MALWARE ALERT! MWALWARE scam email from HSBC hsbcservces6@host61.registrar-servers.com www.hsbcservces.cf

DO NOT CLICK ON THE LINK IN THIS EMAIL!  This email IS NOT FROM HSBC BANK and the link DOES NOT TAKE YOU TO THE HSBC BANK WEBSITE!  The link takes you to http://hsbcservces.cf/clientsdata/Policy.doc.exe which is an executable program that contains MALWARE which can infect your computer and/or device!  If you have clicked or downloaded this file, run a full virus scan as soon as possible.  You can download free versions from safe websites such as https://www.malwarebytes.org/ and http://free.avg.com/us-en/homepage

Originating IP: 129.56.97.25
Originating ISP: As-natcom
City: Abuja
Country of Origin: Nigeria

from: Hsbc <hsbcservces6@host61.registrar-servers.com> via hsbcservces.cf 
reply-to: Hsbc <admin@hsbcservces.ml>
to: 
date: Mar 1, 2019, 1:31 AM
subject: Hsbc
mailed-by: hsbcservces.ml
signed-by: hsbcservces.cf

HSBC

Dear Client OF HSBC Bank,

A sudden change has been noticed on your "secure key app"
it is Advised that you review immediately,We do advise you to proceed to confimation on customer data using the referral button.

Please Do Note This Instruction Has Been Sent Also To Customers Of Similar Issue And You Are Advised To Review Immediately
Failure To So Permits Account Suspension

www.hsbc.com

From the .html of the email:
Failure To So Permits Account Suspension

www.hsbc.com ( http://hsbcservces.cf/clientsdata/Policy.doc.exe )

( http://hsbcservces.cf/clientsdata/Policy.doc.exe )
<a href="http://hsbcservces.cf/q/index.php?option=com_acymailing&no_html=1&ctrl=url&urlid=1&mailid=9&subid=3703">www.hsbc.com</a>
<p>&nbsp;</p>
<a href="http://hsbcservces.cf/q/index.php?option=com_acymailing&no_html=1&ctrl=url&urlid=1&mailid=9&subid=3703" target="empty"><input type="button"
value="REFERRAL" /></a></blockquote><img alt="" src="http://hsbcservces.cf/q/index.php?option=com_acymailing&ctrl=stats&mailid=9&subid=3703&no_html=1"
 border="0"  height="1"  width="50" />

MALWARE ALERT! Malware email from WARNING@mailadmin.com https://nsjsta.com/uu/viralert/index.php

DO NOT CLICK ON THE LINK IN THIS EMAIL!  The link may contain MALWARE that can be harmful to your device.  If you have clicked or downloaded this file, run a full virus scan as soon as possible.  You can download free versions from safe websites such as https://www.malwarebytes.org/ and http://free.avg.com/us-en/homepage

Originating IP: 129.205.113.13
Originating ISP: Globacom-as
City: Dambatta
Country of Origin: Nigeria

from: WARNING@mailadmin.com 
to: 
date: Tue, Jun 19, 2018 at 3:56 AM
subject: WARNING: Virus Alert!!!

Your email is infected.
To keep your account safe, Click Here and run a Quick Email Scan now

If you ignore this warning, we will shutdown your account without further notice,
and all data will be permanently lost.

We regret the inconvenience, but this exercise is aimed at helping us protect your account.

From the HTML of the email:

<a href="https://nsjsta.com/uu/viralert/index.php"><b>Click Here</b></a>

Loan scam email & MALWARE Alert from Mrs. Helen J. Anderson Loan Service Desk Prestige Finance Loan tester432@tandemservice.ru prestigefinanceloan02@gmail.com +27-840499150 +27-785758753

*** The .pdf attachment that came with this email was flagged as containing a virus by my email client.

from: Prestige Finance Loan <tester432@tandemservice.ru> 
reply-to: prestigefinanceloan02@gmail.com
to: 
date: Fri, May 11, 2018 at 12:13 PM
subject: GET QUICK LOAN FROM PRESTIGE FINANCE AT 5% FIXED INTEREST RATE
mailed-by: tandemservice.ru

Dear Valued Customer,

Prestige Finance Loan is a registered financial services provider focused on partnering with individuals and cooperate bodies, by developing  opportunities for the small-medium-large businesses that drive South Africa’s economy. The offer is open to those who are blacklisted and those with bad credit records. We offer all types of loan and our interest rate is fixed for the entire duration of the loan.

Prestige Finance Loan is made to suit each individual's financial needs, helping them to achieve financial freedom and escape the trap of bad debt. Our simple three-step process to financial independence means our loan approval for qualified applications are granted within 48 hours.

Prestige Finance Loan is committed to providing personal loans, Business Loans, Car Loans, Home loan and debt consolidation loans for only 5% per annum, products that enable the responsible use of credit as part of a structured financial plan.

Too many South Africans fall prey to loan sharks. The loans they get from these unscrupulous lenders aren't designed around their situations and have high repayments.

Type of Loan And Loan Range

*Loan Duration 1year to 20years for personal and business loan

*Platinum Package Loan:.....R30,000,000.00 ,*Gold Package Loan..............R20,000,000.00

*Premium Package Loan:.....R10,000,000.00 ,*Large Scale Business Loan: R1,000,000.00

*Mortgage/Home Loan:........R500,000.00 and Above., *Small Scale Business Loan:. R200,000.00 and Above.

Applying for a loan is quick and easy!

