From: Margarita.Crowe@sage.co.uk [Margarita.Crowe@sage.co.uk]Attached is a file sage_invoice_3074381_09042014.pdf which is identical to the payload for this Companies House spam circulated earlier.
Date: 23 July 2014 10:31
Subject: FW: Invoice_7104304
Please see attached copy of the original invoice (Invoice_7104304).
From: Companies House [web-filing@companies-house.gov.uk]
Date: 4 September 2014 10:58
Subject: (AR01) Annual Return received
Thank you for completing a submission Reference # (1650722).
(AR01) Annual Return
Your unique submission number is 1650722
Please quote this number in any communications with Companies House.
Check attachment to confirm acceptance or rejection of this filing.
All web filed documents (with the exception of downloaded accounts templates) are available to view / download for 10 days after their original submission.
Once accepted, these changes will be displayed on the public record.
Not yet filing your accounts online? See how easy it is...
For enquiries, please telephone the Service Desk on +44 (0)303 1234 500 or email enquiries@companieshouse.gov.uk
This email was sent from a notification-only email address which cannot accept incoming mail. Please do not reply directly to this message.
Date: Wed, 3 Sep 2014 09:17:22 +0200 [03:17:22 EDT]The attachment is Statement.zip which contains a malicious executable Statement.scr which has a reasonable VirusTotal detection rate of 18/55. The Anubis report indicates that the binary phones home to the following domains which may be worth blocking:
From: "Sky.com" [statement@sky.com]
Subject: Statement of account
Afternoon,
Please find attached the statement of account.
We look forward to receiving payment for August, invoice as this is now due for payment.
Regards,
Clark
This email, including attachments, is private and confidential. If you have received this
email in error please notify the sender and delete it from your system. Emails are not
secure and may contain viruses. No liability can be accepted for viruses that might be
transferred by this email or any attachment. Wilson McKendrick LLP Solicitors, Queens
House, 29 St. Vincent Place, Glasgow G1 2DT Registered in Scotland No. SO303162. Members:
Mark Wilson LLB Dip. NP LP Allan T. McKendrick LLB Dip. LP NP.
From: Ebilling [Ebilling@westlothian.gov.uk]
Date: 3 September 2014 09:20
Subject: NDR Bill
Please find attached your Non Domestic Rates bill.
If your account is in credit you are due a refund unless you have any other debt due to the Council.
To allow your credit to be processed please confirm:
- If you want the credit transferred to another account you have with us. Please confirm the account details.
- If you want the credit refunded by cheque, please confirm who it should be sent to and the address.
Links to Non Domestic Rates information are detailed below.
Important Note:
If you access these links using a mobile phone the network provider may charge for this service.
Yours sincerely
Scott Reid
Revenues Manager
http://www.westlothian.gov.uk/media/downloaddoc/1799465/1851216/2395547
* PDF Viewer required.
This message, together with any attachments, is sent subject to the
following statements:
1. It is sent in confidence for the addressee only. It may
contain legally privileged information. The contents are
not to be disclosed to anyone other than the addressee.
Unauthorised recipients are requested to preserve this
confidentiality and to advise the sender immediately.
2. It does not constitute a representation which is legally
binding on the Council or which is capable of constituting
a contract and may not be founded upon in any proceedings
following hereon unless specifically indicated otherwise.
http://www.westlothian.gov.uk
From: WallStreetOTC Daily
Date: 29 August 2014 13:36
Subject: This company is about to go ten fold.
WallStreetOTC Daily
August 29, 2014
Billlions in proven reserves just found
Dear Investor,
Every once in a while a ridiculous deal presents itself. IRMGF (or inspiration miniing corporation) is a junior miining company that has properties in Ontario, Utah and Chile and has just found massive reserves of nickel, copper platinum and other rare metals. Walstreet is about to start buying up shares in IRMGF this very quickly as it is so cheap right now trading at just under 10cents. I expect to see this hit a dollar next week. Move quickly.
To end your WallStreetOTC Daily e-mail subscription and associated external offers sent from WallStreetOTC Daily, click here to unsubscribe.
If you are you having trouble receiving your WallStreetOTC Daily subscription, you can ensure its arrival in your mailbox by whitelisting Laissez Faire Today.
(c) 2014 WallStreetOTC Daily, LLC. Reproduction, copying, or redistribution (electronic or otherwise, including on the World Wide Web), in whole or in part, is encouraged provided the attribution WallStreetOTC Daily Faire Books is preserved. 808 Saint Paul Street, Baltimore MD 21202. Nothing in this e-mail should be considered personalized
From: SuperStocksTIPS Daily
Date: 29 August 2014 19:14
Subject: This company just struck gold. Cashin on the rush.
