Tuesday, June 28, 2016

FROM JIMMY CHIEN.

Mr. Jimmy Chien
Vice President/Branch Manager
Industrial and Commercial Bank of China (USA) NA
South San Francisco Branch
235 Grand Avenue, Suite No. 101
South San Francisco, CA 94080, USA

Greetings,

I am Mr. Jimmy Chien, Vice President /Branch Manager ICBC South San Francisco Branch here in California. I am contacting you base on my facts finding about your reputation and someone I can trust for this purpose. The content of my email is a bit detailed that is why I first seek your permission, to let you know before emailing my proposal so that you won't trash it when I do. Please grant me your permission to email you my proposal of which I know will be acceptable to you if you are willing to be honest with me.

Waiting for your response.

Mr. Jimmy Chien,
Vice President/Branch Manager
Industrial and Commercial Bank of China (USA) NA
South San Francisco Branch.

Email analysis :

NOTE : jmmchien@gmail.com
NOTE : 2055@charter.net
NOTE : 164.132.34.5


NOTE : Received : from drennydread.name
NOTE : (ns3266123.ip-5-39-79.eu [5.39.79.125])

Top Rank in Google

Hi,

I hope you are doing great.

We can get your website on the first page of Google, Yahoo, Bing. Kindly reply us on this e-mail for more info. If you can give me a website URL I can do a detailed analysis and send quotes accordingly

Best Regards,

Sapna Rani

PS: I will be happy to send the “Proposal” and “Pricing” furthermore

Email analysis :

NOTE : sapnarani876@outlook.com
NOTE : client-ip=65.55.34.205;

Can You Handle This?

Hello,

Greetings! Although, I do not know you in person; I am Mrs. Suzanne Mubarak from Egypt. There uncertainty in Egypt. As a result of political crisis and my husband have a serious problem with the government, for this l need your assistance to receive my reserved fund for safe keeping or for reinvestment in your country.

Be inform, all requirement to transfer the fund to you little by little will be in your name as l will tell my bank you are my foreign manager. If you will render your service to me I will pay you 30% percentage out of the total amount of (50,000,000.00) (U.S.D)

The fund is deposited in Standard Chartered bank Asia, notify me if you can handle my fund as l have made inquiring on how l can transfer the fund to your country for investment and l was advised that l must employed a services of local Citizen in your country.

Email analysis :

NOTE : susane.m@mail.com
NOTE : khailijunai@gmx.com
NOTE : Received : from User ([42.153.57.10] unverified)


NOTE : by angelina.baramultigroup.co.id

Régulariser votre situation (Phishing CIC)

correttamente , on

Bonjour,

Un nouveau Message est disponible sur votre Messagerieo
Nous venons de nous apercevoir que vous avez ete debite deux fois l'ors de votre achats.
Regler votre situation en Cliqueant sur le lien ce-dessous :

Regler votre situation

Nous vous remercions de votre confiance.

Ce courriel vous a été envoyé par un système automatique d'émission de messages.
L'adresse d'émission n'est pas une adresse de courriel classique.
Si vous écrivez à cette adresse, votre message ne sera pas pris en compte

LINGE DE LIT LINGE DE BAIN LINGE DE TABLE LES ENFANTS

Email screenshot :


Email analysis :

NOTE : serviice@modele-lettre-type.com
NOTE : Content-Type : text/html; charset=iso-8859-1
NOTE : Mime-Version : 1.0
NOTE : Return-Path : < www-data@modele-lettre-type.com >
NOTE : Received : from modele-lettre-type.com ([185.107.213.241])
NOTE : Received : by modele-lettre-type.com (Postfix, from userid 33)
NOTE : X-Php-Originating-Script : 0:ao.php
NOTE : Régulariser votre situation

Phishing analysis :

