Password phishing emails originating from West Africa

[FrumpyBB]

Yahoo

Dear Customer,

This is a courtesy notice that Your incoming messages were placed on pending due to your email has exceeded limits and require to be validate within 24 hours. You are advised to Sign in to Yahoo to Verify your account immediately to get your mail working.

*Important: In general, domestic data usage will be reflected within 24 hours.

Thank you for using Yahoo! Mail.

Yahoo!©2014
Reply, Reply All or Forward | More


Return-Path: <veerpram9@aol.com>
Received: from Que-Cash (unknown [41.138.187.28])
From: "Yahoo! Mail" <veerpram9@aol.com>
Subject: Y!Mail Notification
X-AOL-IP: 41.138.187.28 Lagos, Nigeria

[FrumpyBB]

Account Information

ACCOUNT ALERT,

Your Account is about to expire

Click here to renew
gfjgkhklflfkdjshdgh.hol.es/


Thank you for helping us protect you.

Yahoo! Membership Service


From: Yahoo! =?ISO-8859-1?Q?Mail=A9?= <Airtest@aol.com>
Subject: Important Notice***
X-AOL-IP: 197.242.102.62

IP: 197.242.102.62
Country: Nigeria
City: Lagos

[FrumpyBB]

Account Information

ACCOUNT ALERT,

Your Account is about to expire

Click here to renew


Thank you for helping us protect you.

Yahoo! Membership Service



From: Yahoo! =?ISO-8859-1?Q?Mail=A9?= <hannoverview53@aol.com>
Subject: Important Notice***
X-AOL-IP: 197.242.102.62 Lagos, Nigeria

[coolbreeze1975]

Account Shutdown

From

Team Reset

email addy = rb2149@aol.com

IP in RS DB

IP: 108.60.134.223
ISP: Atlantic Metro Communications
Services: Network sharing device or proxy server <-----------------
Type: Corporate
Country: United States

Return-Path: <rb2149@aol.com>
X-Originating-IP: [108.60.134.223]

Dear Customer,


Your E-mail account has exceeded its limit and needs to be verified, If not verified within 24hrs, your account will be temporarily suspended

Click Here

Thanks.

AOL Mail Privacy Policy | AOL Privacy Policy | Web Beacons in Email

Please do not reply to this message. This is a service email related to your use of AOL Mail.

AOL is located at 701 First Avenue, Sunnyvale, CA 94089

CB1975

[FrumpyBB]

Dear valued customer,

Your online account has been successfully migrated to our new server

You are required to synchronize your token
device for effective online transactions

This process is in line with the cbn cashless policy

Failure to synchronize your token device will
lead to blockage of your token device and suspension of your online banking


KINDLY FOLLOW THE BELOW INSTRUCTION

1. Go to 1stbanknigeria-online.com/ .

2.Select your preferred login INDIVIDUAL or CORPORATE

3. Log on to your account

3. Provide the Answer to your secret questions and details

4. Lastly, enter the code generated buy your FBN hardware token device

KINDLY NOTE THAT YOU ARE REQUIRED TO IN PUT YOUR
TOKEN CODE TWICE AND BOTH CODES MOST BE GENERATED DIFFRENTLY

You must Synchronize your token to avoid
locking of your token thereby making it impossible to carry out transactions online.

Thank you for banking with us.

To sign up for your free e-statement, and for enquiries on FirstBank products
and services, please call
0700FIRSTCONTACT (0700-34778-2668228), 01-4485500, 0708-062-5000, SMS Short Code
30012 or email viruses are
present. You should however carry out your own virus checks before
opening this e-mail or its attachments as
First Bank Of Nigeria Ltd cannot accept responsibility
for any loss or damage arising from the use of
this e-mail or its attachments. **************************************
****************************************


Return-Path: <abbeyo44@hotmail.co.uk>
Received-SPF: softfail (transitioning domain of hotmail.co.uk does not designate 213.171.216.60 as permitted sender)
Subject: New Firstonline Banking Credentials
From: FirstOlineBanking <abbeyo44@hotmail.co.uk>

[spanky]

Another ugly looking phishing link in final correspondence from mugu below.

