Advert.

Do NOT tell your scammer he is posted here, or report their accounts as it puts others at risk!

Phishers impersonating Google / Gmail

DO NOT click on any links in these emails.

Phishers impersonating Google / Gmail

Unread postby SlapHappy » Thu Jul 11, 2013 12:54 am

Webmaster irina.pohtio@elisanet.fi Subject: Account Update

* 41.71.171.29 Visafone Lagos Nigeria

Return-Path: <irina.pohtio@elisanet.fi>
Received: from gw01.mail.saunalahti.fi (gw01.mail.saunalahti.fi. [195.197.172.115])
by mx.google.com with ESMTPS id e4si8614362lah.140.2013.07.08.19.45.05
for <multiple recipients>
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Mon, 08 Jul 2013 19:45:07 -0700 (PDT)
Received-SPF: pass (google.com: domain of irina.pohtio@elisanet.fi designates
195.197.172.115 as permitted sender) client-ip=195.197.172.115;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of irina.pohtio@elisanet.fi designates
195.197.172.115 as permitted sender) smtp.mail=irina.pohtio@elisanet.fi
Received: from cfwo-21-2.mail.saunalahti.fi (cfwo-21.mail.saunalahti.fi [62.142.5.103])
by gw01.mail.saunalahti.fi (Postfix) with ESMTP id 0D7471513C2;
Tue, 9 Jul 2013 05:45:05 +0300 (EEST)
Received: from localhost (localhost [127.0.0.1])
by cfwo-21-2.mail.saunalahti.fi (Postfix) with ESMTP id 8DEFD2006D;
Tue, 9 Jul 2013 05:45:04 +0300 (EEST)
X-Spam-Checker-Version: SpamAssassin 3.3.2-saunamods_5.22 (2011-06-06) on
cfwo-21.mail.saunalahti.fi
X-Spam-Level:
X-Spam-Status: No, score=0.0 required=7.0 tests=TVD_SPACE_RATIO
shortcircuit=no autolearn=no version=3.3.2-saunamods_5.22
Received: from kadir.webmail.saunalahti.fi (kadir.webmail.saunalahti.fi [195.197.55.121])
by cfwo-21-2.mail.saunalahti.fi (Postfix) with ESMTP id 899162005D;
Tue, 9 Jul 2013 05:44:55 +0300 (EEST)
Date: Tue, 9 Jul 2013 05:44:55 +0300 (EEST)
From: Webmaster <irina.pohtio@elisanet.fi>
To: update@gmail.com
Message-ID: <4078802.4139271373337895523.JavaMail.ari.pohtio@kolumbus.fi>
Subject: Account Update
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_Part_108771_23772041.1373337895522"
X-Mailer: Saunalahti webmail - http://saunalahti.fi
X-Originating-IP: 41.71.171.29

------=_Part_108771_23772041.1373337895522
Content-Type: text/plain; Charset=iso-8859-1; Format=Flowed
Content-Transfer-Encoding: 7bit


Dear Gmail User.pdf 96k
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

Googledoc@gmail.com Subject: NEW FILE

Unread postby SlapHappy » Wed Nov 27, 2013 5:08 pm

* 50.196.77.92 Comcast Cable Miami United States
195.154.95.219 Iliad Entreprises Customers n/a France
*Probable originating IP address

