Post up and share your examples of spam phishing emails messages #scamaware

[Tools]

Re: Post up and share your examples of spam phishing emails messages #scamaware

These .doc files contain a well embedded macro

See here for more details - https://grahamcluley.com/2015/02/ban...t-word-macros/

[Crazy council]

Re: Post up and share your examples of spam phishing emails messages #scamaware

Electronic Submission Gateway

Thank you for your submission for the Government Gateway.
The Government Gateway is the UK's centralized registration service for e-Government services.

To view/download your form to the Government Gateway please visits spamspam'''''''''''
This is an automatically generated email. Please do not reply as the email address is not
monitored for received mail.

The best place to find government services and information

that really from @Bluesnorth.com

scamscam..gateway.gov.uk/file/s/gdvzk7toum8ghnc/SecureDocument.zip?dl=1 is dead ( nnot quite dead, just reading the code at the mo )

odd one that,,, mmm its russion scammers behind it looks like. i wander if they managed to get a file on that site

[Tools]

Re: Post up and share your examples of spam phishing emails messages #scamaware

Via Trend Labs - Explains that document attached to your spam/malware email and why you should never open them

http://blog.trendmicro.com/trendlabs...rops-bartalex/

Early this year Microsoft reported an increase in macro-related threats being used to spread malware via spam. Similarly, we’ve been seeing a drastic increase in spammed emails with attached Microsoft Word documents and Microsoft Excel spreadsheets that come with embedded macros.
Macros are a set of commands or code that are meant to help automate certain tasks, but recently the bad guys have yet again been utilizing this heavily to automate their malware-related tasks as well. Here are some recent blog posts in which we tackled various macro-based malware:

• Banking Trojan DRIDEX Uses Macros for Infection
• ROVNIX Infects Systems with Password-Protected Macros
• Banking Malware VAWTRAK Now Uses Malicious Macros, Abuses Windows PowerShell

Recent spammed emails now spread BARTALEX malware
A recent sample email pictured below shows a fake Air Canada e-ticket with faulty airline information attached in the form of a .DOC file. Opening the .DOC file leads to a document with a malicious macro. We detect this as W2KM_BARTALEX.EU.

[enaid]

Re: Post up and share your examples of spam phishing emails messages #scamaware

• DHL EXPRESS
• Today at 1:47 PM

To



Greetings

From DHL Courier Company Office Benin Republic.
Date: 25/03/2015

This is to inform you that there is ATM VISA card in this office deposited by World Bank Group President Jim Yong Kim. on the 15th of March 2015, your e-mail address was attached to it and is to be posted to you. We have been waiting for you to contact us for your conformable ATM VISA card which contains the sum of $2.6 Million USD and some vital documents. So kindly get back to this office (DHL COURIER COMPANY BENIN REPUBLIC) to avoid fraudulent issues concerning in this service.Note: The only fee you are to pay is $195 required by the management.

Below is the Registration Information's of your ATM VISA CARD SHIPMENT,
SHIPMENT CODE AWB 83XcS
REGISTERED TAG FCSCB77017.
SECURITY CODE SCAT/2012dhl/996/
TRANSACTION CODE 233/CYST/101/32044/
CERTIFICATE DEPOSIT CODE SCAT/BUN/lxiv/-05/01

we shall send the ATM VISA Card to you as soon as you reconfirm provide Delivery address below.
Your full name.........
Your country............
Your postal code and address.....
Your direct phone.......

Note: that you are to pay for the Delivery fee of $195.you are advise to confirm your readiness in sending the fee to enable us proceed the Delivery of your ATM VISA Card.Note: that every claim has an expiring period of FIVE working-days (5days) so you have to send this fee so that your ATM Visa Card will be Delivered to you urgently to avoid expiration,

You can call us on +229-9652 6788
Thanks
Your best regard
Mr.David Zaza
Phone +229-9652 6788
Manager of DHL Courier Company
Benin Republic.

[enaid]

Re: Post up and share your examples of spam phishing emails messages #scamaware

[LLOYDS BANK] Confirm Your Account ✔


People

• me
• Today at 6:23 AM

To

• me

This message contains blocked images.

Show Images
Change this setting

Dear Customer,

To protect your accounts, we automatically suspend your online access
when your log in details have been entered incorrectly several times.

To get back into the service, you can re-instate your details quickly and easily
prevent your self from online fraudulent and unauthorized transfers within
your account, click the ''link' below to proceed.

Suspended ID Number: TSB-558-271-374

Log On Here to proceed.

Thank you for banking with Lloyds Bank.

