FAKE INVOICE translated from Portuguese

Scams Refund Scam
1

HOTLINLK USE CAUTION (open in Virtual Machine) :
(https://is.gd/Rrlgsu?0659818.6392)

Portuguese Scam
Portuguese Scam690×645 54.1 KB

Portuguese Scam SCREENSHOT
Portuguese Scam SCREENSHOT1001×432 55.8 KB

Received: from 127.0.0.1
by atlas-production.v2-mail-prod1-gq1.omega.yahoo.com pod-id atlas--production-gq1-b988d578b-vfxxn.gq1.yahoo.com with HTTP; Tue, 7 May 2024 09:59:35 +0000
Return-Path: [email protected]
X-Originating-Ip: [191.6.221.241]
Received-SPF: fail (domain of jcam.com.br does not designate 191.6.221.241 as permitted sender)
Authentication-Results: atlas-production.v2-mail-prod1-gq1.omega.yahoo.com;
dkim=temp_fail [email protected] header.s=uni51;
spf=fail smtp.mailfrom=jcam.com.br;
dmarc=unknown header.from=jcam.com.br;
X-Apparently-To: ; Tue, 7 May 2024 09:59:36 +0000
X-YMailISG: Rrg.ZG0WLDsd60fNEVlVqLotZ.Ybe.6dFkFbbDVD.Q982o4D
IeZGqApSKqKZic4Zs1d9GKn3JV13jIuUL2wSn3ir.3Ta_.5UwqZo9Tw_FZ_g
0lj1FHeE2jh0NHmHR1MSQDot7cFnqr_yW_wQNOqTjmIdzvaH6l8LRxb90VYs
ahu_2uNsnnMj54zYOwad0nr4GMeTpH_4HOu6La3RXOjTTD5fljLxZfIF8Bib
MBcmOnEQvXSScWo5M.4y5s6xQzqSDmY4W58xEgBFHAsz5UXr6HS5Kntix8nK
fv_zDbh2pYmI.ql8Hj.sro1eJICoCQjLj8xQqX2CbbGDmrSCrbAOgCfmKWEQ
UCs5RHBI.9Shtv2QFbHEggzsqz7cNFvN0yOPJ9Yw0sTNe8YTD1ZMsfoHso3g
JstCb4sIDowUzt7L3hFuO7kX_DuoIbASnjihF2eIxPHhpbawjQYGd_2Rk1fp
WBFF_lOV6Kp2O6bls.i3Cy9ag7.KuXz6XiwEuV4ReQRZLoDWyVPgIUGdsYKy
1QAsfJrilyERLKJgT2.wTFyZABtzImOvNsaa9Kn7h9SApm6.d0riUWaoOShn
p8oBMv4ssB4iaVj8r.DMMSFqlRXfHPMMTTLEXN30kGhnpPI0YzjI.mFpOneo
kYs7RK9MueWtJhcTPww8n2kwTEd9ca0_BC_4K69CdzXaA7XucarEivjH4WZU
b9O_wcP.4EAllc58lr9K6fn_g2CeojPL1XXoRwccr.RbSNVZ3lVCJMMXKM0.
P2lEy07s5XlPUinJluIf4zUx.ycjpQg5_kmjNjcJV1MHaXKvG8qn0YGthj0L
KukaVUCUo2LuTlowog3JD8zkJtt2hRDlVfyO0Kyp3N9C.zWGvRxuGrtcWBfj
Nz6QWvCktuQjFUGqt_do6qr2nvQrUsE9ADghgRaSDIAnE.yqeiPfbkCVd6t.
XHDAeE1BvDHbIK7T4mFew5SHFvmNQ506Ka2vbT8s5TTv6zzoIBiBV4mehNBq
qeGOe9kXTWxW514p5Ws_SGSQqt9zNoAuRWLQleProBPgSG3yp27V4jb2V_Wg
zdOn.Ntzsibmg3tL7opVWsatcKh82hj8wgXkkg.2jdtj7a.u7Asu2rLhZCI