SuperStocksTIPS Daily
If you are reading this now you must act very quickly.
I.R.M.G.F (inspiration.miining.corp) is about to blow up. They have just found billiions worth of minerals on their properties and the stokc is about to soar to new highs. My analyst told me that we could see shares go up by as much as 15 times in a span of days. Move fast before bargainprices run out.
This message was delivered to [redacted]
Unique ID: 2c2864c18552de62f398a858f625a48810b2dee735055839
To unsubscribe, change your due date, or change your e-mail preferences, click here
SuperStocksTIPS
4 New York Plaza
4th Floor
New York, NY 10041
2014 SuperStocksTIPS Publications, Inc. All Rights Reserved.
====================
From: WallSt Report
Date: 30 August 2014 11:33
Subject: (IRMGF) has produced big gains this week!
Wall St Report
If you can get sharres in this company for less than 15cents you are very lucky. It is currently at slightly under 10cents but we expect that itll soar a lot today. I.R_M_G_F (inspiration miningg corporation) just found billlions in proven reserves, special, rare and precious mettals.
We expect to see shhares cross the 2dollar range next week. Act quickly before its too late.
1d467f58c8310949c647e38f59a4ef0f030139beb824c32a
The preceding is a paid message from a Wall St Report advertiser and does
not reflect the views of nor is in any way endorsed by Wall St Report.
We do not share personal information with any third party without your permission.
This email was requested by: [redacted]
Unsubscribe, Modify or Add Newsletters: Click here.
This e-mail was sent by: Wall St Report Publishing LLC
3400 Dundee Road
Northbrook, IL 60062
United States of America
(c) 2014. Wall St Report. All rights reserved
Privacy Policy. By using this site you agree to our Terms of Service.
To learn about our email partners' privacy policies, click here.
====================
From: TheWallStreet Journal
Date: 30 August 2014 15:46
Subject: Critical news information read now
TheWallStreet Journal Aug 30, 2014
If this company doesnt at least triple im retiring
My prediction is coming true.
I told you I R M,G:F, inspraition miningg corp, was going to soar to new highs.
Since the company discovered 4billion worth of proven metal reserves it has become the target of Walstreet invesstors looking to cash in on the rush.
Analysts are predicting a rise to over 1dollar in the coming weeks from a current price of 11cents.
Be swift and grab sharres first thing tuesday morning.
This email was sent to [redacted]. You are receiving this newsletter because you opted-in to receive relevant communications from TheWallStreet Journal LLC. If you would like to manage your newsletter preferences, please click here.
WSJ LLC | 16192 Coastal Highway Lewes, DE 19958
68aff86579d632c6a7dcbc7c6a29786c4476728b2989ac49
Unsubscribe
====================
From: The OTC Bulletin Board
Date: 31 August 2014 18:51
Subject: Gains of over 55 percent! Momentum is strong!
The OTC Bulletin Board®
Sunday, August 31, 2014
Happy labor day week end.
As you know , inspiration miniing corporation, IR:M,GF is up over 55% for the week on massive news on metals discovery.
The company is now sitting on more than 3billion worth of preciousmetals reserves. Sharess are tradinng at 11cents right now and are expected to reach more than a dollar each next week.
Move fast to grab cheapshares on tuesday while you still can.
About This Email:
You are signed up for this OTCBB email as [redacted].
Manage My OTCBB Mail | Unsubscribe
OTCBB Privacy Policy
OTCBB Office of Privacy | 1201 Peachtree Street, NE | 400 Colony Square, Suite 2400 | Atlanta, GA 30361
© 2014 OTCBB, LLC. All rights reserved.
====================
From: StockWatch
Date: 1 September 2014 06:39
Subject: Ready? Last reminder
We have received reports of customers receiving a text message asking them to visit www.cars4cashuk.com to sell their cars quickly for cash. Customers are asked to pay a deposit in order to secure the sale of their vehicle. This website is not genuine and in no way affiliated with AutoTrader. We are currently working to have this website shut down.The site is a crude attempt to extract money from unsuspecting people trying to trade their car, but it does feature the AutoTrader logo prominently.
For more information please contact our Customer Security team on 0330 303 9001.
Fom: Accounts [hiqfrancistown910@gmail.com]
Date: 27 August 2014 09:51
Subject: Customer Statements
Good morning,attached is your statement.
My regards.
W ELIAS
From: Madikwe, Gladness [GMadikwe@mcm.co.uk]
Date: 27 August 2014 10:43
Subject: Tax Invoice for Delivery Note 11155 dated 22.08.14
Hello ,
Please find attached the invoice for delivery note 11155 which was created on the 22 . 08. 14 after a system error to process this tax invoice.