Sincerely,

Online Security Team
Lloyds Banking Group.

[enaid]

Re: Post up and share your examples of spam phishing emails messages #scamaware

• Belinda Williams
• Today at 1:55 AM

To




My name is Belinda Williams, 28 years old single lady, a Canadian citizen,

I wish to inquire of your services to be my partner/investor and support me to transfer and manage my funds by investing in profit making ventures like buying of company shares or Real Estate Investment Trust funds ,i am not in Canada now. I don't have anybody here.

I have a reasonable sum that I inherited from my step father Mr.Desmond Williams, which I would like you to help me invest it in your country.

Attached here are my personal photos, evidence of deposit of the fund, my international passport and my late father’s death certificate in France. I am sending all these for you to have confidence that you are dealing with a genuine person.

Please reply me as soon as you read this message and the documents so that I can know how to proceed.

Best regards

Miss Belinda Williams.

Note:below is the major reason i am contacting you.

(1) To provide a new empty bank account which this money would be transfer. if you dont want us to use your personal account .

(2) To serve as a guardian of this fund since bank insist that their agreement with my father was that i provide a foriegn partner before releasing the fund.

(3) To make arrangement for me to come over to your country to further my education and to secure a resident permit in your country.

[Kati]

Re: Post up and share your examples of spam phishing emails messages #scamaware

Account Loked




Account Loked

Lloyds (Lloyd.account.security@gmx.cn)

09:01

To:

From:	Lloyds (mailer_response@emailcounts.com) on behalf of Lloyds (Lloyd.account.security@gmx.cn) Microsoft SmartScreen classified this message as junk.
Sent:	01 April 2015 09:01:53
To:

Dear Lloyd member, Lloyd is constantly working to ensure security by regularly screening the accounts in our system.We recently reviewed your account, and we need more information to help us provide you with secure service.Until we can collect this information, your access to sensitive account features will be limited. We would like to restore your access as soon as possible, and we apologize for the inconvenience. Why is my account access limited? Your account access has been limited for the following reason(s): We have reason to believe that your account was accessed by a third party. We have limited access to sensitive Lloyd online account features in case your account has been accessed by an unauthorized third party. We understand that having limited access can be an inconvenience, but protecting your account is our primary concern. Click here to remove your limitation If we do not receive the appropriate account verification within 24 hours, we will assume your account is fraudulent and will be suspended. Thank you for your understanding and cooperation in this matter. Lloyds Security Online Security Team Lloyds Banking Group

Reported to emailscams@lloydsbanking.com

[enaid]

Re: Post up and share your examples of spam phishing emails messages #scamaware

Dear Winner,

We write to congratulate you as one of the Euro Million lucky winners. Your email was electronically selected with a lucky
winning number: 2.9.26.32.38*3*6.

We advised you to contact our Head Office with your lucky winning number for the processing of your winning.

Contact Person: Van Koning
Claim Processing Officer
Tel: 0032 466 251 869
Fax: 003 2466 251 869
euromillionlotobe@yahoo.be

Congratulations!

Sincerely,

Euro Million/National Post Code Lottery
Avenue de Bruselxstraat 115-117
1150 Brussel - Belgium
http://www.lotto.be

[Nibbler]

Re: Post up and share your examples of spam phishing emails messages #scamaware

[ODC]

Re: Post up and share your examples of spam phishing emails messages #scamaware

In the space of yesterday afternoon I had 3 seperate email telling me I had won a lottery of €10,000,000 (Ten million euros) All were identical with the exception of the country they were supposed to be from. All were from the same "barrister" who apparentlly is also a Reverend Doctor.

Our souls

[enaid]

Re: Post up and share your examples of spam phishing emails messages #scamaware

• FBI OFFICE
• Today at 9:12 AM

Anti-Terrorist And Monetary Crimes Division
FBI Headquarters, Washington, D.C
Federal Bureau Of Investigation
J.Edgar Hoover Building
935 Pennsylvania Avenue, Nw Washington, D.C. 20535-0001


Attention: BENEFICIARY

This e-mail has been issued to you in order to Officially inform you that we have completed an investigation on an International Payment in which was issued to you by an International Lottery Company. With the help of our newly developed technology (International Monitoring Network System) we discovered that your e-mail address was automatically selected by an Online Balloting System, this has legally won you the sum of $2.4million USD from a Lottery Company outside the United States of America. During our investigation we discovered that your
e-mail won the money from an Online Balloting System and we have authorized this winning to be paid to you via INTERNATIONAL CERTIFIED BANK DRAFT.

