From: INTUIT INC. [mailto:support@careerbuilder.com]
Sent: 01 March 2012 15:26
Subject: Your Intuit.com order confirmation.
Dear Customer:
Thank you for purchasing your software Intuit Market. We are processing and will message you when your order is processed. If you ordered several items, we may process them in more than one delivery (at no extra cost to you) to ensure quicker delivery.
If you have questions about your order, please call 1-800-955-8890.
ORDER INFORMATION
Please download your full invoice
id #038964148686 information at Intuit small business website.
NEED HELP?
• Email us at mktplace_customerservice@intuit.com.
• Call us at 1-800-955-8890.
• Reorder Intuit Checks Quickly and Easily starting with
the information from your previous order.
To help us better serve your needs, please take
a few minutes to let us know how we are doing.
Submit your feedback here.
Thanks again for your order,
Intuit Market Customer Service
Privacy , Legal , Contact Us , About Us
You have received this business communication as part of our efforts to fulfill your request or service your account. You may receive this and other business communications from us even if you have opted out of marketing messages.
Please note: This e-mail was sent from an auto-notification system that cannot accept incoming email
Please do not reply to this message.
If you receive an email message that appears to come from Intuit but that you suspect is a phishing e-mail, please forward it immediately to spoof@intuit.com. Please visit http://security.intuit.com/ for additional security information.
2011 Intuit, Inc. All rights reserved. Intuit, the Intuit Logo, Quickbooks, Quicken and TurboTax, among others, are registered trademarks of Intuit Inc.
Date: Thu, 1 Mar 2012 18:34:39 +0300the second one:
From: "INTUIT INC."
Subject: Your Intuit.com software order.
dear {l1}:
thank you for {l2} intuit market. we {l3} and will {l4} when your {l5}. if you ordered {l6} items, we may {l7} them in more than one {l8} (at no extra cost to you) to {l9}.
if you have questions about your order, please call 1-800-955-8890.
order information
please download your {la}
id #{digit} information at intuit small business website.
need help?
email us at mktplace_customerservice@intuit.com.
call us at 1-800-955-8890.
reorder intuit checks quickly and easily starting with
the information from your previous order.
to help us better serve your needs, please take
a few minutes to let us know how we are doing.
submit your feedback here.
thanks again for your order,
intuit market customer service
privacy , legal , contact us , about us
you have received this business communication as part of our efforts to fulfill your request or service
your account. you may receive this and other business communications from us even if you have opted
out of marketing messages.
please note: this e-mail was sent from an auto-notification system that cannot accept incoming email
please do not reply to this message.
if you receive an email message that appears to come from intuit but that you suspect is a phishing
e-mail, please forward it immediately to spoof@intuit.com. please visit http://security.intuit.com/ for
additional security information.
�2011 intuit, inc. all rights reserved. intuit, the intuit logo, quickbooks, quicken and turbotax,
among others, are registered trademarks of intuit inc.
Date: Thu, 1 Mar 2012 12:33:28 -0300
From: "Jesus Kendall"
Subject: Your tax appeal status.
Dear Business owner,
Hereby you are informed that your Tax Return Appeal id#8179621 has been DECLINED. If you consider that the IRS did not properly assess your case due to a misunderstanding of the facts, be prepared to submit additional information. You can download the rejection details and re-submit your appeal under the following link Online Tax Appeal.
Internal Revenue Service
Telephone Assistance for Businesses:
Toll-Free, 1-800-829-4933
Hours of Operation: Monday � Friday, 7:00 a.m. � 7:00 p.m. your local time (Alaska & Hawaii follow Pacific Time).
From: INTUIT INC. [mailto:noreply@careerbuilder.com]
Sent: 01 March 2012 14:30
Subject: Your intuit.com order confirmation.
Dear Customer:
Thank you for purchasing your software Intuit Market. We are processing and will message you when your order is processed. If you ordered multiple items, we may process them in more than one shipment (at no extra cost to you) to ensure quicker delivery.
If you have questions about your order, please call 1-800-955-8890.
ORDER INFORMATION
Please download your complete order
id #443475245229 information at Intuit small business website.
NEED HELP?
• Email us at mktplace_customerservice@intuit.com.
• Call us at 1-800-955-8890.
• Reorder Intuit Checks Quickly and Easily starting with
the information from your previous order.
To help us better serve your needs, please take
a few minutes to let us know how we are doing.
Submit your feedback here.
Thanks again for your order,
Intuit Market Customer Service
Privacy , Legal , Contact Us , About Us
You have received this business communication as part of our efforts to fulfill your request or service your account. You may receive this and other business communications from us even if you have opted out of marketing messages.
Please note: This e-mail was sent from an auto-notification system that cannot accept incoming email
Please do not reply to this message.
If you receive an email message that appears to come from Intuit but that you suspect is a phishing e-mail, please forward it immediately to spoof@intuit.com. Please visit http://security.intuit.com/ for additional security information.
©2011 Intuit, Inc. All rights reserved. Intuit, the Intuit Logo, Quickbooks, Quicken and TurboTax, among others, are registered trademarks of Intuit Inc.
