Solde débiteur chez paypal (Arnaque par Spoofing)

Madame, Monsieur,

A la requête de votre créancier, PAYPAL (Europe) SARL & Cie- 22-24
Boulevard ROYAL -L-2449 LUXEMBOURG , dont la Easytransac
est le mandataire, vous êtes redevable de la somme de 53,83 EUR
qui représente l'état débiteur de votre compte PayPal à ce jour.

En vertu du mandat qui nous a été confié par PayPal, dans le
cadre d'un recouvrement amiable nous agissons conformément à la loi du
09/07/1991 (art. 32*). Aucun frais ne vous est réclamé à ce stade de la
procédure.

Nature de la créance : Compte PayPal débiteur
MONTANT TTC : 53,83 EUR
Date de limite de paiement : à réception de ce courrier électronique

A défaut de paiement, nous serons contraints de transmettre votre
dossier à notre service juridique chargé d'engager une procédure
contentieuse à votre encontre, et qui pourra éventuellement saisir le
tribunal afin d'obtenir un titre exécutoire, ce qui ajouterait au
principal de la créance les dommages et intérêts légaux, ainsi que ceux
demandés au titre de l'Article 700 du Nouveau Code de Procédure Civile.

Tout paiement doit être adressé à :
Easytransac
15 Rue Auguste Gervais, 92130 Issy-les-Moulineaux, France

Modes de paiement acceptés :

- par virement bancaire:

NOM: Paypal IE
IBAN: IE43PFSR99107013999485
BIC: PFSRIE21
REFERENCE : DEBIT92037357FR
Montant: 53,88 Euro

Note : il est impossible de répondre à ce message électronique pour
raison de sécurité et de confidentialité des informations vous concernant.
« sauf s'ils concernent un acte dont l'accomplissement est prescrit

par la loi, les frais de recouvrement entrepris sans titre exécutoire
restent à la charge du créancier, toute stipulation contraire est
réputée non écrite. Cependant, le créancier qui justifie du caractère
nécessaire des démarches entreprises pour recouvrer sa créance peut
demander au juge de l'exécution de laisser tout ou partie des frais
ainsi exposés à la charge du débiteur de mauvaise foi. »

Conformément à l'art.27 de la loi n°78-17 d'Informatique et Liberté,
vous disposez d'un droit d'accès et de rectification pour les données
nominatives vous concernant auprès de l'émetteur de la présente.
Easytransac au capital de 3 365 000 EUR
15 Rue Auguste Gervais, 92130 Issy-les-Moulineaux, France

Email analysis :

NOTE : spoofing noreply@recouvrement.com
NOTE : 157.230.106.218

NOTE : recouvrement.com

NOTE : WHOIS recouvrement.com

Domain Name: RECOUVREMENT.COM
Registry Domain ID: 1435933_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.ovh.com
Registrar URL: http://www.ovh.com
Updated Date: 2020-12-21T09:54:06Z
Creation Date: 1998-06-17T04:00:00Z
Registry Expiry Date: 2023-06-16T04:00:00Z
Registrar: OVH sas
Registrar IANA ID: 433
Registrar Abuse Contact Email: abuse@ovh.net
Registrar Abuse Contact Phone: +33.972101007
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Name Server: CHLOE.NS.CLOUDFLARE.COM
Name Server: JULIO.NS.CLOUDFLARE.COM
DNSSEC: signedDelegation
DNSSEC DS Data: 2371 13 2 C404DEF0800990F7567A91CBE3B57DBCF85000197A828A351EFB3D2C1968CBB1
URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/

Bitcoin Abuse (1PKQvF9qK3zuB8KVwmDVDUxtpUVfE1P6fp)

Bitcoin Abuse

Description :

I think $712 is a very small amount for my silence.
Besides, I spent a lot of time on you!

I accept money only in Bitcoins.
My BTC wallet: 1PKQvF9qK3zuB8KVwmDVDUxtpUVfE1P6fp

You do not know how to replenish a Bitcoin wallet?
In any search engine write "how to send money to btc wallet".
It's easier than send money to a credit card!

For payment you have a little more than two days (exactly 50 hours).
Do not worry, the timer will start at the moment when you open this letter. Yes, yes .. it has already started!

