Thursday, August 27, 2015

Security Notice Updates (LinkedIn Phishing)

LinkedIn

Security Notice Updates

On the 23rd of August 2015, An Attempt into your account has been detected from an unknown location, For your security, access to your LinkedIn Account has been temporarily suspended. To regain access,you must complete REGISTRATION BY DOWNLOAD & FILL ATTACHED FORM PLEASE NOTE: This is a compulsory measure. Failure to update your information will lead to service termination Linkedin security team.

VIEW ATTACHED TO UPDATE

You received an invitation to connect. LinkedIn will use your email address to make suggestions to our members in features like People You May Know. Unsubscribe
Learn why we included this. If you need assistance or have questions, please contact LinkedIn Customer Service.

© 2015, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA

Phishing analysis :

OPEN : LinkedIn Verification.html
EXTRACT FORM : action="http://test88212.test-account.com/BEXXXXLINK.php"

Whois test-account.com :

Domain Name: test-account.com
Registry Domain ID: 86840496_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.registrygate.com
Registrar URL: www.registrygate.com
Updated Date: 2014-12-29T01:33:34Z
Creation Date: 2002-05-22T01:33:22Z
Registrar Registration Expiration Date: 2016-05-22T20:04:29Z
Registrar: RegistryGate GmbH
Registrar IANA ID: 1328
Registrar Abuse Contact Email: abuse@registrygate.com
Registrar Abuse Contact Phone: +49.89.55061272
Domain Status: ok

Registrant Name: Werner Kaltofen
Registrant Organization: Neue Medien Muennich GmbH
Registrant Street: Hauptstr. 68
Registrant City: Friedersdorf
Registrant State/Province:
Registrant Postal Code: 02742
Registrant Country: DE
Registrant Phone: +49.3587235310
Registrant Fax: +49.3587235330
Registrant Email: hostmaster@all-inkl.com

Admin Name: Werner Kaltofen
Admin Organization: Neue Medien Muennich GmbH
Admin Street: Hauptstr. 68
Admin City: Friedersdorf
Admin State/Province:
Admin Postal Code: 02742
Admin Country: DE
Admin Phone: +49.3587235310
Admin Fax: +49.3587235330
Admin Email: hostmaster@all-inkl.com

Tech Name: Werner Kaltofen
Tech Organization: Neue Medien Muennich GmbH
Tech Street: Hauptstr. 68
Tech City: Friedersdorf
Tech State/Province:
Tech Postal Code: 02742
Tech Country: DE
Tech Phone: +49.3587235310
Tech Fax: +49.3587235330
Tech Email: hostmaster@all-inkl.com
Name Server: ns5.kasserver.com
Name Server: ns6.kasserver.com
DNSSEC: unsigned

Registry Billing ID:
Billing Name: Werner Kaltofen
Billing Organization: Neue Medien Muennich GmbH
Billing Street: Hauptstr. 68
Billing City: Friedersdorf
Billing State/Province:
Billing Postal Code: 02742
Billing Country: DE
Billing Phone: +49.3587235310
Billing Fax: +49.3587235330
Billing Email: hostmaster@all-inkl.com

Email analysis :

NOTE : Return-Path : < werner.laube@t-online.de >
NOTE : X-Remote : 194.25.134.17 (mailout02.t-online.de)
NOTE : Mime-Version : 1.0
NOTE : Content-Type : multipart/mixed; boundary="===============1507808188=="
NOTE : Received : from mailout02.t-online.de (194.25.134.17)
NOTE : Received : from fwd40.aul.t-online.de (fwd40.aul.t-online.de [172.20.26.139])
NOTE : by mailout02.t-online.de
NOTE : Received : from h2358992.stratoserver.net (@[85.214.197.244])
NOTE : by fwd40.t-online.de with (TLSv1:DHE-RSA-AES256-SHA encrypted)
NOTE : Security Notice Updates

I seek your permission.

My Dear Friend,

Greetings to you. I got your email address from a mail Directory and decided to mail you for a permission to go ahead. I am Mrs.Joan Gates United Kingdom, married to Dr. James R. Gates who worked with Texaco Oil Company in Thailand before he died in a ghastly motor accident on his way to a Board meeting. My Husband and me were married but without any children. Since his death I decided not to re-marry and presently I am 69 Years old. When my late husband was Alive he deposited the sum of $16.5M. (Sixteen Million Five Hundred Thousand U.S. Dollars) with a Bank.

Presently this money is still with the Bank and the management just Wrote me as the beneficiary to come forward to receive the money or rather Issue a letter of authority to somebody to receive it on my behalf. I am presently in a hospital where I have been undergoing treatment Cancer of the lungs. I have since lost my ability to talk and my doctors have told me that I have only a few months to live so I think the best thing to do is to use the money for charity purposes. I want a person who is trustworthy that I will make the beneficiary of my late Husband's Fund deposited with the bank so that the person can get the money and utilize 70% of this money to fund churches, orphanages and widows around the world.

