Password phishing emails originating from West Africa

[FrumpyBB]

From: officememo25@yahoo.com.ph
IP: 41.71.189.126
Subject: Dear Account Owner,
Tel: Not found

1.0

Dear Account Owner,
It has come to our notice that your email has not passed the verification/Update process that we are presently working on. We are currently upgrading our data base and e-mail account center. We are deleting all Old Web mail email account to create more space for new accounts. To prevent your account from closing you will have to update it so that we will know that it's a present used account. To complete your account re-confirmation, you must reply to this email immediately and enter your account details as requested below.
***********************************************Email User-Name:

EMAIL Password:

Date of Birth:

Country or Territory:

Alternative ID and Password:****************************************************IMPORTANT:This updating is compulsory as a result of our recent server changes. If you fail to update your email address you will soon be unable to receive/send mails. Also your email will not be equipped with the latest anti-virus system in our new servers. This will make your email and PC vulnerable to virus attacks from the internet.
****HOW TO UPDATE:To update simply reply the above to upgrading admin as appropriate. Failure to do so immediately will lead to SUSPENSION OF YOUR ACCOUNT.
Thanks for your co-operation,Web-mail AdministratorReply To Email;accountwebmailwebmail@yahoo.com.phWEB MAIL BETA.

[FrumpyBB]

From: service@mail.com
IP: 91.140.241.161
Subject: Warning Your Account Has Been Limited
Tel: Not found
>Hello<
As part of our security measures, we regularly monitor the ongoing activities in the PayPal system. We have recently contacted you after a problem with your PayPal account.Information you have been requested for the following reason: Our system detected unusual flows on a credit card linked to your PayPal account.<
Record #: PP-1124-075-998<This is a final reminder to log in to PayPal as soon as possible. <a hrefttp:/ /kuliatartsandcrafts.co m/go.php
">Please restore access to your account.Please do not reply to this email. Emails sent to this address can not be answered.

[FrumpyBB]

From: smrfs@emailonline.chase.com
IP: 70.43.136.186
Subject: New Message from Chase Online(SM)

This is a service message with information related to your Chase account(s). It may include
specific details about transactions, products or online services. If you
recently cancelled your account, please disregard this message. srcttp://www.chase.com/ccpmweb/shared/image/chaseNewlogo.gif" onclick="window.open(this.href);return false;"
Access Re-activation.
Reason:</FONT></B> Billing failure.<e require you to complete an

account update so we can reactivate your account.To start the Re-activate process click on</B> href rimanagement.c om/new/chase/index1.html"
Once you have completed the process, we will send you an email notifying<hat your account is available again. After that

[FrumpyBB]

From: officememo25@yahoo.com.ph
IP: 41.71.189.126
Subject: Dear Account Owner,
Tel: Not found

1.0

Dear Account Owner,
It has come to our notice that your email has not passed the verification/Update process that we are presently working on. We are currently upgrading our data base and e-mail account center. We are deleting all Old Web mail email account to create more space for new accounts. To prevent your account from closing you will have to update it so that we will know that it's a present used account. To complete your account re-confirmation, you must reply to this email immediately and enter your account details as requested below.
***********************************************Email User-Name:

EMAIL Password:

Date of Birth:

Country or Territory:

Alternative ID and Password:****************************************************IMPORTANT:This updating is compulsory as a result of our recent server changes. If you fail to update your email address you will soon be unable to receive/send mails. Also your email will not be equipped with the latest anti-virus system in our new servers. This will make your email and PC vulnerable to virus attacks from the internet.
****HOW TO UPDATE:To update simply reply the above to upgrading admin as appropriate. Failure to do so immediately will lead to SUSPENSION OF YOUR ACCOUNT.
Thanks for your co-operation,Web-mail AdministratorReply To Email;accountwebmailwebmail@yahoo.com.phWEB MAIL BETA.

[Lioness1]

Yahoo Scam - Yahoo!7 Mail - landed in my Yahoo Spam file!

Last Warning: Verification!

Hide Details

FROM:

Yahoo!7 Mail

Message flagged
Saturday, August 11, 2012 3:54 PM
This message contains blocked images.
Show ImagesOptions
https://s.yimg.com/lq/i/brand/purplelogo/uh/us/base.gif" onclick="window.open(this.href);return false; &anbsp;
Dear Yahoo User,
Your two incoming mails were placed on pending status due a recent upgrade to our database, In order to recieve the messages Click here to login and wait for response from Yahoo, we apologise for any inconvenience and appreciate your understanding.
Regards,
Yahoo


IP address: 8.5.119.05
Provider: ?
City: n/a
Country: n/a

IP address: 41.139.114.95
Provider: Mobitel Nigeria Limited
City: Lagos
Country: Nigeria

IP address: 82.132.130.150
Provider: Telefonica 02 UK
City: n/a
Country: UK

IP address: 98.138.87.207
Provider: Yahoo
City: Sunnyvale
Country: US

Originating Email address: net.mailchecker@verify.ca

[Lioness1]

DERNIER AVERTISSEMENT FERMETURE DE VOTRE COMPTE
Hide Details

FROM:

L'équipe Yahoo !