Return-Path: <Googledoc@gmail.com>
Received: from smtp.marine-conseil.fr (smtp.marine-conseil.fr. [195.154.95.219])
by mx.google.com with ESMTP id s5si21442268wjs.169.2013.11.27.07.20.01
for
Wed, 27 Nov 2013 07:20:01 -0800 (PST)
Received-SPF: softfail (google.com: domain of transitioning Googledoc@gmail.com does not designate 195.154.95.219 as permitted sender) client-ip=195.154.95.219;
Authentication-Results: mx.google.com;
spf=softfail (google.com: domain of transitioning Googledoc@gmail.com does not designate 195.154.95.219 as permitted sender) smtp.mail=Googledoc@gmail.com;
dmarc=fail (p=NONE dis=NONE) header.from=gmail.com
X-ASG-Debug-ID: 1385565599-03d64e7ba994a960001-OmKWeg
Received: from web.marine-conseil.fr ([10.251.251.20]) by smtp.marine-conseil.fr with ESMTP id WLLRIqoCpJjY8VHT; Wed, 27 Nov 2013 16:19:59 +0100 (CET)
X-Barracuda-Envelope-From: Googledoc@gmail.com
X-ASG-Whitelist: Client
Received: from User (50.196.77.92) by web.marine-conseil.fr (10.251.251.20)
with Microsoft SMTP Server id 8.3.327.1; Wed, 27 Nov 2013 16:19:59 +0100
Reply-To: <Googledoc@gmail.com>
From: Google <Googledoc@gmail.com>
Subject: NEW FILE
Date: Wed, 27 Nov 2013 10:19:59 -0500
X-ASG-Orig-Subj: NEW FILE
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0106_01C2A9A6.0C1847AA"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <e607c827-5376-411d-a4d6-2c043e47f75f@web.marine-conseil.fr>
To: Undisclosed recipients:;
X-Barracuda-Connect: UNKNOWN[10.251.251.20]
X-Barracuda-Start-Time: 1385565599
X-Barracuda-URL: http:/ / smtp.marine-conseil.fr:80/cgi-mod/mark.cgi
X-Virus-Scanned: by bsmtpd at marine-conseil.fr
X-Barracuda-BRTS-Status: 1


------=_NextPart_000_0106_01C2A9A6.0C1847AA
Content-Type: text/plain; charset="Windows-1251"
Content-Transfer-Encoding: 7bit

Wednesday 27th of Nov, 26/11/2013

New Document is now available for download.

Please download the new wealth management file for your buisness.

Yours Sincerely,
Mrs. Regina Moreno-Sanchez

---This message was relayed and anlayzed by Marine Conseil's Antivirus Gateway---

attachment; filename="index.html"
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

From: Google+ team <adfeiger@mac.com>

Unread postby SlapHappy » Mon Jan 06, 2014 3:42 pm

108.230.83.12 At&t U-verse Cedar Hill United States

Return-Path: <adfeiger@mac.com>
Received: from nk11p00mm-asmtp003.mac.com (nk11p00mm-asmtp003.mac.com.
[17.158.161.2])
by mx.google.com with ESMTP id o8si70809211qec.136.2014.01.06.00.53.19
for <multiple recipients>;
Mon, 06 Jan 2014 00:53:25 -0800 (PST)
Received-SPF: pass (google.com: domain of adfeiger@mac.com designates 17.158.161.2
as permitted sender) client-ip=17.158.161.2;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of adfeiger@mac.com designates 17.158.161.2 as permitted
sender) smtp.mail=adfeiger@mac.com;
dmarc=pass (p=NONE dis=NONE) header.from=mac.com
Received: from nk11p00mm-spool002.mac.com ([17.158.161.99])
by nk11p00mm-asmtp003.mac.com
(Oracle Communications Messaging Server 7u4-27.08(7.0.4.27.7) 64bit (built Aug
22 2013)) with ESMTP id <0MYZ00AG120N3C20@nk11p00mm-asmtp003.mac.com>; Mon,
06 Jan 2014 08:53:19 +0000 (GMT)
Received: from localhost ([17.158.43.22]) by nk11p00mm-spool002.mac.com
(Oracle Communications Messaging Server 7u4-27.01(7.0.4.27.0) 64bit (built Aug
30 2012)) with ESMTP id <0MYZ00F1820N5Z40@nk11p00mm-spool002.mac.com>; Mon,
06 Jan 2014 08:53:11 +0000 (GMT)
Date: Mon, 06 Jan 2014 08:53:15 +0000 (GMT)
From: Google+ team <adfeiger@mac.com>
Subject: Important message on your account
X-Originating-IP: [108.230.83.12]
To: Undisclosed recipients: ;
Message-id: <9bccbb9b-31d4-4c32-8160-56be99250099@me.com>
MIME-version: 1.0
X-Mailer: iCloud MailClient1U43 MailServer1U25.15099
Content-type: multipart/alternative;
boundary="Boundary_(ID_iahgcS8J5tOJTe9V4N2NBA)"
X-Proofpoint-Virus-Version: vendor=fsecure
engine=2.50.10432:5.11.87,1.0.14,0.0.0000
definitions=2014-01-05_03:2014-01-03,2014-01-05,1970-01-01 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=1 spamscore=1
suspectscore=0 phishscore=81 adultscore=0 bulkscore=89 classifier=spam
adjust=0 reason=mlx scancount=1 engine=7.0.1-1308280000
definitions=main-1401060006


