CHANGE OF BENEFICIARY 24/9/2015

FROM: MR JON STEWART
BARCLAYS BANK PLC.
54 ANTHONY WAY,
LAGOS, NIGERIA.
barclaysbnknng@yahoo.co.jp

Attention: Sir,

URGENT CHANGE OF BENEFICIARY

This is very urgent and an urgent attention is needed.

In our office today, was a present of One Mr. Steve Moore of 1200 Fitch Way, Sacramento, Ca. 95864 along with his attorney filing application contrary to your pending fund transfer. The above mentioned persons visited this Bank with a power of attorney given in his favor by your humble self, granting him the benefit to process and claim your inheritance of $5,000,000.00(Five Million United States Dollars Only) for personal reasons. He further Stated that your online account with us be Terminated while the fund should be wired to his Bank account with Bank Of America, Routing Number 121000358. Our office have ask Mr. Steve Moore to return back to the Bank within 48hours to enable us have a personal confirmation from you being known the beneficiary to this fund. Therefore,

1. Did you instruct one Mr. Steve Moore of 1200 Fitch Way, Sacramento, Ca. 95864, to claim and receive the payment on your behalf? 2. Did you sign any 'Deed of Assignment' in his favor thereby making him the current beneficiary? We are sorry to have delayed your instruction in giving out this fund since we must adhere to the procedures of this honorable bank by making sure this request is verified and confirmed by the beneficiary. Your confirmation to the above will be appreciated. We look forward to hearing from you soon via this email (barclaysbnknng@yahoo.co.jp)

Yours sincerely,

Mr. JON STEWART
Head of Operations.
Barclays Bank Plc
barclaysbnknng@yahoo.co.jp

Email analysis :

NOTE : donotreplyhere@barclays.com
NOTE : unwbrcdepartment@yahoo.co.jp
NOTE : Received : from User ([69.193.135.50])
NOTE : by gwexch2.hanchang.co.kr with Microsoft SMTPSVC

Abonnement Mobile (Phishing Free)

Bonjour,

Nous avons constate qu'il y'a eu un problème lors du prélèvement de votre facture mensuelle. Vous devez régulariser votre situation au plus vite sous peine de fermeture de vos service mobile.

Cliquez-ici

Nous restons à votre disposition pour toute information complémentaire et vous prions de recevoir nos sincères salutations.

Votre
Service Abonnés.

Pour nous contacter:
* Par téléphone au 32 44 (appel inclus
dans le forfait depuis une ligne mobile Free)
* Par courrier adressé à:
Free
Service Courrier
75371 Paris Cedex 08 Francesdsfsdfsdfsdf

Phishing analysis :

CLICK : Cliquez-ici
OPEN : http://www.l601neu.at/ray/
REDIRECT : https://ruscona.sk/app/design/app/public_html/ez/***/

Email analysis :

NOTE : info@free.fr
NOTE : Received : from gnarfi.store ([192.168.41.180])
NOTE : by josoe.store (RZmta 37.12 OK) with ESMTP

Inquiry (EC21 Phishing)

Date: 2015.09.28

Dear User,

Congratulations! You have received a new inquiry sent to you from posted on EC21.com. To see the content and reply to this inquiry, please click on the Check Inquiry button below.

Please do not reply to this email as it is unmonitored.

Dynamic Marketplace for Global B2B � EC21
Copyright (c) EC21 Inc. All Rights Reserved./ipod design (c)

Phishing analysis :

CLICK : button
OPEN : http://tiverious.gr/wp-includes/js/plupload/EC21.com/index.html

VALIDATE : FORM
REDIRECT : http://supplier.ec21.com/
INFOS EXTRACTED : helpmegod.me@gmail.com

helpmegod.me@gmail.com analysis :

Domain Name: BEN-LAWYER.COM
Registrar: NetEarth One, Inc.
Registrar IANA ID: 1005
Registrant Name: Sam Luoi
Registrant Organization: ben-lawyer
Registrant Street: 2nd ave linden street,
Registrant City: johannebsurg
Registrant State/Province: Gauteng
Registrant Postal Code: 0001
Registrant Country: ZA
Registrant Phone: +27.780062257
Registrant Email: helpmegod.me@gmail.com

Domain Name: JASONFOXTRADING.COM
Registrar: NetEarth One, Inc.
Registrar IANA ID: 1005
Registrant Name: Jason Fox
Registrant Organization: Jason Foxtrading
Registrant Street: 2nd ave kent road
Registrant City: Johannesburg
Registrant State/Province: Gauteng
Registrant Postal Code: 2001
Registrant Country: ZA
Registrant Phone: +27.214261956
Registrant Fax: +27.866888831
Registrant Email: helpmegod.me@gmail.com