Normally, it will take up to 5 business days for an INTERNATIONAL CERTIFIED BANK DRAFT by your local bank. We have successfully notified this company on your behalf that funds are to be drawn from a registered bank within the world winded, so as to enable you cash the check instantly without any delay, henceforth the stated amount of $2.4million USD has been deposited with IMF.

We have completed this investigation and you are hereby approved to receive the winning prize as we have verified the entire transaction to be Safe and 100% risk free, due to the fact that the funds have been deposited with IMF you will be required to settle the following bills directly to the Lottery Agent in-charge of this transaction whom is located in Cotonou, Benin Republic. According to our discoveries, you were
required to pay for the following,

(1) Deposit Fee's ( IMF INTERNATIONAL CLEARANCE CERTIFICATE )
(3) Shipping Fee's ( This is the charge for shipping the Cashier's Check to your home address)

The total amount for everything is $96.00 We have tried our possible best to indicate that this $96.00 should be deducted from your winning prize but we found out that the funds have already been deposited IMF and cannot be accessed by anyone apart from you the winner, therefore you will be required to pay the required fee's to the Agent in-charge of this transaction

In order to proceed with this transaction, you will be required to contact the agent in-charge ( Mr.Mark Edward) via e-mail. Kindly look below to find appropriate contact information:

CONTACT AGENT NAME: Mr.Mark Edward
Email( markedward197@gmail.com
PHONE NUMBER: +229-61912635
You will be required to e-mail him with the following information:

FULL
NAME:
ADDRESS:
CITY:
STATE:
ZIP CODE:
DIRECT CONTACT NUMBER:
OCCUPATION:

You will also be required to request Western Union or Money Gram details on how to send the required $96.00 in order to immediately ship your prize of $2.4million USD via INTERNATIONAL CERTIFIED BANK DRAFT from IMF, also include the following transaction code in order for him to immediately identify this transaction : EA2948-910.

This letter will serve as proof that the Federal Bureau Of Investigation is authorizing you to pay the required $96.00 ONLY to Mr.Mark Edward via information in which he shall send to you,


Mr. JAMES B COMEY
Federal Bureau of Investigation F B I
Yours in Service,Photograph of Director
JAMES B COMEY, 111 JAMES COMEY
III Director Office of Public Affairs

[enaid]

Re: Post up and share your examples of spam phishing emails messages #scamaware

• rs.Lisa Mark
• Today at 6:28 PM

MINISTRY OF FINANCE COTONOU HEAD OFFICE
Plot 87 Adeogun Street,Cotonou
RepublicDu' Benin.

CONGRATULATIONS DEAR
Attn: Payment Notification,

I have Deposited your check with the Western Union. Send
your receiving information at: (wunion.plc2015@yandex.com) My
agreement with them is $5,000 USD two times daily Until the whole of
$4.5 Million USD is Transferred.

note: that You Will be required to pay only $75 for paper
work and stamp duty charge The Contact person is

Namer.McDonnell Douglas
phone number: +229 99394154
Email:wunion.plc2015@yandex.com


Thank Mrs.Lisa Mark

[Crazy council]

Re: Post up and share your examples of spam phishing emails messages #scamaware

i can thelp but think of this guys accent when i read scam mails like above

[enaid]

Re: Post up and share your examples of spam phishing emails messages #scamaware

• Bank of Scotland Online
• May 20 at 9:18 PM

Toenaid

Dear Bank of Scotland member, There has been an issue with your account that needed urgent attention. There were 19 failed login attempts during today, 20th of May, 2015. To prevent any abuse we have decided to temporarily limit your account. To reactivate it just login to your account and answer a simple security question by clicking the following link: Click here to login to online services Thank you for your understanding, Joshua H. Campbell, IT Executive.

[Boycie]

Re: Post up and share your examples of spam phishing emails messages #scamaware

It's not just account payment logins they're after.

I received this one the other day and the link has already got a Google 'phishing warning' flag on it. There are many things a hacker can do with a website, though most usually they'll use it to host more phishing pages.

Dear [Bertram Wooster],

Your cPanel webhosting account has been transmitting viruses to our servers and will be deactivated permanently if not resolved.

In respect to the above, you are urgently required to sanitize your webhosting account with Norton E-mail Scanner; otherwise, your access to cPanel webhosting services will be deactivated

Click here now to scan and sanitize your webhosting account

Note that failure to sanitize your webhosting account immediately will lead to permanent deactivation without warning.

We are very sorry for the inconveniences this might have caused you and we assure you that everything will return to normal as soon as you have sanitized your webhosting account.

cPanel Admin