Advert.

Do NOT tell your scammer he is posted here, or report their accounts as it puts others at risk!

Phishers impersonating Google / Gmail

DO NOT click on any links in these emails.

googleclaimunit@yandex.com

Unread postby SlapHappy » Fri Jan 22, 2016 9:29 pm

* 199.180.114.139 Onthefly Poland United States

Return-Path: <dammam@etisal.com.sa>
Received: from User (199.180.114.139) by Exchange.etisal.com.sa
(192.168.17.252) with Microsoft SMTP Server id 8.3.389.2; Fri, 22 Jan 2016
23:22:58 +0300
Reply-To: <googleclaimunit@yandex.com>
From: Google PROMO <dammam@etisal.com.sa>
Subject:
Date: Fri, 22 Jan 2016 10:21:30 -0800
To: Undisclosed recipients:;
Return-Path: dammam@etisal.com.sa




Attn: Winner'

Your e-mail address has been randomly selected as Google Winner for 2016 Google New Year AWARD.

Please view attached PDF file for More "DETAIL".

Yours faithfully,

Lawrence "Larry" Page
Co-founder and CEO of Google Inc™



Disclaimer: This email and any files transmitted with it are confidential and intended solely for the use of the addressee(s) named herein. If you are not the intended recipient or addressee, you should not use, disseminate, distribute, copy or alter this email and its contents, partially or entirely, and you are kindly requested to notify the sender and delete it immediately.
Any views or opinions presented in this email are solely those of the author and might not represent those of "Etisal International Company".
Although Etisal has taken reasonable precautions to ensure no viruses are present in this email, Etisal cannot accept responsibility for any loss or damage arising from the use of this email or its attachments.

Attachments area
Preview attachment Google Active User.pdf
[PDF]
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

"Google Verification.html" <noreply@box.com>

Unread postby SlapHappy » Mon Feb 01, 2016 5:19 pm

* 208.76.63.251 Dynamic Network Services Wilmington United States

Return-Path: <bounces+xxx@mailer.box.com>
Received: from mtaout-63251-pao.mailer.box.com (mtaout-63251-pao.mailer.box.com.
[208.76.63.251])
by mx.google.com with ESMTPS id x77si5561745pfa.33.2016.02.01.01.38.34
for xxx
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Mon, 01 Feb 2016 01:38:34 -0800 (PST)
Received-SPF: pass (google.com: domain of bounces+xxx@mailer.box.com designates
208.76.63.251 as permitted sender) client-ip=208.76.63.251;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of bounces+xxx@mailer.box.com
designates 208.76.63.251 as permitted sender)
smtp.mailfrom=bounces+xxx@mailer.box.com;
dkim=pass header.i=@box.com;
dkim=pass (test mode) header.i=@dynect.net;
dmarc=pass (p=REJECT dis=NONE) header.from=box.com
DKIM-Signature:
DKIM-Signature
To: xxx
Subject: Google Verification.html sent you a file on Box
From: "Google Verification.html" <noreply@box.com>
Sender: xxx.xxxxx.08@bk.ru
Reply-To: <noreply@box.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="generic-=_t4eobXHGrcp8RHzaT47Ka5G2LtmhmrBjq"
Accreditor: Habeas
X-Habeas-Report: Please report use of this mark in spam to http: //www.habeas.com/report/
X-DynectEmail-Msg-Key: 20160201093812.000000a4e2c9@mail6-38-us ... dyndns.com
Message-Id: <20160201093812.1BE7B9A04C1@content1033.ve.box.net>
Date: Mon, 1 Feb 2016 01:38:12 -0800 (PST)
X-DynectEmail-Msg-Hash
X-DynectEmail-X-Headers:
X-Feedback-ID: Qm94VExTVk1UQXM=:317488:183492:dyn06




GV
Google Verification.html (xxx.xxxxx.08@bk.ru) has sent you a file:
Google Verification.html

View File
https:/ /cle2.box.com/s/jbu9tuzhz162s0j7zxojjqn9mhqffnaa

Get our app to view this on mobile

"Dear Gmail User,
For Your information, Sign in to the Your Google Account And Verification Attachment Send to you Within 24hrs . Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043

You received this mandatory email service announcement to update your account about important changes to Google services or your Google Account.
"
Box © 2016
About Box • Privacy Policy • Edit Notification Settings • 4440 El Camino Real, Los Altos, CA 94022, USA
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

Google gbeardom_1953@periphman.com

Unread postby firefly » Sat Feb 20, 2016 8:45 pm

Email:

Google


You have deferred message.