To benefit from our tremendous offer, email the required details below to the following address; prestigefinanceloan02@gmail.com

Full Names: ID Number: Cell Number: E-mail: Occupation: Monthly Salary:

See attached file for loan application form

Kind Regards,

Mrs. Helen .J. Anderson
(Loan Service Desk)
Tel.: +27 840499150, +27 785758753

attachment; filename="Prestige Finance Loan Application Form.pdf";

MALWARE ALERT! MALWARE scam email from UPS Ups@purdue.edu www.ups-tracking.website

DO NOT CLICK ON THE LINK IN THIS EMAIL!  This email is not from UPS and the link does not take you to the UPS website!  The link takes you to http://ups-tracking.website/label.jar and has been flagged by engines as MALWARE that can infect your computer!

http://trafficlight.bitdefender.com/info?url=http://ups-tracking.website

Stop! This website is not safe
This website contains malware that may harm your computer
This website contains elements classified as malware: software that can harm your computer or operate without your consent. Visiting a site that contains malware can infect your computer.

If you have clicked on this link, run a full virus scan as soon as possible.  You can download free versions from safe websites such as https://www.malwarebytes.org/ and http://free.avg.com/us-en/homepage
Originating IP: 128.210.5.16
Originating ISP: Purdue University
City: West Lafayette
Country of Origin: United States

from: UPS <Ups@purdue.edu> 
to: "ig.com.br," 
date: Fri, Dec 1, 2017 at 8:52 PM
subject: Package out for delivery
mailed-by: purdue.edu


UPS 

To get an estimated delivery time for UPS packages, Download Shipping Label

You have a package coming.

Scheduled Delivery Date:  Saturday 12/02/2017

Download

UPS 
Change Delivery
Manage Preferences
View Delivery Planner

This message was sent to you at the request of the shipper to notify you that the shipment information below has been transmitted to UPS. The physical package may or may not have actually been tendered to UPS for shipment. To verify the actual transit status of your shipment, click on the tracking link below.

Shipment Details

From: Amazon, LLC

Tracking Number:
1Z3689Y603666787

UPS Service: UPS GROUND
Number of Packages: 1
Package Weight: 17.8 LBS
Scheduled Delivery: 12/02/2017
Reference Number 1: 1081966

Download the UPS mobile app

© 2017 United Parcel Service of America, Inc. UPS, the UPS brandmark, and the color brown are trademarks of United Parcel Service of Amercia, Inc. All rights reserved.

All trademarks, trade names, or service marks that appear in connection with UPS's services are the property of their respective owners.

Please do not reply directly to this e-mail. UPS will not receive any reply message.
For more information on UPS's privacy practices, refer to the UPS Privacy Notice.
For questions or comments, visit Contact UPS.

 This communication contains proprietary information and may be confidential. If you are not the intended recipient, the reading, copying, disclosure or other use of the contents of this e-mail is strictly prohibited and you are instructed to please delete this e-mail immediately.

UPS Privacy Notice
Contact UPS 

MALWARE ALERT! Malware email from Scammer Posing as UPS ups@purdue.edu 832-772-2139 www.upss.website

DO NOT CLICK ON THE LINK IN THIS EMAIL!  The link in the email is http://www.upss.website/ups.jar and has been flagged by multiple engines as MALWARE that can infect your computer!

http://trafficlight.bitdefender.com/info?url=http://upss.website

Stop! This website is not safe
This website contains malware that may harm your computer
This website contains elements classified as malware: software that can harm your computer or operate without your consent. Visiting a site that contains malware can infect your computer.

From Google:

This site may harm your computer
Malicious software can allow unwanted programs to steal passwords and credit card numbers, slow down your computer, or change your search results. We recommend that you don't visit the site until this message disappears from the search result.

If you have clicked on this link, run a full virus scan as soon as possible.  You can download free versions from safe websites such as https://www.malwarebytes.org/ and http://free.avg.com/us-en/homepage

Originating IP: 17.11.20.15
Originating ISP: Apple Inc.
City: Cupertino
Country of Origin: United States

from: ups <ups@purdue.edu> 
to: 
date: Mon, Nov 20, 2017 at 5:47 PM
subject: Order Shipped.
mailed-by: purdue.edu

Dear,

Your order has been shipped via Ups.. Click here to view receipt and tracking number.

Thank you for your order. If you have any question,

Please call me at 832-772-2139 or email me

Please contact us immediately if you are unable to view.

From the HTML of the email:

<A HREF="http://www.upss.website/ups.jar">Click here</A>

MALWARE ALERT! MALWARE email from Bates Randy grantj@gvsu.edu cp.my

DO NOT OPEN THE DOCUMENT ATTACHED TO THIS EMAIL AND DO NOT CLICK ON THE LINK IN THE DOCUMENT!  The link takes you to https://cp.my/robots.php which has been flagged by BitDefender as containing MALWARE!

http://trafficlight.bitdefender.com/info?url=http://cp.my

Stop! This website is not safe
This website contains malware that may harm your computer
This website contains elements classified as malware: software that can harm your computer or operate without your consent. Visiting a site that contains malware can infect your computer.

If you have clicked this link, run a full virus scan as soon as possible.  You can download free versions from safe websites such as https://www.malwarebytes.org/ and http://free.avg.com/us-en/homepage

Originating IP: 218.61.3.229
Originating ISP: China Unicom China169 Backbone
City: Shenyang
Country of Origin: China

from: Bates Randy <grantj@gvsu.edu> 
to: 
date: Thu, Oct 5, 2017 at 4:56 AM
subject: Telegraphic Transfer Receipt
mailed-by: gvsu.edu
signed-by: gvsu5.onmicrosoft.com

We have made payment of $35,600 USD today as promised.  Find T/T receipt attached.