At the moment I cannot take any telephone calls right now due to the fact that my relatives (They had squandered the funds I gave them for this purpose before are around me I have been helping orphans orphanage/motherless homes. I have also donated some money for humanitarian needs in Sudan , South Africa , Brazil , Spain , Austria, Germany and some Asian countries.

I have been touched to the good work of humanity through you, rather than allow my relatives to use my husband's hard earned funds inappropriately. I know i have never met you but my mind tells me to do this, and I hope you act sincerely.

As soon as I receive your reply I shall give you the contact details of the Bank. I will also issue you a letter of authority that will prove you as the new beneficiary of this fund.Please assure me that you will act accordingly as I stated here in and Keep this contact confidential till such a time this funds get to your Custody. This is to ensure that nothing jeopardizes my last wish on Earth.

May the good lord bless you -Amen,I await your urgent reply.

Regards,
Mrs.Joan Gates.

Email analysis :

NOTE : joangates.mrs28@yahoo.de
NOTE : X-Msmail-Priority : Normal
NOTE : Return-Path : < beautifulseptember2014@gmail.com >
NOTE : Content-Transfer-Encoding : 7bit
NOTE : X-Mailer : Microsoft Outlook Express 6.00.2600.0000
NOTE : Received : from 2014la.org (HELO mail.2014la.org) (213.5.120.35)


NOTE : Received : from User (unknown [41.138.175.57]) by mail.2014la.org (Postfix)


NOTE : I seek your permission.

Facturation mensuelle inadaptée (Phishing Free)


Phishing analysis :

CLICK : Se connecter
OPEN : http://www.strifus.com/test@free.fr
OPEN : http://www.htyzuaieuy.com/test@free.fr

Domain analysis :

Domain Name: STRIFUS.COM
Registry Domain ID: 1521855746_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.liquidnetlimited.co.uk
Registrar URL: http://liquidnetlimited.co.uk
Updated Date: 2014-12-30T17:47:35Z
Creation Date: 2008-09-29T09:36:45Z
Registrar Registration Expiration Date: 2015-09-29T09:36:45Z
Registrar: LIQUIDNET Ltd.
Registrar IANA ID: 1472
Registrar Abuse Contact Email: abuse@liquidnetlimited.co.uk
Registrar Abuse Contact Phone: +44.2036951294
Domain Status: clientTransferProhibited
Registry Registrant ID:
Registrant Name: Andrey Alexeenko
Registrant Street: Dzerzhinskaya st, 18-210
Registrant City: Solnechnogorsk
Registrant State/Province: Moscow region
Registrant Postal Code: 141500
Registrant Country: RU
Registrant Phone: +7.9037919106
Registrant Email: neffarian@mail.ru
Admin Name: Andrey Alexeenko
Admin Street: Dzerzhinskaya st, 18-210
Admin City: Solnechnogorsk
Admin State/Province: Moscow region
Admin Postal Code: 141500
Admin Country: RU
Admin Phone: +7.9037919106
Admin Email: neffarian@mail.ru
Tech Name: Andrey Alexeenko
Tech Street: Dzerzhinskaya st, 18-210
Tech City: Solnechnogorsk
Tech State/Province: Moscow region
Tech Postal Code: 141500
Tech Country: RU
Tech Phone: +7.9037919106
Tech Email: neffarian@mail.ru
Name Server: ns1.exclusivehosting.net
Name Server: ns2.exclusivehosting.net
Name Server: ns3.exclusivehosting.net
Name Server: ns4.exclusivehosting.net
DNSSEC: not signed

Domain Name: htyzuaieuy.com
Registry Domain ID: 1951135600_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.register.com
Registrar URL: http://www.register.com
Updated Date: 2015-08-04T21:37:14Z
Creation Date: 2015-08-04T21:37:14Z
Registrar Registration Expiration Date: 2016-08-04T21:37:14Z
Registrar: Register.com, Inc.
Registrar IANA ID: 9
Registrar Abuse Contact Email: abuse@web.com
Registrar Abuse Contact Phone: +1.8773812449
Domain Status: clientTransferProhibited http://icann.org/epp#clientTransferProhibited
Registrant Name: PERFECT PRIVACY, LLC
Registrant Street: 12808 Gran Bay Pkwy West
Registrant City: Jacksonville
Registrant State/Province: FL
Registrant Postal Code: 32258
Registrant Country: US
Registrant Phone: +1.9027492701
Registrant Email: 6865a66d0a28fd0a4fc61255b706a5ea@domaindiscreet.com

Email analysis :

NOTE : oak@huffpostmaghreb.com
NOTE : alf@huffpostmaghreb.com
NOTE : Content-Type : text/html; charset=UTF-8
NOTE : X-Priority : 2
NOTE : Return-Path :
NOTE : Content-Transfer-Encoding : 8bit
NOTE : Received : from huffpostmaghreb.com ([149.202.162.145])
NOTE : Received : by huffpostmaghreb.com (Postfix, from userid 33)
NOTE : Facturation mensuelle inadaptée

Wednesday, August 26, 2015

Regarding your ATM master card

Deputy governor
Central Bank of Africa
Marina- Benin.