Faceless male on profile page
ChristianMingle
Username: Alexander347
Relationship status: Divorced
Occupation: Finance
58/Tinton Falls, New Jersey
Seeking women: 45-85

Introduction:

I am a finance professional living once again on the east coast after spending most of my life/career in the mid-west and Houston. I am a Father of twins a boy and a girl. I am currently working as an Accountant for a local concern. I took early retirement last year after my firm merged with another global company.. I am very laid back but at the same time enjoy a challenge, working with and creating businesses and financial products. Currently I do volunteer my financial services and sit on a number of institutional and financial boards. I am looking for someone who loves God, makes God a part of their daily lives, loves family and who has goals. Someone who wants a simple yet content life, enjoys dialogue, loves books, education and is giving back to her community. Someone who is sexy, attractive and who wants to be protected, provided for, and/we can provide for each other.I am looking or someone with a plan or strategy, who trusts the Father, likes the outdoors, seeks to enjoy life no matter whether or not its raining.

------------------------------------

Alexander347
58 years old
TINTON FALLS, NJ, USA
Fri, 28 Feb 2014

I am new at this, but I couldn't help saying "Hi, what's your name?"

------------------------------------

Alexander347
58 years old
TINTON FALLS, NJ, USA
Fri, 28 Feb 2014

Thanks for getting back to me,I will like to know you more after reading your profile.Do you know that  men and women are angels created with only one wing? And they need to embrace each other to be able to fly... I Hope to find my angel whom i can fly with forever.I guarantee that I am a nice Man and know how to treat a woman.I have a good sense of humor.I do not see distance as a problem between us as a barrier i cant always come around here is my contact andy675543 at Gmail or drop me yours and also drop me your text number...I will wait to read back from you

David A Fogle

------------------------------------

Alexander347
58 years old
TINTON FALLS, NJ, USA
Fri, 28 Feb 2014

Thanks for dropping me your email just sent you an email check your email and get back to me overthere, if you did not get it in your inbox check your spam here

------------------------------------

Also uses andy675543@yahoo.com but avatar is invisible.

------------------------------------

On Friday, February 28, 2014 8:03 AM, David A fogle <andy675543@gmail.com> wrote:

Just click on this link  

packaging-solutions.asia/wp-content/uploads/chsnew/llt.html it will take you to my Christianmingle login page and login your username and password to view my pics.. 

[FrumpyBB]

This is a hacked domain

[JulieNP]

International Banking Services
Eurolife House
4 Evrou Street
2003 Strovolos
Nicosia
Cyprus

Email: bnkofcyprus.tr@gmail.com

BOC© Bank of Cyprus Crediting International Remittance Notification.

Attn: Valued Beneficiary BOC©, - (File No: BOC65775/8#/ G.C. Makenzie -
Charity013)-

BOC© Bank Of Cyprus hereby officially inform you that your valid cheque for
$900, 000.00 USD (Nine Hundred Thousand Dollars.) is currently in our bank's
possession and as it was deposited with us as an International bank draft by the
Cindy & Mark Hill, the Missouri Powerball jackpot Lottery Winners. Your details
were forwarded to us by the management of George Y Yiangou & Co Law firm on
behalf of Cindy & Mark Hill Family the Missouri Powerball jackpot Lottery
Winners, declaring you as a bonafide beneficiary of their ongoing Donation
(Charity).

Please confirm the ongoing Cindy & Mark Hill Charity donation.
powerball.com/powerball/winners/2012/112812MO_Hill.shtml

According to the BOC© Bank Of Cyprus Financial Service Authority rules and
regulations for accounts and large transfers, International Customers are to
employ the services of an intermediary bank which will be responsible for
clearing their cheque here in Europe before the funds in cash can be transferred
to the destination country.