Date: Thu, 1 Mar 2012 09:43:50 +0530
From: ARLYNEO93ESQUIVEL@gmail.com
Subject: Fwd: Re: Fwd: Scan from a Hewlett-Packard Officejet #603320
Attachments: HP_Scan-27-499614.htm
Attached document was scanned and sent
to you using a Hewlett-Packard HP SmartJet 4931F.
Sent by: ARLYNE
Pages : 9
Attachment Type: .HTM [Internet Explorer/Mozilla Firefox]
This spam comes with a malicious attachment pointing to a page on cparabnormapoopdsf.ru.
Date: Tue, 27 Feb 2012 03:53:09 +0530
From: sales1@victimdomain.com
Subject: Fwd: Your Flight N US787-8929269
Attachments: FLIGHT_TICKET_N3988-753843.htm
Dear Customer,
FLIGHT NUMBER 8333-452628141
DATE/TIME : MARCH 23, 2011, 16:15 PM
ARRIVING AIRPORT: WASHINGTON DC INT. AIRPORT
PRICE : 856.77 USD
Your bought ticket is attached to the letter as a scan document (Internet Exlporer File).
To use your ticket you should print it.
LAKEISHA Wolff,
American Airlines
Another IRS spam run leading to malware, this time on pollypeach.com. Date: Tue, 27 Feb 2012 17:02:45 +0600
From: "Ofelia Childers"
Subject: IRS notification of your tax appeal status.
Dear Accountant Officer,
Hereby you are notified that your Income Tax Return Appeal id#0184348 has been REJECTED. If you believe the IRS did not properly assess your case due to a misinterpretation of the case details, be prepared to provide additional information. You can obtain the rejection report and re-submit your appeal under the following link Online Tax Appeal.
Internal Revenue Service
Telephone Assistance for Businesses:
Toll-Free, 1-800-829-4933
Hours of Operation: Monday � Friday, 7:00 a.m. � 7:00 p.m. your local time (Alaska & Hawaii follow Pacific Time).
Date: Mon, 26 Feb 2012 12:16:40 +0530
From: accounting@victimdomain.com
Subject: Fwd: ACH and Wire transfers disabled.
Dear Online Account Operator,
Your ACH transactions have been
temporarily disabled.
View details
Best regards,
Security department
Date: Mon, 26 Feb 2012 12:30:50 +0100
From: "BBB"
Subject: BBB case ID 73773062
Attachments: betterbb_logo.jpg
Attention: Owner/Manager
Here with the Better Business Bureau notifies you that we have been sent a complaint (ID 73773062) from your customer in regard to their dealership with you.
Please open the COMPLAINT REPORT below to obtain the details on this matter and inform us about your position as soon as possible.
We hope to hear from you shortly.
Regards,
Arnold Melendez
Dispute Counselor
Better Business Bureau
Council of Better Business Bureaus
4200 Wilson Blvd, Suite 800
Arlington, VA 22203-1838
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277
Date: Fri, 23 Feb 2012 12:29:00 +0100The links go through a legitimate hacked site to some obfuscated javascipt leading to a malicious payload on synetworks.net/main.php?page=2d057d472cd217e2 and synetworks.net/content/ap2.php?f=3dc5c (report here) hosted on 76.12.101.172 (HostMySite, US). That IP is also home to housespect.net which also appears to be malicious. Blocking the IP should prevent any other malicious sites on the same server from being a problem.
From: "Jonathon Humphrey"
Subject: Termination of your CPA license.
You're receiving this notification as a Certified Public Accountant and a member of AICPA.
Having trouble reading this email? View it in your browser.
Termination of Accountant status due to income tax fraud accusations
Dear AICPA member,
We have received a complaint about your alleged participation in income tax fraudulent activity on behalf of one of your clients. According to AICPA Bylaw Section 600 your Certified Public Accountant status can be terminated in case of the event of submitting of a false or fraudulent income tax return on the member's or a client's behalf.
Please be informed of the complaint below and provide your feedback to it within 7 days. The failure to respond within this term will result in withdrawal of your CPA license.
Complaint.doc
The American Institute of Certified Public Accountants.
Email: service@aicpa.org
Tel. 888.777.7077
Fax. 800.362.5066
==================
Date: Fri, 23 Feb 2012 12:28:45 +0100
From: "Dominic Moreno"
Subject: Your accountant license can be revoked.
You're receiving this email as a Certified Public Accountant and a member of AICPA.
Having trouble reading this email? View it in your browser.
Termination of Public Account Status due to tax return fraud accusations
Dear accountant officer,
We have been informed of your alleged involvement in income tax fraudulent activity for one of your clients. According to AICPA Bylaw Subsection 730 your Certified Public Accountant status can be revoked in case of the aiding of presenting of a incorrect or fraudulent tax return on the member's or a client's behalf.
Please be notified below and provide your feedback to it within 7 days. The failure to do so within this period will result in suspension of your Accountant status.
Complaint.doc
The American Institute of Certified Public Accountants.
