Password phishing emails originating from West Africa

[FrumpyBB]

Suspicious Login Alert
FirstOnline
Dear user,
You successfully logged into your Firstonline profile on 26 July, 2015 in CHINA
If you did not initiate this login, follow our site here immediately ibank.firstbanknigeria. com/
.First Bank keeps you instantly informed about login activities on your account.
To add security features to your account, sign in through here ibank.firstbanknigeria. com/Security
Thank you for choosing First Bank, Your Bank.

The Information contained and transmitted by this E-MAIL is proprietary to First Bank and/or its Customer and is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or exempt from a disclosure under applicable law.
If this is a forwarded message, the content of this E-MAIL may not have been sent with the authority of the Bank. First Bank shall not be liable for any mails sent without due authorisation or through unauthorised access.
If you are not the intended recipient, an agent of the intended recipient or a person responsible for delivering the information to the named recipient, you are notified that any use, distribution, transmission, printing, copying or dissemination of this information in any way or in any manner is strictly prohibited.
If you have received this communication in error, please delete this mail and notify us immediately at firstcontact@firstbanknigeria.com.


Return-Path: <streetdeypay@server88-208-236-94.live-servers.net>
X-Originating-IP: [88.208.236.94]
From: =?utf-8?Q?FirstOnline?= <jescalante@latinmediacorp.net>
Subject: =?utf-8?Q?Suspicious=20Login=20Alert?=

[FrumpyBB]

Email security notice!
People
Yahoo alert!!
Your email account has been logged in to an unknown device.
Your email will be blocked within Hours if you don't verify your account.

You are required to verify your password to continue sending and receiving messages.
RE-Verify to continue receiving massages

Please follow the links below to keep your Google account safe

RE-Activate second sign-in.

Thanks

Copyright 2015 Yahoo! Inc.



Return-Path: <afolagboyeemmanuel@gmail.com>
Subject: Email security notice!
From: "Yahoo alert!!" <afolagboyeemmanuel@gmail.com>
To: undisclosed-recipients:;

[coolbreeze1975]

From Customer service

email addy = account@update.com

ip not in RS DB - I will post

General IP Information
IP: 84.246.226.199
ISP: ELB multimedia
Continent: Europe
Country: France

header =

Return-Path: <frambatc@machine8.ayrade.net>
Received: from machine8.ayrade.net (machine8.ayrade.net [84.246.226.199])

email

Your AOL account has been limited until we hear from you

[coolbreeze1975]

Your USAA Online Confirmation Alert
From USAA

email addy= frank.monaco@rcn.com

ip not in rs db - i will post to mf

IP: 204.127.217.101
ISP: AT&T Services
Organization: ITODC Pool ATTCT-FRFCA
Continent: North America
Country: United States
State/Region: New Jersey

header =

Return-Path: <frank.monaco@rcn.com>
Received: from fmailhost01.isp.att.net (fmailhost01.isp.att.net [204.127.217.101])



USAA Member Home


Dear USAA Customer,


We're currently upgrading our systems to bring enhanced features to your USAA Account experience. As a result, your account is temporarily unavailable.

Please download the file attached and upgrade your USAA Account to our new system.

Note: FAIL TO UPGRADE YOUR ACCOUNT, IT WILL BE AUTOMATICALLY CLOSED.

After this step, you are permitted to access your usaa.com.

Sincerely,
Customer Service Team.
Copyright © 2015 USAA.

[coolbreeze1975]

Chase Account Has Been Suspended
From Chase chase@bell.ca

ip not in rs db - I will post to MF

IP: 209.226.175.47
ISP: Bell Canada
Continent: North America
Country: Canada
State/Region: Ontario
City: Ottawa

header =

Return-Path: <chase@bell.ca>
Received: from toip48.srvr.bell.ca (toip48.srvr.bell.ca [209.226.175.47])

email

Dear User,

You are required to follow instructions in [attached file to
validate your account to avoid suspension.

Chase Online Team

[coolbreeze1975]

Wells Fargo Account Alert: Violation of policy
From Wells Fargo Customer Service

email addy = hs497@cornell.edu

ip not in rs db - I will post to MF

IP: 24.101.101.59
ISP: Armstrong Cable Services
Continent: North America
Country: United States
State/Region: Pennsylvania
City: Evans City

header

Return-Path: <hs497@cornell.edu>
Received: from [192.168.1.10] (dynamic-acs-24-101-101-59.zoominternet.net. [24.101.101.59])

email

Dear Customer,

We've limited certain features from your Wells Fargo account, due to many changes of contact address and violation of policy.

Please note: This limitation is to protect your Wells Fargo account details.

We implore you to confirm your account by clicking MY ACCOUNT to avoid account been suspended

Sincerely,

Wells Fargo® Customer Service

[coolbreeze1975]

From USAA

email addy = frank.monaco@rcn.com

ip not in rs db - i will post to mf

IP: 204.127.217.101
ISP: AT&T Services
Continent: North America
Country: United States
State/Region: New Jersey
City: Holmdel


header =

Return-Path: <frank.monaco@rcn.com>
Received: from fmailhost01.isp.att.net (fmailhost01.isp.att.net [204.127.217.101])

email



USAA Member Home


Dear USAA Customer,


We're currently upgrading our systems to bring enhanced features to your USAA Account experience. As a result, your account is temporarily unavailable.

Please download the file attached and upgrade your USAA Account to our new system.

