Spam Mega Thread

Ctrl Alt Del

I'll start the first post but i will leave @syklops to open it

Just got this today,i should be very happy :


CONFIRM YOUR PRIZE!!!

This email is to notify you that you have won an Award Sum of
979,650.90€uros in Euro million email lottery held on the 06/08/2014.

Please contact the Payment Director with your winning info: REF NUM. (No:
GFC8110/3740) BATCH NUM. (HOL04-R591/XB30) WINING
NUM.(NJP8182-131),Ticket Number: (0031-43650210) Lucky Number SPL
(501/02658)Kindly send the following to the below contact for
easyidentification/timely consideration:

1. Full Name:2. Direct phone:3. Date of Birth / Age:4. Occupation:5. Current
Address (P.o Box not acceptable)By contacting:-

Contact Name: Ken Lawson
Email: eumlot@aol.com

The Euro million email lottery is lawfullfully sponsored by the
MicrosoftCorporation and is registered and protected by the Benelux
trademark law.

Please note that the validity period of these winning is 21 working
days;hence
you are expected to make your claims immediately. Any claim not madebefore
this date will be transfer to the suspense vault of the
SpanishGamingBoard.
Congratulations!!!
Sincerely yours,
Mrs brown (Dr)
Director of Operation

KoolKid

A fairly obvious one claiming to be BOI..


Bank of Ireland safeguards your account when there is a possibility that someone other than you tried to Sign On .
For your security , we have temporarily prevented access to your account.

Restore your account here :

http://www.xyjiwei.gov.cn/www2.3.6.5.boionline.365.bank.com.online.authentication.activateFlow.bns.convid.13621466/index.html

syklops

Ctrl Alt Del wrote: »

I'll start the first post but i will leave @syklops to open it

I was waiting for a good one...

Dude111

Ctrl Alt Del wrote:

This email is to notify you that you have won an Award Sum of
979,650.90€uros in Euro million email lottery held on the 06/08/2014.

Congrats on your win!!!!!!

I have "won" also many times!! (uugghh)

KoolKid

Anyone getting any of these lately?


E-ZPass
Service Center


Dear customer,

You have not paid for driving on a toll road. This invoice is sent repeatedly,
please service your debt in the shortest possible time.

Get Invoice




Terms & Conditions | Site Map | Privacy Policy | Phishing Policy 2014 E-ZPass

Dude111

Hehe shame on you KOOLAID for not paying your toll!!

Click that link now and get your invoice

Chance The Fapper

Done deal are selling addresses, I wonder is that the source for the tolls one?

KoolKid

Might just email them back my cc details, sure that would be handier

KoolKid

This e-mail has been sent to you to inform you that we were unable to process your most recent payment.

Please check attached file for more detailed information on this transaction.

Pay To Account Number: **********56
Due Date: 20/05/2014
Amount Due: 940.48

IMPORTANT: The actual delivery date may vary from the Delivery by date estimate. Please make sure that there are sufficient available funds in your account to cover your payment
beginning a few days before Delivery By date estimate and keep such funds available until the payment is deducted from your account.

If we fail to process a payment in accordance with your properly completed instructions, we will reimburse you any late-payment-related fees.

Copyright HSBC 2013. All rights reserved. No endorsement or approval of any third parties or their advice, opinions, information, products or services is expressed or implied by any information on this Site or by any hyperlinks to or from any third party websites or pages. Your use of this website is subject to the terms and conditions governing it. Please read these terms and conditions before using the website..

KoolKid

And another regular
This is an automated email, please do not reply

Dear PayPal User
Warning ! : You Must Confirm Your Information!

Please click on the following link to Confirm It:

Click here to Confirm Your Account Information.

You Must Confirm Your Information To Save It .

Thanks You For Helping,
The PayPal Team

Need Assistance?
We're happy to help by phone at 1-514-748-5774, Monday to Friday 9:00am to 5:00 pm EST, or by email
Copyright 2014. All rights reserved. PayPal

Email ID: 15464

Chance The Fapper

What do you be signing up to that's getting you all this spam? :P

eddiehen

Mail from bogus open24 with a link to a phishing page...

Which is so true to the website it has the picture saying "Permanent TSB will never text or email you... ..asking you to log into your account"

Dude111

KOOLAID,

Post the links they are giving you,we will gladly fill out thier forms!