View messages. - phishing link : http:/ /zenconfeitaria. com.br/wp-content/plugins/revslider/temp/internals.php

Cordially
Google support

This message was sent to xxx@gmail.com; Don't want occasional updates about Google activity and friend suggestions? Change what message Google sends you. Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043 USA


Return-Path: <gbeardom_1953@periphman.com>
Received: from s16997122.onlinehome-server.info (s16997122.onlinehome-server.info. [87.106.251.80])
by mx.google.com with SMTP id ta9si13971236pab.92.2016.01.27.20.22.17
Received-SPF: neutral (google.com: 87.106.251.80 is neither permitted nor denied by best guess record for domain of gbeardom_1953@periphman.com) client-ip=87.106.251.80;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 87.106.251.80 is neither permitted nor denied by best guess record for domain of gbeardom_1953@periphman.com) smtp.mailfrom=gbeardom_1953@periphman.com
X-Priority: 1
MIME-Version: 1.0
Succession-Priory-Hillsides: 26DC7FE62E
From: Automation Google Notify <gbeardom_1953@periphman.com>
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=UTF-8
Message-ID: <d17ae.3ed7-a6eaf22@periphman.com>
Subject: Caution You have deferred messages conjuring

Originating IP: 87.106.251.80
Originating ISP: 1&1 Internet Ag
Country of Origin: Germany
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Google Support drh@slami-aamipi.com

Unread postby firefly » Sat Feb 20, 2016 9:14 pm

Email:

Google Support
xxx@gmail.com
Kendall Price (Google Support) just sent you a message:

Message status: undeliverable.
More information
View messages
This message was sent to xxx@gmail.com.
Don't want occasional updates about Google activity? Change what email Google Team sends you.


Phishing link hidden inside the message: http:/ /moodesignproducts. com/moodesignproducts/stump.php

Header:

Return-Path: <drh@slami-aamipi.com>
Received: from s18124797.onlinehome-server.info (s18124797.onlinehome-server.info. [87.106.233.105])
by mx.google.com with SMTP id 22si41252035pfp.196.2016.01.31.13.20.19
Received-SPF: neutral (google.com: 87.106.233.105 is neither permitted nor denied by best guess record for domain of drh@slami-aamipi.com) client-ip=87.106.233.105;
Subject: Incoming messages
From: Google <drh@slami-aamipi.com>
Reply-To: no-reply <drh@slami-aamipi.com>
Freshest-Claremont-Preventable: ypsilanti
Breach-Flog-Pie: 9E68D8275F3
Content-Transfer-Encoding: 7bit
Battlefronts-Joplin: 45cad1ce2d411a
Insomnia-Sorensen-Intercity: defense
Content-Type: text/html; charset=UTF-8
MIME-Version: 1.0

Originating IP: 87.106.233.105
Originating ISP: 1&1 Internet Ag
City: Munich
Country of Origin: Germany
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Google detambled@os2bbs.com

Unread postby firefly » Sat Feb 20, 2016 9:23 pm

Email:

Google
Hi xxxs,

You have new notifications.

Broken message was restored and re-sent to you.
View 2 messages
We hope you found this message to be useful. However, if you'd rather not receive future e-mails of this sort, please opt-out here.


Phishing link hidden in the content of the message: http:/ /djmagui. com.br/sinfulness.php

Header:

Return-Path: <detambled@os2bbs.com>
Received: from s16985825.onlinehome-server.info (s16985825.onlinehome-server.info. [87.106.245.192])
Subject: Broken message was restored and re-sent to you
X-Priority: 1
Displayed-Grottos-Restrainers: 44528
Discontinuity-Breathed: escherichia
Jacksonian-Denied: methodologies
From: "Gmail" <detambled@os2bbs.com>
Content-Type: text/html; charset=ISO-8859-1
Remarkableness-Cloudy: retirements
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
Story-Compile: EE651755

Originating IP: 87.106.245.192
Originating ISP: 1&1 Internet Ag
Country of Origin: Germany
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Google degraffd@amega.com

Unread postby firefly » Sat Feb 20, 2016 9:28 pm

Email:

Google

We sent you a message.

4 broken messages was recovered and sent to you.
View messages
We hope you found this message to be useful. However, if you'd rather not receive future e-mails of this sort, please opt-out here .