QfyAeN4FQAi5jhTfQUOE3Kr9sq8XYLh5aVwGOoURzG329Mmd9a9O0CJ7nbl
OeFaXP4U1Q4b.u1yk8Apu9cobUR50jALSN9H36SV.imSqBMYsL3PmAhoGyTH
F4Jn_QDe1b7GyqWUodEEizEt5Q0.EoD9CmSrRzpHoGO.uTs1wijgXK8L5TRK
3hNG
Received: from 191.6.221.241 (EHLO smtp-sp221-241.uni5.net)
by 10.213.145.27 with SMTPs
(version=TLS1_2 cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256);
Tue, 07 May 2024 09:59:35 +0000
Received: from smtp-sp221-135.uni5.net (smtp-sp221-135.uni5.net [191.6.221.135])
(using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by smtp-sp221-241.uni5.net (Postfix) with ESMTPS id D4367231ACF9
for <>; Tue, 7 May 2024 06:59:33 -0300 (-03)
Received: from [192.168.100.2] (unknown [IPv6:2804:1e68:c201:4ac:bc01:39d1:3372:65cb])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
(No client certificate requested)
(Authenticated sender: [email protected])
by smtp-sp221-135.uni5.net (Postfix) with ESMTPSA id D47732022A41
for <>; Tue, 7 May 2024 06:59:30 -0300 (-03)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=dkim.uni5.net;
s=uni51; t=1715075970; bh=Af3FSl/3aDmAzDJgELxdHsPjg0I=;
h=From:To:Subject:From;
b=F4/XiabOLzQhZykDe0yzdbJ1RAEaWZ4kp26scNPlyLHkFktf/Sf2qnb/skAPrEkz/
uDjIBxS/GYyEgYUcuIv6uA/qSO9+/YSD3W+V5WHa4NvVUX7jVcFZh6GURdA1nDcZJ/
/I6racsni/im1k8VtaQmSnsNeVD8WNJTalaiQJLE=
Content-Type: multipart/mixed; boundary=“===============3484844157404198833==”
MIME-Version: 1.0
From: NF-e[email protected]
To:
Subject: Segue a NFe gerada - 0659818.6392
X-SND-ID: 94qlC/3BkHTH3c88MHrfKB1xfsA1Fo/rJ7HSwVj3Fb3pYDrHGubdALbJHWxI
r5F1mc/AwpOrlFfwBtrheWvMiTnzSS66T5B3TLL2q+fA3JhnjcMs0324rRFH
HD1dhYEZr3nVAmzRc3kqlJV9rsDyj6K22nZ7u/O37KDltxp5Gmfbm2ss5BaB
0b9LY6Ei8HS444smZ4i9fHFt8Qw9EI/Ldhe+N6rQWmFcAGUSON2eWVKOPJT+
Qff3WJtPDM6XOKy+vCc4tzLHsy4o/lmefnt8fnUv1bWO+ySC9h3hEBbO1Iii
0KvOFp7V70upZdkrl9UOiDEenJtvhwMyle0L5D0l4c7n/mtPuYISTUrj7s6L
aFysBq/6K8JKYutwYF84SEKRvUGVW320+TwAWl8pdJSxuGfZWIFMLzzg9pxA
95/V3lnMgsotc894QHcieNUwwTLN5npx6e1IFPnYFhEFV876EtvU6IH6lvMv
1SMdIT08wRzfyiS1X5r71vnYdvbCXHii
Content-Length: 2510