Step 1: Step 2:
*FIRST NAME: *BANK NAME:
*LAST NAME: *BANK ADDRESS:
*DATE OF BIRTH: *NAME OF ACCOUNT:
*SEX: *ACCOUNT NUMBERS:
*ADDRESS: *SWIFT CODE:
*CITY: *ROUTING NUMBERS:
*STATE:
*POSTCODE:
*COUNTRY:
*MOBILE NO:
*FAX IF ANY:
*OCCUPATION:

Step 3:
a] One original document to confirm your identity, i.e Current signed passport
or Photo card driving license.

Your funds which amounts to 900, 000.00 USD (Nine Hundred Thousand Dol lars.)
will be credited to your operational bank account within 2-3 working days after
transfer.

NOTE: If you do not wish to submit the above details due to reasons best known
to you, your valid Bank Cheque can be sent to your address Via Courier Delivery,
But you will be responsible for courier delivery fee as delivery fee must be
paid before shipment is effected.

We look forward to the successful transfer of your funds.

Mr Pavlos Vovides
Branch Manager at BOC© Bank Of Cyprus
Email: bnkofcyprus.tr@gmail.com

DISCLAIMER NOTICE:
If you have received this mail in error, please notify us by a return e-mail and
delete the document.If you a re not the intended recipient, you are hereby
notified that any disclosure, copying, distribution or taking any action in
reliance on the contents of this information is strictly prohibited and may be
unlawful. Bank of cyprus is not liable for the improper and incomplete
transmission of the information contained in this communication or for any delay
in its receipt (c)2014

[FrumpyBB]

Dear valued customer,

Your online account has been successfully migrated to our new server

You are required to synchronize your token
device for effective online transactions

This process is in line with the cbn cashless policy

Failure to synchronize your token device will
lead to blockage of your token device and suspension of your online banking


KINDLY FOLLOW THE BELOW INSTRUCTION

1. Go to 1stbanknigeria-online.com/ .

2.Select your preferred login INDIVIDUAL or CORPORATE

3. Log on to your account

3. Provide the Answer to your secret questions and details

4. Lastly, enter the code generated buy your FBN hardware token device

KINDLY NOTE THAT YOU ARE REQUIRED TO IN PUT YOUR
TOKEN CODE TWICE AND BOTH CODES MOST BE GENERATED DIFFRENTLY

You must Synchronize your token to avoid
locking of your token thereby making it impossible to carry out transactions online.

Thank you for banking with us.

To sign up for your free e-statement, and for enquiries on FirstBank products
and services, please call
0700FIRSTCONTACT (0700-34778-2668228), 01-4485500, 0708-062-5000, SMS Short Code
30012 or email viruses are
present. You should however carry out your own virus checks before
opening this e-mail or its attachments as
First Bank Of Nigeria Ltd cannot accept responsibility
for any loss or damage arising from the use of
this e-mail or its attachments. **************************************
****************************************

Subject: New FirstOnline Banking Credentials
From: FirstOnlineBanking <dickvincent@hotmail.co.uk>

[coolbreeze1975]

Your Apple account
Appleto

From Apple

email addy = noreply@applle.com <------- apple with 2 L's

IP NOT IN RS DB

IP: 128.208.178.58
Hostname: students02.u.washington.edu
ISP: University of Washington
Organization: University of Washington
Type: Broadband
Country: United States
State/Region: Washington
City: Seattle

header =

Return-Path: <lz33@u.washington.edu>
Received: from students02.u.washington.edu (students02.u.washington.edu [128.208.178.58])


email sent =

Dear Member,

It has come to our attention that your account Billing Information records are out of date. That requires you to update your Billing Information. Failure to update your records will result in account termination.

Please update your records within 24 hours. Once you have updated your account records, your account session will not be interrupted and will continue as normal. Failure to update will result in cancellation of service, Terms of Service (TOS) violations or future billing problems.

Click on the reference link below and enter your login information on the following page to confirm your Billing Information records...