--Boundary_(ID_iahgcS8J5tOJTe9V4N2NBA)
Content-type: text/plain; CHARSET=US-ASCII; format=flowed
Content-transfer-encoding: 7BIT

Attachment:122.169.87.38.pdf

Contents:

Dear Gmail User,
To help protect your privacy, we'll sometimes ask you to verify your email address even
through you're already signed in to avoid your account been disabled from our service.

Verify your email

This link will expire 24 hours
Sincerely,
The Google Accounts Team


Download/view attached file to help protect your privacy.
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

From: Google+Mail <jaredjustice@me.com>

Unread postby SlapHappy » Mon Jan 06, 2014 3:49 pm

* 172.243.122.222 Viasat Communications Mount Pleasant United States

Return-Path: <jaredjustice@me.com>
Received: from nk11p00mm-asmtp002.mac.com (nk11p00mm-asmtp002.mac.com.
[17.158.161.1])
by mx.google.com with ESMTP id r5si70892994qat.0.2014.01.06.01.22.21
for <multiple recipients>;
Mon, 06 Jan 2014 01:22:26 -0800 (PST)
Received-SPF: pass (google.com: domain of jaredjustice@me.com designates 17.158.161.1
as permitted sender) client-ip=17.158.161.1;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of jaredjustice@me.com designates 17.158.161.1 as
permitted sender) smtp.mail=jaredjustice@me.com;
dmarc=pass (p=NONE dis=NONE) header.from=me.com
Received: from nk11p00mm-spool002.mac.com ([17.158.161.99])
by nk11p00mm-asmtp002.mac.com
(Oracle Communications Messaging Server 7u4-27.08(7.0.4.27.7) 64bit (built Aug
22 2013)) with ESMTP id <0MYZ000B33CY8870@nk11p00mm-asmtp002.mac.com>; Mon,
06 Jan 2014 09:22:16 +0000 (GMT)
Received: from localhost ([17.158.237.78]) by nk11p00mm-spool002.mac.com
(Oracle Communications Messaging Server 7u4-27.01(7.0.4.27.0) 64bit (built Aug
30 2012)) with ESMTP id <0MYZ00FM43CY5Z40@nk11p00mm-spool002.mac.com>; Mon,
06 Jan 2014 09:22:10 +0000 (GMT)
Date: Mon, 06 Jan 2014 09:22:06 +0000 (GMT)
From: Google+Mail <jaredjustice@me.com>
Subject: your email address
X-Originating-IP: [172.243.122.222]
To: Undisclosed recipients: ;
Message-id: <d6d142a3-534c-42b7-8ab5-8be42fef54c3@me.com>
MIME-version: 1.0
X-Mailer: iCloud MailClient1U43 MailServer1U25.15099
Content-type: multipart/alternative;
boundary="Boundary_(ID_twL83H+p3YF4n10HNR+JHQ)"
X-Proofpoint-Virus-Version: vendor=fsecure
engine=2.50.10432:5.11.87,1.0.14,0.0.0000
definitions=2014-01-05_03:2014-01-03,2014-01-05,1970-01-01 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0
suspectscore=0 phishscore=1 adultscore=0 bulkscore=1 classifier=spam adjust=0
reason=mlx scancount=1 engine=7.0.1-1308280000 definitions=main-1401060012

View attached file to help protect your privacy.