Email analysis :

NOTE : jrb14n@my.fsu.edu
NOTE : X-Originating-Ip : [197.228.71.63]
NOTE : Mime-Version : 1.0
NOTE : client-ip=157.56.111.247;
NOTE : X-Originatororg : my.fsu.edu
NOTE : Received : from boy1-PC.www.huaweimobilewifi.com (197.228.71.63)

NOTE : Inquiry

Offrez vous un prêt entre particulier en ligne

Mr et Mme ,

Désormais plus de soucis pour vos crédits en ligne, Prêt Mutuel a ramené votre taux à 2% l'an pour les 30 premières personnes à faire leur demande de crédits en ligne sur notre site à compter de ce mois.
Vous êtes à la recherche de prêt pour soit relancer vos activités, soit pour la réalisation d'un projet, soit pour vous acheter un appartement mais vous êtes interdit bancaire ou votre dossier a été rejeté par les banques ou leur conditions ne vous conviennent pas, alors plus de soucis Prêt Mutuel leader le la plate forme européenne est votre solution. Nous octroyons des prêts allant de 5.000 € à plus à toutes personnes capable de respecter nos conditions de crédit.

Notre taux d’intérêt est désormais 2% l'an quelques soit le montant emprunté et quelques soit le domaine dans les quels vous voulez investir.

* Prêt personnel
* Prêt entreprise
* Prêt immobilier
* Prêt automobile
* Prêt à l'investissement
* Dette de consolidation
* Deuxième hypothèque
* Marge de crédit
* Rachat de crédit
* etc. . .

Alors n’hésiter plus à faire votre demande directement sur notre site Web www.***.com

Email analysis :

NOTE : User-Agent : Roundcube Webmail/1.1.3
NOTE : Offrez vous un prêt entre particulier en ligne
NOTE : contact@***.com
NOTE : client-ip=91.216.107.238;

Spammer Whois :

Domain Name: pretmutuel.com
Registry Domain ID: 1940452992_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.rrpproxy.net
Updated Date: 2015-07-06T12:20:14.0Z
Creation Date: 2015-06-20T17:39:37.0Z
Registrar Registration Expiration Date: 2016-06-20T17:39:37.0Z
Registrar: Key-Systems GmbH
Registrar IANA ID: 269
Registrar Abuse Contact Email: abuse@key-systems.net
Registrar Abuse Contact Phone: +49.68949396850
Registrant Name: constantin bonou
Registrant Street: cotonou
Registrant City: cotonou
Registrant Postal Code: 00229
Registrant Country: BJ
Registrant Phone: +229.96473308
Registrant Email: pretmtuel2015@gmail.com
Admin Name: constantin bonou
Admin Street: cotonou
Admin City: cotonou
Admin Postal Code: 00229
Admin Country: BJ
Admin Phone: +229.96473308
Admin Email: pretmtuel2015@gmail.com
Registry Tech ID:
Tech Name: LWS Societe
Tech Street: 4 rue galvani
Tech City: paris
Tech Postal Code: 75017
Tech Country: FR
Tech Phone: +33.826102413
Tech Email: domaine@lws.fr
Name Server: ns1.lws-hosting.net
Name Server: ns2.lws-hosting.net
Name Server: ns3.lwsdns.com
Name Server: ns4.lwsdns.com
DNSSEC: unsigned
Billing Name: LWS Societe
Billing Organization:
Billing Street: 4 rue galvani
Billing City: paris
Billing State/Province:
Billing Postal Code: 75017
Billing Country: FR
Billing Phone: +33.826102413
Billing Email: domaine@lws.fr

nouveau message vocal

SMS :
===========================
nouveau message vocal pour le +234**********
Duree: 29s Pour l'écouter; Cliquez sur ce lien: http://msgvocal.co/202-FG5VTF9
===========================

Open :
===========================
http://msgvocal.co/202-FG5VTF9
===========================

Result :
===========================
Vous avez (1) nouveau message vocal Emetteur: Béatrice Cliquez ci-dessous pour le consulter: (1) Message vocal - Cliquez ici reçu le
===========================

Result :
===========================
tel:+33899785310
===========================