Thank you,
Bates Randy


attachment; filename="TT_Receipt.docx"
The link text shows an adobe link, but the actual link takes you to https://cp.my/robots.php

Bates Randy shared a file using Adobe cloud.  Click on the link below to download.

https://www.adobe.com/cloud/yMLvNa6UU563tKZdENCKKCZ8/

File Description: Telegraphic Transfer Receipt

Date: 5th October, 2017

File Size: 256kb

Thank you for using Adobe.

MALWARE ALERT! Potential MALWARE email from ASW Global LLC info@popot.xyz https://jumpshare.com/v/BT7SgfsQGZdIifcyhfLb 626-574-6946

DO NOT CLICK ON THE LINK IN THIS EMAIL!  The link may contain MALWARE that can be harmful to your device.  If you have clicked or downloaded this file, run a full virus scan as soon as possible.  You can download free versions from safe websites such as https://www.malwarebytes.org/ and http://free.avg.com/us-en/homepage

Originating IP: 103.253.212.54
Originating ISP: Rumahweb Indonesia Cv.
City: Jakarta
Country of Origin: Indonesia

from: A S W GLOBAL.LLC <info@popot.xyz> 
to: 
date: Tue, Oct 3, 2017 at 2:09 PM
subject: 10-03-2017 - Order List And Picture - ABB 2CSM
mailed-by: popot.xyz
signed-by: popot.xyz

Good Morning!

Following up with our past conversations, below is our order and the product pictures for October 2017.

Download here our  ORDER LIST

And Download here the  ORDER PICTURE

We need from your company.

Please send to below address :

A S W GLOBAL.LLC
400 S. Baldwin Ave
Arcadia, CA 91007
+16265746946
Should there be any problem, please don't hesitate to call. Thank you.

Brst Regards,
Zharg
Amata Nakorn Industrial Estate 700/553,
Moo 7, T.Don Hua Roh, A.Maung, Chonburi, 20000, Thailand

From the HTML of the email:

<a style="color: #0000ff;" href="https://jumpshare.com/v/uZ0FAmWgKNHEtelQIreu"><strong>ORDER LIST</strong></a>

MALWARE ALERT! MALWARE scam email from Naresh Shirsath Nobel Hygiene Pvt. Ltd. Executive-Operations sales1@ellistoncaravanpark.com.au

DO NOT OPEN THE FILE ATTACHED TO THIS EMAIL!  The order.doc file attached to this email contains MALWARE!  If you have clicked/downloaded this file, run a full virus scan as soon as possible.  You can download free versions from safe websites such as https://www.malwarebytes.org/ and http://free.avg.com/us-en/homepage

from: Naresh Shirsath <sales1@ellistoncaravanpark.com.au> 
reply-to: Naresh Shirsath <sales1@ellistoncaravanpark.com.au>
to: 
date: Mon, May 1, 2017 at 7:04 AM
subject: Order

Dear Sir / Madam,

Please find the attached purchase order. Please check and get back to us asap.

Thanks & Regards,
Naresh Shirsath
Executive-Operations
Nobel Hygiene Pvt. Ltd.
A - 70, MIDC, Malegaon, Sinnar, Nashik – 422 113 (MH)
Mobile: 7385089006.

attachment; filename=order.doc;

MALWARE ALERT! MALWARE scam disguised as Mystery Shopper Employment email from Mystery Shopping Services postmaster@infinitemail.com

DO NOT CLICK ON THE LINK IN THIS EMAIL!  The link takes you to http://promic.cl/plugins/system/p3p/activate/active/application.html which has been flagged by MULTIPLE VIRUS ENGINES as containing MALWARE as of 3 months ago!  The site may have been moved to another host and engines may not be updated today, however, it is still a MALWARE threat!  Full detains of the Virus Scan are below.

If you have clicked this link, run a full virus scan as soon as possible.  You can download free versions from safe websites such as https://www.malwarebytes.org/ and http://free.avg.com/us-en/homepage
Originating IP: 12.44.84.194
Originating ISP: At&t Services, Inc.
City: n/a
Country of Origin: United States

from:    Mystery Shopper <postmaster@infinitemail.com>
to:   
date:    Sat, Feb 18, 2017 at 7:51 PM
subject:    Mystery Shopping Invitation

Mystery Shopper, Inc.
Mystery Shopper is accepting applications for qualified individuals to become mystery shoppers. It's fun and rewarding, and you choose when and where you want to shop. You are never obligated to accept an assignment. There is no charge to become a shopper and you do not need previous experience.
Mystery Shopper NEVER charge fees to become a shopper, mystery shoppers are paid a prearranged fee for a particular shop, We have available for immediate assignment an inspection of the customer service of some stores and businesses in your area. This fee will be paid upfront. During this shop you will visit the location and make several observations as regards the customer service. You will be required to interact with the shop clerk. You may conduct the shop alone or as a couple.

Please click here to read about the Job Description

Please note: If this message goes to your spam mail, you need to move it to your inbox for the link to redirect to our sign up page.