Attachment: 213.229.248.10.pdf
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

From: Google+mail <andwin1@mac.com>

Unread postby SlapHappy » Mon Jan 06, 2014 3:52 pm

* 107.214.55.40 At&t U-verse Barberton United States

Return-Path: <andwin1@mac.com>
Received: from st11p01mm-asmtp005.mac.com (st11p01mm-asmtp005.mac.com.
[17.172.204.240])
by mx.google.com with ESMTP id gm1si28030823pac.216.2014.01.06.01.47.15
for <multiple recipients>;
Mon, 06 Jan 2014 01:47:21 -0800 (PST)
Received-SPF: pass (google.com: domain of andwin1@mac.com designates 17.172.204.240
as permitted sender) client-ip=17.172.204.240;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of andwin1@mac.com designates 17.172.204.240 as
permitted sender) smtp.mail=andwin1@mac.com;
dmarc=pass (p=NONE dis=NONE) header.from=mac.com
Received: from st11p01mm-spool002.mac.com ([17.172.204.247])
by st11p01mm-asmtp005.mac.com
(Oracle Communications Messaging Server 7u4-27.08(7.0.4.27.7) 64bit (built Aug
22 2013)) with ESMTP id <0MYZ00LDQ4IF5R50@st11p01mm-asmtp005.mac.com>; Mon,
06 Jan 2014 09:47:14 +0000 (GMT)
Received: from localhost ([17.172.205.16]) by st11p01mm-spool002.mac.com
(Oracle Communications Messaging Server 7u4-27.01(7.0.4.27.0) 64bit (built Aug
30 2012)) with ESMTP id <0MYZ00KU14IFGJ30@st11p01mm-spool002.mac.com>; Mon,
06 Jan 2014 09:47:03 +0000 (GMT)
Date: Mon, 06 Jan 2014 09:47:08 +0000 (GMT)
From: Google+mail <andwin1@mac.com>
Subject: your email address
X-Originating-IP: [107.214.55.40]
To: Undisclosed recipients: ;
Message-id: <141986a0-049a-4712-b10d-a6e364ae52f3@me.com>
MIME-version: 1.0
X-Mailer: iCloud MailClient1U43 MailServer1U25.15099
Content-type: multipart/alternative;
boundary="Boundary_(ID_qWhsNlbCYLK3PMWFA2tiaw)"
X-Proofpoint-Virus-Version: vendor=fsecure
engine=2.50.10432:5.11.87,1.0.14,0.0.0000
definitions=2014-01-05_03:2014-01-03,2014-01-05,1970-01-01 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0
suspectscore=0 phishscore=8 adultscore=0 bulkscore=1 classifier=spam adjust=0
reason=mlx scancount=1 engine=7.0.1-1308280000 definitions=main-1401060016

View attached file to help protect your privacy.

Attachment: 213.229.248.10.pdf
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

Google Drive <jaredjustice@icloud.com>

Unread postby SlapHappy » Fri Jan 10, 2014 4:11 am

* 108.253.41.147 At&t U-verse Houston United States
17.158.236.222 Apple Cupertino United States
7.0.4.27 Dod Network Information Center Columbus United States
17.158.161.71 Apple Cupertino United States
17.158.161.4 Apple Cupertino United States
*Probable originating IP address

