SALINA BINTI ABD WAHAB

Account Holder, $550,000.00 usd,has been awarded to you by Oxfam(UAE) Please contact clearance officer with your Qualification Number.[OXG /101/231/BDB]Ref: AE/9420X2/68. via email:(oxfam.oxfamuae@lycos.com).

Email analysis :

NOTE : salinaaw@jkr.gov.my
NOTE : oxfam.oxfamuae@lycos.com
NOTE : X-Originating-Ip : [10.24.232.108]
NOTE : Received : from mx2-esg.1govuc.gov.my (mx2.1govuc.gov.my. [49.236.205.108])

Notes :

1govuc.gov.my seems hijacked.

Christy Walton

Greetings to you my dear beloved, I am Mrs. Christy Walton a citizen ofUnited States of America. I bring to you a proposal worth ($9,000,000,000.00) Nine Billion United State Dollars which i intend to use for CHARITY.Please reply me back

Email analysis :

NOTE : mchristywalton159@gmail.com
NOTE : info@fsmi.org
NOTE : Received : from 197.211.52.57 ([197.211.52.57])
NOTE : (proxying for 197.211.52.57)

NOTE : (SquirrelMail authenticated user ncar2010@fsmi.in)
NOTE : by webmail.fsmi.in
NOTE : User-Agent : SquirrelMail/1.5.2 [SVN]

Your Atm Card Of $5.5million usd,

HELLO! DEAR, GOOD NEWS TO YOU,

I have registered your ATM MASTER CARD valued $5.5 million usd with DHL COMPANY this morning as we agreed and the delivery will take off tomorrow morning based on my agreement with DHL Director Emma Eze MOST IMPORTANT:reconfirm your current delivery address to him then contact him via the following email:(caredhlcustomer@gmail.com

Am in Japan for investment project and i will not be reached till march 18th, 2016. Your amount in the Card is US$5.5Million and the Pin code of your ATM CARD is: {0609}

Thanks MR.AMU OMATA

Email analysis :

NOTE : parisconcertonetwo63@intuitspromo.com
NOTE : caredhlcustomer@gmail.com
NOTE : Originating-Ip : [104.243.24.187]

Compliment of the Season.

Attn: Sir/Madam

This message is coming to you From Federal Ministry of Finance. My name is Mr. Ibrahim Musa Tumsah the Director Internal Audit Department
Federal Ministry of Finance. while going through all the files in my office, I found out that your fund has been lying down unclaimed. I
asked what is the problem why the beneficiary can not make a claim on this fund, I found out that you need a Clearance Certificate from the Department Federal Ministry of Finance. My interest in contacting you is because I feel to help you get the requested document out from Department Federal Ministry of Finance and use it to transfer your fund. You have to reply back to me and give me go ahead to do the processing and transfer your fund.

I wait for your reply,

Regards,

Mr. Ibrahim Musa Tumsah
Director Internal Audit

Email analysis :

NOTE : owork3700@gmail.com
NOTE : uloelu1010@gmail.com

Your Order Has Been Placed (iTunes Store Phishing)

Apple: Order Number: 103993128

iTunes Store
Dear

Thank you for buying the following product on 18/01/2016

Product Name: F1-Pilot Premium(R)
Order Number: 103993128
Receipt Date: 18/01/2016
Order total: 14.02 EUR.

We hope that our tools and solutions have improved the way you do business this year.

If you did not authorize this purchase, please proceed with "Cancellation Form"

Cancel this Purchase

Phishing analysis :

CLICK : Cancel this Purchase
OPEN : https://directcabcall.com/dcc/cron/Update/login/
REDIRECT : http://https.paypatl.com.leodimiranda.com/nl/webapps/mf2f/home

Email analysis :

NOTE : Return-Path : < voveriukas@jml-group.lt >
NOTE : X-Php-Script : jml-group.lt/wp-content/files_mf/send.php for 105.108.42.181

NOTE : Received : from mail.ledinis.lt (mail.ledinis.lt. [109.235.64.119])

NOTE : Your Order Has Been Placed

Conclusion :

- iTunes Store phishing turning to Paypal phishing.

Hijacked websites :

directcabcall.com : owner : DIRECTCABCALL.COM@domainsbyproxy.com
leodimiranda.com : owner Irene Perrin / +61.386242485 / contact@myprivateregistration.com
jml-group.lt : UAB "Interneto vizija" / hostmaster@iv.lt
jml-group.lt : ress website / account voveriukas
ledinis.lt : UAB "Interneto vizija" / hostmaster@iv.lt

Phisher's origin :

IP : 105.108.42.181
Provider : Telecom Algeria
Country : Algeria
Latitude : 28
Longitude : 3

FROM MR.JUAN RAMOZ

Espoz y Mina, 22, 28012
Madrid, Spain.
Tell: +34- 631-445-058
Email: juanramoz@email.com

Dear Sir,

My company is a financial management law firm based in Spain, and I am communicating with you to see if you can discuss with me on matters concerning Michael George, a housing estate business man in Spain for two decades and who left some deposited fund in a financial institution before his death.

Because of its nature, my investigation requires some privacy. You can contact me by phone or email for further information on Mr. Michael George, whom I believe from my investigations that you could be entitled to his fund.

I await your soonest response.

Best Regards
Juan Ramoz

Email analysis :

NOTE : juanramoz@email.com
NOTE : gold@kb99.com
NOTE : User-Agent : ASFN Webmail/0.8.4
NOTE : Received : from [127.0.0.1] (helo=webmail.kb99.com)
NOTE : by kb99.com with esmtp (Exim 4.80)