Regards,

Mystery Shopping Services

---------------------------------------------------------------------------------------------------------------
This message is auto-generated from our server and replies sent to this email can not be delivered. This email is meant for:

From the HTML of the email:

<A style="PADDING-BOTTOM: 0px; MARGIN: 0px; OUTLINE-STYLE: none; OUTLINE-COLOR: invert; PADDING-LEFT: 0px; OUTLINE-WIDTH: medium; PADDING-RIGHT: 0px; COLOR: rgb(25,106,212); TEXT-DECORATION: none; PADDING-TOP: 0px; -webkit-padding-start: 0px; background-size: initial; background-origin: initial; background-clip: initial" href="http://promic.cl/plugins/system/p3p/activate/active/application.html" shape=rect rel=nofollow target=_blank><SPAN style="FONT-FAMILY: calibri; COLOR: rgb(255,255,255); FONT-SIZE: small; -webkit-padding-start: 0px"><STRONG><SPAN lang=EN>Please click here to read about the Job Description</SPAN></STRONG></SPAN></A>

Virus Scan Information:

From VirusTotal.com:
https://www.virustotal.com/en/url/450b4db1114ee7cdeb749e739b468b3b5c0b30158f861f1d8c69b233c3ac/analysis/1487601413/

URL:     http://promic.cl/plugins/system/p3p/activate/active/application.html
Detection ratio:     7 / 64
Analysis date:     2017-02-20 14:36:53 UTC ( 0 minutes ago )
AutoShun     Malicious site
Dr.Web     Malicious site
Malware Domain Blocklist     Malicious site
BitDefender     Malware site
Fortinet     Malware site
G-Data     Phishing site
Malwarebytes hpHosts     Phishing site

Previous:
VirusTotal metadata
First submission 2016-11-17 16:56:57 UTC ( 3 months ago )
Last submission 2016-11-17 16:56:57 UTC ( 3 months ago )
ExifTool file metadata
MIMEType
text/html
ContentType
text/html; charset=iso-8859-1
Generator
MSHTML 8.00.6001.18975
Title
Mystery Shoppers, Inc.
FileType
HTML
FileTypeExtension
html
Keywords
mystery shopping, mysteryshopping, mystery shop, mysteryshop, mystery shopper, mysteryshopper, free shopping, shopper, shopping, secret shop, secret shopper, secret shopping, work at home, home based business, home based employment, work for yourself, consumer research, marketing, sales visibility, quality control, sales management, increase sales, improve service

From https://sitecheck.sucuri.net/results/promic.cl

Website:     promic.cl
Status:     Site Potentially Harmful. Immediate Action is Required.
Web Trust:     Blacklisted (10 Blacklists Checked): Indicates that a major security company (such as Google, McAfee, Norton, etc) is blocking access to your website for security reasons. Please see our recommendation below to fix this issue and restore your traffic.

Scan for: http://promic.cl
Hostname: promic.cl
IP address: 186.103.213.249

System Details:
Running on: Apache
Powered by: PHP/5.6.27

Web application details:
Application: Joomla! - Open Source Content Management - http://www.joomla.org

Web application version:
Joomla Version 3.4.5 found at: http://promic.cl/administrator/manifests/files/joomla.xml
Joomla version outdated: Upgrade required.
Outdated Joomla Found: Joomla under 3.6.4
List of Links Found
/index.php
List of scripts included
/modules/mod_featured_youtube_slider/library/contentslider.js
/templates/ajt005_j30/js/bootstrap.min.js
/templates/ajt005_j30/js/scrolltopcontrol.js
/templates/ajt005_j30/js/hoverIntent.min.js
/templates/ajt005_j30/js/superfish.js
http://code.jquery.com/jquery-latest.pack.js
List of iframes included
https://www.youtube.com/embed/5fN-ryAEgLw?theme=dark&color=white&autohide=2&showinfo=0&autoplay=1
https://www.youtube.com/embed/eUvPCbQbc7A?theme=dark&color=white&autohide=2&showinfo=0&autoplay=0
https://www.youtube.com/embed/KTT_Wl4Pcxg?theme=dark&color=white&autohide=2&showinfo=0&autoplay=0
https://www.youtube.com/embed/4_9BW5VbPWs?theme=dark&color=white&autohide=2&showinfo=0&autoplay=0

From https://quttera.com/detailed_report/promic.cl

promic.cl blacklist status
Quttera Labs - domain is Malicious.
"The malware entry is cached and may not reflect the current status of the domain. You can request re-consideration by Quttera malware research team."

PHISHING/MALWARE ALERT! PHISHING scam email with potential MALWARE from Capital One capitalone@notification.capitalone.com zorrobabel.labajo@dict.gov.ph www.juandavidcocina.com

DO NOT OPEN THE FILE IN THIS EMAIL and DO NOT ENTER ANY INFORMATION ON THE FORM!  This email IS NOT FROM CAPITALONE and is PHISHING for your account information and posting it to http://www.juandavidcocina.com/capital360/home/log.php.  There is also a potential MALWARE warning!

Originating IP: 16.12.12.13
Originating ISP: Hewlett-packard Company
City: Palo Alto
Country of Origin: United States

from:    Capital One" <capitalone@notification.capitalone.com> <zorrobabel.labajo@dict.gov.ph>
to:   
date:    Mon, Dec 12, 2016 at 3:37 PM
subject:    Irregular Activity Detected On Your Account

Visit Capital One
Sign In

account verification.   

Dear valid Customer,

We detected irregular activity on your Card on Saturday, December 10, 2016. As the Primary Contact, you must verify your account activity before you can continue using your card, and upon verification, we will remove any restrictions placed on your account. To review your account as soon as possible please download the attached form and follow the instructions on your screen.

Thank you for Banking With Us.

We appreciate your business and the opportunity to serve you. Please do not reply to this e-mail as this is only a notification. Mail sent to this address cannot be answered.

If something doesn’t look right to you, sign in to see your payment activity. We’re here to help you, 24 hours a day, 7 days a week.

View Activity
View Posting Times
Manage Alerts
   
Download the Capital One Mobile app
Simple. Flexible. Mobile.
Download the secure Capital One Mobile app.

Important Information from Capital One®

Contact Us  |  Privacy  |  Help Prevent Fraud

To ensure delivery, add capitalone@notification.capitalone.com to your address book.