Return-Path: <jaredjustice@icloud.com>
Received: from nk11p00mm-asmtp005.mac.com (nk11p00mm-asmtp005.mac.com.
[17.158.161.4])
by mx.google.com with ESMTP id l8si4684940qey.104.2014.01.09.00.50.24
for <multiple recipients>;
Thu, 09 Jan 2014 00:50:30 -0800 (PST)
Received-SPF: pass (google.com: domain of jaredjustice@icloud.com designates
17.158.161.4 as permitted sender) client-ip=17.158.161.4;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of jaredjustice@icloud.com designates 17.158.161.4
as permitted sender) smtp.mail=jaredjustice@icloud.com;
dmarc=pass (p=NONE dis=NONE) header.from=icloud.com
Received: from nk11p00mm-spool003.mac.com ([17.158.161.71])
by nk11p00mm-asmtp005.mac.com
(Oracle Communications Messaging Server 7u4-27.08(7.0.4.27.7) 64bit (built Aug
22 2013)) with ESMTP id <0MZ40003DLVSUS60@nk11p00mm-asmtp005.mac.com>; Thu,
09 Jan 2014 08:50:24 +0000 (GMT)
Received: from localhost ([17.158.236.222]) by nk11p00mm-spool003.mac.com
(Oracle Communications Messaging Server 7u4-27.08(7.0.4.27.7) 64bit (built Aug
22 2013)) with ESMTP id <0MZ400820LVSO810@nk11p00mm-spool003.mac.com>; Thu,
09 Jan 2014 08:50:17 +0000 (GMT)
Date: Thu, 09 Jan 2014 08:50:21 +0000 (GMT)
From: Google Drive <jaredjustice@icloud.com>
Subject: Important message
X-Originating-IP: [108.253.41.147]
To: Undisclosed recipients: ;
Message-id: <7f719514-5fd4-4220-88c2-2647108b5e97@me.com>
MIME-version: 1.0
X-Mailer: iCloud MailClient1U43 MailServer1U25.15099
Content-type: multipart/alternative;
boundary="Boundary_(ID_JvmI/yOIn7bWSUjT6FTaTQ)"
X-Proofpoint-Virus-Version: vendor=fsecure
engine=2.50.10432:5.11.87,1.0.14,0.0.0000
definitions=2014-01-09_03:2014-01-07,2014-01-09,1970-01-01 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0
suspectscore=0 phishscore=2 adultscore=0 bulkscore=1 classifier=spam adjust=0
reason=mlx scancount=1 engine=7.0.1-1308280000 definitions=main-1401090002


--Boundary_(ID_JvmI/yOIn7bWSUjT6FTaTQ)
Content-type: text/plain; charset=ISO-8859-1; format=flowed
Content-transfer-encoding: quoted-printable

Hi,

At Google, we take your privacy and security seriously. Download to read attached documents

We apologise for any inconvenience and appreciate your understanding.


Attachment: email.pdf
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

"Google Drive"<googledocs@drive.google.com>

Unread postby SlapHappy » Sat Feb 15, 2014 5:26 am

* 202.168.70.178 Setia Haruman Technology, Sdn Bhd Kuala Lumpur Malaysia
138.91.226.215 Microsoft Hosting n/a United States
*Probable originating IP address

Return-Path: <googledocs@drive.google.com>
Received: from ttoanwest.ccv.pm ([138.91.226.215])
by mx.google.com with ESMTPS id cb10si9373287icc.139.2014.02.14.18.36.07
for <multiple recipients>
(version=TLSv1.1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
Fri, 14 Feb 2014 18:36:11 -0800 (PST)
Received-SPF: neutral (google.com: 138.91.226.215 is neither permitted nor denied
by best guess record for domain of googledocs@drive.google.com)
client-ip=138.91.226.215;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 138.91.226.215 is neither permitted nor denied by
best guess record for domain of googledocs@drive.google.com) smtp.mail=googledocs@drive.google.com;
dmarc=fail (p=REJECT dis=NONE) header.from=google.com
Message-Id: <52fed29b.4a5f2b0a.0140.3d1fSMTPIN_ADDED_MISSING@mx.google.com>
Received: from User (unknown [202.168.70.178])
by ttoanwest.ccv.pm (Postfix) with ESMTPA id 6694D61C7A;
Sat, 15 Feb 2014 02:32:06 +0000 (UTC)
Reply-To: <noreply_microsoftdocs@google.com>
From: "Google Drive"<googledocs@drive.google.com>
Subject: Google Drive for Windows
Date: Sat, 15 Feb 2014 10:32:05 +0800
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000


Dear Window User,

Please view the document uploaded for you by our team.

CLICK HERE and sign in to view. It's very Important.

"http:/ /myteamsheets.com/windowsgoogledrive/" << Phishing link.

Google Drive lets you store up to 15GB of your stuff for free, access them from anywhere, and collaborate with others.

