Please verify your email address (Dropbox Phishing Attempt)

The Dropbox logo

Hi *,

We just need to verify your email address before your sign up is complete!

Verify your email

Happy Dropboxing!

Email analysis :

NOTE : no-reply@dropbox.com
NOTE : Received : from [177.182.101.95] (unknown [177.182.101.95])

NOTE : Received : from ip-161-245.vnt.net.id (unknown [103.58.161.245])

NOTE : Received : from unitel.com.la (unknown [183.182.101.232])

Phishing analyis :

CLICK : Verify your email
OPEN : http://jaysonmorrison.com/dropbox.html
SCREENSHOT :

CLICK : click here
OPEN : http://dippydado.net/json.php
RESULT : website broken...
OPEN : Another dropbox phishing with the same content
CLICK : Verify your email
OPEN : http://dar-alataa.com/dropbox.html
SCREENSHOT :

CLICK : click here
RESULT : same result...
OPEN : Another Dropbox phishing with the same content
CLICK : Verify your email
OPEN : http://potamitis.gr/dropbox.html
SCREENSHOT :

CLICK : click here
RESULT : same result...

Donations from Mrs Dariya Truhina!

Donations from Mrs Dariya Truhina!
Japonise spécialiste hospitalité
11 Boulevard de la Marina 08
B.P 0929 COTONOU
République de Benin.

Greetings, my name is Mrs Dariya Truhina a 42yrs old sick woman from Ufa (RUSSIA) and my late husband was the former Consular of Russian Embassy in Cotonou Benin Republic , since my illness relatives and friends has plundered so much of this wealth , I can not live with the agony entrusting this responsibility to any of them. I have decided to donate what I have to the poor, the needy and charity organizations around the globe and do not forget that inheritance is a common thing in our society as i was diagnosed with esophageal cancer 3 years ago and I am currently admitted in Japanese specialist hospital in Cotonou Benin Republic.

Since the loss of my husband, I have found a new desire to assist helpless families, i have been helping orphans in orphanage/motherless homes, i have also donated some money for humanitarian needs, only recently I saw on television the colossal loss of properties and livelihood, i was moved with great pity and compassion that I decided to make this contribution on assisting the less priviledged.

I have kept fund in a long-term deposit with a Financial company in Cotonou Benin Republic, since i have lost my ability to talk and my doctors have told me that I have only few weeks to live.... It is my wish to see this money distributed to the less privileged, then after going through your profile details i was inspired to contact you with my laptop for this humanitarian need.

I will introduced you to my USA based attorney as my late husband business partner to enable him to give you all the assistance you may need in the course of releasing fund to you and if you have any further question please do not hesitate to ask as i anticipate your utmost response towards this need.

In light to the above i have included my current picture by my bedside.

Awaiting your sincere response.

Best regards to your family,
Mrs Dariya Truhina.

Email analysis :

NOTE : mrstruhina@outlook.com
NOTE : There is a link inside the scam.
NOTE : http://aka.ms/weboutlook
NOTE : There is an image inside the scam.
NOTE : http://english.people.com.cn/200504/01/images/0331_A77.jpg

Mercy Francis Brautigam

Good morning and how are you doing?... I am SGT. Mercy Francis. B.

Email analysis :

NOTE : frn6mercy.brautigam@gmail.com
NOTE : fran6mercy3@gmail.com
NOTE : mail-vk0-x242.google.com

About Payment 23-08-2017

Good day,

We have been instructed by your customer to make this transfer to you. Please we are very sorry for the delay in the payment, it was due to the Holidays. Attached is the Payment remittance copy for your reference.Please confirm for errors and get back to us through email.