WHOIS : msgvocal.co
======================================================================
Domain Name: MSGVOCAL.CO
Domain ID: D68265206-CO
Sponsoring Registrar: PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Sponsoring Registrar IANA ID: 303
Registrar URL (registration services): www.PublicDomainRegistry.com
Domain Status: clientTransferProhibited
Registrant ID: PP-SP-001
Registrant Name: Domain Admin
Registrant Organization: PrivacyProtect.org
Registrant Address1: ID#10760, PO Box 16
Registrant Address2: Note - All Postal Mails Rejected, visit Privacyprotect.org
Registrant City: Nobby Beach
Registrant Postal Code: QLD 4218
Registrant Country: Australia
Registrant Country Code: AU
Registrant Phone Number: +45.36946676
Registrant Email: contact@privacyprotect.org
Administrative Contact ID: PP-SP-001
Administrative Contact Name: Domain Admin
Administrative Contact Organization: PrivacyProtect.org
Administrative Contact Address1: ID#10760, PO Box 16
Administrative Contact Address2: Note - All Postal Mails Rejected, visit Privacyprotect.org
Administrative Contact City: Nobby Beach
Administrative Contact Postal Code: QLD 4218
Administrative Contact Country: Australia
Administrative Contact Country Code: AU
Administrative Contact Phone Number: +45.36946676
Administrative Contact Email: contact@privacyprotect.org
Billing Contact ID: PP-SP-001
Billing Contact Name: Domain Admin
Billing Contact Organization: PrivacyProtect.org
Billing Contact Address1: ID#10760, PO Box 16
Billing Contact Address2: Note - All Postal Mails Rejected, visit Privacyprotect.org
Billing Contact City: Nobby Beach
Billing Contact Postal Code: QLD 4218
Billing Contact Country: Australia
Billing Contact Country Code: AU
Billing Contact Phone Number: +45.36946676
Billing Contact Email: contact@privacyprotect.org
Technical Contact ID: PP-SP-001
Technical Contact Name: Domain Admin
Technical Contact Organization: PrivacyProtect.org
Technical Contact Address1: ID#10760, PO Box 16
Technical Contact Address2: Note - All Postal Mails Rejected, visit Privacyprotect.org
Technical Contact City: Nobby Beach
Technical Contact Postal Code: QLD 4218
Technical Contact Country: Australia
Technical Contact Country Code: AU
Technical Contact Phone Number: +45.36946676
Technical Contact Email: contact@privacyprotect.org
Name Server: NS8459.HOSTGATOR.COM
Name Server: NS8460.HOSTGATOR.COM
Created by Registrar: PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Last Updated by Registrar: PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Domain Registration Date: Wed Aug 12 17:55:08 GMT 2015
Domain Expiration Date: Thu Aug 11 23:59:59 GMT 2016
Domain Last Updated Date: Thu Aug 13 11:25:40 GMT 2015
DNSSEC: false
======================================================================

confirmez votre compte Itunes (Phishing Apple)

Chère/Cher client(e,

Nous vous informons que votre compte arrive à expiration dans moins de 48 heures, il est impératif d'effectuer une vérification de vos informations dès à présent, sans quoi votre compte sera supprimé.
Telechargez le formulaire ci-joint et l'ouvrir dans votre navigateur et faites votre demande.

Pourquoi ce courrier électronique vous a-t-il été envoyé ?
L'envoi de ce courrier électronique s'applique lorsque la date d'expiration de votre compte arrive à terme.

Merci,
L'assistance à la clientèle Apple

Mon identifiant Apple | Assistance | Engagement de confidentialité
Copyright © 2015 iTunes S.à r.l. 31-33, rue Sainte Zithe, L-2763 Luxembourg.? Tous droits réservés.

Confirmation_N527728.html

Phishing analysis :

NOTE : open Confirmation_N527728.html
NOTE : Inside the file Confirmation_N527728.html javascript "unescape"
NOTE : Unescape file Confirmation_N527728.html
NOTE : Extract http://85.214.65.215/~php/TOS.php
NOTE : Extract http://85.214.65.215/~images/css/validationEngine.jquery.css
NOTE : The file Confirmation_N527728.html is a phishing page.
NOTE : The datas are sent to http://85.214.65.215/~php/TOS.php
NOTE : http://85.214.65.215/~php/TOS.php redirect to apple.com