Google Drive Team

Learn more about Google Drive »

© Google· Privacy Policy · Help
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

Google Drive <fbcamper@gmail.com>

Unread postby SlapHappy » Mon Mar 31, 2014 10:15 am

Return-Path: <fbcamper@gmail.com>
Received-SPF: pass (google.com: domain of fbcamper@gmail.com designates 10.182.28.134
as permitted sender) client-ip=10.182.28.134
Authentication-Results: mr.google.com;
spf=pass (google.com: domain of fbcamper@gmail.com designates 10.182.28.134 as
permitted sender) smtp.mail=fbcamper@gmail.com;
dkim=pass header.i=@gmail.com
X-Received: from mr.google.com ([10.182.28.134])
by 10.182.28.134 with SMTP id b6mr13972536obh.27.1396133980339 (num_hops = 1);
Sat, 29 Mar 2014 15:59:40 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20120113;
h=mime-version:date:message-id:subject:from:to:content-type;
bh=gpVkwzljtyXAWpfnkPqJym+oKE4N0rbbi9C3C+FMO08=;
b=PokJUgJcigJN6q3PvQwag1080u8A4voxuvtPZcRwFtZKLfLJqgINphkxWkA7Qw8HYu
lBiVvQAanixRW3WZO7/hgCMBpRoSybSsROIXD+mE7ekdSb3WhfiUoqbJLA5TiTNuW1n8
tF9iYP4zKWVvit82RkKQV+W7SWL0Mh7kki7zHbV/dy01z+GbLt7cHtF1+wjeNQDMwOOs
7nWoMyLfLz5gvvjbLUb8isQvDVwrpbyb5vB9+COHmpMwzoqM1joWLj3tS/NpJm1+3xz/
52gUKbSU6LC72F0UjX4S3owwFZfUfo73cXWhlrpb3KFPgcT6QCFa+aiTXzXe6Y7pGzzZ
JVzw==
MIME-Version: 1.0
X-Received: by 10.182.28.134 with SMTP id b6mr13900034obh.27.1396133980244;
Sat, 29 Mar 2014 15:59:40 -0700 (PDT)
Received: by 10.76.80.35 with HTTP; Sat, 29 Mar 2014 15:59:40 -0700 (PDT)
Date: Sat, 29 Mar 2014 15:59:40 -0700
Message-ID: <CAD6xKvEgc37Q=2M42bDUF6g=PPVxsnAv7+vV5GNaO1QV3x3YBw@mail.gmail.com>
Subject: You Received a file ''Invoice.Pdf''
From: Google Drive <fbcamper@gmail.com>
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary=001a11c2903cf39b1a04f5c6c512
Bcc:



Google Docs File Delivery Notification:

You've got a file named Invoice.pdf, (39 kb) waiting to be downloaded at Google Docs.

You can use the following link below to redirect to our secured document portal to sign in and retrieve your file.


Get <http://bit.ly/1ajGAij> <<< Phishing link to infected file.


The file will be available for a limited time only.

Thank you,

docs.google.com - Google's free web-based word processor,
spreadsheet, and presentation application.
----------------------------------------------------------------------
Please do not reply to this email. This auto-mailbox is not
monitored and you will not receive a response.
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