Thank you
Regards
Gladness B Madikwe
Sales & Marketing Clerk
Morupule Coal Mine
Private Bag 35
Palapye,Botswana
Tel: +267 494 1204
Cell: +267 71373569
Fax: +267 4920643
Debswana Diamond Company Email Disclaimer: The information contained in this e-mail is confidential and may be subject to legal privilege. If you are not the intended recipient, you must not use, copy, distribute or disclose the e-mail or any part of its contents or take any action in reliance on it. If you have received this e-mail in error, please e-mail the sender by replying to this message. All reasonable precautions have been taken to ensure no viruses are present in this e-mail and the sender cannot accept responsibility for loss or damage arising from the use of this e-mail or attachments.
From: Vodafone MMS service [mms813562@vodafone.co.uk]The version I had was mangled and the attachment was just called noname which required a bit of work to turn into a ZIP file IMG Id 813562-PicYbgRr TYPE--MMS.zip which in turn contains a malicious executable Picture Id 550125-PicSfdce TYPE-MMS.exe
Date: 26 August 2014 12:00
Subject: IMG Id 813562-PictQbmR TYPE--MMS
From: [victim]The link in the email goes to a bit.ly address that forwards to [donotclick]informativoministeriopublico.info/2014-20090717094507AAtpljuX&ei=sVblU7RHpd-wBKbhgZgG&ved=0CBsQvwUoAAqid=20090717094507AAtpljuX&ei=sVblU7RHpd-wBKbhgZgG&ved=0CBsQvwUoAA.html which has garnered a fair number of clicks according to the bit.ly statistics:
To: [victim]
Date: 11 August 2014 14:33
Subject: Ministerio Publico federal 11 08 2014 07:35
VISUALIZAR-PROCESSO-MPF
Scan Security Avast, NOD 100% Seguro.
From: American Express [AmericanExpress@welcome.aexp.com]
Date: 24 July 2014 10:35
Subject: Security concern on your AmericanExpress Account
Dear Customer:
We are writing to you because we need to speak with you regarding a security concern on your account. Our records indicate that you recently used your American Express card on August 8, 2014.
For your security, new charges on the accounts listed above may be declined. If applicable, you should advise any Additional Card Member(s) on your account that their new charges may also be declined.
To secure your account , please click log on to : http://americanexpress.com
Your prompt response regarding this matter is appreciated.
Sincerely,
American Express Identity Protection Team
Please do not reply to this e-mail. This customer service e-mail was sent to you by American Express. You may receive customer service e-mails even if you have unsubscribed from marketing e-mails from American Express.
Contact Customer Service | View our Privacy Statement | Opt Out
This email was sent to [redacted].
American Express Customer Service Department
P.O. Box 297817 | Ft. Lauderdale, FL 33329-7817
2014 American Express Company. All rights reserved.
Date: Fri, 8 Aug 2014 05:57:02 +0700 [08/07/14 18:57:02 EDT]
From: Janette Sheehan [Janette.Sheehan@linkedin.com]
Subject: FW: Resume
Attached is my resume, let me know if its ok.
Thanks,
Janette Sheehan
Date: Thu, 24 Jul 2014 09:33:37 GMT [07/24/14 05:33:37 EDT]The attachment is IM03393549.zip containing a malicious executable IM008082014.scr which has a VirusTotal detection rate of 15/42. The CAMAS report shows that the malware connects to the following locations to download additional components:
From: Annie Wallace[Annie.Wallace@rbs.co.uk]
Subject: RE: Incident IM03393549
Good Afternoon ,
Attached are more details regarding your account incident. Please extract the attached
content and check the details.
Please be advised we have raised this as a high priority incident and will endeavour to
resolve it as soon as possible. The incident reference for this is IM03393549.
We would let you know once this issue has been resolved, but with any further questions
or issues, please let me know.
Kind Regards,
Annie Wallace Level 2 Adviser | Customer Experience Team, IB Service & Operations 7th
Floor, 1 Hardman Boulevard | Manchester | M3 3AQ | Depot code: 049
Tel: 0845 300 4108 |Email: Annie.Wallace@rbs.co.uk The content of this e-mail is
CONFIDENTIAL unless stated otherwise
Received: from murch.greatsill.info (HELO find-your-perfect-bride-russians.us) (94.102.56.147)The body text is just HTML:
by [redacted] with SMTP; 8 Aug 2014 00:36:28 -0000
Date: Thu, 07 Aug 2014 17:34:22 -0700
Subject: How are you doing?
From: Stewart [stewart@find-your-perfect-bride-russians.us]
The originating IP is 94.102.56.147 (Ecatel, Netherlands). The spamvertised site is hosted on 143.95.32.129 (michael.asmallorange.com) although it is currently 403ing.