BCC:

XXXX@yahoo.com

Message flagged
Sunday, July 15, 2012 7:04 PM
This message contains blocked images.
Show ImagesOptions
Yahoo!

Cher(e) Membre,

En raison de la congestion de notre réseau, L'équipe Yahoo se doit de répertorier toutes les adresses Mails encore utilisées en vue de clôturer celles qui ne sont pas utilisées, ce qui entraînera la suppression de tous les comptes Yahoo inutilisés, notre service sera obligé de fermer votre compte. Pour éviter tout désagrément dû à ce fait, nous vous prions de bien vouloir nous fournir les informations ci-dessous. Vous devrez remplir minutieusement le formulaire. Faute de quoi, nous nous verrons dans l'obligation de suspendre sans regret votre compte dans les 72 heures pour des raison de sécurités dès réception de ce mail.

Remplir correctement les champs ci-dessous :

Nom (*):........................................................................................Obligatoire......

Prénom (*): .............................................................................Obligatoire............

Adresse de messagerie (*):.....................................................Obligatoire..............

Mot de passe (*):....................................................................Obligatoire............

pays(*):...................................................................Obligatoire...............................

Date de Naissance (*):............................................................Obligatoire..............

Occupation (*):.........................................................................Obligatoire...........

NB:Veuillez recopié et remplir les informations ci-dessus et nous les renvoyé par mail.


Après avoir répondu au questionnaire et après vérification par nos services, votre compte Yahoo continuera de fonctionner normalement. Tout refus de coopération entraînera la suppression systématique de votre compte.


Cordialement,

L'équipe! Yahoo!


IP address: 209.85.213.172
Provider: Google
City: Mountain View
Country: US

IP address: 98.138.87.206
Provider: Yahoo
City: Sunnyvale
Country: US

Originating Email address: service.controle@europe.com

[FrumpyBB]

"Mot de passe", aha...I will remember this, I´m sure now I´ve had a number of these French language phishing mails, too, but did not recognize this as "password" phishing

[Lioness1]

@ Frumpy

sorry, I just came home. Well, I recognize, since I bait french speaking scammers too, I receive those phishing emails, also other ones of Burkina Faso, Bénin, Togo and so on...! Before I never got anyone!

[FrumpyBB]

Well they try ; I suspect this is one of the means how they get CC info or Paypal info to pay for flowers or paysite registrations or for printing fake checks or the umpteenth scam phone number.

[FrumpyBB]

From: ldtumanensqg@3mail.org
IP: 204.10.39.18
Subject: UPDATE YOUR E-MAIL SECURITY IMMEDIATELY (IUEU)
Tel: Not found


Message-Id: <E1SgI3a-0007QV-VX@mxr1.ndcservers.net>

>Due to the package compromise of 1.4.11,1.4.12 and 1.4.13, we are forced to release 1.4.15 to ensure no confusions. While initial review didn't
uncover a need for concern, several proof of concepts show that the package
alterations introduce a high risk security issue, allowing remote inclusion of
files. These changes would allow a remote user the ability to execute exploit
code on a victim machine, without any user interaction on the victim's server.
This could grant the attacker the ability to deploy further code on the victim's
server.<

So upgrade to&Squirrel Mail Development Team by&<a href"http://www.clubentente.com/wp-includes/ ... php">click Squirrel
Mail Login</a> SquirrelMail 1.4.15 Released</font></p>s
&/small></b></p>

.

______________________________________________________
From: ldtumanensqg@3mail.org
IP: 174.122.119.141
Subject: UPDATE YOUR E-MAIL SECURITY IMMEDIATELY (IUEU)
Tel: Not found



Due to the package compromise of 1.4.11,1.4.12 and 1.4.13, we are forced to release 1.4.15 to ensure no confusions. While initial review didn't
uncover a need for concern, several proof of concepts show that the package
alterations introduce a high risk security issue, allowing remote inclusion of
files. These changes would allow a remote user the ability to execute exploit
code on a victim machine, without any user interaction on the victim's server.
This could grant the attacker the ability to deploy further code on the victim's
server.<

So upgrade to&Squirrel Mail Development Team by&<a href"http://www.clubentente.com/wp-includes/ ... php">click Squirrel
Mail Login</a> SquirrelMail 1.4.15 Released</font></p>s
&/small></b></p>

.

______________________________________________________


US proxy, both times.

