Support Center
[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]
VERY IMPORTANT INFORMATION, READ THIS FIRST: The example and associated information published on this page are subject to the SHPAMEE Terms Of Use. Please familiarise yourself with these terms before viewing or using any information on this page.
Header:
From - Sat Mar 30 14:06:42 2013
X-Account-Key: account2
X-UIDL: x
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Apparently-To: x via 46.228.37.123; Wed, 27 Mar 2013 15:50:20 +0000
X-YahooFilteredBulk: 87.76.30.226
Received-SPF: none (domain of server.hostguen.com does not designate permitted sender hosts)
X-YMailISG: x
X-Originating-IP: [87.76.30.226]
Authentication-Results: mta1065.mail.ir2.yahoo.com from=support.co.za; domainkeys=neutral (no sig);
from=support.co.za; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO server.hostguen.com) (87.76.30.226)
by mta1065.mail.ir2.yahoo.com with SMTP; Wed, 27 Mar 2013 15:50:20 +0000
Received: from izmirana by server.hostguen.com with local (Exim 4.80)
(envelope-from <izmirana@server.hostguen.com>)
id 1UKjxQ-0003EP-Hv
for x; Wed, 27 Mar 2013 00:35:36 -0600
To: x
Subject: [Bulk] Support Center
From: SARS <info@support.co.za>
Reply-To:
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <x@server.hostguen.com>
Date: Wed, 27 Mar 2013 00:35:36 -0600
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.hostguen.com
X-AntiAbuse: Original Domain - yahoo.co.uk
X-AntiAbuse: Originator/Caller UID/GID - [548 548] / [47 12]
X-AntiAbuse: Sender Address Domain - server.hostguen.com
X-Get-Message-Sender-Via: server.hostguen.com: authenticated_id: izmirana/only user confirmed/virtual account not
confirmed
X-Account-Key: account2
X-UIDL: x
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Apparently-To: x via 46.228.37.123; Wed, 27 Mar 2013 15:50:20 +0000
X-YahooFilteredBulk: 87.76.30.226
Received-SPF: none (domain of server.hostguen.com does not designate permitted sender hosts)
X-YMailISG: x
X-Originating-IP: [87.76.30.226]
Authentication-Results: mta1065.mail.ir2.yahoo.com from=support.co.za; domainkeys=neutral (no sig);
from=support.co.za; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO server.hostguen.com) (87.76.30.226)
by mta1065.mail.ir2.yahoo.com with SMTP; Wed, 27 Mar 2013 15:50:20 +0000
Received: from izmirana by server.hostguen.com with local (Exim 4.80)
(envelope-from <izmirana@server.hostguen.com>)
id 1UKjxQ-0003EP-Hv
for x; Wed, 27 Mar 2013 00:35:36 -0600
To: x
Subject: [Bulk] Support Center
From: SARS <info@support.co.za>
Reply-To:
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <x@server.hostguen.com>
Date: Wed, 27 Mar 2013 00:35:36 -0600
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.hostguen.com
X-AntiAbuse: Original Domain - yahoo.co.uk
X-AntiAbuse: Originator/Caller UID/GID - [548 548] / [47 12]
X-AntiAbuse: Sender Address Domain - server.hostguen.com
X-Get-Message-Sender-Via: server.hostguen.com: authenticated_id: izmirana/only user confirmed/virtual account not
confirmed
Body:
Dear Client,
A payment has been made into your account from SARS- Efiling and it will take a period of five working days to reflect.
In other to process and confirm this payment please do click here to login.
During this process, your account will be checked and verified.
Sincerely,
Security Department
Comments:
Related Cyber Criminal Profiles:
No related profiles found.Similar Spam Examples:
Check Out Our Latest And Available New Hot PropertiesSARS Efiling / ABSA Payment Notification Phishing Scam
ABSA Excess Charges Refund Banking Phishing Scam
SARS Phishing Scam - SARS eFiling Payment Adjudicated
Paypal Phishing Scam - Attention! Your PayPal Account Could Be Suspended!
Related Malware Samples:
No related malware samples found.[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]
5 WORKING DAYS! What bank are you using, some kind of foreign, Swiss account?
You can make a payment VIA SARS eFiling, but a payment can't be made into your account FROM SARS eFiling, it is made from a SARS bank account.
Checked and verified for what?
Security Department
We thought this e-mail came from SARS, or wait... it came from support.co.za, but that's not SARS either. So the only thing that tells you that this is a SARS e-mail is the eFiling logo at the top. So much for authenticity. Geat job mr. phishing scammer.