Note: FAIL TO UPGRADE YOUR ACCOUNT, IT WILL BE AUTOMATICALLY CLOSED.

After this step, you are permitted to access your usaa.com.

Sincerely,
Customer Service Team.
Copyright © 2015 USAA.

[FrumpyBB]

Reply-To: mail@service.com
Subject: Email Alert Notification
From: Yahoo Account Update <victoronitilo@gmail.com>
To: undisclosed-recipients:;



Yahoo


Dear E-mail Client,

You have exhausted the 5GB Bandwidth of your email account and for this reason some of your incoming mails with files and documents above 50KB have been filtered and placed pending.

Your e-mail account's Bandwidth has been upgraded to 10GB to enable us serve you better. Kindly Click on the below link to complete the upgrade on your account in order to receive your pending mails and enjoy better quality and efficient service delivery.

Follow this link to complete the process: CLICK HERE


Once the information provided matches the records on our database, your account will function normal again.

Sincerely,

Mail Service Team.
****************************************************************************************** *****************************************************************************************
Disclaimer:

The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information.If you are not the intended recipient of this message any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited and your are requested to notify the sender & delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly forbidden.

[IceFM]

A DEPOSIT in the amount of $724.90 is verified APPROVED.


We got the update that you have wanted so much to hear!

You are now certified to get your daily commission as its already approved
by our dependable system:

uswomanssoccer.com

What you need to do now is follow the above link within 24 hours upon
receiving it.

All the best for you & thanks a million,

[IceFM]

Send Money Worldwide
Mrs. Rosemary Nwetego
Address; 15 Ayibate Zogbo
Republique du Benin.
Tel; +229 68322291

To The Attention Of Beneficiary:


This is from Internal Revenue Service (IRS) We have finally finalized the transfer of your total fund of 4,500,000.00 million usd click here to (finance.safecashzone.top) then lo-gin your current email address and your correct email password then click login now to claim your fund without anymore delay.

NOTE: IF YOU FINE THIS MESSAGE IN YOUR SPAM FOLDER PLEASE MOVE IT TO YOUR INBOX , SO THE LINK WILL BE ABLE TO WORK
Thank you

Yours in service,
Mrs. Rosemary Nwetego.
Western Union® Benin Republic

[FrumpyBB]

Yahoo! Mail

Dear User,

Your Account was recently signed in from a unknown Location, please Verify Here for verification to avoid account closure. dragon.co.id/wp-admin/network/money/updateY!.html <<<== evil linky! bad bad bad!

Sincerely,.

Yahoo.


Received: from mtaout-mce02.mx.aol.com (mtaout-mce02.mx.aol.com [172.29.27.206])
Received: from I-PC (unknown [154.120.103.122])
From: "Mail Office" <Supsuz@aol.com>
Subject: Mail Suspended!

[FrumpyBB]

Dear ,

You have exceeded your email storage capacity.
0.3bits is all you have and cannot be able to receive emails with attachment or send emails.
Click here to add up free 20GB storage.
If not gotten from you in the next 24 hours, We shut down your mail account,

Until after proper verification before you can access you mail account again...

Thanks.
Domain Security 2014/2015.

Return-Path: <www-data@srv01.ceocal.co>
X-Originating-IP: [190.0.46.251]
Received: from 127.0.0.1 (EHLO srv01.ceocal.co) (190.0.46.251)
Received: by srv01.ceocal.co (Postfix, from userid 33)
Subject: You've Exceeded The Storage Limit For Your Mailbox
X-PHP-Originating-Script: 33:Anyi1God.php
From: Mail Service < no-reply@microsofts.com>
Reply-To: no-reply@microsofts.com
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: ceocal.miportal.co

[IceFM]

...... I don't have GMX-account................

Dear Account Owner,

It has come to our notice that your email has not passed the verification/Update process that we are presently working on. We are currently upgrading our data base and e-mail account center .We are deleting all gmx email account to create more space for new accounts. To prevent your account from closing you will have to update it so that we will know that it's a present used account. To complete your account re-confirmation, you must reply to this email immediately and enter your account details as requested below.

*********************************************

Email User-name :
EMAIL Password :
Date of Birth :
Country or Territory :

This updating is compulsory as a result of our recent server changes. If you fail to update your email address you will soon be unable to receive/send mails.Also your email will not be equipped with the latest anti-virus system in our new servers. This will make your email and PC vulnerable to virus attacks from the internet.

Warning!!! Account owner that refuses to update his/her account after two days of receiving this message will lose his or her account permanently.

Thanks for your co-operation,
GMX CUSTOMER SERVICE

[FrumpyBB]

My "Your Yahoo box is full!" emails always come from "aol"
Your "Bank of America" uses Googlemail to "warn" you your GMX account is full.
A soap opera couldn´t be better written

[IceFM]

Dear esteemed customer,

Your payment is ready.

Below is the payment information made to your account through our telegraphic wire transfer platform as agreed by your representative and the board of overdue payment organization. It is strongly recommended that you manually complete the transaction to avoid wrong payment. To complete transaction, please
Click complete transaction

Customer Code: 1.23713072
Amount: $4,500,700.00 USD
Transaction ID: 000025744702

Take one minute of your time to complete this online transaction by clicking this secure web page link and filling the information required.
complete transaction

Thank you for banking with us.

United bank Limited UK.
82 Ilford Lane Ilford Essex IG1 2LA
Telephone: 020 89110123
Fax: 020 84788634.