CLICK : Regler votre situation
OPEN : http://elbandito.com.pl/apis.php
REDIRECT :

data:text/html;https://www.cic.fr/fr/banques/particuliers/;base64,PFNjcmlwdCBMYW5ndWFnZT0nSmF2YXNjcmlwdCc+DQo8IS0tINiq2LTZgdmK2LEgQW0zUmVmaC5Db20gLS0+DQo8IS0tDQpkb2N1bWVudC53cml0ZSh1bmVzY2FwZSgnJTNDJTY4JTc0JTZEJTZDJTNFJTNDJTY4JTY1JTYxJTY0JTNFJTNDJTJGJTY4JTY1JTYxJTY0JTNFJTNDJTYyJTZGJTY0JTc5JTNFJTBBJTNDJTc0JTY5JTc0JTZDJTY1JTNFJTQzJTQ5JTQzJTIwJTNFJTIwJTQ5JTY0JTY1JTZFJTc0JTY5JTY2JTY5JTYzJTYxJTc0JTY5JTZGJTZFJTNDJTJGJTc0JTY5JTc0JTZDJTY1JTNFJTBBJTA5JTA5JTNDJTZDJTY5JTZFJTZCJTIwJTcyJTY1JTZDJTNEJTIyJTczJTY4JTZGJTcyJTc0JTYzJTc1JTc0JTIwJTY5JTYzJTZGJTZFJTIyJTIwJTc0JTc5JTcwJTY1JTNEJTIyJTY5JTZEJTYxJTY3JTY1JTJGJTc4JTJEJTY5JTYzJTZGJTZFJTIyJTIwJTY4JTcyJTY1JTY2JTNEJTIyJTY4JTc0JTc0JTcwJTNBJTJGJTJGJTc3JTc3JTc3JTJFJTcwJTYxJTZDJTY5JTYzJTZCJTZGJTc2JTYxJTY2JTZGJTc0JTZGJTJFJTYzJTdBJTJGJTZDJTZGJTY3JTczJTJGJTZDJTZGJTY3JTJGJTY5JTZEJTY3JTJGJTY2JTYxJTc2JTY5JTYzJTZGJTZFJTJFJTY5JTYzJTZGJTIyJTNFJTBBJTBBJTNDJTZEJTY1JTc0JTYxJTIwJTYzJTY4JTYxJTcyJTczJTY1JTc0JTNEJTIyJTc1JTc0JTY2JTJEJTM4JTIyJTNFJTBBJTBBJTNDJTZEJTY1JTc0JTYxJTIwJTY4JTc0JTc0JTcwJTJEJTY1JTcxJTc1JTY5JTc2JTNEJTIyJTU4JTJEJTU1JTQxJTJEJTQzJTZGJTZEJTcwJTYxJTc0JTY5JTYyJTZDJTY1JTIyJTIwJTYzJTZGJTZFJTc0JTY1JTZFJTc0JTNEJTIyJTQ5JTQ1JTNEJTQ1JTZEJTc1JTZDJTYxJTc0JTY1JTQ5JTQ1JTM3JTIyJTNFJTBBJTBBJTBBJTNDJTZEJTY1JTc0JTYxJTIwJTY4JTc0JTc0JTcwJTJEJTY1JTcxJTc1JTY5JTc2JTNEJTIyJTQzJTZGJTZFJTc0JTY1JTZFJTc0JTJEJTU0JTc5JTcwJTY1JTIyJTIwJTYzJTZGJTZFJTc0JTY1JTZFJTc0JTNEJTIyJTc0JTY1JTc4JTc0JTJGJTY4JTc0JTZEJTZDJTNCJTIwJTYzJTY4JTYxJTcyJTczJTY1JTc0JTNEJTU1JTU0JTQ2JTJEJTM4JTIyJTNFJTBBJTIwJTNDJTczJTc0JTc5JTZDJTY1JTNFJTBBJTIwJTIwJTdCJTZEJTYxJTcyJTY3JTY5JTZFJTNBJTMwJTNCJTcwJTYxJTY0JTY0JTY5JTZFJTY3JTNBJTMwJTNCJTdEJTBBJTY4JTc0JTZEJTZDJTJDJTBBJTYyJTZGJTY0JTc5JTIwJTIwJTIwJTIwJTdCJTY4JTY1JTY5JTY3JTY4JTc0JTNBJTMxJTMwJTMwJTI1JTNCJTIwJTIwJTc3JTY5JTY0JTc0JTY4JTNBJTMxJTMwJTMwJTI1JTNCJTIwJTZGJTc2JTY1JTcyJTY2JTZDJTZGJTc3JTNBJTY4JTY5JTY0JTY0JTY1JTZFJTNCJTdEJTBBJTc0JTYxJTYyJTZDJTY1JTIwJTIwJTdCJTY4JTY1JTY5JTY3JTY4JTc0JTNBJTMxJTMwJTMwJTI1JTNCJTIwJTIwJTc3JTY5JTY0JTc0JTY4JTNBJTMxJTMwJTMwJTI1JTNCJTIwJTc0JTYxJTYyJTZDJTY1JTJEJTZDJTYxJTc5JTZGJTc1JTc0JTNBJTczJTc0JTYxJTc0JTY5JTYzJTNCJTBBJTYyJTZGJTcyJTY0JTY1JTcyJTJEJTYzJTZGJTZDJTZDJTYxJTcwJTczJTY1JTNBJTYzJTZGJTZDJTZDJTYxJTcwJTczJTY1JTNCJTdEJTBBJTY5JTY2JTcyJTYxJTZEJTY1JTIwJTIwJTdCJTY2JTZDJTZGJTYxJTc0JTNBJTZDJTY1JTY2JTc0JTNCJTIwJTY4JTY1JTY5JTY3JTY4JTc0JTNBJTMxJTMwJTMwJTI1JTNCJTIwJTc3JTY5JTY0JTc0JTY4JTNBJTMxJTMwJTMwJTI1JTNCJTdEJTBBJTJFJTY4JTY1JTYxJTY0JTY1JTcyJTIwJTdCJTYyJTZGJTcyJTY0JTY1JTcyJTJEJTYyJTZGJTc0JTc0JTZGJTZEJTNBJTMxJTcwJTc4JTIwJTczJTZGJTZDJTY5JTY0JTIwJTIzJTMwJTMwJTMwJTdEJTBBJTJFJTYzJTZGJTZFJTc0JTY1JTZFJTc0JTIwJTdCJTY4JTY1JTY5JTY3JTY4JTc0JTNBJTMxJTMwJTMwJTI1JTNCJTdEJTBBJTNDJTJGJTczJTc0JTc5JTZDJTY1JTNFJTBBJTBBJTBBJTIwJTIwJTIwJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDJTY5JTY2JTcyJTYxJTZEJTY1JTIwJTczJTcyJTYzJTNEJTIyJTY4JTc0JTc0JTcwJTNBJTJGJTJGJTc3JTc3JTc3JTJFJTcwJTYxJTZDJTY5JTYzJTZCJTZGJTc2JTYxJTY2JTZGJTc0JTZGJTJFJTYzJTdBJTJGJTZDJTZGJTY3JTczJTJGJTZDJTZGJTY3JTJGJTIyJTIwJTY2JTcyJTYxJTZEJTY1JTYyJTZGJTcyJTY0JTY1JTcyJTNEJTIyJTMwJTIyJTNFJTNDJTJGJTY5JTY2JTcyJTYxJTZEJTY1JTNFJTBBJTA5JTIwJTIwJTBBJTNDJTJGJTYyJTZGJTY0JTc5JTNFJTNDJTJGJTY4JTc0JTZEJTZDJTNFJykpOw0KLy8tLT4NCjwvU2NyaXB0Pg==