–===============3484844157404198833==
Content-Type: text/html; charset=“utf-8”
MIME-Version: 1.0
Content-Transfer-Encoding: base64

PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9InB0LWJyIj4KPGhlYWQ+CiAgICA8bWV0YSBjaGFy
c2V0PSJVVEYtOCI+CiAgICA8bWV0YSBuYW1lPSJ2aWV3cG9ydDA2NTk4MTguNjM5MiIgY29udGVu
dD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCI+CiAgICA8dGl0bGU+U2Vn
dWUgYSBORmUgZ2VyYWRhIC0gMDY1OTgxOC42MzkyPC90aXRsZT4KICAgIDxzdHlsZT4KICAgICAg
ICBib2R5IHsKICAgICAgICAgICAgZm9udC1mYW1pbHk6IEFyaWFsLCBzYW5zLXNlcmlmOwogICAg
ICAgICAgICBtYXJnaW46IDA7CiAgICAgICAgICAgIHBhZGRpbmc6IDA7CiAgICAgICAgICAgIGJh
Y2tncm91bmQtY29sb3I6ICNmNGY0ZjQ7CiAgICAgICAgfQogICAgICAgIC5jb250YWluZXIgewog
ICAgICAgICAgICBtYXgtd2lkdGg6IDYwMHB4OwogICAgICAgICAgICBtYXJnaW46IDIwcHggYXV0
bzsKICAgICAgICAgICAgcGFkZGluZzogMjBweDsKICAgICAgICAgICAgYmFja2dyb3VuZC1jb2xv
cjogI2ZmZjsKICAgICAgICAgICAgYm9yZGVyLXJhZGl1czogMTBweDsKICAgICAgICAgICAgYm94
LXNoYWRvdzogMCAwIDEwcHggcmdiYSgwLCAwLCAwLCAwLjEpOwogICAgICAgIH0KICAgICAgICAu
YnRuIHsKICAgICAgICAgICAgZGlzcGxheTogaW5saW5lLWJsb2NrOwogICAgICAgICAgICBwYWRk
aW5nOiAxMHB4IDIwcHg7CiAgICAgICAgICAgIGJhY2tncm91bmQtY29sb3I6ICMwMDdiZmY7CiAg
ICAgICAgICAgIGNvbG9yOiAjZmZmOwogICAgICAgICAgICB0ZXh0LWRlY29yYXRpb246IG5vbmU7
CiAgICAgICAgICAgIGJvcmRlci1yYWRpdXM6IDVweDsKICAgICAgICAgICAgdHJhbnNpdGlvbjog
YmFja2dyb3VuZC1jb2xvciAwLjNzIGVhc2U7CiAgICAgICAgfQogICAgICAgIC5idG46aG92ZXIg
ewogICAgICAgICAgICBiYWNrZ3JvdW5kLWNvbG9yOiAjMDA1NmIzOwogICAgICAgIH0KICAgIDwv
c3R5bGU+CjwvaGVhZD4KPGJvZHk+CiAgICA8ZGl2IGNsYXNzPSJjb250YWluZXIiPgogICAgICAg
IDxoMj5TZWd1ZSBhIE5GZSBnZXJhZGE8L2gyPgogICAgICAgIDxwPlByZXphZG8gQ2xpZW50ZSw8
L3A+CiAgICAgICAgPHA+R29zdGFyw61hbW9zIGRlIGluZm9ybWFyIHF1ZSB1bWEgbm90YSBmaXNj
YWwgZWxldHLDtG5pY2EgZm9pIGVtaXRpZGEgYXV0b21hdGljYW1lbnRlIHBhcmEgc3VhIGNvbnRh
IGNvbSBvcyBzZWd1aW50ZXMgZGV0YWxoZXM6PC9wPgogICAgICAgIDx1bD4KICAgICAgICAgICAg
PGxpPjxzdHJvbmc+TsO6bWVybyBkYSBORjo8L3N0cm9uZz4gMDY1OTgxOC42MzkyPC9saT4KICAg
ICAgICAgICAgPGxpPjxzdHJvbmc+RGF0YTo8L3N0cm9uZz4gMDcvMDUvMjAyNDwvbGk+CiAgICAg
ICAgICAgIDxsaT48c3Ryb25nPlZhbG9yOjwvc3Ryb25nPiBSJCA4NjksMDA8L2xpPgogICAgICAg
IDwvdWw+CiAgICAgICAgPHA+Vm9jw6ogcG9kZSB2aXN1YWxpemFyIGEgbm90YSBmaXNjYWwgY2xp
Y2FuZG8gbm8gYm90w6NvIGFiYWl4bzo8L3A+CiAgICAgICAgPHA+PGEgaHJlZj0iaHR0cHM6Ly9p
cy5nZC9Scmxnc3U/MDY1OTgxOC42MzkyIiBjbGFzcz0iYnRuIiB0YXJnZXQ9Il9ibGFuayI+Vmlz
dWFsaXphciBOb3RhIEZpc2NhbDwvYT48L3A+CiAgICAgICAgPGJyPjxwPkNhc28gdGVuaGEgYWxn
dW1hIGTDunZpZGEsIG7Do28gaGVzaXRlIGVtIG5vcyBjb250YXRhci48L3A+CiAgICA8L2Rpdj4K
PC9ib2R5Pgo8L2h0bWw+Cg==