85.214.65.215 analysis :

inetnum: 85.214.16.0 - 85.214.139.255
netname: STRATO-RZG-DED2
org: ORG-SRA1-RIPE
descr: Strato Rechenzentrum, Berlin
country: DE
admin-c: SRDS-RIPE
tech-c: SRDS-RIPE
remarks: ************************************************************
remarks: * Please send abuse complaints to abuse-server@strato.de *
remarks: * or fax +49-30-88615-755 ONLY. *
remarks: * Abuse reports to other e-mail addresses will be ignored. *
remarks: ************************************************************
status: ASSIGNED PA
mnt-by: STRATO-RZG-MNT
created: 2006-05-11T16:37:24Z
last-modified: 2013-07-06T09:34:26Z
source: RIPE Filtered
organisation: ORG-SRA1-RIPE
org-name: Strato AG
org-type: LIR
address: Strato AG
address: Christian Mueller
address: Pascalstrasse 10
address: 10587
address: Berlin
address: GERMANY
phone: +4930398020
fax-no: +493039802222
mnt-ref: STRATO-RZG-MNT
mnt-ref: RIPE-NCC-HM-MNT
mnt-ref: AS286-MNT
mnt-by: RIPE-NCC-HM-MNT
admin-c: CM265-RIPE
admin-c: CHSE-RIPE
abuse-c: SRAC-RIPE
abuse-mailbox: abuse@strato.de
created: 2004-04-17T11:12:39Z
last-modified: 2015-08-12T13:35:20Z
source: RIPE Filtered
role: RIPE contact Dedicated Server
address: STRATO AG
address: Pascalstr. 10
address: D-10587 Berlin
address: Germany
phone: +49 30 39802-0
org: ORG-SRA1-RIPE
abuse-mailbox: abuse-server@strato.de
admin-c: XX1-RIPE
tech-c: CHSE-RIPE
nic-hdl: SRDS-RIPE
remarks: ************************************************************
remarks: * Please send abuse complaints to abuse-server@strato.de *
remarks: * or fax +49-30-88615-755 ONLY. *
remarks: * Abuse reports to other e-mail addresses will be ignored. *
remarks: * *
remarks: * For peering requests or operational issues please look *
remarks: * at the information in the AS6724 RIPE database object. *
remarks: ************************************************************
mnt-by: STRATO-RZG-MNT
created: 2010-01-15T08:35:31Z
last-modified: 2013-10-14T08:04:17Z
source: RIPE Filtered
route: 85.214.65.0/24
descr: STRATO AG
descr: prefix only advertised in case of DDoS
origin: AS6724
mnt-by: STRATO-RZG-MNT
created: 2014-02-18T16:19:23Z
last-modified: 2014-02-18T16:19:23Z
source: RIPE Filtered

% This query was served by the RIPE Database Query Service version 1.80.1 (DB-1)

Email analysis :

NOTE : Return-Path : < noreply@apple.com >
NOTE : Return-Path : noreply@apple.com
NOTE : X-Remote : 185.8.50.110 ()
NOTE : Mime-Version : 1.0
NOTE : X-Priority : 1 (High)
NOTE : Received : from unknown (HELO final) (185.8.50.110)
NOTE : Received : from [185.8.50.110] ([127.0.0.1]) by final with Microsoft SMTPSVC
NOTE : confirmez votre compte Itunes

185.8.50.110 analysis :

inetnum: 185.8.50.0 - 185.8.51.255
netname: ARUBACLOUD-FR
descr: Aruba SAS - Cloud Services Farm4
country: FR
admin-c: SANS-RIPE
tech-c: AN3450-RIPE
status: ASSIGNED PA
mnt-by: ARUBAFR-MNT
created: 2012-10-29T11:05:37Z
last-modified: 2012-10-29T11:05:37Z
source: RIPE Filtered
role: ARUBA NOC
address: Aruba S.p.A.
address: Loc. Palazzetto 4
address: 52011 Bibbiena Stazione - Arezzo
address: Italy
abuse-mailbox: abuse@staff.aruba.it
admin-c: SS936-RIPE
tech-c: SC279-RIPE
nic-hdl: AN3450-RIPE
mnt-by: ARUBA-MNT
created: 2008-11-19T19:02:34Z
last-modified: 2011-12-28T16:45:28Z
source: RIPE Filtered
person: Eric Sansonny
address: Aruba SAS
address: Rue de Cambrai 32
address: 75019 Paris
phone: +330140388700
fax-no: +330146079808
nic-hdl: SANS-RIPE
mnt-by: ARUBAFR-MNT
created: 2012-09-20T06:28:55Z
last-modified: 2012-09-20T06:34:56Z
source: RIPE Filtered
route: 185.8.48.0/22
descr: Aruba.FR Network
origin: AS199653
mnt-by: ARUBAFR-MNT
created: 2012-10-26T15:40:29Z
last-modified: 2012-10-26T15:40:29Z
source: RIPE Filtered