman

Email analysis :

NOTE : Received : from mbx1.bardstowncable.net
NOTE : (mbx1.bardstowncable.net [10.1.2.151])
NOTE : by mbx1.bardstowncable.net (Postfix)
NOTE : X-Mailer : Zimbra 8.6.0_GA_1153 (zclient/8.6.0_GA_1153)
NOTE : X-Originating-Ip : [200.219.249.88]
NOTE : wemematt@bardstowncable.net
NOTE : jeffreybman@aol.co.uk

Payment Authentication Code #: MFA/FGN/PDX237NG/15

Hello friend,

Re: PAYMENT AUTHENTICATION

I am Dr. Frank Okafor, Chairman Foreign Contract Review Panel; my office monitors and control all foreign contracts payments. I am the final signatory to any transfer or remittance of foreign contracts settlements. I have before me list of funds, which could not be transferred to some nominated accounts as these accounts have been identified either as ghost accounts, unclaimed deposits and over-invoiced sum etc. I write to present you to the federal government that you are among the contractors expecting their funds to be transferred into their account, on this note; I WISH TO HAVE A DEAL WITH YOU AS REGARDS TO THE UNPAID CERTIFIED CONTRACT FUND WITH VALUE US$18.5 Million. I have every files before me and the data will be change to your name to enable you receive the fund into your bank account as the beneficiary. I have the opportunity to write you based on the instructions I received 2 days ago from the Senate Committee on Contract Payments/Foreign Debts to submit the List of payment reports / expenditures and audited reports of revenues. Among several others, I have decided to remit this sum following my idea that we have a deal/agreement and I am going to do this legally.

MY CONDITIONS.

1. You will give me 50% of the total contract funds as soon as you confirm it in your designated bank account.
2. This deal must be kept secret forever and all correspondence will be strictly by email / telephone for security reasons.
3. There should be no third parties as most problem associated with fund release are caused by agents or representatives.

If you AGREE with my conditions, l advise you on what to do immediately and the transfer will commence without delay as I will proceed to fix your name on the Payment schedule instantly to meet the 3days mandate.

AWaiting for your reply soon.

Yours Sincerely.

Dr. Frank Okafor
CHAIRMAN FOREIGN CONTRACT REVIEW PANEL
Federal Ministry of Foreign Affairs.
Garki-Abuja - Nigeria
Email: frkokafo@yahoo.co.jp

The information in this message and in any attachments, contains confidential information and is intended solely for the attention and use of the addressee.

DONATION

Am Mr. Tom Crist. I am donating a grant of $850,000 USD to you. Contact me(tomcrisdonation@gmail.com ) for further details. Mr Tom Crist

Email analysis :

NOTE : eonardbrown609@yahoo.pt
NOTE : tomcrisdonation@gmail.com
NOTE : X-Yahoo-Newman-Property : ymail-3

Attention Dear Winner.

Facebook Lottery Team
REF: online splash promo.

Attention Dear Winner.

We (Facebook Lottery Team) proudly announce! that your E-MAIL ACCOUNT has been selected as one of the lucky winners and has won the sum $5,000,000.00USD (Five Million United State Dollars ) in the on-going Face-book online award promo. Your Ticket number is 00545 188 564756.

Prize #77801209/N,
WINNING NUMBER: FB/575061725.
Serial number 5368/02
Lucky numbers: 17 98 09 67 46

All participant were selected through a computer random integrated system drawn in 27 million E-mail address address via the Internet and lucky winners do not have to purchase any ticket to participate in this lottery program

Kindly forward below details to:
Contact Person: Mr. David M. Wehner
E-mail: mr.marc.andreessen@gmail.com
E-mail: facebook-company@fastservice.com
Tel+447045764488

===================================
(**) Your Full names:
(**) Your Telephone Number
(**) Your Contact address:
(**) Your Occupation:
(**) Your Country:
(**) Your Age & Sex:
(**) And your lucky number above:
===================================

NOTE: For security reasons and due to the mix-up of some numbers and names, we ask that you keep this notification strictly from public notice until your claim has been processed and your money remitted to you. This is part of our security protocol to avoid double claiming or unscrupulous acts by non-participants of this program.

