TV Licensing Refund Notification email

(UK) TV Licensing Refund Notification!

TV Licensing refund of 84.07 GBP - Still Pending
After the last annual calculation we have determined that you are eligible to receive a TV Licensing refund of 84.07 GBP. Due to invalid account details records, we were unable to credit your account.
Please s_ubmit the TV Licensing refund request and allow us 5-10 working days to be credited your account.
Click "Refund Me Now" and follow the steps in order to have process your request.

Refund Me Now

NOTE: For security reasons, we will record your IP Address, the date and time. Deliberate wrong inputs are criminally pursued.

Return-Path: <[email protected]>

Header Analysis Quick Report
Originating IP: 93.174.94.137
Originating ISP: Novogara Ltd
City: n/a
Country of Origin: Seychelles
* For a complete report on this email header goto ipTRACKERonline

The Refund Me Now link
Takes you to http://hmannindustries.com



Where you can give away all your personal information and not get the imaginary refund.

The real UK TV Licensing website is http://www.tvlicensing.co.uk - boring but true.

Now using another hacked site
http://a340project.us/data

An old post but it seems this has resurfaced again.

We're sorry to let you know that the TV License could not be automatically renewed.

Something's gone wrong with your payments.

As we couldn't take the latest payment from your bank account, this amount will also need to be paid when you set up your new Direct Debit.

Remember, if you don't keep up with your payments, we may be forced to cancel your license or pass your details to a debt collection agency.
To change your payment method, have a look at all your options.
So, all you need to do is make sure there's enough money in your account.
Or , if you prefer to pay the missed amount now, you can sign in online and pay using your debit or credit card.
While you're signed in, please make sure we have your correct bank details.

I'm not the bill payer for the license, hence why it looks odd, there is more to the email but I will not share the rest unless you wish me to, the above is the main meat of the text. The IP however traces back to the Netherlands, bit odd since it is supposed to be UK based.

Will keep the email for the next few weeks if you want me to post the rest.

Website is: http://strati-concept.com/los/

whois: http://whois.domaintools.com/strati-concept.com

Looks to be legit, but is it odd that a French company is doing this?

Return-Path: <bounce+b9f0b5.250013-(removed)@insightbase.com>
Delivered-To: (removed)
Received: from sheldon.hostingclick.uk
by sheldon.hostingclick.uk with LMTP
id 2P62Js9ksFxKKgAA4/ENfg
(envelope-from <bounce+b9f0b5.250013-(removed)@insightbase.com>)
for <(removed)>; Fri, 12 Apr 2019 11:13:35 +0100
Return-path: <bounce+b9f0b5.250013-(removed)@insightbase.com>
Envelope-to: (removed)
Delivery-date: Fri, 12 Apr 2019 11:13:35 +0100
Received: from z6.mailgun.us ([104.130.96.6]:55907)
by sheldon.hostingclick.uk with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
(Exim 4.91)
(envelope-from <bounce+b9f0b5.250013-(removed)@insightbase.com>)
id 1hEtBe-0005Ng-45
for (removed); Fri, 12 Apr 2019 11:13:35 +0100
DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=insightbase.com; q=dns/txt;
s=k1; t=1555063993; h=Content-Transfer-Encoding: Content-Type:
List-Unsubscribe: In-Reply-To: References: Message-ID: MIME-Version:
Date: Subject: To: From: Sender;
bh=Id43yDSDtkDiLjnmpHLS7GOVnl234LKPEpDvbwoFKHQ=; b=rPNETejvL7mrSqMDdoVCmRZ43dp22+h8Y5JX80abf3wBFVzD64wwpcIK5rWJDD5DxOrdheO2
VVZhXRq6ouqo14sdmiQcTxgzfwekdQWNRpOAoeu2yDuMi119tDpJIejxqzdnX8D4Ru6t3Zal
Ubx3q6ErRJ7Z8jnwYxSNPiXDp68=
X-Mailgun-Sending-Ip: 104.130.96.6
X-Mailgun-Sid: WyI4NDQzZSIsICJwYXVsc0B0aGFtZXNpbnRlcm5ldC5jb20iLCAiMjUwMDEzIl0=
Sender: [email protected]
Received: from John.PC (Unknown [213.227.139.176])
by mxa.mailgun.org with ESMTP id 5cb064a4.7ffb403b8240-smtp-out-n01;
Fri, 12 Apr 2019 10:12:52 -0000 (UTC)
From: TV Licensing UK Office <[email protected]>
To: (removed)
Subject: Re: Direct Debit Cancelled
Date: 12 Apr 2019 03:12:46 -0700
MIME-Version: 1.0
Message-ID: <594185entxiqkmskmshb414836776163izyawemunpdcrf403361@gizmodo.com.br>
X-mailer: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0
References: <vn87ls-625378c-px33ng-84xrf-39io63is836301@AM5EUR03FT096.eop-EUR03.prod.protection.outlook.com>
In-Reply-To: <gv19wi-662323c-ip22er-63eg-99tn69zg733230@AM5EUR03FT057.eop-EUR03.prod.protection.outlook.com>
List-Unsubscribe: <mailto:[email protected]?subject=list-unsubscrib>
X-EmailType-Id: 520234
X-Sent-To: (removed)
Accept-Language: en-GB
Content-Language: en-GB
Content-Type: text/html;
charset="utf-7"
Content-Transfer-Encoding: base64
X-Spam-Status: No, score=3.2
X-Spam-Score: 32
X-Spam-Bar: +++
X-Ham-Report: Spam detection software, running on the system "sheldon.hostingclick.uk",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.