Email: service@aicpa.org
Tel. 888.777.7077
Fax. 800.362.5066
Date: Thu, 22 Feb 2012 05:04:38 +0700
From: scanner@victimdomain.com
Subject: Fwd: Re: Scan from a Hewlett-Packard Officejet #19152659
Attachments: HP_Officejet_02-23_OFCJET88353.htm
Attached document was scanned and sent
to you using a Hewlett-Packard HP OfficeJet 34612A.
Sent by: FELICE
Images : 0
Attachment Type: .HTML [Internet Explorer]
HP Officejet Location: --
Date: Thu, 22 Feb 2012 11:29:29 +0100
From: "Guadalupe Kessler"
Subject: Fraudulent tax return assistance accusations.
You're receiving this message as a Certified Public Accountant and a member of AICPA.
Having trouble reading this email? View it in your browser.
Termination of CPA license due to income tax fraud allegations
Valued accountant officer,
We have received a complaint about your alleged participation in income tax infringement for one of your employers. According to AICPA Bylaw Subsection 765 your Certified Public Accountant license can be cancelled in case of the event of presenting of a incorrect or fraudulent tax return for your client or employer.
Please be notified below and respond to it within 21 days. The failure to respond within this term will result in cancellation of your Accountant license.
Complaint.pdf
The American Institute of Certified Public Accountants.
Email: service@aicpa.org
Tel. 888.777.7077
Fax. 800.362.5066
Urgent - You may be entitled to up to £3000 from mis-sold PPI on loans or credit cards. For a free no obligation check reply PPI or STOP to opt outThe sending number was +447866079549, although these spammers change their number more often than their underwear.
From: The Electronic Payments Association filmeboo@filmeboo.com
Reply-To: The Electronic Payments Association
Date: 22 February 2012 21:46
Subject: Technical failure report
Valued Customer,
Unfortunately we notify you , that Direct Deposit payment (#ACH603865004417US) could not be completed, because of discontinued receipient account.
Direct Deposit procedure incomplete
Transaction # : ACH603865004417US
Information: Please download and print the transfer correction request below adjust the recipient banking details.
Transfer Report report-ACH603865004417US.doc (Microsoft Word Document)
13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100
2012 NACHA - The Electronic Payments Association
Another malicious spam pointing to cpojkjfhotzpod.ru:8080Date: Wed, 21 Feb 2012 06:09:01 -0800
From: "Keitha Hanks"
Subject: Urgent! Check the access to your card!
We have detected operations with large amounts on your card which fact had not previously been observed. Please, familiarize yourself with the copies and contact us in case these transfers of amounts were not made by you.
operations screenshot.jpg 103kb
With best regards
Keitha Hanks
MD5 check sum: xxxxxxxxxxxxxxxxxxxxx
Another spam run (will they ever end?) this time with a malicious .htm attachment that tries to download from cpojkjfhotzpod.ru. Here are some examples:Date: Wed, 21 Feb 2012 07:17:49 +0800
From: "LARUE Riley"
Subject: Fw: Contract from LARUE
Attachments: Contract_Scan_N5005.htm
Good afternoon,
In the attached file I am forwarding you the Translation of the Job Contract
that I have just received yesterday. I am really sorry for the delay.
Best regards,
LARUE Riley, secretary
==========
Date: Wed, 21 Feb 2012 05:17:01 +0700
From: "DELORIS Hensley"
Subject: Fw: Contract of 09.06.2011
Attachments: Contract_Scan_N0395.htm
Dear Customers,
In the attached file I am forwarding you the Translation of the Job Contract
that I have just received yesterday. I am really sorry for the delay.
Best regards,
DELORIS Hensley, secretary
===========
Date: Wed, 21 Feb 2012 09:10:09 +0900
From: "ALISHA MCMILLIAN"
Subject: Fw: Contract from ALISHA
Attachments: Contract_Scan_N67448.htm
Dear Customers,
In the attached file I am transferring you the Translation of the Sales Contract
that I have just received today. I am really sorry for the delay.
Best regards,
ALISHA MCMILLIAN, secretary
==========
Date: Wed, 21 Feb 2012 04:41:45 +0700
From: "Drake Milton"
Subject: Fw: Contract of 09.06.2011
Attachments: Contract_Scan_N7682.htm
Hello,
In the attached file I am forwarding you the Translation of the Purchase Contract
that I have just received a minute ago. I am really sorry for the delay.
Best regards,
Drake Milton, secretary
==========
Date: Wed, 21 Feb 2012 11:21:48 +0100The link in the email goes to a legitimate hacked site and then via some obfuscated javascript to energirans.net/main.php?page=598991e7306ac07e where it attempts to infect the machine with the Blackhole Exploit kit.
From: "BBB"
Subject: Better Business Bureau complaint
Attachments: betterbb_logo.jpg
Good afternoon,
Here with the Better Business Bureau would like to inform you that we have received a complaint (ID 15343433) from a customer of yours in regard to their dealership with you.
Please open the COMPLAINT REPORT below to view the details on this issue and suggest us about your position as soon as possible.
We hope to hear from you shortly.
Regards,
Rebecca Wilcox
Dispute Counselor
Better Business Bureau
Council of Better Business Bureaus
4200 Wilson Blvd, Suite 800
Arlington, VA 22203-1838
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277