This email was sent to you and contains information directly related to your account with us, other services to which you have subscribed, and/or any application you may have submitted.

The site may be unavailable during normal maintenance or due to unforeseen circumstances. Please visit our Set Alerts page to modify your alerts subscription preferences.

Please do not reply to this message, as this email inbox is not monitored. To contact us, visit www.capitalone.com/contact.

Products and services offered by the Capital One family of companies, including Capital One Bank (USA), N.A., and Capital One, N.A., Members FDIC.

© 2016 Capital One. Capital One is a federally registered service mark. All rights reserved.

PAYSCH 10044 53552


From the Capital One 360 - Servicing - Login.html file attached to this email

<form action="http://www.juandavidcocina.com/capital360/home/log.php" name=chalbhai id=chalbhai method=post>

From Chrome:

Deceptive site ahead

Attackers on www.juandavidcocina.com may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone numbers, or credit cards).

Google Safe Browsing recently detected phishing on www.juandavidcocina.com. Phishing sites pretend to be other websites to trick you. Learn more.

You can report a detection problem or, if you understand the risks to your security, visit this unsafe site.

MALWARE ALERT! MALWARE email from Dr. Olax Urina Purchasing Manager +66-984107287 +66-853507654 www.sales16773.wix.com/isotch

DO NOT OPEN THE FILE ATTACHED TO THIS EMAIL!  The .doc file attached to this email contains MALWARE!  If you have clicked downloaded this file, run a full virus scan as soon as possible.  You can download free versions from safe websites such as https://www.malwarebytes.org/ and http://free.avg.com/us-en/homepage

from: Farley <farleyhratanto@gmail.com> 
to: Farley Farley <farleyhratanto@gmail.com>
bcc: 
date: Fri, Oct 7, 2016 at 12:54 AM
subject: Re: New Order
mailed-by: gmail.com
signed-by: gmail.com

Dear Sir/Madam

Hope this meets you well.

We are a trading company that engages in large quantity importation and exportation of top quality finished goods. We are interested in purchasing your company's products, we do hope to establish a long term business relationship.We would like to customize our product with our company logo.

However, please we would like to see your company's latest catalogs with the;

Minimum Order Quantity
Delivery time/FOB
payment terms warranty

Attached is our Invoice Purchase Order(InvPO). We  hope to hear from you soon.

MD
Dr Olax Urina
(Purchasing Manager)
Address :280/ Pattaya, S Pattaya Rd,
Chonburi, Bang Lamung District,
Chon Buri 20150
http://sales16773.wix.com/isotch     
Skype:Purchase manager
Tel:0066-984 1072 87
Fax:0066-853-5076 54

attachment; filename="InvPO.doc"

PHISHING ALERT!New list of PHISHING sites posing as Paypal, Apple, etc.

Some of these may already be shut down, but many of them are still live.  Some of them also have MALWARE warnings so please DO NOT VISIT THESE SITES!

Registered to vipspuc3ngine@yahoo.com

accountpalpay.com
appie-verivication.com
bioskoprumah.com
checkergates.com
customerpaiypal.com
dns-messa.com
fraudpaypai.com
jsakhfanasd-account.com
kohakukyo.com
limitpaiypal.com
messaharianto.com
messahosting.com
ncgasidjbnc.com
paipay-secure.com
paypai-limited.com
paypaii-limited.com
paypaiverivied.com
payyidpall.com
pvaypal.com
pypll.com
recover-account.net
service-intlpaypai.com
servicepaypai.com
services-intlpaypai.com
veriviedbypalpay.com

Registered to hashfiribery@yahoo.co.id

payqpl.com
updates-payphl.com

Registered to kolam.cece@gmail.com

get-verif.com
paayyppaall.com
pacypal.com
payipaall.com
paypai-cgi-bin.com
paypalservicces.com
payphal.net
payypaalllllll.com

Registered to emanuelabastari@mail.com

payipral.com

Registered to ar4kida@gmail.com

checkout-paypal.com
cmd-paypal-service.com
com-webscr.com
copaypal.com

Registered to yohanazza23@gmail.com

paysrpal.com

Registered to mencoins@gmail.com

www-securepaypal.com
wwwpaypals.com

Registered to aip234arif@gmail.com

4paypal.com
intlpaypals.com
paypal-secure-webapps.com
securtypaypalservice.com
srcpaypal.com

Registered to mr.arakida@gmail.com

paycepecall.com

Registered to repestsunny@gmail.com

netsucure-linked.com
netsucure-pay.com
payhpals.com
payphai.com
phaypals.com
secure-linked.net

Registered to ununut3@outlook.com

customer-paylpal-service.com
payipqal.com

MALWARE ALERT! MALWARE email from Ana Rohmawan Carlisle Productos de Mexico commercial@ptsuparmatbk.com www.tscl.com.bd

DO NOT DOWNLOAD OR OPEN THE .HTML FILE ATTACHED TO THIS EMAIL!  The .html file contains a link to http://tscl.com.bd/z/QUOTATION ORDER.zip and MALWARE that has been flagged by multiple engines as containing a TROJAN VIRUS which can be very harmful to your computer/device! 