WITH BOGUS DATA

RainyDay

Not quiet spam, but I was surprised to get an email from 7dayshop within an hour or so or visiting their site for the purposes of this post. I didn't login during that visit. I made one purchase from them years ago, but I'm certain that I've reinstalled my OS since then, so I'm not sure how a cookie would link my visit to my email address.

So is it coincidence, or have they some way of linking my recent visit to my previous transaction & email?

Fred Swanson

This post has been deleted.

timmywex

RainyDay wrote: »

Not quiet spam, but I was surprised to get an email from 7dayshop within an hour or so or visiting their site for the purposes of this post. I didn't login during that visit. I made one purchase from them years ago, but I'm certain that I've reinstalled my OS since then, so I'm not sure how a cookie would link my visit to my email address.

So is it coincidence, or have they some way of linking my recent visit to my previous transaction & email?

Or have your browser synched across multiple devices - for example if you use chrome and you are logged in

RainyDay

Fred Swanson wrote: »

This post has been deleted.

No, dynamic IP from a domestic BB provider.

timmywex wrote: »

Or have your browser synched across multiple devices - for example if you use chrome and you are logged in

I don't explicitly synch across devices. I would be logged in to my gmail account within the browser all right, but surely it's not picking up my login from a different browser tab?

Rucking_Fetard

Why do Nigerian Scammers Say They are from Nigeria?

False positives cause many promising detection technologies to be unworkable in practice. Attackers, we show, face this problem too. In deciding who to attack true positives are targets successfully attacked, while false positives are those that are attacked but yield nothing.

This allows us to view the attacker's problem as a binary classification. The most profitable strategy requires accurately distinguishing viable from non-viable users, and balancing the relative costs of true and false positives. We show that as victim density decreases the fraction of viable users than can be profitably attacked drops dramatically. For example, a 10× reduction in density can produce a 1000× reduction in the number of victims found. At very low victim densities the attacker faces a seemingly intractable Catch-22: unless he can distinguish viable from non-viable users with great accuracy the attacker cannot find enough victims to be profitable. However, only by finding large numbers of victims can he learn how to accurately distinguish the two.

Finally, this approach suggests an answer to the question in the title. Far-fetched tales of West African riches strike most as comical. Our analysis suggests that is an advantage to the attacker, not a disadvantage. Since his attack has a low density of victims the Nigerian scammer has an over-riding need to reduce false positives. By sending an email that repels all but the most gullible the scammer gets the most promising marks to self-select, and tilts the true to false positive ratio in his favor.

oscarBravo

I thought this one at least had the benefit of being somewhat original:

am Mr. Nasser Omar from United Arab Emirates (UAE) seeking for your partnership in a very lucrative project to be invested in your country. Reply me if you are interested for further information.

Kind regards

---

Tб mй an tUasal Nasser Omar у Aontas na nЙimнrнochtaн Arabacha (UAE) a lorg do chomhphбirtнocht sa tionscadal an-brabъsaн a infheistiъ i do thнr fйin. Freagra a thabhairt dom mб tб suim agat chun tuilleadh eolais agat.

Cineбl Maidir

The machine translation to Irish is a nice touch; shame about the character encoding.

KoolKid

Worst worded one I have ever seen.....

ATTN: SIR,

WE WANT TO INFORM YOU THAT WE ARE TRY TO CALL YOU TO PICK UP YOUR FUNDS OF
£1,488,569.13 TODAY BECAUSE YOUR FUNDS WAS RELEASE TO YOU BY THE UK
INTERNATIONAL LAURYNTO,IF YOU ARE READY TO COLLECT YOUR FUNDS AND WE ARE
READY TO SEND YOUR INFORMATION TO YOU TO COLLECT YOUR FUNDS AS SOON AS
POSSIBLE.

EXPECTING YOUR IMMEDIATE RESPONSE.

REGARDS,

DR BARRY GROOT
+31 61 77 446 50

Rucking_Fetard

But hes a doctor....must be legit?

Kinet1c

KoolKid wrote: »

Worst worded one I have ever seen.....

ATTN: SIR,

WE WANT TO INFORM YOU THAT WE ARE TRY TO CALL YOU TO PICK UP YOUR FUNDS OF
£1,488,569.13 TODAY BECAUSE YOUR FUNDS WAS RELEASE TO YOU BY THE UK
INTERNATIONAL LAURYNTO,IF YOU ARE READY TO COLLECT YOUR FUNDS AND WE ARE
READY TO SEND YOUR INFORMATION TO YOU TO COLLECT YOUR FUNDS AS SOON AS
POSSIBLE.

EXPECTING YOUR IMMEDIATE RESPONSE.

REGARDS,

DR BARRY GROOT
+31 61 77 446 50

Your reply should read:

I am Groot!

Rucking_Fetard

Kinet1c wrote: »

Your reply should read:

I am Groot!

Groot

First time I saw your post I was like , just googled it there. Never heard of it.

Anywho.

What to Do If You’ve Been Hacked (And How to Prevent It)

One of the better articles on this. More in it. May aswell put it in here.

Dude111

KoolKid wrote:

EXPECTING YOUR IMMEDIATE RESPONSE.

Ya right....... (Not the response they want!!)

Hotblack Desiato

Just got a suspicious looking email from Revenue, which appears to be legit. :rolleyes:

KoolKid

Worst one I have ever read....

Hello PayPal customer,

We are sorry to inform you that you can not access all your paypal advantag es like sending money and purchasing,due to account limitation .

Why my account PayPal is limited?
Because we think that your account is in danger from stealing and unauthori zed uses .

What can I do to resolve the problem?
You have to confirm all your account details on our secure server by click the link bellow and following all the steps

madmaggie

KoolKid wrote: »

Worst one I have ever read....

I got a version of this in my email today, the grammar and spelling mistakes are hilarious. Do they think we all live under rocks, so obvious. :rolleyes:

SIX PACK

Anyone hear of this Company Tenjin & Associates. Japan. they have informed me that my current share value is $177,000 & to release the money I must send them $7800. I got a couple of Emails & phone calls by a person calling himself Samuel Booth.
I invested €2000 in Pacific International 10 years ago but their worth nothing.

Vinculus

I've just received three emails, one from Flyby and two from cheapo air with booking confirmation and flight itinerary to fly from Aberdeen to London.
I'm a bit freaked by these as they look very legit.

Has anybody received mails from them?

Fingers crossed it just very sophisticated spam.

FSL

Check the headers the emails will not have originated in the UK.

Vinculus

Thanks FSL for responding.

I'm checking the headers of the mails now and I'm not seeing any other location other than the Uk.
I'm used to receiving and dealing with spam but these three mails arrived within moments of each other. Starting with flight confirmation, then a booking receipt and finally a ticket number.
They looks so much like the real thing, I'm worried they might be.

Blowfish

Vinculus wrote: »

Thanks FSL for responding.

I'm checking the headers of the mails now and I'm not seeing any other location other than the Uk.
I'm used to receiving and dealing with spam but these three mails arrived within moments of each other. Starting with flight confirmation, then a booking receipt and finally a ticket number.
They looks so much like the real thing, I'm worried they might be.

Would contacting the company by phone not be the easiest way to check it's legitimacy?

Vinculus

Easier said than done, I would imagine. I'll go that route if I have to.

Vinculus

I just got in touch with the company and they confirmed that it was indeed spam.
Thanks for the suggestion Blowfish.

Ctrl Alt Del

Began getting emails with Apple ID...never ever owned an Apple product but they don't know that!
Sent an email over to Peats,asking for information how my email landed on a spam list.

Subject:

Apple ID Expired ✔

Headers:

Received: from gmy2-mh.smtproutes.com (94.186.192.15) by
email.myserver.lan with Microsoft SMTP Server id 8.1.240.5;
Tue, 8 Dec 2015 10:22:03 +0000
X-Katharion-ID: 1449570112.99878.gmy2-mh828 (unfiltered-unk)
Return-Path: <admin_upl@costumers.com>
Received: from seevent.ch ([46.163.71.158]) by gmy2-mh.smtproutes.com
[(94.186.192.15)] with ESMTP via TCP; 08 Dec 2015 10:21:52 +0000
Received: from [151.236.58.219] ([127.0.0.1]) by seevent.ch with hMailServer ;
Tue, 8 Dec 2015 04:53:40 +0100
From: Apple <Appie_meinfo@cotumers.com>
To: "peats2011" <peats2011@mydomain.lan>
Subject: Apple ID Expired =?UTF-8?Q?=E2=9C=94_?=
Message-ID: <fa030bcb57f4be468602bbc8958749b3@ID15362>
Date: Tue, 8 Dec 2015 03:52:38 +0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_9BD889C8.61F5F84C"
X-Priority: 3
X-Mailer: Microsoft Office Outlook 12.0
X-hMailServer-Spam: YES
X-hMailServer-Reason: The host name specified in HELO does not match IP address.

