Sophisticated bid invitation spam pretending to be Hyundai

Attachment: EQUIPMENT NEEDED (JUNE 2017).rar (103.9KB), EQUIPMENT DRAWINGS & TERMS.pdf (893.7KB)

This spam email source IP address is: 200.107.200.54
This spam email source IP hostname is: web4g.redynet.com.ar

Country: Argentina
City: Buenos Aires
Area Code: -
Latitude: -34.6033
Longitude: -58.3816
ISP: Redynet SRL
Organization: Redynet SRL

This is a sophisticated spam pretending to be Hyundai. Looking like a regular bid invitation for a project in Thailand, but email sent from Argentina. One of attached file is a non-harmful pdf file, but other file contains hacking tool.

Subject : Fwd: RE:EQUIPMENT /MATERIAL NEEDED
Date : 2017-04-30 12:37:15
From : "HYUNDAI ENGR.LTD." <procurementdept@gmail.com>
To : support@mailminion.com
Cc : yaomaiyumingzhaowo@126.com; ekashparmar01@yahoo.com; rechelemb@yahoo.com

FROM: HYUNDAI ENGINEERING CO., LTD. / S.KOREA

PROJECT: PTTLNG Nong Fab Project of Thailand (BIDDING)

EQUIPMENT: PTTLNGNF-BULK-CI-009
DUE DATE: June 18th, 2017
ACKNOWLEDGEMENT REPLY: Requested

Dear Sales,

We (HEC) are preparing a tender for the PTTLNG Nong Fab Project of
Thailand (BIDDING) on Engineering, Procurement, Construction and
Commissioning (EPCC).

We are pleased to invite you to the bid for the supply of equipment,
materials and services.

Please find the attached file for more details.

1) Commercial Terms & Conditions

Attached file includes more information. In addition, there are two
forms that you need to fill in (Table A and B). By filling up these
forms, we can check the further information of your offer. Please send
me your proposal with the forms filled in.

2) Material Requisition (Technical Requirements)

I look forward to your response and valuable offer by the due date.
Thank you.

Sincerely,

Lee Chin

Young-Hoon Kang

Procurement Engineer / Equipment & Materials Estimate Team

Process Plant Division

-----------------------------------------------------
ISP detail of this spam email
-----------------------------------------------------

inetnum:     200.107.200/21
status:      allocated
aut-num:     N/A
owner:       Redynet SRL
ownerid:     AR-RESR2-LACNIC
responsible: Carlos Ariel Canta
address:     San Mart�n, 663, PB
address:     1004 - Ciudad Aut�noma de Bs.As - BA
country:     AR
phone:       +54 11 4328-7954 []
owner-c:     CAC14
tech-c:      CAC14
abuse-c:     CAC14
inetrev:     200.107.200/22
nserver:     S2.REDYNET.COM.AR  [lame - not published]
nsstat:      20171018 NOT SYNC ZONE
nslastaa:    20170116
nserver:     S3.REDYNET.COM.AR
nsstat:      20171018 AA
nslastaa:    20171018
created:     20070424
changed:     20070424

nic-hdl:     CAC14
person:      Carlos Ariel Canta
e-mail:      [email protected]
address:     San Mart�n, 663, PB, 011, 43287954
address:     1004 - Ciudad de buenos aires - BA
country:     AR
phone:       +54 11 43287954 [104]
created:     20060411
changed:     20060411
Location: san martin 663 pb oficina 5, C1004AAM CABA, Argentina

Comments

Post a Comment

Popular spam

Buyout from DJI is imminent at $1.37 per share

Subject : This stock is about to receive a buyout at 10 times its current market price... Date : 2017-03-20 From : "Efren Bray" <Bray779@airenetworks.es> To : rechelemb@yahoo.com Cc : ekashparmar01@yahoo.com, yaomaiyumingzhaowo@126.com, support@mailminion.com, info@mercranet.com, priyeshk00@gmail.com Dear Subscriber, It's been a long time since I sent you my special newsletter containing a hot stock tip. The reason for that is because I really haven't had many opportunities to present to you. Incapta Inc (ticker: INCT) is a company that was brought to my attention earlier this morning by one of my colleagues at an M&A firm in manhattan. It seems that a buyout from DJI is imminent at $1.37 per share and is set to be announced next week on Tuesday, March 28. INCT is a company that has revolutionized the drone industry by creating the first independent drones that can be dispatched to areas of interest such as crime scenes, car chases, wildfire...
Read more

Vietnamese fake inquiry which sent from Nigeria through German email service

Attachment: RFQ-40371.r11 (345.7KB) Spoofed server Name: Dang Thi Toan Mailing Address: So E61, cho Hoi Do, duong Nguyen Chi Thanh, P.Thanh Binh, Hai Duong Thanh Binh 1000 VN Phone: +84.0978599011 Email:zaimu@wacoh-vn.com Subject : Fwd: RFQ-40371 Date : 2017-06-26 19:11:56 From : DANG THI TOAN <dianameitert@t-online.de> To : "samumex@samudies.co.kr" <samumex@samudies.co.kr> Cc : info@mercranet.com; ludo_gallery@yahoo.com; support@mailminion.com Good Day, Please quote for the following items as attached so you can raise contract terms for PI Appreciate to receive your quotation at your earliest. Thank you for your assistance. Best Regards. Sales Manager DANG THI TOAN (Ms) VIET NAM WACOH Co. Ltd. Add: Room 602, 7 th Floor, Hoa Xa Building, 360 Nguyen Luong Bang Street Thanh Binh Ward, Hai Duong city, Hai Duong Province Tel: +84 3203 895 515 Phone: 0978 599 011 Email: zaimu@wacoh-vn.com Refer to below: SECURITY ALERT - Fake ...
Read more

Confirm your banking details

Attachment: Swift Copy.jar (497.6KB) Subject : Re: Re: Confirm your banking details Date : 2017-03-14 11:35:56 From : kasse@fundus-nienburg.de Dear Sir, We have made the bank transfer today and the transfer has been done by our bank, kindly confirm the receipt of the payment and let us know the estimated ETA. The transfer swift copy is attached, hope the transfer is as you instructed and all information are correct on the attached slip. For security purpose, the document is a secured document, enable content and editing to view the document. Thanks! "Sent from my iPhone"
Read more