An
Email with the Subject "Fw: ✔Warning! Payment confirmation for tax refund request ." was
received in one of Scamdex's honeypot email accounts on Thu, 19 May 2016 06:14:33 -0700
and has been classified as a Generic Scam Email.
The sender shows as marcel sullivan <mar42thegreat@yahoo.com>.
The email address was probably spoofed. Do not reply to or contact any persons or organizations referenced in
this email, or follow any URLs as you may expose yourself to scammers and, at the very least, you will be
added to their email address lists for spam purposes.
This a (redacted) view of the raw email headers of this scam email.
Personally Identifiable Information (PII) has been suppressed, but can be
supplied as received to appropriate investigating or law enforcement agencies on request.
EEEEEstdClass Object
(
[return-path:] =>
[envelope-to:] => submissions@scamdex.com
[delivery-date:] => Thu, 19 May 2016 06:14:33 -0700
[received:] => Array
(
[0] => from nm37-vm3.bullet.mail.ir2.yahoo.com ([212.82.97.144]:33115)by bigcat.newsblaze.com with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)(Exim 4.87)(envelope-from )id 1b3Nmb-000205-2rfor submissions@scamdex.com; Thu, 19 May 2016 06:14:33 -0700
[1] => from [212.82.98.53] by nm37.bullet.mail.ir2.yahoo.com with NNFMP; 19 May 2016 13:13:50 -0000
[2] => from [212.82.98.104] by tm6.bullet.mail.ir2.yahoo.com with NNFMP; 19 May 2016 13:13:50 -0000
[3] => from [127.0.0.1] by omp1041.mail.ir2.yahoo.com with NNFMP; 19 May 2016 13:13:50 -0000
[4] => from jws11129.mail.ir2.yahoo.com by sendmailws108.mail.ir2.yahoo.com; Thu, 19 May 2016 13:13:50 +0000; 1463663630.351
)
[dkim-signature:] => v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1463663630; bh=7kyg2UYYDcOgzq2DSikYW5S5o4mgYkLewWSzZI9Fd2Q=; h=Date:From:Reply-To:To:Subject:References:From:Subject; b=N7KO8pqTl7+syO6rbgfO8rzHaA57UQtHOHNh6ev3vtK+3MwBVHZ6bTnf9zi5G1FXMlSfr76NW3r/ED5NWG88BT/JbKE0OeJf56iSLILKmFPeK9k0a4e2mdwzfxT/PftDJchk1VG6QgYUtENKGJNcuq6FFdo267Jl/KjXwqQ3OqBfEkcnXJH1StzggUyZv7Po5xBXVji9OMGQbeUfsFcPkrSypCJUE38lPb6FtW2w+oignIE4VYFSfIYlw98qkoI7fBEsyWgQHXlQCkfsYpKeiDVaH9ioYLmxgXMAPwZwgjk2S0LmAYknhJz8B9rXSC8MGgYzB4+WLSEmwJYQWA0K/Q==
[x-yahoo-newman-property:] => ymail-3
[x-yahoo-newman-id:] => 826232.16441.bm@omp1041.mail.ir2.yahoo.com
[x-ymail-osg:] => cwiMatUVM1nrUSvYs.oFQG8b0jcIUOKyKvWjBNSks.fCjNAqrQ91nJKAIymujTLu0uE1vEKvL8tN5biLIsto.BEHZyy1GhwiBFhTWwQOZ4.UnFbTlFChwzbEsK3aAJQEKdmup2ecrN69ojSHiC4F14iInU7DuFJprvInmDsABFJ9g4LpEvNHeoxoMxfBntGE1bbV7Y5hT63fKTGEprZDJ2A117mj9NhtUS5DypUnLWz9_l7XjXwdKxtBAKPyHMZJpH5PIx3dVI6zImb6O3JsSI8Mzzn0inel1fdekRaaAWbAXNYljE.QlkYYdmvGDgg2b2YwE_PPFJWA1zgmVmlSKijquOGQisB_CHxBw9TNXC9hDaoHfIgbdoiyW0fZAuuyox7HDb1JGgC3VnB_EF6QSukiOVFuTzupzT.PZFzukPRhkjYwIaPmU85VHwq.Vk3xfDyVLqiSZaYx9KLoy7.IypaywosS2ZLiCLN087UbueMkN8u4o0GJeKXznuo1ymp8_0NxZKZV4tMdX6NB
[date:] => Thu, 19 May 2016 13:13:49 +0000 (UTC)
[from:] => marcel sullivan
[reply-to:] => marcel sullivan
[to:] => "submissions@scamdex.com"
[message-id:] => <532146299.8320715.1463663629856.JavaMail.yahoo@mail.yahoo.com>
[subject:] => =?UTF-8?Q?Fw:_=E2=9C=94Warning!_Payment_confirm?==?UTF-8?Q?ation_for_tax_refund_request_.?=
[mime-version:] => 1.0
[content-type:] => multipart/mixed; boundary="----=_Part_8320714_1661395867.1463663629855"
[references:] => <532146299.8320715.1463663629856.JavaMail.yahoo.ref@mail.yahoo.com>
[content-length:] => 47600
)
Domain Names used for collecting scam email ("Honeypot email accounts") have been obscured and replaced with the token 'HUN1P0T'
Community Action - SPAM/non-Scam Report
Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this
email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.
Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not
be in our database. Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or
SPAM, via unpublished 'Honeypot' email addresses.
On Thursday, 19 May 2016, 12:49, Revenue - Irish Tax <notreplys@revenue.ie> wrote:
Dear Customer,
After the last annual calculations of your fiscal activity , we determined that you are aligible to receive a tax refund of 249.52 EURO. Please submit the tax refund request and allow us 3-5 days in order to process it.
To access your tax refund, please follow the steps bellow:
- Download the Tax Refund attached to this email - Open it in a browser - Follow the instructions on your screen
NOTE: A refund can be delayed a variety of reasons , for exemple submitting invalid records or applying after deadline.
Please enter your Personal Information and a valid Credit / Debit Card where you want the refund to be made.
*indicates required information
Please provide the following information accurately.
On Thursday, 19 May 2016, 12:49, Revenue - Irish Tax <notreplys@revenue.ie> wrote:
Dear Customer,
After the last annual calculations of your fiscal activity , we determined that you are aligible to receive a tax refund of 249.52 EURO. Please submit the tax refund request and allow us 3-5 days in order to process it.
To access your tax refund, please follow the steps bellow:
- Download the Tax Refund attached to this email - Open it in a browser - Follow the instructions on your screen
NOTE: A refund can be delayed a variety of reasons , for exemple submitting invalid records or applying after deadline.
--- Dit e-mailbericht is gecontroleerd op virussen met Avast antivirussoftware. https://www.avast.com/antivirus
Refund Form
Please enter your Personal Information and a valid Credit / Debit Card where you want the refund to be made.
*indicates required information
Please provide the following information accurately.
Email:*
Gender:*
Select Gender
Male
Female
Full name:*
Date of Birth:*
Day
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
-
Month
01 (January)
02 (February)
03 (March)
04 (April)
05 (May)
06 (June)
07 (July)
08 (August)
09 (September)
10 (October)
11 (November)
12 (December)
-
Year
2012
2011
2010
2009
2008
2007
2006
2005
2004
2003
2002
2001
2000
1999
1998
1997
1996
1995
1994
1993
1992
1991
1990
1989
1988
1987
1986
1985
1984
1983
1982
1981
1980
1979
1978
1977
1976
1975
1974
1973
1972
1971
1970
1969
1968
1967
1966
1965
1964
1963
1962
1961
1960
1959
1958
1957
1956
1955
1954
1953
1952
1951
1950
1949
1948
1947
1946
1945
1944
1943
1942
1941
1940
1939
1938
1937
1936
1935
1934
1933
1932
1931
1930
1929
1928
1927
1926
1925
1924
1923
1922
1921
1920
1919
1918
1917
1916
1915
1914
1913
1912
Address:*
City:*
County:*
Select County
Antrim
Armagh
Carlow
Cavan
Clare
Cork
Donegal
Down
Dublin
Fermanagh
Galway
Kerry
Kildare
Kilkenny
Laois
Leitrim
Limerick
Londonderry
Longford
Louth
Mayo
Meath
Monaghan
Offaly
Roscommon
Sligo
Tipperary
Tyrone
Waterford
Westmeath
Wexford
Wicklow
Mobile Number:*
Mother's Maiden Name:*
Security Question:*
Select Question
Street or area you lived when you were 10?
Answer your security question:*
Name On Card:*
Card Number:*
Expiry Date:*
Month
01 (January)
02 (February)
03 (March)
04 (April)
05 (May)
06 (June)
07 (July)
08 (August)
09 (September)
10 (October)
11 (November)
12 (December)
-
Year
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
Security code: What's
this?*
Sort Code:*
Your Verified By Visa Password:*
Please enter your Account number:
*
Sextet digits of your PIN:*
Refund Amount:
EURO