Per VirusTotal.com:

URL Scanner     Result
Dr.Web     Malicious site
BitDefender     Malware site
ESET     Malware site
Fortinet     Malware site
Antivirus     Result     Update
AhnLab-V3     Trojan/Win32.ZBot.C715770     20160829
Avast     Win32:Evo-gen [Susp]     20160829
Avira (no cloud)     TR/Dropper.Gen     20160829
Baidu     Win32.Trojan.WisdomEyes.151026.9950.9999     20160829
ESET-NOD32     a variant of MSIL/Injector.OBU     20160829
Fortinet     MSIL/Injector.OBU!tr     20160829
Ikarus     Trojan.MSIL.Injector     20160829
Invincea     trojan.win32.skeeyah.a!rfn     20160829
Kaspersky     HEUR:Trojan.Win32.Generic     20160829

If you have clicked this link, run a full virus scan as soon as possible.  You can download free versions from safe websites such as https://www.malwarebytes.org/ and http://free.avg.com/us-en/homepage

Originating IP: 41.58.10.80
Originating ISP: Swiftng
City: Lagos
Country of Origin: Nigeria

from: commercial <commercial@ptsuparmatbk.com> 
to: 
date: Sun, Aug 28, 2016 at 11:15 PM
subject: Product List
mailed-by: ptsuparmatbk.com

Dear Sir,

Please see attached the new order and advise if shipment can be made early.

Details mentioned in the attached.

I wait for your reply immediately.

Ana Rohmawan
Carlisle Productos de Mexico S de R.L. de C.V.
Av. Alejandro Dumas 11331
Complejo Industrial Chihuahua
Chihuahua, Mexico
C.P. 31136
Phone: 011 (52) 614 442-20-00

attachment; filename="Product List.html"

<META HTTP-EQUIV="Refresh" CONTENT="1;URL=http://tscl.com.bd/z/QUOTATION ORDER.zip" >

MALWARE ALERT! PHISHING scam email with potential MALWARE from James Automobile auberge.fayoum@helnan.com www.kreatopedia.com

DO NOT OPEN THE FILE ATTACHED TO THIS EMAIL and DO NOT CLICK ON THE LINK IN THE .PDF FILE!  The link takes you to http://kreatopedia.com/wp-admin/adobe/adobe/MAcPET%20Trade%20PI.PDF%20-%20Copy.htm which has been flagged by MULTIPLE ENGINES as potentially containing MALWARE!

Per VirusTotal.com:

Antivirus    Result    Update
AVG     JS/Phish     20160802
AegisLab     Js.Phish.Gen!c     20160801
Avast     VBS:Malware-gen     20160802
CAT-QuickHeal     JS/Redirector.CE     20160802
Cyren     HTML/Phish.GF     20160802
DrWeb     JS.Redirector.252     20160802
ESET-NOD32     HTML/Phishing.Agent.AT     20160802
F-Prot     HTML/Phish.GF     20160802
Fortinet     JS/FakePDF.A!phish     20160802
GData     HTML.Trojan.Agent.29J3K1     20160802
Ikarus     JS.Phish     20160802
McAfee     JS/Phish     20160802
McAfee-GW-Edition     JS/Phish     20160802
NANO-Antivirus     Trojan.Html.Redirector.eegmft     20160802
Qihoo-360     Script/Trojan.7e1     20160802
Sophos     Mal/Phish-A     20160802
TrendMicro-HouseCall     HTML_ADOPHISH.SM     20160802

If you have clicked this link, run a full virus scan as soon as possible.  You can download free versions from safe websites such as https://www.malwarebytes.org/ and http://free.avg.com/us-en/homepage

Originating IP: 197.211.57.19
Originating ISP: Globacom Ltd
City: Lagos
Country of Origin: Nigeria

from: James Automobile <auberge.fayoum@helnan.com> 
to: Recipients <auberge.fayoum@helnan.com>
date: Mon, Aug 1, 2016 at 7:21 PM
subject: Re: revised p/i
mailed-by: helnan.com

Dear Sir,

Kindly download the revised p/i for my reference, so i can remit payment
into your account.

Best Regards

Thank you,

attachment; filename="revised PI.pdf"

MALWARE ALERT! MALWARE scam email with from Cathi Peters cathi_p@yahoo.com

DO NOT CLICK ON THE LINK IN THE .PDF FILE ATTACHED TO THIS EMAIL!  The link in the .pdf file takes you to http://gdgyaounde.org/file/PDF/PDF/login.htm and has been flagged by MULTIPLE ENGINES as containing MALWARE!

http://onlinelinkscan.com/results/gdgyaounde-orgfilepdfpdflogin-htm/

gdgyaounde.org/file/PDF/PDF/login.htm – Virus Scan Results
Link Scan Summary
    Overall result : This site may not be safe.
    PhishTank : This site is safe.
    Google Safe Browsing : This site is safe.
    WebsecurityGuard: This site is not safe.
    Google Page Rank: 0
    Alexa Rank:
    Host IP: 67.209.114.5
    File Size: 255.03 KB
    Whois Info:
Created : 2015-08-31T16:33:45Z
Data Validation : N/A
Expiration Date : 2016-08-31t16:33:45z
Registrar : TLD Registrar Solutions Ltd.
    IPInfo:
City : Chicago
Region : Illinois
Country : US
Location : 41.8745,-87.6503
Org : RockSolid Network, Inc.
ISP : AS55293 A2 Hosting, Inc.
Postal : 60607

VirusTotal.com

URL:     http://gdgyaounde.org/file/PDF/PDF/login.htm
Detection ratio:     4 / 67
Analysis date:     2016-06-21 11:44:14 UTC ( 0 minutes ago )
CRDF     Malicious site
BitDefender     Malware site
Fortinet     Malware site
SCUMWARE.org     Malware site

If you have clicked this link, run a full virus scan as soon as possible.  You can download free versions from safe websites such as https://www.malwarebytes.org/ and http://free.avg.com/us-en/homepage

from: Cathi Peters <cathi_p@yahoo.com> 
reply-to: Cathi Peters <cathi_p@outlook.com>
to: 
date: Mon, Jun 20, 2016 at 2:37 PM
subject: IMPORTANT DOUCUMENT
mailed-by: yahoo.com
signed-by: yahoo.com

Kindly receive the attachment file.

attachment; filename=invoice.pdf

MALWARE ALERT! Potential Malware scam email from Wendy Gao Pwer Plus International Trading Company Purchasing Manager kkpatti@muthoottumini.com

DO NOT OPEN THE FILE ATTACHED TO THIS EMAIL!  This .xls file contains MACROS and they want you to enable MACROS when you open the file.  DO NOT ENABLE MACROS!  If you enable MACROS your computer could be infected with MALWARE from this file! If you have opened this file, run a full virus scan as soon as possible.  You can download free versions from safe websites such as https://www.malwarebytes.org/ and http://free.avg.com/us-en/homepage

From Microsoft:

What is a macro and what is the security risk?

Macros automate frequently-used tasks; many are created with VBA and are written by software developers. However, some macros pose a potential security risk. A person with malicious intent can introduce a destructive macro, in a document or file, which can spread a virus on your computer.

Originating IP: 122.181.168.78
Originating ISP: Bharti Airtel Ltd., Telemedia Services, For Smb Cu
City: Bangalore
Country of Origin: India

from: LONGYUAN INTL CO.,LTD <kkpatti@muthoottumini.com> 
to: 
date: Thu, Mar 24, 2016 at 1:23 AM
subject: purchase order
mailed-by: muthoottumini.com

Dear sir,

Please Attached is our current purchase order, some changes were made in items
3 and 7, please take note of corrections get back to me with your PI ASAP.

We need them urgently supplied.

Warm regards,
Wendy Gao
(Purchasing Manager)
POWER PLUS INTERNATIONAL TRADING CO.,LTD
Ph.  No. 00867-51-580224, 580324
Fax No.  00867-51-521668, 580124
Office Address:901,No.501,LianQian Xi Road,Xiamen,China

attachment; filename="Contract Po.xls"

PHISHING/MALWARE ALERT! PHISHING/MALWARE scam email from Email Alert jadelhegazy@horizondoors.co www.kemenpppa.go.id/media/jusertube/mailbox/index.php

DO NOT CLICK ON THE LINK IN THIS EMAIL!  This email IS NOT FROM YOUR EMAIL PROVIDER and the link DOES NOT TAKE YOU TO YOUR EMAIL!  The link takes you to http://www.kemenpppa.go.id/media/jusertube/mailbox/index.php which is not only PHISHING for your email log-in, but may also contain MALWARE!

From VirusTotal.com:

Netcraft     Malicious site
BitDefender     Phishing site
ESET     Phishing site
Malwarebytes hpHosts     Phishing site

from: E-mail Alert <jadelhegazy@horizondoors.co> 
to:
date: Sun, Mar 13, 2016 at 5:44 AM
subject: Dear
mailed-by: horizondoors.co

Dear 

Your mailbox is almost full.

1969MB           2000MB
Current size           Maximum size

Your Mailbox Has Exceeded It Quota/Limit, And You May Not Be Able To Send Or Receive New Mails Until You Re-Validate It.

To Re-Validate, Please Click : Re-Activate to add more MB to your mailbox.

From the HTML of the email:

<A style="PADDING-RIGHT: 0px; PADDING-LEFT: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; COLOR: rgb(25,106,212); LINE-HEIGHT: 32px; PADDING-TOP: 0px; BACKGROUND-COLOR: transparent; outline-style: none; outline-width: medium" href="http://www.kemenpppa.go.id/media/jusertube/mailbox/index.php" target=_blank rel=nofollow data-mce-style="line-height: 32px; background-color: transparent; margin: 0px; outline-style: none; outline-color: invert; outline-width: medium; color: #196ad4; padding: 0px;" data-mce-href="http://bit.ly/1pxstym">Re-Activate</A>

PHISHING/MALWARE ALERT! PHISHING scam email with potential MALWARE from 514glory@hanmail.net

DO NOT CLICK ON THE LINK IN THE .PDF FILE ATTACHED TO THIS EMAIL!  The link in the .pdf file takes you to http://eol.org.pe/admin/functions/B4/accounts/index.php which has been flagged by multiple engines as being a PHISHING SITE and MALICIOUS SITE!

Per VirusTotal.com:

URL Scanner     Result
CRDF     Malicious site
Sophos     Malicious site
BitDefender     Malware site
Fortinet     Phishing site
Google Safebrowsing     Phishing site

http://www.urlvoid.com/scan/eol.org.pe/

If you have clicked this link, run a full virus scan as soon as possible.  You can download free versions from safe websites such as https://www.malwarebytes.org/ and http://free.avg.com/us-en/homepage

Originating IP: 169.159.70.2
Originating ISP: Smile Communications Nigeria
City: Lagos
Country of Origin: Nigeria

from: 영광 <514glory@hanmail.net> 
to: 514glory@hanmail.net
date: Mon, Feb 15, 2016 at 4:11 AM
subject: Swift payment
mailed-by: hanmail.net

attachment; filename="MT 103.pdf"

MALWARE ALERT! PHISHING scam email with potential MALWARE from Smith Wan Sales Excutive Cooperate Logistics Co.,Ltd jessica.escobar@legrand.us

DO NOT CLICK ON THE LINK IN THIS EMAIL!  This SCAMMER is using the identity of a legitimate company and the link in this email DOES NOT TAKE YOU TO DHL.COM!  The link takes you to http://theperfectmocha.com/shippingdocs/DHL/tracking.php?userid=email@gmail.com and has been reported by multiple engines as being a MALICIOUS LINK CONTAINING TROJAN VIRUSES!

VirusTotal.com:

URL Scanner     Result
Websense ThreatSeeker     Malicious site
BitDefender     Malware site

AegisLab     Troj.Script.Generic!c     20160203
Avast     HTML:Phishing-IC [Trj]     20160203
Kaspersky     HEUR:Trojan.Script.Generic     20160203

http://www.urlvoid.com/scan/theperfectmocha.com/

http://trafficlight.bitdefender.com/info?url=http://theperfectmocha.com

If you have clicked this link, run a full virus scan as soon as possible.  You can download free versions from safe websites such as https://www.malwarebytes.org/ and http://free.avg.com/us-en/homepage

from: Cooperate Logistics Co.,Ltd <jessica.escobar@legrand.us> 
to: 
date: Thu, Feb 11, 2016 at 5:49 AM
subject: FW: Your Shipping Documents
mailed-by: legrand.us

Shipping Documents Receiver's eMail: email@gmail.com

Greetings,

As instructed by your shipper, we have attached below the secured PDF copies of your shipping
 documents and your shipment tracking details from our international logistic partner, DHL Epress.

Click Here To View Your Documents And Shipment Tracking Details:  www.dhl.com/documents/0094325.pdf

At Co-Logistics we offer best Service Delivery Commitment with shipper & client.

*´¨)
 ¸.• ´¸.•*´¨) ¸.•*¨)
 (¸.•´ (¸.•'* Best Regards
                  (¸.•'* .•*´¨)
Smith Wan               *
                                 (¸.•'*
Sales Excutive

Cooperate Logistics Co.,Ltd
************************


Head Office
Rm 2401-2502,Guidu Bld, Chungfeng Rd,
Luohu, Shenzhen, China
Phone: (86) 755 88863799
Email: info@co-logistics.com
URL:   www.co-logistics.com

Image result for Carrier: DHL FedEx UPS TNT

Ce message, ainsi que tous les fichiers joints à ce message, peuvent contenir des informations sensibles et/ ou confidentielles ne devant pas être divulguées. Si vous n'êtes pas le destinataire de ce message (ou que vous recevez ce message par erreur), nous vous remercions de le notifier immédiatement à son expéditeur, et de détruire ce message. Toute copie, divulgation, modification, utilisation ou diffusion, non autorisée, directe ou indirecte, de tout ou partie de ce message, est strictement interdite.
Se désabonner: Si vous souhaitez être retiré de notre liste de diffusion, s'il vous plaît envoyer vos coordonnées à CASL.unsubscribe@legrand.ca et indiquer quels sont les messages que vous ne souhaitez plus recevoir.

This e-mail, and any document attached hereby, may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized, direct or indirect, copying, disclosure, distribution or other use of the material or parts thereof is strictly forbidden.
Unsubscribe: If you would like to be removed from our mailing list, please send your contact information to CASL.unsubscribe@legrand.ca and indicate what messages you no longer wish to receive.

From the source code of the email:

<a href="http://theperfectmocha.com/shippingdocs/DHL/tracking.php?userid=email@gmail.com"><img height="46" src="http://pdftribute.net/pdf-icon.png" width="67">www.dhl.com/documents/0094325.pdf</a>

MALWARE/PHISHING ALERT! Malware Phishing scam email from user@chem.kyushu-univ.jp www.yaamiindia.com/B/accounts/index.php

DO NOT CLICK ON THE LINK IN THIS EMAIL!  This email IS NOT FROM YOUR EMAIL PROVIDER!  The link in the email takes you to http://yaamiindia.com/B/accounts/index.php and has been identified by MULTIPLE engines as being a PHISHING website that may contain MALWARE harmful to your computer!

Virustotal.com

Netcraft     Malicious site
Opera     Malicious site
Sophos     Malicious site
BitDefender     Malware site
Fortinet     Phishing site
Google Safebrowsing     Phishing site

http://trafficlight.bitdefender.com/info?url=http://yaamiindia.com

Stop! This website is not safe
This website contains malware that may harm your computer
This website contains elements classified as malware: software that can harm your computer or operate without your consent. Visiting a site that contains malware can infect your computer.
This website is classified as phishing
This website is classified as a phishing website. It is associated with attempts to acquire sensitive information such as user names, passwords and credit card details by masquerading as a trustworthy entity. You should not enter confidential information on this website.

https://www.google.com/transparencyreport/safebrowsing/diagnostic/index.html#url=yaamiindia.com

Current status:
Dangerous
yaamiindia.com contains deceptive content.
Site Safety Details
Attackers on this site might try to trick you to download software or steal your information (for example passwords, messages, or credit card information).
Testing details
We last updated our information about yaamiindia.com on December 8, 2015.
This website is hosted on 1 AS:
AS16276 (OVH)

If you have clicked this link, run a full virus scan as soon as possible.  You can download free versions from safe websites such as https://www.malwarebytes.org/ and http://free.avg.com/us-en/homepage

Originating IP: 169.159.121.59
Originating ISP: Smile Communications Nigeria
City: Lagos
Country of Origin: Nigeria

from: E-MAIL <user@chem.kyushu-univ.jp> 
to: 
date: Mon, Nov 30, 2015 at 11:32 PM
subject: VALIDATE
mailed-by: chem.kyushu-univ.jp

Dear User,

Your account will be Shutdown & Closed Down today

To retain your account, kindly Cancel Request to continue using our services.

CANCEL & STOP REQUEST NOW

© Thanks