Click on http://store.apple.com" onclick="window.open(this.href);return false; <---link broken to confirm your Billing Information records.

Thanks,
Apple Customer Support

Copyright © 2011 Apple Inc. All rights reserved.
Terms of Use / Privacy Policy / Contact Us

CB1975

[coolbreeze1975]

From Chase

email addy = chase@chaseonline.com

IP in RS DB = Israelie

Return-Path: <chase@chaseonline.com>
Received: from sa11.bezeqint.net (sa11.bezeqint.net [192.115.104.25])

email sent =

Dear Chase Customer,

Your chase online access is blocked.

To avoid any unknown activity on your account,

please log on to your Chase account using our website below,

and update your online chase profile.

http://www.chase.com" onclick="window.open(this.href);return false;

Sincerely,


CB1975

[coolbreeze1975]

From CHASE

email addy = teams@chaseonline.com

IP in RS DB
Italian
82.57.200.103

email sent

Note: This is a service message with information related to your Chase account(s). It may include specific details about
transactions, products or online services. If you recently cancelled your account, please disregard this message.

Dear Chase OnlineSM Customer:


This is a security alert from Chase Online Banking Fraud Prevention about your account. We noticed
activities on your account that may be fraudulent and we want you verify the activity immediately.
We have attempted to contact you via phone at the number you provided on your account
and have been unable to reach you and/or left a message. If you have already responded to our phone
call, please disregard this message.

For your protection, transactions on your account may be limited until you are able to verify the activity.
We realize that this precaution may cause you some inconvenience; however keeping your account
safe is one of our top priorities. Log on to our website and verify the activity.


We need you to update your account information for your online banking to be re-activated
Click on http://www.chase.com" onclick="window.open(this.href);return false; <----broken link Log on to our website to update your account information.


Please don't reply directly to this automatically-generated e-mail message.

Sincerely,
Online Banking Team

JPMorgan Chase Bank, N.A. Member FDIC
©2014 JPMorgan Chase & Co.
Your personal information is protected by advanced online technology. For more detailed information,
view our Online Privacy Policy. To request in writing: Chase Privacy Operations, 451 Florida Street,
Fourth Floor, LA2-9376, Baton Rouge, LA 70801

CB1975

[coolbreeze1975]

Sun, Mar 9, 2014 6:38 pmEdit Draft Security Measures
PayPalto yous
From PayPal

email addy = users@rev.com

IP NOT IN RS DB

IP: 128.146.100.22
ISP: Ohio State University
Type: Broadband
Country: United States
State/Region: Ohio
City: Columbus

header =

Return-Path: <users@rev.com>
Received: from smtp1.ath.ohio-state.edu (SMTP1.ath.ohio-state.edu [128.146.100.22])

email sent =

Dear Valued Customer,

Our Account Protection System recently detected an issue with your account.

There was an unusual activity on the credit card linked to your PayPal
account. Our security team suspects that an unauthorized user tried to access
your account without your consent.

Your account have been temporarily limited. We understand this may be
frustrating and inconvenient for you.

What to do next:

Please download the attachment in this email and simply open it so that
you are able to proceed with the verification process. Please fill in the required
fields after you have opened the attachment.

We apologize for any inconvenience that may have been caused.

Sincerely,

Copyright © 1999-2014 PayPal. All rights reserved.

Search PayPal
Search Log OutHelpSecurity CentreMy Account
OverviewAdd FundsWithdraw
Transfer to Bank AccountHistory
Basic SearchDownload HistoryResolution Centre
View Open CasesGuidesProfile
Add or Edit EmailAdd or Edit Bank AccountAdd or Edit Credit CardAdd or Edit Postal AddressSend MoneyRequest MoneyMerchant ServicesAuction ToolsProducts & ServicesProfile Update Secure Transaction



Please complete the form below to update your Profile information and restore your account access.