DATAS EXTRACTED : تشفير Am3Refh.Com
DATAS EXTRACTED : http://www.palickovafoto.cz/logs/log/
DATAS EXTRACTED : http://www.palickovafoto.cz/logs/log/first.php?token=*&default=*

SCREENSHOT :


CLICK : OK
REDIRECT + SCREENSHOT :


CLICK : Confirmer
SCREENSHOT :


Domain analyis palickovafoto.cz :

domain: palickovafoto.cz
registrant: FORPSI-C8V-S503870
nsset: NSS:ISOL:1
registrar: REG-INTERNET-CZ
contact: FORPSI-C8V-S503870
name: Mgr.Pavla Pali??kov??
address: Ben??tsk?? 296
address: Krmel??n
address: 73924
address: CZ
registrar: REG-INTERNET-CZ
created: 05.04.2014 14:32:05
nsset: NSS:ISOL:1
nserver: ns1.isol.cz (89.187.131.40)
nserver: ns2.isol.cz (89.187.131.41)
tech-c: FORPSI-LAZ-C151031
registrar: REG-INTERNET-CZ
contact: FORPSI-LAZ-C151031
org: ISOL Int. s.r.o.
name: ISOL Int. s.r.o.
address: Borivojova 35/878
address: Praha 3
address: 13000
address: CZ
phone: +420.724979858
registrar: REG-GRANSY

Domain analysis elbandito.com.pl :

DOMAIN NAME: elbandito.com.pl
registrant type: individual
nameservers: ns1.dahost.pl. [91.228.199.2]
ns2.dahost.pl. [91.228.196.26]
no option
dnssec: Unsigned
TECHNICAL CONTACT:
company: Biznes-Host.pl sp. z o.o.
street: Grottgera 16/1
city: 60-758 Pozna??
location: PL
phone: +48.618667050
last modified: 2011.02.17
REGISTRAR:
Biznes-Host.pl sp. z o.o.
Grodziska 17a/4
60-363 Pozna??
Tel: +48.616624200
bok@biznes-host.pl

During your last purchase (Phishing Paypal)

Header Image

Privacy Policy for PayPal Services Copyright ©2016

PayPal fraud prevention set standards by presenting the best security solution in the industry that make your business more secure.If you do not renew your paypal account will be limited or closed permanently

Update Your Account Info. Please click below.

Thank you for choosing PayPal

border

Copyright ©2016 All rights reserved.

Email analysis :NOTE :

NOTE : Return-Path : < *@sendgrid.net >
NOTE : Mime-Version : 1.0
NOTE : Content-Transfer-Encoding : quoted-printable
NOTE : X-Mailer : ColdFusion 9 Application Server
NOTE : client-ip=50.31.42.127;
NOTE : Received : from o1.email.britishsoapawards.tv ([50.31.42.127])
NOTE : Received : by filter0036p1las1.sendgrid.net
NOTE : Received : from vaya-backend09-optusrts (unknown [103.1.216.177])
NOTE : by ismtpd0018p1sin1.sendgrid.net (SG)
NOTE : During your last purchase

Phishing analysis :

CLICK : THE BUTTON
OPEN : https://bit.ly/1RFlDg4
REDIRECT : http://64.71.78.238/CFIDE/web.html
REDIRECT : http://horseridingholidaysgb.co.uk/php/update_info*/True-Login/*/signin.php
SCREENSHOT :


CLICK : Log In
REDIRECT http://horseridingholidaysgb.co.uk/php/update_info*/True-Login/*/signin.php?error_login_id=*#


NOTE : THE LOGIN ASK FOR A VALID PASSWORD...
NOTE : SHORT THE URI TO http://horseridingholidaysgb.co.uk/php/update_info/
SCREENSHOT :


NOTE : FUNNY...
NOTE : CHANGE IP
SCREENSHOT :


NOTE : LAUGHT...

Do you need a loan? $5,000.00 to $1,000,000.00 at 2%

Do you need a loan? $5,000.00 to $1,000,000.00 at 2%, Interested and serious person contact us.

Name:
Amount needed:
Duration:
country:
Mobile Number:

Thanks.

