Tax refund phish from Japan
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 04 Sep 2022 08:36:00 -0600
Received: from ns.gigamall.ne.jp ([210.166.222.44]:52962)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1oUqik-0009Q2-AR
for dave@doctor.nl2k.ab.ca;
Sun, 04 Sep 2022 08:35:38 -0600
Received: by ns.gigamall.ne.jp (Postfix, from userid 48)
id 00F1B8341442; Sun, 4 Sep 2022 23:35:10 +0900 (JST)
To: dave@doctor.nl2k.ab.ca
Subject: Refund invoice ID: 95169271547739925401/2022/P800
X-PHP-Originating-Script: 48:leaf-389921.php
Date: Sun, 4 Sep 2022 23:35:10 +0900
From: Revenue Commissioners
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_f47ba216e292741e9a13bc214c4c431f"
Content-Transfer-Encoding: 8bit
This is a multi-part message in MIME format.
--b1_f47ba216e292741e9a13bc214c4c431f
Content-Type: text/plain; charset=us-ascii
Dear Taxpayer,We would like to notify you that you still have an outstanding tax refund of 265.48 Euro from overpaid tax from year ending 2021.
You have until 16 September 2022 to make your claimClaim Your Refund Now (Login Now)
(Reference No: 1884983095188619334594/2022/P800)
If you find this message wrongly classified as spam, you can unmark the message. Just select the message, and click the Not Spam button that appears at the to and bottom of your current view. Unmarking a message will automatically move it to your inbox.
--b1_f47ba216e292741e9a13bc214c4c431f
Content-Type: text/html; charset=us-ascii
Claim Your Refund Now (Login Now)
(Reference No: 6051254449573/2022/P800)
--b1_f47ba216e292741e9a13bc214c4c431f--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 04 Sep 2022 08:36:00 -0600
Received: from ns.gigamall.ne.jp ([210.166.222.44]:52962)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from
id 1oUqik-0009Q2-AR
for dave@doctor.nl2k.ab.ca;
Sun, 04 Sep 2022 08:35:38 -0600
Received: by ns.gigamall.ne.jp (Postfix, from userid 48)
id 00F1B8341442; Sun, 4 Sep 2022 23:35:10 +0900 (JST)
To: dave@doctor.nl2k.ab.ca
Subject: Refund invoice ID: 95169271547739925401/2022/P800
X-PHP-Originating-Script: 48:leaf-389921.php
Date: Sun, 4 Sep 2022 23:35:10 +0900
From: Revenue Commissioners
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_f47ba216e292741e9a13bc214c4c431f"
Content-Transfer-Encoding: 8bit
This is a multi-part message in MIME format.
--b1_f47ba216e292741e9a13bc214c4c431f
Content-Type: text/plain; charset=us-ascii
Dear Taxpayer,We would like to notify you that you still have an outstanding tax refund of 265.48 Euro from overpaid tax from year ending 2021.
You have until 16 September 2022 to make your claimClaim Your Refund Now (Login Now)
(Reference No: 1884983095188619334594/2022/P800)
If you find this message wrongly classified as spam, you can unmark the message. Just select the message, and click the Not Spam button that appears at the to and bottom of your current view. Unmarking a message will automatically move it to your inbox.
--b1_f47ba216e292741e9a13bc214c4c431f
Content-Type: text/html; charset=us-ascii
Dear Taxpayer,
We would like to notify you that you still have an outstanding tax refund of 265.48 Euro from overpaid tax from year ending 2021.
You have until 16 September 2022 to make your claim
Claim Your Refund Now (Login Now)
(Reference No: 6051254449573/2022/P800)
If you find this message wrongly classified as spam, you can unmark the message. Just select the message, and click the Not Spam button that appears at the to and bottom of your current view. Unmarking a message will automatically move it to your inbox.
--b1_f47ba216e292741e9a13bc214c4c431f--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments