Scam Got a Scam/Spam or Phish in my junk or normal mail box (Mega Thread)

[Malware1]

Title: HMRC - Error in the calculation of your tax‏
Link: "My Refvund" - VirusTotal
Payload (site down): p.exe - VirusTotal

The "My Refvund" shows this before getting redirected to the payload, but the site is no longer up.
View attachment 11122

Dear Customer :

HM Revenue & Customs has identified an error in the calculation of your tax from the last payment, amounting to GBP 1.400. To return the excess payment, please click the " My Refund" below:

My Refvund

How to return itself, have not changed. Only the format of what you claim and how you get paid back from HMRC has changed digitally. HMRC Department has trouble to return it through the data you give on the Tax application form.

We are here to Ensure the correct tax is paid at the right time, whether this relates to payment of taxes received by the department or entitlement to benefits paid.

Best Regards,
HM Revenue & Customs Department

View email with graphics:

View attachment 11121

This one was available in one of my packs.

 

[Ink]

I just sent the email.

 

[Malware1]

I just sent the email.

Thanks. The sample will be available in the next pack.

 

[Ink]

No Apple account for me.

 

[Ink]

Phishing Email: Your Online Access has been temporarily disabled

Suspicious URL: ( some url ) . com/err_log/sub/activate.html

[/COLOR]

 

[Ink]

Title: You have 4 messages that must be viewed
Scam: View 4 messages
Sender: (see image)

 

[Ink]

SPAM: Shipment delivery problem #(insert numbers) by FedEx SmartPost
Details: http://www.microsoft.com/security/p...anDownloader:JS/Nemucod.D&threatid=2147690621
VirusTotal: 1 of 54

 

[Malware1]

SPAM: Shipment delivery problem #(insert numbers) by FedEx SmartPost
Details: http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=TrojanDownloader:JS/Nemucod.D&threatid=2147690621
VirusTotal: 1 of 54

View attachment 44137

Can you PM me the link?

Edit: submitted

 

[Ink]

Edit: submitted

Only 15/56 on VT. Not flagged by Bitdefender?

 

[Cain]

No offense intended against anyone, but I'll bet a weeks wage this comes from India.
The joys of a public facing email account...

 

[Ink]

WhatsApp Messenger - New Voicemail 10:25PM

 

[Rishi]

Got this phising attempt in one of my junk mailboxes twice, involving PayPal asking me to "continue replacing my security information".It is interesting to note they have used PayPal banner in the email but the link is not only suspicious but redirects to a hosted webpage which looks like a spoofed copy of PayPal without the secure padlock of course!(.php).The scammer does not know I don't use PayPal anyways. See below :

Phising Attempt : To continue replacing your security information, click the button

URL redirects to : some url.com..../modules/navigator/auth/




Virustotal scan results: Seems like a new site


Remedial measures taken : Duly reported to paypal ,US-Cert and APWG.

too bad they don't know I am a MT user.

 

[Deleted Member 333v73x]

I got something similar on Skype, somebody put in a very long paragraph - somebody with the same second name as me has died and the person who said it claimed he worked for a bank in India trying to find the heir to his millions. It looked very professional (with a VPN obviously) I replied saying can you show me some ID? and then he (in slang and using 'u' instead of 'you') give me your e-mail. I used a masked one and still recieved nothing. I again said give me some ID and he just said give our bank £900 via a P.O Box and then we will tell you where to go and give you the millions you deserve

What I did:

1. Found his IP and sent it to all the authorities I could.
2. Reported him to Skype.
3. Blocked him.

Please don't ignore these scammers! People are losing hard earned money because of these false claims, report them!

 

[Rishi]

Got this scam mail in one of my junk email inbox. As you can see the sender's email is a big hint, secondly I am not subscribed to secret shopper(never heard of it).

Upon checking the email header online at several sites to confirm,we find the source :

Obviously it is a scam email and has been flagged as phising. The company involved has also been notified.

 

[Morvotron]

Ugh, I receive like three or four on my secondary account each week.. It's so pathetic. I mean why would they give you 80 millions dollars? Everybody knows a decent person won't accept less than 100mil.

 

[Ink]

Flagged by Spam Filters in Gmail.

Dear Sir,

My name is Mr. Fekete Sandor Istvan, I hope my mail meets you in good faith. I work as a sailor executive/ Chief Engineer with JPY Worldwide Shipping Company here in the UK, and i'm usually in the ship almost all the time, JPY Worldwide is a very big company with large services Nationwide.

However, my main aim of contacting you is because my company is about to embark into buying of a Maintenance Oil which is mainly distributed from South East Asia market (Malaysia) for our ship services and maintenance.

I need a reliable individual or friend from any part of the world that can handle this project which will be a one year contract of interval supplies. I have made the necessary researches and arrangement on this transaction. I wish to intimate you into making this supply if you will accept my conditions. I will give you the full information's if i find you interested by replying to me. I have included my email address (<removed>@hotmail.com) so that we can be in contact immediately after you read and understood this summary of supply proposal

I Hope to hear from you soon.

Best Regards,
Mr. Fekete Sandor Istvan

 

[Kalashnikov]

I, too, once or twice I got this e-mail, report it,block and delete.Simple rule of never click on attachments ..

 

[_CyberGhosT_]

@Huracan
I would have got pissed about the crappy grammar halfway through and deleted this anyway
Have you noticed that nearly all spam now appears written by individuals with very poor grammar ?

 

[Ink]

Not exactly junk mail, but I stumbled across this a couple months ago. It's quite convincing to destroy the reputation of Qihoo, oh wait, they do that to themselves.

 

[Kalashnikov]

Impersonating a well-known brands virus is already known for many years,and it is on Windows and Android ...