Link in the email,DO NOT OPEN OR CLICK:

[url]httpx://redirectedme.tantes.ns11-wistee.fr/cgi-bin/connectvrif1.php[/url]

Hotblack Desiato

Would be safer to put hxxp or similar in the link to make it non-clickable but still obvious where it goes.

Treepole

I got a fairly sophisticated "Eir" phishing email earlier.

It used the following wording:

Dear Customer,
We experienced an overnight nationwide outage that impacted our broadband customers from approximately 1:30am to 3:00am. The cause of this issue is currently unknown and remains under investigation.

As a security measure some of your information need to be updated before you can continue with our services please login to my eir (malicious link) and follow the instruction to update your account.

Thank you for your patience during this time and apologies for the inconvenience.
eir care
This is an automated email so please do not reply to it as you will not receive a response.


The email was fully branded and the above wording (with the addition of the line about logging into your account) is taken from a legitimate notice sent out by Eir of the 20th of May.

AnCatDubh

not sure if it is a new one (i think i've seen a variant of it before).

---

---

Being delivered through the eircom.net mail servers too.

ItHurtsWhenIP

AnCatDubh wrote: »

not sure if it is a new one (i think i've seen a variant of it before).

---

---

Being delivered through the eircom.net mail servers too.

Yep, it's new. The ISC flagged it up today.

rolion

Linkedin hacked again!??

Go an email to my dedicated and unique linkedin email address wih Bank of Ireland content ! Very strange !