Yours in service,
Mr.Marc Andreessen
Facebook Lottery Facilitator.
Copyright ©2015 Facebook Lottery Promotions!

Once again stop contacting those people,

Troy Illinois General Board & Compensation Reserve Team

GRANTED APPROVAL FROM INTERNATIONAL MONETARY FUND Plot 1379 Tiamiyu Savage Street, Victoria Island, London

Great News, YOU ARE ADVISED TO STOP CONTACTING THEM!!!

I am Mrs. CYNDY BANKS, I am a US citizen, 42 years Old. I reside here in Spring City, Pennsylvania. My residential address is as follows. 3663 Schuylkill Rd# 1, Spring City, Pennsylvania, United States, am thinking of relocating since I am now rich. I am one of those that took part in the Compensation in Troy Illinois many years ago and they refused to pay me, I had paid over $52,000 while in the United States trying to get my payment all to no avail. I decided to travel down to Troy Illinois with all my compensation documents and i was directed to meet Mr.David Morgan, he is among the member of the COMPENSATION AWARD COMMITTEE, I contacted him and he explained everything to me. He said whoever is contacting us through emails are fake because the Inheritance/Compensation Law clearly states that the beneficiary/recipient is exempt from paying any out of pocket fees or charges to receive said funds. Mr. David Moragntook me to the paying bank for the claim of my Compensation payment. Right now I am the happiest woman on earth because I have received my compensation funds of $9,500,000.00 (nine million five hundred thousand dollars). Moreover, Mr. David Moragnshowed me the full information of those that are yet to receive their payments and I saw your name and email address as one of the beneficiaries that is why I decided to email you to stop dealing with those people, they are not with your funds, they are only making money out of you. I will advise you to contact Mr. David Moragn you have to contact him directly on this information below.

COMPENSATION AWARD HOUSE
Name: Mr. David Moragn
Email: dm9823984@gmail.com

Listed below are the name of mafias and banks behind the non release of your funds that I managed to sneak out for your kind perusal.

1) Prof. Charles soludo
2) Senator David Mark
2) Micheal Edward
3) Chief Joseph Sanusi
3) Sanusi Lamido
4) Dr. R. Rasheed
5) Mr. David Koffi
6) Barrister Awele Ugorji
7) Mr. Roland Ngwa
8) Barrister Ucheuzo Williams
9) Mr. Ernest Chukwudi Obi
10) Dr. Patrick Aziza Deputy Governor - Policy / Board Member
11) Mr. Tunde Lemo Deputy Governor - Financial Sector Surveillance/Board Member
12) Mrs. W. D. A. Mshelia Deputy Governor - Corporate Services / Board Members
13) Mrs. Okonjo Iweala
14) Mrs. Rita Ekwesili
15) Barr Jacob Onyema
16) Dr. Godwin Oboh: Director Union Bank Of Nigeria.
17) Mr. John Collins: Global Diplomat Director.
18) Foreign fund diplomatic courier
19) Barr. Becky Owens
20) Rev. Steven Jones
21) Mr. Alfred james
22) Mrs. Sherry Williams
23) Mr. Scott Larry

You really have to stop dealing with those people that are contacting you and telling you that your fund is with them, it is not in anyway with them, they are only taking advantage of you and they will dry you up until you have nothing. The only money I paid after I met Barrister GODWIN ONUH was just $300 for the delivery charges, take note of that. (NOTE: TELLING YOU TO PAY FOR ANY DELIVERY OR COURIER CHARGE IS ALL NOTHING BUT LIES, I REPEAT THE ONLY MONEY YOU WILL HAVE TO PAY AND WHICH I ALSO PAID IS $300 FOR THE DELIVERY CHARGES IMPOSED BY THE GOVERNMENT AND YOUR PACKAGE CONTAINING YOUR CERTIFIED BANK DRAFT CHEQUE WILL BE REACHING YOU THROUGH THE EXPRESS COURIER SERVICE). Once again stop contacting those people, I will advise you to contact Mr. David Moragn so that he can help you to deliver your funds instead of dealing with those liars that will be turning you around asking for different kind of money to complete your transaction.