Best Regards,
DANIEL MURRAY
Sharaf Exchange LLC.
Address:Sharaf Exchange Shop No. G15,
Union Co-Op Society,
Al Aweer,Near Fruit and Vegetable Market, Ras Al Khor, Dubai - UAE
Phone No:04-3200698
Website: http://www.sharafexchange.com

IMG-051220378052.DOC

Email analysis :

NOTE : danielmurray@mail.ru
NOTE : Received : from [104.243.26.4] (port=51917 helo=User)

NOTE : by shared.buxar-host.in
NOTE : bylinkove-zdravi@seznam.cz

Virus analysis :

Ad-Aware W97m.Downloader.GCK
AhnLab-V3 W97M/Downloader
BitDefender W97m.Downloader.GCK
DrWeb W97M.DownLoader.1802
eScan W97m.Downloader.GCK
F-Secure W97m.Downloader.GCK
GData W97m.Downloader.GCK
Ikarus Trojan-Downloader.VBA.Agent
MAX malware (ai score=81)
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
ZoneAlarm HEUR:Trojan-Downloader.Script.Generic

Verify your account™ (Phishing)

Hi *@*,

Password confirmation is required to authenticate *@* ownership on our server and retrieve pending incoming mails and save your new configuration settings.

Please click here for confimation to avoid mail malfunction.

Regards
Mail sent to: *@*

© 2017 Online Office. All rights reserved. NMLSR ID 399801

Email analysis :

NOTE : mbalok@hotmail.com
NOTE : client-ip=40.92.0.22;

Phishing analysis :

CLICK :
OPEN : https://artinfonews.ro/wp-content/themes/twentythirteen/css/ENC/
REDIRECT : https://artinfonews.ro/wp-content/themes/twentythirteen/css/ENC/cmd-login=*/en.php?
SCREENSHOT :

VALIDATE : FORM
REDIRECT : https://artinfonews.ro/wp-content/themes/twentythirteen/css/ENC/cmd-login=*/sxc.php?
SCREENSHOT :

317061979269082.doc (Virus)

317061979269082.doc

Email analysis :

NOTE : Return-Path: < noreply@xo.net >
NOTE : identity=mailfrom; client-ip=208.36.229.61;
NOTE : helo=xo.net; envelope-from=noreply@xo.net;
NOTE : Received: from xo.net (208.36.229.61.ptr.us.xo.net [208.36.229.61])
NOTE : Content-Type: application/msword; name="317061979269082.doc"
NOTE : From: < noreply@ulegv.com >
NOTE : 208.36.229.61.ptr.us.xo.net)

Virus analysis :

Ad-Aware W97M.Downloader.GDB
AegisLab Troj.Script.Agent!c
AhnLab-V3 W97M/Downloader
ALYac Trojan.Downloader.W97M.Gen
Arcabit HEUR.VBA.Trojan.e
Avast Other:Malware-gen [Trj]
AVG Other:Malware-gen [Trj]
Avira W97M/Dldr.Agent.mgjui
Baidu VBA.Trojan-Downloader.Agent.bup
BitDefender W97M.Downloader.GDB
Comodo UnclassifiedMalware
Cyren PP97M/Downldr
DrWeb W97M.DownLoader.1961
Emsisoft Trojan-Downloader.Agent (A)
eScan W97M.Downloader.GDB
ESET-NOD32 VBA/TrojanDownloader.Agent.DYZ
F-Prot New or modified PP97M/Downldr
F-Secure W97M.Downloader.GDB
Fortinet WM/Agent.Q!tr.dldr
GData W97M.Downloader.GDB
Ikarus Trojan-Downloader.VBA.Agent
Kaspersky HEUR:Trojan.Script.Agent.gen
MAX malware (ai score=99)
McAfee W97M/Downloader.cfm
McAfee-GW-Edition W97M/Downloader.cfm
Microsoft TrojanDownloader:O97M/Donoff
Panda O97M/Downloader
Sophos AV Troj/DocDl-KBA
Symantec W97M.Downloader
Tencent Win32.Trojan-downloader.Agent.Sxyr
TrendMicro W2KM_DLOADR.YYTCY
TrendMicro-HouseCall W2KM_DLOADR.YYTCY
ViRobot W97M.S.Agent.76249
ZoneAlarm HEUR:Trojan.Script.Agent.gen