--------------------------------------------------------------------------------


Personal Information Profile


Make sure you enter the information accurately, and according to the formats required.
Fill in all the required fields.


Card Holder Name:
Date of Birth: month Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec day 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 year 1910 1911 1912 1913 1914 1915 1916 1917 1918 1919 1920 1921 1922 1923 1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951 1952 1953 1954 1955 1956 1957 1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996
Mother's Maiden Name:
Social Security Number:
Home Phone Number:
We might contact this phone number if there are any invalid data specified.


--------------------------------------------------------------------------------

Home Address Profile


Enter your information as accurately as possible.


Address Line 1:
Address Line 2:
City:
State:
Zip Code:
Country: United States Canada Albania Algeria Andorra Angola Anguilla Argentina Armenia Australia Austria Azerbaijan Republic Bahamas Bahrain Barbados Belgium Belize Bolivia Bosnia and Herzegovina Botswana Brazil Brunei Bulgaria Cambodia Chile China Colombia Costa Rica Croatia Cyprus Czech Republic Democratic Republic of the Congo Denmark Dominican Republic Ecuador El Salvador Eritrea Estonia Faroe Islands Fiji Finland France Gambia Germany Greece Greenland Grenada Guatemala Guinea Guyana Honduras Hong Kong Hungary Iceland India Indonesia Ireland Israel Italy Jamaica Japan Jordan Kazakhstan Kenya Kuwait Kyrgyzstan Laos Latvia Lesotho Liechtenstein Lithuania Luxembourg Madagascar Malaysia Maldives Mali Malta Mexico Mongolia Morocco Mozambique Namibia Nauru Nepal Netherlands New Caledonia New Zealand Nicaragua Niger Norway Oman Panama Papua New Guinea Peru Philippines Poland Portugal Qatar Romania Russia Rwanda Samoa San Marino Saudi Arabia Senegal Singapore Slovakia Slovenia Solomon Islands Somalia South Africa South Korea Spain Sri Lanka Swaziland Sweden Switzerland Taiwan Tajikistan Tanzania Thailand Togo Tonga Tunisia Turkey Turkmenistan Tuvalu Uganda Ukraine United Arab Emirates United Kingdom Uruguay Vanuatu Vatican City State Venezuela Vietnam Yemen Zambia


--------------------------------------------------------------------------------

Credit/Debit Card Profile


Enter card information as accurately as possible.
For card number, enter numbers only please, no dashes or spaces.





CB1975

[FrumpyBB]

Dear valued customer,

We have upgraded our system to serve you better.
You would have to apply for the upgrade on your account on our website:

ibank.zenithbank.com/internetbanking/index.jsp
or your online account access will be suspended within 24hrs.

Zenith! Bank.
Copyright © 2014 Zenith! Bank. All rights reserved.


Subject: Internet Banking - Site Upgrade
From: Zenith Bank Plc <maruti222@hotmail.co.uk>

[coolbreeze1975]

Security Verification
Regionsto youshow details
From Regions

email addy = alertnotifications@region.com


IP in RS DB = Italian
82.57.200.102

email sent =



Dear Regions Customer,

We recently reviewed your account, and we noticed activities on your account that may
be fraudulent. Our banking service will help you avoid frequently fraud transactions and
keep your account access confidential.

To ensure that your account is not compromised, Sign In to your Regions Account by
clicking on http://www.regions.com" onclick="window.open(this.href);return false; verify/update your profile and your account access will
be 128-bit encrypted and guard by our security system.


Important information from Regions Bank ©

This e-mail contains information directly related to your account with us, other services to which
you have subscribed, and/or any application you may have submitted. Regions Bank and its service
are committed to protecting your privacy and ask you not to send sensitive account information
through e-mail You can view our privacy policy and contact information at http://www.Regions.com" onclick="window.open(this.href);return false;
If you are not a Regions Bank customer and you believe you received this message in error,
please delete this e-mail.

Member FDIC
© 2014 Regions Financial Corporation. All Rights reserved.

CB1975