RE: YOUR URGENT RESPONSE HIGHLY NEEDED.

Dear Friend,

Good day and compliments, I know this letter will definitely come to you as a huge surprise, but I implore you to take the time to go through it carefully as the decision you make will go a long way to determine my future and continued existence. Please allow me to introduce myself. I am Sgt. Marco Giras, a US serving in the Hqs.

Multinational Corps Iraq, III Corps-Camp Victory, which Patrols the Baghdad province. I am desperately in need of assistance and I have summoned up courage to contact you. I am presently in Iraq and I found your contact particulars in an internet address journal. I am seeking your assistance to evacuate the sum of $100,000,000 (ONE HUNDRED MILLION UNITED STATES DOLLARS) to the States or any safe country of your choice, as far as I can be assured that it will be safe in your care until I complete my service here. This is no stolen money and there are no dangers involved.

I have now found a secured way of getting the package out of Iraq for you to pick it up. I do not know for how long I will remain here as I have been lucky to have survived 2 suicide bomb attacks by Pure Divine intervention. This and other reasons put into consideration have prompted me to reach out for help. If it might be of interest to you then Endeavor to contact me and we would work out the necessary formalities, but I pray that you are discreet about this mutually benefiting relationship.

Respectfully,
Sgt. Marco Giras

Email analysis :

NOTE : sgtmarco33@gmail.com
NOTE : sunpol@brain.net.pk
NOTE : Received : from 41.190.2.22

NOTE : (SquirrelMail authenticated user sunpol)
NOTE : by brain.pk with HTTP;

YOUR PAYMENT APPROVED

IMF Headquarters Washington, D.C. 20431, USA
Dept: World Debt Reconciliation Agencies.
Advise: Your Outstanding Payment Notification.

Attn: Beneficiary,

This is to inform you that fund release order has been received by this office from the US Department of The Treasury and your part-payment $5.5 Million US Dollars has been approved. Please kindly re-confirm the details below to enable us process your funds release papers and proceed with your payment.

Your Full Name:
Your Home Address:
Your Phone Number:
Your Occupation:

Congratulations!!!

Mr. Malde Kettan
IMF Headquarters Washington, D.C. 20431, USA

Email analysis :

NOTE : maldekettan1@gmail.com
NOTE : henpal01@hanpal.jp.tn
NOTE : client-ip=157.56.112.254;

I have wriiten to you before

What kept you waiting to claim your fund $4.5 million since then? you are urgently needed to respond to me asap with your valid data to enable me direct you to the bank where your fund was posted for security reasons. hurry and get back to me immediately you receive this mail to avoid error procedures.

Regards,
Mr. Mustafa Ali
MINISTRY OF FINANCE ON FOREIGN PAYMENT.
Plot 33,ATB Way Cadastral

Email analysis :

NOTE : tlsqn-fukuoka-UGI.@shirt.ocn.ne.jp
NOTE : ali310619@gmail.com
NOTE : client-ip=153.149.228.23;

my

hello,

how are you doing am carool by name i saw your contact and have interest over it to contact you for important issue i we like you to write me back.

Email analysis :

NOTE : dwecks_carools@yahoo.com.sg
NOTE : victorymichael38@yahoo.com.sg
NOTE : X-Yahoo-Newman-Property : ymail-3
NOTE : client-ip=106.10.148.240;

Hi

Hi. i would like to introduce each an every one an employment Opportunities at CNRL Oil company Canada, the management company of CNRL Canada is in need of foreign skill workers, you re advise to contact CNRL with your CV and international passport immediately through Via email cnrloilcompanyresumecanada2006@gmail. com for the details of the employment and how to process immigrant visas 2016 will send to you immediately also feel free to visit our employment Web link: Cnrl.com / career. email address is cnrloilcompanyresumecanada2006@ gmail. com.

Thanks.

Email analysis :

NOTE : account32@qetour.com
NOTE : cnrloilcompanyresumecanada2006@gmail.com
NOTE : X-Amavis-Modified : ScrolloutF1.goholidaytour.com
NOTE : Return-Path : < account32@qetour.com >
NOTE : X-Originating-Ip : [207.244.83.208]
NOTE : Mime-Version : 1.0
NOTE : Content-Transfer-Encoding : 7bit
NOTE : X-Mailer : Zimbra 8.0.9_GA_6191 (ZimbraWebClient - GC48 (Win)/8.0.9_GA_6191)
NOTE : Thread-Topic : Hi
NOTE : Content-Type : text/plain; charset=utf-8
NOTE : Received-Spf : client-ip=27.254.142.144;
NOTE : Received : from ScrolloutF1.goholidaytour.com ([27.254.142.144])
NOTE : Received : from mail.goholidaytour.com (unknown [192.168.1.244])
NOTE : by ScrolloutF1.goholidaytour.com
NOTE : Hi

Notes from Scam.cz

Is goholidaytour.com server is compromised ?

goholidaytour.com servers were used to relay this scam.

Appstore - check your personal data (Apple Phishing)

Dear Customer

We need your help to solve a problem with your account.

Your Apple ID was used to log in to iCloud from an unauthorized computer.

Your iTunes account will be suspended.

To help us solve this problem, click the link below and perform a verification of personal data.

Https://www.apple.com/En-Au/check your personal data./ID: 6HL37295PC836484T

For further information, please contact custom! er service.

Thanks,
Apple Customer Support Service

Apple Sales International, Hollyhill Industrial Estate, Cork, Ireland. Numero di registrazione impresa 15719. Partita IVA IE6554690W.
Tutti i diritti riservati/Tutela della privacy/Il mio Apple ID

Se non desideri ricevere comunicazioni di carattere commerciale da Apple o se hai cambiato indirizzo e-mail, fai-clic qui.

TM e copyright 2014 Apple Inc.

Phishing analysis :

CLICK : Https://www.apple.com/En-Au/check your personal data./ID: 6HL37295PC836484T
OPEN : http://reims-et-soissons.com/wp-includes/ID3/
REDIRECT : http://zwonakaparkandlodge.co.za/components/com_ajax/paoolinh.apple.com/
SCREENSHOT :

ACTION : VALIDATE FORM
REDIRECT : http://zwonakaparkandlodge.co.za/components/com_ajax/paoolinh.apple.com/info.php?//appleid.apple.com/cgi-bin/WebObjects/MyAppleId.woa/273/wo/RHbGlbVOSDtkOMbXu4TET0/0.0.67.17.1
SCREENSHOT :

ACTION : VALIDATE FORM
REDIRECT : https://appleid.apple.com/

Email analysis :

NOTE : icoud@dongi.ir
NOTE : apache@dongi.ir
NOTE : X-Msmail-Priority : High
NOTE : X-Mailer : timor.websitewelcome.com 192.185.164.21
NOTE : client-ip=78.111.2.20;

Notes from Scam.cz

- A compromised wordpress installation : reims-et-soissons.com
- A compromised joomla installation : zwonakaparkandlodge.co.za
- A relay to send phishing : dongi.ir