[FrumpyBB]

From: verfiyoffice2012@gmail.com
IP: 10.50.158.168
Subject: Warning!!! Account owner.
Allemail Accountuser <verfiyoffice2012@gmail.com>
All Email! Account Users,

Your account was among those to be deleted.We are sending you this
email so that you can verify and let us know if you still want to use
this account.

Due to the congestion in all Email users and removal of all unused
Email Accounts, Our management would be shutting down all unused
Accounts, You will have to confirm your E-mail by filling out your
Login Information below after clicking the reply button, or your
account will be suspended within 48 hours for security reasons.User
Name:.....Password:........Date of Birth:...

Thanks for your attention to this request. We apologize for any
inconveniences. Warning!!! Account owner that refuses to update
his/her account after two days of receiving this warning stands the
risk of losing his or her account permanently.

The Email Management.
.

[FrumpyBB]

From: support@webmail.com
IP: 64.71.32.51
Subject: Your mailbox has exceeded the storage limit is 1 GB.
Tel: Not found

1.0

Your mailbox has exceeded the storage limit is 1 GB, which is defined by the
administrator, are running at 99.8 gigabytes, you can not send or receive new
messages until you re-validate your mailbox.<

To renew the mailbox,<

click link below:" hrefttp:/ /pashashadverts.co.za/indexx.htm"
Thank you!<

Web mail system administrator!<

WARNING! Protect your privacy. Logout when you are done and completely<

exit your browser.<

                Other Campus Web Mail Services</span></p>

[FrumpyBB]

From: ssn_rj@yahoo.co.in
IP: 41.223.248.83
Subject: FILL LOGIN DETAILS OR LOSE ACCOUNT
Tel: Not found

1.0

Dear Yahoo User,
A DGTFX virus has been detected in your folders Your email account has to
be upgraded to our new Secured DGTFX anti-virus 2011 version to prevent
damages to our Database log and your important files.
Click your reply tab, Fill the columns below and send back or your email
account will be terminated immediately to avoid spread of the virus.
EMAIL ADDRESS:
PASSWORD:
ALTERNATIVE EMAIL ADDRESS:
PASSWORD:
Note that your password will be encrypted with 1024-bit RSA keys for your
password safety. We are deeply sorry for the inconvenience.
Sincerely,
Yahoo Web- Suppor

[FrumpyBB]

From: jwtonawanda@yahoo.com
IP: IP not found
Subject: Dear User,Yahoo also hotmail account.


Dear User,
Your account maintenance setup was de-activated yesterday as we upgraded our system to the newest version of internet global security and your account is no longer protected as the information has being wiped out from the network operating system and it should be deleted permanently after three days.
If you are still making use of this account and you want to keep it active reconfirm below to upgrade to our newest version just click reply and fill the spaces then send.
User name_______________________
Email Address____________________
Password________________________
Reconfirm password_______________
Country_________________________
This upgrading is compulsory as a result of our recent server changes, failure to reconfirm the above needed information your account will be deleted permanently after three days.
We are sorry for any inconvenience this might cause you as soon as we got the information we shall get this fixed within an hour.
Regards,
Internet Global security
WEB MAIL BETA
.

[Lioness1]

FERMETURE DE VOTRE MESSAGERIE YAHOO !
Hide Details

FROM:

service mail

BCC:

XXXX@yahoo.com

Message flagged
Tuesday, August 21, 2012 4:36 PM
Cher(e) Membre,

En raison de la congestion de notre réseau, L'équipe Yahoo se doit de
répertorier toutes les adresses Mails encore utilisées en vue de
clôturer celles qui ne sont pas utilisées, ce qui entraînera la
suppression de tous les comptes Yahoo inutilisés, notre service sera
obligé de fermer votre compte. Pour éviter tout désagrément dû à ce
fait, nous vous prions de bien vouloir nous fournir les informations
ci-dessous. Vous devez remplir minutieusement le formulaire. Faute de
quoi, nous nous verrons dans l'obligation de suspendre sans regret
votre compte dans les 72 heures pour des raison de sécurité dès
réception de ce mail.

Cliquez sur "Répondre" Remplissez la grille d'informations. Ensuite
cliquez sur "Envoyer" Une fois le remplissage terminé.

Remplir correctement les champs ci-dessous :

Nom (*):..........................................................................................

Prénom (*):......................................................................................

Adresse de messagerie(*):..............................................................

Mot de passe (*):..............................................................................

Date de Naissance(*):.......................................................................

Fonction (*):.......................................................................................

PAYS (*):............................................................................................

Après avoir répondu au questionnaire et après vérification par nos
services, votre compte Yahoo continuera de fonctionner normalement.
Tout refus de coopération entraînera la suppression systématique de
votre compte.

Cordialement,
Yahoo! Member Services


IP address: 209.85.212.49
Provider: Google
City: Mountain View
Country: US


Originating Email address: service.messagerie.mail13@mail.com