Received: from

Wed, 24 Aug 2016 11:22:14 +0100
Return-Path: <msprvs1=17044d0x7lva1=bounces-77338@bounce.fntv.com>
Delivered-To:
Received: (qmail 28236 invoked by uid 399); 24 Aug 2016 11:20:05 -0000
Delivered-To: linkedin
Received: (qmail 28230 invoked by uid 399); 24 Aug 2016 11:20:05 -0000
Received: from unknown (HELO mta53a.sparkpostmail.com) (54.244.48.130)
(de-)crypted with TLSv1: DHE-RSA-AES256-SHA [256/256] DN=unknown by
mail1.myisp.ie with ESMTPS; 24 Aug 2016 12:20:05 -0000
X-Originating-IP: 54.244.48.130
Received-SPF: pass (mail1.myisp.ie: SPF record at _spf.sparkpostmail.com designates 54.244.48.130 as permitted sender)
identity=mailfrom; client-ip=54.244.48.130;
envelope-from=<msprvs1=17044d0x7lva1=bounces-77338@bounce.fntv.com>;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fntv.com;
s=scph0816; t=1472041188; i=@fntv.com;
bh=ga8atk7QEsB9WZQGUEnmDZZs09FVl/SzT8ZqLX+Xt28=;
h=Reply-To:From:To:Subject:Date:List-Unsubscribe:List-Id;
b=DQVmdTvDUqnA/GK6Pqu3ewvEVhVRfEM0WNYJVBNPddTyNhmafTwpVvLso46CPrTgC
So1iBA4VVss/W3WXcW9huTaT9RZyQHO7WeX8GO3XDT/kA+6kIfHDkvlqWzZLZsBLR2
rFrXQYaJ4ouuRiIiyKrx7pc3mB7CZfJd7bQA5AnY=
X-MSFBL: bEbD7POqYWg71xy+GmfSu/xCdYWQYPcrGZEkZqkA1/s=|eyJ0ZW5hbnRfaWQiOiJ
zcGMiLCJnIjoiYmdfbmV3Iiwic3ViYWNjb3VudF9pZCI6IjAiLCJpcF9wb29sIjo
ic2hhcmVkIiwibWVzc2FnZV9pZCI6IjAwMDFlMzkwYmQ1NzIxMTAxMDgzIiwicmN
wdF90YWdzIjpbIF0sInNlbmRpbmdfaXAiOiI1NC4yNDQuNDguMTMwIiwidGVtcGx
hdGVfaWQiOiJzbXRwXzMwMzYyMTUxMzMxODQ1NjIxIiwicmNwdF9tZXRhIjp7fSw
iZnJpZW5kbHlfZnJvbSI6InBvc3RtYXN0ZXJAZm50di5jb20iLCJyIjoibGlua2V
kaW5fMjAxNEBjdHJsYWx0ZGVsZXRlLmllIiwiY3VzdG9tZXJfaWQiOiI3NzMzOCI
sInRyYW5zbWlzc2lvbl9pZCI6IjMwMzYyMTUxMzMxODQ1NjIxIiwiaXBfcG9vbF9
yYXciOiJuZXciLCJiIjoiaXBfNTQuMjQ0LjQ4LjEzMCIsInRlbXBsYXRlX3ZlcnN
pb24iOiIwIn0=
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset="iso-8859-1"
Authentication-Results: momentum3.platform1.us-west-2.aws.cl.messagesystems.com smtp.user=smtp_injection; auth=pass (LOGIN)
Received: from [188.212.109.10] ([188.212.109.10:57334] helo=fntv.com) by
momentum3.platform1.us-west-2.aws.cl.messagesystems.com (envelope-from
<msprvs1=17044d0x7LVA1=bounces-77338@bounce.fntv.com>) (ecelerity
4.2.24.56718 r(Core:4.2.24.5)) with ESMTPSA (cipher=AES256-SHA) id
01/38-04129-3E09DB75; Wed, 24 Aug 2016 12:19:48 +0000
Reply-To: postmaster@fntv.com
From: Bank of Ireland 365 Online <postmaster@fntv.com>
To: first_email.ie, second_email.ie,
linkedinXXX
Subject: 3D Secure Service Disabled linkedin_myemail
Date: Wed, 24 Aug 2016 12:19:46 +0200
Message-ID: <20160824141945.ECE08F0D1A@fntv.com>
MIME-Version: 1.0
List-Unsubscribe: <mailto:unsubscribe@unsub.spmta.com?subject=unsubscribe:2IFt0wN5kKeoz3MXqh22grMueNwrlman2KwoazqbJM4~|eyAicmNwdF90byI6ICJsaW5rZWRpbl8yMDE0QGN0cmxhbHRkZWxldGUuaWUiLCAicmNwdF9tZXRhIjogInt9IiwgInJjcHRfdGFncyI6ICJbIF0iLCAiZnJpZW5kbHlfZnJvbSI6ICJwb3N0bWFzdGVyQGZudHYuY29tIiwgInRlbXBsYXRlX2lkIjogInNtdHBfMzAzNjIxNTEzMzE4NDU2MjEiLCAibWVzc2FnZV9pZCI6ICIwMDAxZTM5MGJkNTcyMTEwMTA4MyIsICJzZW5kaW5nX2lwIjogIjU0LjI0NC40OC4xMzAiLCAidGVtcGxhdGVfdmVyc2lvbiI6ICIwIiwgIm1haWxmcm9tIjogIm1zcHJ2czE9MTcwNDRkMHg3TFZBMT1ib3VuY2VzLTc3MzM4QGJvdW5jZS5mbnR2LmNvbSIsICJpcF9wb29sIjogInNoYXJlZCIsICJpcF9wb29sX3JhdyI6ICJuZXciLCAiY3VzdG9tZXJfaWQiOiAiNzczMzgiLCAic3ViYWNjb3VudF9pZCI6ICIwIiwgInRlbmFudF9pZCI6ICJzcGMiLCAidHJhbnNtaXNzaW9uX2lkIjogIjMwMzYyMTUxMzMxODQ1NjIxIiB9>

2RockMountain

rolion wrote: »

Linkedin hacked again!??

Go an email to my dedicated and unique linkedin email address wih Bank of Ireland content ! Very strange !

Why 'again'? Could they have got your email from the hack a few months back?

rolion

2RockMountain wrote: »

Why 'again'? Could they have got your email from the hack a few months back?

That email,before hack,was _2012.I created a new email with _2014 in the name field.
So,how the 2014 created email got in the spammers database !???

Even more...yesterday i got an email from Netflix inform me that i failed to renew my never had service... AND at the same email.
Send an email to GoDaddy as the domain "@fntv&quot; is registered with them.

Peculiar world of IT...