Email analysis :

NOTE : Email spoofing
NOTE : client-ip=86.136.118.17; helo=host86-136-118-17.range86-136.btcentralplus.com

NOTE : 1PKQvF9qK3zuB8KVwmDVDUxtpUVfE1P6fp
NOTE : Bitcoin Fraud, don't send BTC to this address

Email spoofing

Email spoofing is the creation of email messages with a forged sender address. Because the core email protocols do not have any mechanism for authentication, it is common for spam and phishing emails to use such spoofing to mislead the recipient about the origin of the message.

Technical detail

When an SMTP email is sent, the initial connection provides two pieces of address information: MAIL FROM: - generally presented to the recipient as the Return-path: header but not normally visible to the end user, and by default no checks are done that the sending system is authorized to send on behalf of that address.RCPT TO: - specifies which email address the email is delivered to, is not normally visible to the end user but may be present in the headers as part of the "Received:" header. Together these are sometimes referred to as the "envelope" addressing, by analogy with a traditional paper envelope, and unless the receiving mail server signals that it has problems with either of these items, the sending system sends the "DATA" command, and typically sends several header items, including:

From: Joe Q Doe < joeqdoe@example.com > - the address visible to the recipient;

but again, by default no checks are done that the sending system is authorized to send on behalf of that address.

Reply-to: Jane Roe < Jane.Roe@example.mil > - similarly not checked

and sometimes:

Sender: Jin Jo < jin.jo@example.jp > - also not checked.

The result is that the email recipient sees the email as having come from the address in the From: header; they may sometimes be able to find the MAIL FROM address; and if they reply to the email it will go to either the address presented in the From: or Reply-to: header - but none of these addresses are typically reliable, so automated bounce messages may generate backscatter.

Use by spam and worms

Malware such as Klez and Sober and many more modern examples often search for email addresses within the computer they have infected, and use those addresses both as targets for email, but also to create credible forged From fields in the emails that they send, so that these emails are more likely to be opened.

For example:

Alice is sent an infected email which she opens, running the worm code.

The worm code searches Alice's email address book and finds the addresses of Bob and Charlie.

From Alice's computer, the worm sends an infected email to Bob, but forged to appear to have been sent by Charlie.

In this case, even if Bob's system detects the incoming mail as containing malware, he sees the source as being Charlie, even though it really came from Alice's computer; meanwhile Alice may remain unaware that her computer has been infected.

Fooling media

It has happened that the media printed false stories based on spoofed e-mails.

In October 2013, an e-mail which looked like it was from the Swedish company Fingerprint Cards was sent to a news agency, saying that Samsung offered to purchase the company. The news spread and the stock exchange rate surged by 50%. It was later discovered the e-mail was a fake.

Legitimate use

In the early Internet, "legitimately spoofed" email was common. For example, a visiting user might use the local organization's SMTP server to send email from the user's foreign address. Since most servers were configured as "open relays", this was a common practice. As spam email became an annoying problem, these sorts of "legitimate" uses fell out of favor.

When multiple software systems communicate with each other via email, spoofing may be required in order to facilitate such communication. In any scenario where an email address is set up to automatically forward incoming emails to a system which only accepts emails from the email forwarder, spoofing is required in order to facilitate this behavior. This is common between ticketing systems which communicate with other ticketing systems.

The effect on mailservers

Traditionally, mail servers could accept a mail item, then later send a Non-Delivery Report or "bounce" message if it couldn't be delivered or had been quarantined for any reason. These would be sent to the "MAIL FROM:" aka "Return Path" address. With the massive rise in forged addresses, Best Practice is now to not generate NDRs for detected spam, viruses etc. but to reject the email during the SMTP transaction. When mail administrators fail to take this approach, their systems are guilty of sending "backscatter" emails to innocent parties - in itself a form of spam - or being used to perform "Joe job" attacks.

Identifying the source of the email

Although email spoofing is effective in forging the email address, the IP address of the computer sending the mail can generally be identified from the "Received:" lines in the email header. In many cases this is likely to be an innocent third party infected by malware that is sending the email without the owner's knowledge.

Countermeasures

The SSL/TLS system used to encrypt server-to-server email traffic can also be used to enforce authentication, but in practice it is seldom used, and a range of other potential solutions have also failed to gain traction.