Content preview: Payment Refund Direct Debit Application Form We're sorry to
let you know that the TV License could not be automatically renewed.

Content analysis details: (3.2 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
blocked. See
http://wiki.apache.org/spamassassin/Dns ... nsbl-block
for more information.
[URIs: britishgas.co.uk]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
bl.spamcop.net
[Blocked - see <https://www.spamcop.net/bl.shtml?104.130.96.6>]
0.1 URIBL_SBL_A Contains URL's A record listed in the Spamhaus SBL
blocklist
[URIs: strati-concept.com]
1.6 URIBL_SBL Contains an URL's NS IP listed in the Spamhaus SBL
blocklist
[URIs: strati-concept.com]
-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
[score: 0.0000]
0.8 KAM_COUK Scoring .co.uk emails higher due to poor registry
security.
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
identical to background
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.6 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image
area
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
0.0 T_REMOTE_IMAGE Message contains an external image
X-Spam-Flag: NO
X-Brightmail-Tracker: AAAABzO5r7szua+bM7mvpzO5r7Qzua+6M7ng7TO5sLE=
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrNqMTGxcIABLq7jm+IMdj2jtti34HvLA6MHsdfvGcKYIzi8MsvUQguSMxN4Mjo2X2BrYChAkQ1MDKsYpTPLU01LM5ILC5JTCwqTi9KTc0rKMpP0S3LNQCDTYxQw3cwbr8oc4pRUkqct+3ohhghgWKggRmleSWpRfFFpTmpxa8YxTkYlYR5S48BZXky80qKM9NhMhIcTEoivCJ6q2OEeIE2IaSkGhh95r3cWX3+uPUpXTETGRe22odfzi56ls3HtvvpbvFmu2AdfuHS/Vzse3rOpU2Zade7RdBbv1ZEppOTUeyZqh43T1dOy6NTz8snuxm/qfadcr7/8OEClaMqt43m3V0686zCs1j3a1PjS/Qi/eOvZ81NvZS7ufaMiGdwYd1Cz/dx6lrzznI7mCixAL1vqMVcVJwIAKnF7nJOAQAA

TV Licensing (the BBC) have a page on their website
https://www.tvlicensing.co.uk/faqs/FAQ288

Already entered your personal details on a fake site? Report it to Action Fraud or call them on 0300 123 2040. If this included card or bank account details, talk to your bank immediately.

We will always:

use [email protected] (or [email protected]) to email you. On a mobile device select the sender’s name to reveal the email address.
include your name in our emails (unless you told us you don’t need a licence and didn’t provide a name).