–===============3484844157404198833==–

2

image
image1265×875 72.1 KB

https://whatismyipaddress.com/ip/191.6.221.241

4

Please post a screenshot of the email you received here, including the link! Just attach it.

5

The link may have a virus as it doesn’t say refund just so not sure about retrieving without a virtual machine. Thanks

6

Just publish it here. I’m telling you bro. It doesn’t matter. Please also provide a screenshot in full of the email you got, at the same time.

(No one would be stupid enough to just click on it anyways as an fyi.)

8

Please include it when you upload the screenshot.
I’m telling you man, quit the nonsense / time wasting etc. I’m asking you nicely.

10

I see you’ve attached it back in the original - Apologies. I was expecting you to simply make another comment.

Please - attach the hotlink too. I’m not harassing you, I’ve asked you repeatedly to attach it like you’ve finally done with the screenshot. Not none of this “DM for it” thing.

12

I literally want the link to investigate it.

bro. it’s not hard, just put it here - or for goodness sake, send it to me personally. would be appreciated.

13

Again, I explained I am NOT accessing the HOTLINK to get download whatever they want to put on my computer. I don’t have a virtual machine. It is not one where it says access for refund so it is suspect.

14

I’m not asking you to access it yourself, I’m asking you to send it to me so I can. I have my own Virtual Machine (“VM”).

Hover over the “VISUALIZAR NOTA FISCAL” button embedded in the email. Do not left click it. Instead, right click it, copy the link and then easily send it to me.

15

Ok I am trying to send you. When I click your Icon say private. Thanks

16

I have personally reached out to you. Please check your inbox.

17

Thanks I didnt know it was that simple as far as right clicking.

18

Thought this was common knowledge… at least for the most part?

I understand where the partial miscommunication stemmed from. Now, at least you know you can do this - You’ve learned something new. :slight_smile:

19

I posted at top THANKS for the RIGHT CLICK thing I had no clue.

20

To start off, I’ve attempted to run an any.run task only to be greeted with the following; I have my VPN on. I ASSUME this is what may have triggered it to some extent, not sure.

image
image1920×959 118 KB

image
image1920×952 131 KB

@OfclyGoodenough

21

UPDATE:

I swapped to a Brazillian VPN IP, used Google Chrome’s incognito browser and was met with this page;

image
image1922×2078 91.5 KB

REDIRECT: https://nota-fiscal.nf-e.com/notafiscal-eletronica/?notafiscal=00173394.184966

image
image968×473 46.8 KB

I have opted not to continue at this stage, will access my VM later.

22

Wow that’s GREAT. You are a pro. Sorry we got sideways earlier. I have always appreciated your work and dedication.

23

No problem.

(Will start-up my VM in a little bit hopefully. Need to do something real quick.)

But at least this gives me a good start so I know what I’m looking at, evidently enough to say the least that they want the victim to specifically download a PDF file to their computer.