Mrs. CYNDY BANKS

UPDATE ME

Good Day,

I am Roberto leiro (Esq.) I must solicit your confidence in this transaction; this is by virtue of the nature as being utterly confidential. Though I know that a transaction of this magnitude will make any one apprehensive and overwhelmed, but I am assuring you that all will be well. The project I am presenting to you is a case of my late client, who willed USD$9.4million to his next-of-kin. It was most unfortunate that him and his next-of-kin died on the same day in an auto-crash, am now faced with indecision about who to pass the funds to. This email might come as a surprise to you, since there was no previous correspondence between us. My purpose of contacting you is for you to help secure the funds left behind by my late client, to avoid it being confiscated or declared unclaimed by the financial institution. The financial institution has issued me a notice to contact the existing relative on this first quarter of year 2015, less the account will be declared unclaimed and the funds diverted to the financial institution's treasury. So far, all my efforts to get hold of someone related to my late client have proved abortive. I am actually asking for your Consent to present you to the financial institution as the Next of Kin/beneficiary of my late client's fund, so that the proceeds of this will be released to you. I shall provide all the documents to back up the claim as my client's Next of Kin All I require is your honest co-operation and to enable us achieves this transaction. I wish to point out that I want 10% of this money to be shared among charity Organizations, while the remaining 90% would be shared equally between us. This transaction is entirely risk free. I will use my position as the client’s attorney to guarantee the successful execution of this transaction.

I need your reply.

Thank You
Roberto leiro (Esq.)
Reply at: robertoleirolinux@linuxmail.org

SINCERELY, GOD BLESS YOU AS YOU HELP

My name is Jeniffer, I am happy to know you, but God knows you better and he knows why he has directed me to you at this point in time so do not be afraid. I saw your contact email at ministries of commerce and foreign trade departments. I am writing this mail to you with heavy sorrow in my heart. And am contacting you because I don’t have any other option than to tell you as I was touched to open up to you, I am with Libyan embassy in London for ten years before he died in the year 2005.we were married for eleven years without a child. He died after a brief illness that lasted for only five days. & i have 8.5 million dollars to transfer to you in charity name to help poor in your place, contact me here.(jenniffer.edward@mail.com)

Sincerely.
Jeniffer Mauller Edward.

jenniffer.edward@mail.com

Saudin Farooq fmf

AUTHORIZATION TO REMIT YOUR FUND
FEDERAL MINISTRY OF FINANCE
128, JAKONDE AVENUE V/ISLAND LAGOS
PO BOX 2704 FEDERAL REPUBLIC OF NIGERIA
COMMITTEE ON FOREIGN PAYMENT
AUTHORIZATION TO REMIT YOUR FUND
Our Ref: RTG /SNT/STB

ATTN: Beneficiary,

We, the entire members of the Federal Ministry of Finance, on behalf of the Federal Republic of Nigeria, Under the auspices of the ECOWAS Head of States, comprising 16 countries these includes Nigeria, Ghana, Togo, Benin, Senegal, Mali, Burkina Faso, cote d’ Ivoire and so on, We held a meeting last week concerning payment , both foreign and local contractors/inheritance funds which has been abandon by our banks in all West African countries. Furthermore, On going through files Friday last week, we discovered that your name and email address was dumped untreated, so at this juncture, we apologize for the delay of your payment and please stop communicating with any office now and attention to this office only for you to receive your payment of $5m (Five- Million United States Dollars) accordingly . Now your new Payment Reference No.-35460021, Allocation No: 674632 Password No : 339331 , Pin Code No: 55674 and your Certificate of Merit Payment No : 103, Released Code No: 0763; Immediate Telex confirmation No: -1114433 ; Secret Code No: XXTN013, Having received these vital payment number, therefore You are qualified now to received and confirm Now you are directed to contact this Office immediately so that we will instruct you on what to do , this is to avoid mistake while transferring your overdue payment. Contact us now for immediate release of your fund and forward your Details to our office to avoid transfer mistake.

Reconfirm to us the following information immediately

Full names:
Current Address:
Mobile:
Occupation:
Your Valid ID Card:
Age:
Nationality:
Next of Kin:

NOTE: We have mounted our security network to monitor every in-coming call,if we still find out that you are still dealing with all those fraudsters that have been frustrating our efforts and defrauding beneficiaries, We shall stop and cancel your payment immediately.

Best Regards

MR. Saudin Farooq
Secretary Resolution Panel on Contract / Inheritance fund Payment
Federal Ministry of finance.
CC: Honorable Minister of Finance
Cc: Senate President.
Cc: All Foreign Payment Offices.
Cc: Board of Directors [Fbg].
Cc: Accountant General Of The Federation
fedminoffinplc@gmail.com
farooqfmfs@yahoo.pt

MR JAMES IBE THE DELIVERY MAN I SENT HAS ARRIVED ,CALL HIM NOW(+16465689774)?

FROM THE EXECUTIVE GOVERNOR,
CENTRAL BANK OF NIGERIA (CBN)
GOV.SANUSI LAMIDO
E-mail: sanusilamido228@yahoo.com.hk

URGENT NOTICE,
ATTENTION: BENEFICIARY

This is to inform you that your delivery man has arrived with your inheritance cash trunk boxes value $8.3 million dollars in John F. Kennedy International Airport New York as their transit. I want you to know that you have 24 hours to call him now with this line (+16465689774) or email (jamesibe18@yahoo.com.ph ),then ask to speak to the diplomatic deliveryman in person of Mr.James Ibe in the United States.Let us know if you are still interested to get your two trunk boxes delivered to you today? As he has been waiting to hear from you to enable him get to your home address without missing his way. For your information, the deliveryman with your package is not aware of the content of the boxes for security purpose. Please do not tell him to avoid running away with your funds.On no account should you let him know about the content of the consignment to avoid evil intention. Most importantly you are advised to send your full data to him,which include your Full Name,Current Residential Address, Direct Cell Number,and A copy of any identity card to verify that you are the right receiver to avoid mistakes. Note that you must call me as soon as you receive this email for more discussion, Also reconfirm your full current address and valid phone number to the Delivery officer via his above email address once you receive this email to enable him deliver your cash consignment boxes to your house without any further delay or mistake. You are advised not to waste his time at the airport,so that he would not be stranded in any way because he will return if he finds out that you are not doing anything to get him over to your house.

CONGRATULATIONS.
MALLAM SANUSI LAMIDO AMINU,
EXECUTIVE GOVERNOR,
CENTRAL BANK OF NIGERIA
Gov.inf1@live.com
governorsanusil@yahoo.com.hk

riichardhii

Hello Friend, I am Richard Hii and i am requesting for your partnership in Re-profiling funds with the bank i work in. Contact me for more details (riichardhii@gmail.com)

Regards
Richard Hii

Email analysis :

NOTE : riichardhii@gmail.com
NOTE : test@ECLECTICSL.COM
NOTE : Received : from [221.207.62.202] (port=53335 helo=User)
NOTE : by server.kirokom.com with esmtpa (Exim 4.84)

Fax = Trojan

Fax message (Fax #0086091)

http://79.96.148.163/.~NEW_RECEIVED_FAX/incoming.html
Sent date: Thu, 22 Jan 2015 15:00:49 +0000

Fax message (Fax #0458849)

http://pristineusa.com/~_RECEIVED~FAX~MESSAGES/incoming.html
Sent date: Thu, 22 Jan 2015 15:13:35 +0000

Fax message (Fax #3457735)

http://hifafarah.com/._RECEIVED.MESSAGES/incoming-fax_letter.html
Sent date: Thu, 22 Jan 2015 15:26:03 +0000

Fax message (Fax #4644306)

http://89.161.234.149/-_NEW_RECEIVED.FAX_MESSAGES/incoming.fax~letter.html
Sent date: Thu, 22 Jan 2015 15:08:31 +0000

Fax message (Fax #6410561)

http://www.get-the-best.com/~_RECEIVED.FAX_MESSAGES/incoming.html
Sent date: Thu, 22 Jan 2015 15:16:23 +0000

Email analysis for 5 emails :

NOTE : Received : from unknown (HELO my-fax.com) (85.133.33.10)
NOTE : Received : from unknown (HELO my-fax.com) (40.131.4.2)
NOTE : Received : from unknown (HELO my-fax.com) (91.183.230.243)
NOTE : Received : from unknown (HELO my-fax.com) (66.203.160.26)
NOTE : Received : from unknown (HELO my-fax.com) (64.20.199.98)

pristineusa.com whois :