Dear Sir/Madam,

This is a reminder message regarding your ATM master card for your compensation fund sum of US$4(ONE MILLION Two hundred and fifty thousand US dollars only) approved by the Ministry of Finance. The Foreign Payment Department of CBA has been mandated by the Federal Ministry of Finance and the Benin National Petroleum Corporation to handle the payment of your compensation fund of the above amount by ATM card. Your email contact is amongst the listed beneficiaries in the data for the sum of US$1.250,000.00. And I have been assigned by the management of CBA to carry out delivery of the ATM card package to you. This compensation is in compliance with IMF and World bank directives to pacify victims of internet scam.On this note,I am pleased to inform you that ATM card Number 4539 7978 0214 3027 for the sum of US$1.250,000.00 has been credited in.your favor and ready for immediate delivery to you.

You are hereby required to confirm your telephone number and present address were you want the ATM card delivered to you. Upon receipt of the above requirements from you I shall have your ATM card package dispatched to you by courier service who will deliver to your designated home address. With the ATM card, you can make withdrawals from any part of the world at ATM center near to you. The pin and all necessary user guides will be attached on delivery (intact in the ATM card package doc.) which will be delivered to you by the courier service, for you easy use.

So the Information you are required to reconfirm to the ATM OFFICE is as Follow.

(1)Your Full Name
(2)Mobile Phone Number
(3)Current Home Address
(4)Fax Number
(5)Country
(6)City
()7your address
(8)A Copy of Your ID For Identification.

Further instruction/directive will be sent to you on receipt of your acknowledgment to this message.

Best Regards

Dr. Kingsley Moghalu

Office of the deput Governor
CBA, Benin
Your Atm Master Card

Email analysis :

NOTE : kingsley@cronos.ocn.ne.jp
NOTE : Received : from mzcstore181.ocn.ad.jp
NOTE : (mv-osn-hkg002 [122.28.30.180])
NOTE : by mv-osn-hkg002.ocn.ad.jp
NOTE : X-Originating-Ip : [41.86.234.165]

PostFinance AG Online-Banking- Account Aktualisierung‏‏

Sehr geehrter Kunde,

kürzlich zeigten unsere Aufzeichnungen, dass Ihr PostFinance AG -Konto durch einen Dritten unbefugten Zutritt hatte. Die Sicherheit Ihres Kontos ist unser wichtigstes Anliegen. Deshalb haben wir beschlossen,den Zugang zu Ihrem Konto vorübergehend zu begrenzen. Für den vollen Zugang zu Ihrem Konto, müssen Ihre Daten wiederhergestellt werden, daher bestätigen Sie Ihr Konto über diesen Link: Sobald Ihre Angaben überprüft und bestätigt ist, erhalten Sie eine Anruf aus von uns. Und somit wird auf Ihr Konto wieder komplettes Zugreifen wiederhergestellt.

Wir danken Ihnen für Ihre Kooperation.

Advice

Accessibility
Legal disclaimer
Prices/Conditions/GTC
Publishing details
Security
Swiss Post

Copyright (c) PostFinance Ltd

Email analysis :

NOTE : antonioluis@uema.br
NOTE : X-Originating-Ip : [197.211.52.5]


NOTE : Mime-Version : 1.0

RE: IMMEDIATE PAYMENT OF YOUR LONG DUE FUND (USD3.5M)

Attn: Honorable Benefactor.

Be informed that after federal executive council meeting (FEC) with senate committee on foreign debts reconciliation, the presidential payment and implementation panel on contract/inheritance/compensation funds have unanimously approved the total sum of (USD3.5M) in your favour as your part payment and the approved fund has gazette for claim, this was under the auspices of Nigerian President and commander in Chief of Arm Forces (Muhammadu Buhari GCFR). Consequence to this notice, let it come to your mind that your approved fund will be coming to you via atm (visa card) in this regards you are obliged to reconfirm to this honorable office these below information’s to avoid wrong delivery of your card.

Full name:
Present house address:
Private telephone number:
Occupation:
Age:
Sex:
A Copy of Your ID:

Do contact this office with the below information:

Contact Name: Mr. Emeka Enuwa
Email: fundmonitors04@yahoo.co.jp
Foreign Remittance Department
Union Bank of Nigeria

Be guided with the directives hereon as we have put all machineries in place to make sure all benefactors receive their atm visa card and commence withdrawal with out any hitch.

Yours faithfully,
Mrs. Oyinkan Adewale

Email analysis :

NOTE : mrsjacquelinescott44@gmail.com
NOTE : fundmonitors04@yahoo.co.jp