Phishing link hidden in the content of the message: http:/ /vitalbrasil.com. br/plugins/germs.php

Header:

Return-Path: <degraffd@amega.com>
Received: from s17819832.onlinehome-server.info (s17819832.onlinehome-server.info. [213.165.79.247])
X-Priority: 1
From: "Support" <degraffd@amega.com>
Astatine-Streamlined: auscultation
Subject: You have 4 broken messages
Content-Transfer-Encoding: 7bit
Retrieval-Toryizes: 2E7FC355F4E21D5
Content-Type: text/html; charset=ISO-8859-1
Unloaded-Runnymede: 1a23657d7b8

Originating IP: 213.165.79.247
Originating ISP: 1&1 Internet Ag
Country of Origin: Germany
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Google dbusch@kpmg.de

Unread postby firefly » Sat Feb 20, 2016 9:37 pm

Email:

Google

We have sent you a message.

4 damaged emails has been restored and sent to you.
View emails
We hope you found this message to be useful. However, if you'd rather not receive future e-mails of this sort, please opt-out here .


Phishing link hidden in the content of the message: http:/ /tillalsaeed. com/rotten.php

Header:

Return-Path: <dbusch@kpmg.de>
Received: from s17945806.onlinehome-server.info (s17945806.onlinehome-server.info. [87.106.136.66])
From: "Support" <dbusch@kpmg.de>
Diametric-Twitch-Prone: 6766CE2217B
X-Priority: 1
Discriminatory-Accelerating: A1C2E6AB
MIME-Version: 1.0
Subject: You have 4 damaged emails
Content-Transfer-Encoding: 7bit
Message-ID: <16fc92_6d85-aa55f337a@kpmg.de>
Content-Type: text/html; charset=ISO-8859-1

Originating IP: 87.106.136.66
Originating ISP: 1&1 Internet Ag
Country of Origin: Germany
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Google Notification System - dworried@innua.com

Unread postby firefly » Sat Feb 20, 2016 10:23 pm

Email:

Google Notification System
Recovery Service Report:

Broken photos has been found and repaired .


(3) photos
We hope you found this message to be useful. However, if you'd rather not receive future e-mails of this sort, please opt-out here .


Phishing link hidden in the content of the message: http:/ /renatocasagrande.com/fibrously.php

Header:

Return-Path: <dworried@innua.com>
Received: from cs187614.nfrance.com (cs187614.nfrance.com. [80.247.235.151])
Subject: Broken photos has been found and repaired
From: Support <dworried@innua.com>
Message-ID: <d43a.d258.a71b759@cs187614.nfrance.com>
Cheerfulness-Clubbed-Question: F29E329364D56C7

Originating IP: 80.247.235.151
Originating ISP: Nfrance Conseil
City: Ramonville
Country of Origin: France
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Google Support - cmcginnigle@hrai.ca

Unread postby firefly » Sat Feb 20, 2016 10:34 pm

Email:

Google Support
xxx@gmail.com
Ella Watson (Google Service) just sent you a message:

Returned email message.
More information
View messages
This message was sent to xxx@gmail.com.
Don't want occasional updates about Google activity? Change what email Google Team sends you.


Phishing link hidden in the content of the message: http: / / cablecom.com.br /wp-content/plugins/gathers.php

Header:

Return-Path: <cmcginnigle@hrai.ca>
Received-SPF: softfail (google.com: domain of transitioning cmcginnigle@hrai.ca does not designate 88.198.189.121 as permitted sender) client-ip=88.198.189.121;
Reply-To: noreply <cmcginnigle@hrai.ca>
Subject: Returned email message
Petticoats-Airframes: chiffon
Content-Type: text/html; charset=UTF-8
MIME-Version: 1.0
Helicopter-Adultery: A95DF3BB62EC4E
From: Google <cmcginnigle@hrai.ca>

Originating IP: 88.198.189.121
Originating ISP: Hetzner Online Gmbh
Country of Origin: Germany
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Support <hansonlo@amega.com>

Unread postby firefly » Fri Mar 18, 2016 8:46 pm

Email:

Google

We sent you a message.

2 damaged emails has been restored and sent to you.
View emails
We hope you found this message to be useful. However, if you'd rather not receive future e-mails of this sort, please opt-out here .


Phishing link: http: / / kindlefreeptclientgettingtools.com/speculations.php

Return-Path: <hansonlo@amega.com>
Received: from s17667438.onlinehome-server.info (s17667438.onlinehome-server.info. [212.227.91.234])
From: "Support" <hansonlo@amega.com>
Subject: You have 2 damaged emails

Originating IP: 212.227.91.234
Originating ISP: 1&1 Internet Ag
Country of Origin: Germany

Google warning for the site kindlefreeptclientgettingtools.com: This site may be hacked.
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

PreviousNext

Return to No clicky clicky. Sites that try to install a virus on your PC.

Who is online

Users browsing this forum: No registered users and 22 guests