Email analysis :

NOTE : unbloaninvestment@gmail.com
NOTE : phong_tdda_skhdt@bacgiang.gov.vn
NOTE : Return-Path : < phong_tdda_skhdt@bacgiang.gov.vn >
NOTE : X-Originating-Ip : [10.9.11.2]
NOTE : Dkim-Filter : OpenDKIM Filter v2.9.2 mta1.bacgiang.gov.vn E73EA1220B5
NOTE : Mime-Version : 1.0
NOTE : Message-Id : < *.*.*.JavaMail.zimbra@bacgiang.gov.vn >
NOTE : X-Mailer : Zimbra 8.6.0_GA_1153 (ZimbraWebClient - GC51 (Win)/8.6.0_GA_1153)
NOTE : Thread-Topic :
NOTE : client-ip=125.212.128.218;
NOTE : Received : from mta1.bacgiang.gov.vn (mail.bacgiang.gov.vn. [125.212.128.218])

NOTE : Received : from localhost (localhost [127.0.0.1])
NOTE : by mta1.bacgiang.gov.vn (Postfix)
NOTE : Received : from mta1.bacgiang.gov.vn ([127.0.0.1])
NOTE : by localhost (mta1.bacgiang.gov.vn [127.0.0.1])
NOTE : Received : from localhost (localhost [127.0.0.1])
NOTE : by mta1.bacgiang.gov.vn (Postfix)
NOTE : Received : from mta1.bacgiang.gov.vn ([127.0.0.1])
NOTE : by localhost (mta1.bacgiang.gov.vn [127.0.0.1])
NOTE : Received : from mailstore1.bacgiang.gov.vn (unknown [10.9.11.12])
NOTE : by mta1.bacgiang.gov.vn (Postfix)
NOTE : The bacgiang.gov.vn servers were used to relay this scam.

vous avez un nouveau ✉ (Phishing CIC)

CI C

Cher(e) Client(e),

Lors de votre dérnier achat, vous avez été averti par un message vous informant de l'obligation d'adhérer à la nouvelle réglementation concernant la fiabilité pour les achats par C.B sur internet et de la mis en place d'un arrét pour vos futurs achats

Or, nous n'avons pas, ce jour , d'adhésion de votr part et nous sommes ou regret de vous informer que vous pouvez plus utiliser votr cart sur internet

Adhésion : cIiquant ici

Merci de la confiance que vous nous témoignez

Cordialement

Conseil d'administration

Email screenshot :


Email analysis :

NOTE : mdl@geosoc.fr
NOTE : Content-Type : text/html; charset=iso-8859-1
NOTE : Return-Path : < www-data@geosoc.fr >
NOTE : Received : from geosoc.fr ([84.39.46.170])
NOTE : Received : by geosoc.fr (Postfix, from userid 33)
NOTE : X-Php-Originating-Script : 0:lkhourza.php
NOTE : Message-Id : < 20160628050458.0648121078@geosoc.fr >
NOTE : vous avez un nouveau ✉

Phishing analysis :

CLICK : Adhésion : cIiquant ici
OPEN : http://royalapparels.com/cgi/
REDIRECT : http://marcellocampos.com.br/loja/magmi/state/-/mpl/lpf/zero/normal42/accorde/*
REDIRECT : http://marcellocampos.com.br/loja/magmi/state/-/mpl/lpf/zero/normal42/accorde/*/lb.php?id=*&default=*
SCREENSHOT :


CLICK : OK
SCREENSHOT :


NOTE : ANALYSIS WITH NO REDIRECT IF THE PASSWORD IS WRONG

Domain analysis : marcellocampos.com.br

domain: marcellocampos.com.br
owner: Marcelo Campos
responsible: Turbo Web Internet
country: BR
owner-c: MAACA45
admin-c: ZAB
tech-c: WAA218
billing-c: MAACA45
nserver: nsbra16.hostgator.com.br
nsstat: 20160627 AA
nslastaa: 20160627
nserver: nsbra17.hostgator.com.br
nsstat: 20160627 AA
nslastaa: 20160627
created: 20070704 #3724896
expires: 20220704
changed: 20150719
status: published
nic-hdl-br: MAACA45
person: Marcelo Andr? de Campos
created: 20070109
changed: 20160126
nic-hdl-br: WAA218
person: Willianson de Almeida Araujo
created: 20050409
changed: 20130401
nic-hdl-br: ZAB
person: Zilda Aparecida Bagattini
created: 19971223
changed: 20151230