Registrant Name: PRISTINE SOFTWARE
Registrant Organization: PRISTINE SOFTWARE
Registrant Street: 1411 W. Covell Blvd Ste 106
Registrant City: Davis
Registrant State/Province: CA
Registrant Postal Code: 95616
Registrant Country: US
Registrant Phone: +1.5307584484
Registrant Phone Ext.:
Registrant Fax:
Registrant Fax Ext.:
Registrant Email: mmadani@pristineusa.com

hifafarah.com whois :

Registrant Name: PERFECT PRIVACY, LLC
Registrant Organization:
Registrant Street: 12808 Gran Bay Pkwy West
Registrant City: Jacksonville
Registrant State/Province: FL
Registrant Postal Code: 32258
Registrant Country: US
Registrant Phone: +1.9027492701
Registrant Phone Ext.:
Registrant Fax:
Registrant Fax Ext.:
Registrant Email: 24ebf0cf0a16123311014b9d998ad564@domaindiscreet.com

get-the-best.com whois :

Registry Admin ID: Admin Name: Lentz, Eduardo
Admin Organization: Get The Best, Inc.
Admin Street: P.O. Box 18630
Admin City: Boulder
Admin State/Province: CO
Admin Postal Code: 80308
Admin Country: US
Admin Phone: (303) 941-2118
Admin Fax: 999 999 9999
Admin Email: gtbusa@IX.NETCOM.COM

Analysis of link

- CLICK LINK
- DOWNLOAD FILE : (fax_message72933.zip)
- EXTRACT FILE : fax_message23055.exe
- PAGE REDIRECTED TO FAX SERVICE WEBSITE.

Analysis of file

ALYac : Trojan.Upatre.J
AVG : Downloader.Generic14.IJZ
AVware : Trojan-Downloader.Win32.Upatre.ao (v)
Ad-Aware : Trojan.Upatre.J
Agnitum : Trojan.Staser!
AhnLab-V3 : Win-Trojan/Downloader.38400.FA
Antiy-AVL : Trojan/Win32.Staser
Avast : Win32:Trojan-gen
Avira : TR/Dldr.Kryptik.pza
BitDefender : Trojan.Upatre.J
ByteHero : Virus.Win32.Heur.c
CAT-QuickHeal : (Suspicious) - DNAScan
Comodo : TrojWare.Win32.TrojanDownloader.Waski.BA
Cyren : W32/Trojan.NMXE-6820
DrWeb : Trojan.Upatre.125
ESET-NOD32 : Win32/TrojanDownloader.Waski.F
Emsisoft : Trojan.Upatre.J (B)
F-Prot : W32/Trojan3.NHH
F-Secure : Trojan-Downloader:W32/Upatre.J
Fortinet : W32/Kryptik.CWCJ!tr
GData : Trojan.Upatre.J
Ikarus : Trojan-Downloader.Waski
Jiangmin : Trojan/Staser.amk
K7AntiVirus : Trojan-Downloader ( 0049d22b1 )
K7GW : Trojan-Downloader ( 0049d22b1 )
Kaspersky : Trojan.Win32.Staser.awvp
Malwarebytes : Trojan.Email.FakeDoc
McAfee : Upatre-FAAJ!3B474BAEAC5F
McAfee-GW-Edition : BehavesLike.Win32.Autorun.nt
MicroWorld-eScan : Trojan.Upatre.J
Microsoft : TrojanDownloader:Win32/Upatre
NANO-Antivirus : Trojan.Win32.Kryptik.dmuguo
Norman : Upatre.FN
Sophos : Troj/Dyreza-AT
Symantec : Downloader.Upatre!gen8
TheHacker : Trojan/Kryptik.cwaa
TotalDefense : Win32/Upatre.IVVGEBC
TrendMicro : TROJ_UPATRE.SMNC
TrendMicro-HouseCall : TROJ_UPATRE.SMNC
VIPRE : Trojan-Downloader.Win32.Upatre.ao (v)
nProtect : Trojan/W32.Agent.38400.XP