The count for me is 2 so far both contained a .scr file which was zipped to avoid detection

secureserver.net is also letting these throught. a bit worrying as millions use Go Daddy and they have pretty darn good spam filters.

I've had 3 of these, so far.
I have a scheme of allocating email addresses which allows me to identify the likely place from which the addresses were obtained - in each case they were not using the address which I gave to HMRC, but were using addresses harvested from careless forums (not this one).
Even the zipped html content looks like a genuine HMRC document, but I get suspicious when I see odd rebate amounts and a request for bank details.

Looks like another bombardment of the same spam and viruses for me,

Here is a list of companies the spammers are using

HSBC UK, Sage.co.uk ,Marjorie stern ,(txt in french) Gateway [email protected]

Natwest. (New Voicemail Message) companies house , sage accounting , land registry (auto notification ) royal mail, facebook, grp Lloydslink Tech reference, Sky.com
Some company must have an insecure server or they are selling peoples e-mail details to these scammers, nearly every e-mail has had an attachment .EXE or .SCR or a HTTP link to a web address that is clean, but is spoofed or has redirects to other IP's the attachments are all the same virus,

FAX348893.zip - Win32/TrojanDownloader.Waski.A trojan - deleted
FAX348893.zip > ZIP > FAX752095.scr - Win32/TrojanDownloader.Waski.A trojan - was a part of the deleted object

http://www.eset.com

Edited by tommy45 (Tue 01-Apr-14 18:08:00)

Thank you for your further info.!!!