Google doc <wcorn@stanford.edu>

Unread postby SlapHappy » Thu Jun 12, 2014 4:00 am

14.140.153.114 Tata Communications Ahmedabad India

Return-Path: <wcorn@stanford.edu>
Received: from smtp.stanford.edu (smtp2.Stanford.EDU. [171.67.219.82])
by mx.google.com with ESMTPS id d3si59165477igx.10.2014.06.08.11.21.10
for <multiple recipients>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sun, 08 Jun 2014 11:21:12 -0700 (PDT)
Received-SPF: pass (google.com: domain of wcorn@stanford.edu designates
171.67.219.82 as permitted sender) client-ip=171.67.219.82;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of wcorn@stanford.edu designates
171.67.219.82 as permitted sender) smtp.mail=wcorn@stanford.edu
Received: from smtp.stanford.edu (localhost [127.0.0.1])
by localhost (Postfix) with SMTP id 4B1C934164C;
Sun, 8 Jun 2014 11:21:10 -0700 (PDT)
Received: from ITS-EXCHFE03.stanford.edu (its-exchfe03.Stanford.EDU [171.67.4.194])
(using TLSv1 with cipher AES128-SHA (128/128 bits))
(No client certificate requested)
by smtp.stanford.edu (Postfix) with ESMTPS id DD70034161E;
Sun, 8 Jun 2014 11:21:09 -0700 (PDT)
Received: from [192.168.50.40] (14.140.153.114) by
ITS-EXCHFE03.stanford.edu
(171.67.4.194) with Microsoft SMTP Server (TLS) id 14.3.181.6; Sun, 8 Jun
2014 11:21:08 -0700
Content-Type: multipart/mixed; boundary="===============0623593494=="
MIME-Version: 1.0
Subject: Please find attached documents uploaded for you
To: Recipients <wcorn@stanford.edu>
From: Google doc <wcorn@stanford.edu>
Date: Sun, 8 Jun 2014 23:50:02 +0530
Message-ID: <4e778c35-d80d-4d8f-97c4-4479880edd1e@ITS-EXCHFE03.stanford.edu>
X-Originating-IP: [14.140.153.114]



Please find attached documents i uploaded for you via the secure page..

just sign in with your email to view the document its very important.

Thank you.

attachment; filename="Confidential - Copy.html" <<Phishing form to steal your email and password.
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

<webmasterprofiles@hotmail.com>

Unread postby SlapHappy » Sun Dec 21, 2014 7:31 pm

Return-Path: <webmasterprofiles@hotmail.com>
Received: from BAY004-OMC1S10.hotmail.com (bay004-omc1s10.hotmail.com.
[65.54.190.21])
by mx.google.com with ESMTPS id x4si3698299pda.9.2014.12.20.23.19.18
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128);
Sat, 20 Dec 2014 23:19:20 -0800 (PST)
Received-SPF: pass (google.com: domain of webmasterprofiles@hotmail.com designates
65.54.190.21 as permitted sender) client-ip=65.54.190.21;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of webmasterprofiles@hotmail.com designates
65.54.190.21 as permitted sender) smtp.mail=webmasterprofiles@hotmail.com
Received: from BAY181-W16 ([65.54.190.60]) by BAY004-OMC1S10.hotmail.com
over TLS secured channel with Microsoft SMTPSVC(7.5.7601.22751);
Sat, 20 Dec 2014 23:19:18 -0800
X-TMN: [UXWqOq0dtSxFldFYsUEYLPdMWFDNSS/w]
X-Originating-Email: [webmasterprofiles@hotmail.com]
Message-ID: <BAY181-W16798280AC4E6C8393D8ADBB690@phx.gbl>
Return-Path: webmasterprofiles@hotmail.com
Content-Type: multipart/mixed;
boundary="_1b1c6272-86da-4ff8-add1-bbccb145f5e8_"
From: gmail-securite-information- general.com <webmasterprofiles@hotmail.com>
Sender: <outlook_0195dc7ee6e3c97e@outlook.com>
Subject: No: 985 8795 * Last day-Required !! or deactivations
Date: Sun, 21 Dec 2014 07:19:18 +0000
Importance: Normal
MIME-Version: 1.0
Bcc:
X-OriginalArrivalTime: 21 Dec 2014 07:19:18.0448 (UTC) FILETIME=[6F0A3B00:01D01CEE]



When creating your Gmail account, you are given the keys they need to carry in your email software.
Overall, you need: the full email address, we inform you of the new protection system is to manage your account secure against virus and spam and do identify the account, this is a final warning if you do compliance by the councils to follow, we close your account. Please see the attached file. And fill out the information request.
The Gmail Team

attachment; filename="2014 Account Network.pdf"
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

Next

Return to No clicky clicky. Sites that try to install a virus on your PC.

Who is online

Users browsing this forum: No registered users and 18 guests