However a number of effective systems are now widely used, including:

• SPF
• Sender ID
• DKIM
• DMARC

Although their use is increasing, estimates vary widely as to what percentage of emails have no form of domain authentication: from 8.6% to "almost half". To effectively stop forged email being delivered, the sending domains, their mail servers, and the receiving system all need to be configured correctly for these higher standards of authentication.

As modern countermeasures prevent spammers from spoofing the envelope-from address, many have moved to utilising the header-from address as seen by the recipient user rather than processed by the recipient MTA. Proprietary implementation beyond the scope of the SPF schema is required to protect against certain header-from spoofing implementations.

© From Wikipedia, the free encyclopedia

Security Warning

Hello!

I'm a member of an international hacker group.

As you could probably have guessed, your account *@* was hacked, because I sent message you from your account.

Now I have access to all your accounts!
For example, your password for *@* : dod419419xk

Within a period from July 31, 2018 to October 3, 2018, you were infected by the virus we've created, through an adult website you've visited. So far, we have access to your messages, social media accounts, and messengers. Moreover, we've gotten full damps of these data. We are aware of your little and big secrets...yeah, you do have them. We saw and recorded your doings on porn websites. Your tastes are so weird, you know.. But the key thing is that sometimes we recorded you with your webcam, syncing the recordings with what you watched! I think you are not interested show this video to your friends, relatives, and your intimate one...

Transfer $800 to our Bitcoin wallet: 1PwENLsmQ2Z6b4EJfXDeeXKBj9v878uHRf

If you don't know about Bitcoin please input in Google "buy BTC". It's really easy.

I guarantee that after that, we'll erase all your "data" :)

A timer will start once you read this message. You have 48 hours to pay the above-mentioned amount.

Your data will be erased once the money are transferred.
If they are not, all your messages and videos recorded will be automatically sent to all your contacts found on your devices at the moment of infection.

You should always think about your security.
We hope this case will teach you to keep secrets.
Take care of yourself.

Email analysis :

NOTE : BTC : 1PwENLsmQ2Z6b4EJfXDeeXKBj9v878uHRf
NOTE : Received-Spf : ⁨Softfail (mailfrom) identity=mailfrom;
NOTE : client-ip=87.196.189.84; helo=87-196-189-84.net.novis.pt;

INFOS : It's just an "Email spoofing".
INFOS : (Email spoofing is the creation of email messages with a forged sender address.)
INFOS : The password was already used in other scams.
INFOS : (http://www.scam.cz/search?q=dod419419xk)

Please verify your email address *

The Dropbox logo

Hi *,

We just need to verify your email address before your sign up is complete!

Verify your email

Happy Dropboxing!

Email analysis :

NOTE : Received : from customer-PUE-207-103.megared.net.mx (unknown [177.245.207.103])

NOTE : verify@dropbox.com
LINK : http://floraisdobrasil.com.br/dropbox.html

NOTE : Received : from 189.89.7.60.telesa.com.br (unknown [189.89.7.60])

NOTE : verify@dropbox.com
LINK : http://basedow-bilder.de/dropbox.html

Phishing analysis :

CLICK : Verify your email
OPEN : http://floraisdobrasil.com.br/dropbox.html
SCREENSHOT :

CLICK : Verify your email
OPEN : http://basedow-bilder.de/dropbox.html
SCREENSHOT :

REDIRECT : http://wittinhohemmo.net/drop.php

OPEN : http://wittinhohemmo.net/drop.php
DOWNLOAD : Dropbox-MSGCODE-*.js
RESULT : Dropbox-MSGCODE-*.js is a virus

Virus analysis :

Arcabit HEUR.JS.Trojan.ba
Avira HTML/ExpKit.Gen2
Baidu JS.Trojan-Downloader.Nemucod.yo
Cyren JS/Agent.AAO1!Eldorado
F-Prot JS/Agent.AAO1!Eldorado
Qihoo-360 virus.js.qexvmc.1075
Rising Malware.Undefined!8.C (cloud:CVrV9ZfawJI)
Symantec JS.Downloader.D
TrendMicro Possible_Cerber-JS03b1
TrendMicro-HouseCall Possible_Cerber-JS03b1
ZoneAlarm HEUR:Trojan-Downloader.Script.Generic

Conclusion :

Virus stored for analysis...