From Wells Fargo
email addy = konrad.rolf@t-online.de.
IP in RS DB
194.25.134.81
email
Dear Client:
We recently have determined that different computers have tried to log in to your account.
Multiple password failures automatically places your account on hold.
We now need you to re-confirm your account information to us.
To remove limitations from your account click on the following link:
online.wellsfargo.com
We are currently investigating this issue.
Thank you for being our customer.
Password phishing emails originating from West Africa
-
coolbreeze1975
- R.I.P.
- Posts: 13721
- Joined: Thu Nov 10, 2011 4:38 pm
- Location: Somewhere over the rainbow with a Martini, stirred, not shaken
Re: Password phishing emails originating from West Africa
CB1975“Health is like money, we never have a true idea of its value until we lose it.” ~Josh Billings
-
coolbreeze1975
- R.I.P.
- Posts: 13721
- Joined: Thu Nov 10, 2011 4:38 pm
- Location: Somewhere over the rainbow with a Martini, stirred, not shaken
Re: Password phishing emails originating from West Africa
From Wells Fargo
email addy = hempel-ingrid@t-online.de
Same IP as my last post
email
Dear Customer
Due to concerns, for the safety and integrity of Wells
Customer we have issued this warning message.
It has come to our attention that your Wellsfargo account information needs to be
updated as part of our continuing commitment to protect your account and to
reduce the instance of fraud on our website.
UPDATE-NOW
Thank You.
Wells Fargo
Account Service Team
email addy = hempel-ingrid@t-online.de
Same IP as my last post
Dear Customer
Due to concerns, for the safety and integrity of Wells
Customer we have issued this warning message.
It has come to our attention that your Wellsfargo account information needs to be
updated as part of our continuing commitment to protect your account and to
reduce the instance of fraud on our website.
UPDATE-NOW
Thank You.
Wells Fargo
Account Service Team
CB1975“Health is like money, we never have a true idea of its value until we lose it.” ~Josh Billings
-
IceFM
- Moderator
- Posts: 100082
- Joined: Fri Nov 16, 2007 10:06 am
- Location: .... on the Baltic Beach
Coach Wootten's Basketball Camp; <camp@coachwootten.com>
I didn't know that I've son from 8 years who plays Basketball........ 
..... this Camp really exist!
coachwootten.com/
Thank You XXXXXXXXXXXXXXXXXX
Transaction ID: 872796398
We have just received a payment in the amount of $150.00 for your registration for Father / Son Overnight.
Details of your registration:
First Name: Jordan
Last Name: XXXXXXXXXXX
Email: XXXXXXXXXXXX
Date of Birth: 8/18/06
School name: Walter J. Mitchell Elementary
School State: MD
School Zip Code: 20646
Grade entering 2015-2016 School year: 4th
Address: 709 Edelen Station Place
City: La Plata
State: MD
Zip: 20646
Father\'s Name: XXXXXXXXXXXXXXXXX
Father\'s Date of birth: 8/6/81
Medical History (check all that apply):
Explain if you checked any boxes above:
Insurance Company: Tricare Prime
Insurance Policy Holder: United States Navy
Policy Number:
Insurance Group Number:
Physician name:
Physician phone:
Consent to release: Yes,
Medication (reason, dosage, timing, camper is required to have one dosage before camp):
The above-listed medication(s) may be given to the above-named camper:
Check payment status or make another payment online
..... this blue Part is original a Link
..... this Camp really exist!
coachwootten.com/
Thank You XXXXXXXXXXXXXXXXXX
Transaction ID: 872796398
We have just received a payment in the amount of $150.00 for your registration for Father / Son Overnight.
Details of your registration:
First Name: Jordan
Last Name: XXXXXXXXXXX
Email: XXXXXXXXXXXX
Date of Birth: 8/18/06
School name: Walter J. Mitchell Elementary
School State: MD
School Zip Code: 20646
Grade entering 2015-2016 School year: 4th
Address: 709 Edelen Station Place
City: La Plata
State: MD
Zip: 20646
Father\'s Name: XXXXXXXXXXXXXXXXX
Father\'s Date of birth: 8/6/81
Medical History (check all that apply):
Explain if you checked any boxes above:
Insurance Company: Tricare Prime
Insurance Policy Holder: United States Navy
Policy Number:
Insurance Group Number:
Physician name:
Physician phone:
Consent to release: Yes,
Medication (reason, dosage, timing, camper is required to have one dosage before camp):
The above-listed medication(s) may be given to the above-named camper:
Check payment status or make another payment online
..... this blue Part is original a Link
------------------------------------------------------------------------------------------------------
+++ Я не воюю с Россией +++
+++ The FAQ / FAQ in deutsch +++
+++ Я не воюю с Россией +++
+++ The FAQ / FAQ in deutsch +++
-
IceFM
- Moderator
- Posts: 100082
- Joined: Fri Nov 16, 2007 10:06 am
- Location: .... on the Baltic Beach
Coach Wootten's Basketball Camp; <camp@coachwootten.com>
***This is an automated response - Do Not Reply***
Thank you XXXXXXXXXXX for registering for Father / Son Overnight.
Location:
101 Braddock Road
Frostburg, MD
21532
Phone: 703-867-2433
Google Map: Map and Directions
We hope that you will find this event both informative and enjoyable. Should you have any questions, please contact camp@coachwootten.com.
If you have not done so already, please submit your payment in the amount of $260.00.
Click here to review your payment information View Your Payment Details.
...... again in original a Link
Edit Registration Details
...... also in original a Link
Thank You.
Thank you XXXXXXXXXXX for registering for Father / Son Overnight.
Location:
101 Braddock Road
Frostburg, MD
21532
Phone: 703-867-2433
Google Map: Map and Directions
We hope that you will find this event both informative and enjoyable. Should you have any questions, please contact camp@coachwootten.com.
If you have not done so already, please submit your payment in the amount of $260.00.
Click here to review your payment information View Your Payment Details.
...... again in original a Link
Edit Registration Details
...... also in original a Link
Thank You.
------------------------------------------------------------------------------------------------------
+++ Я не воюю с Россией +++
+++ The FAQ / FAQ in deutsch +++
+++ Я не воюю с Россией +++
+++ The FAQ / FAQ in deutsch +++
-
IceFM
- Moderator
- Posts: 100082
- Joined: Fri Nov 16, 2007 10:06 am
- Location: .... on the Baltic Beach
Internal Revenue Service; <service@irs.gov>
As per a recent change in our Security Regulations, it is hereby required of you to validate some of your personal and employment-related information, that we have on record for you in the IRS database. The change was introduced with the purpose of keeping more up-to-date records of everyone, registered with the Internal Revenue Service.
The validation webpage will remain active for 10 days after you receive this email. Failure to comply with the requirement, outlined above, will result in a fine of $250.00, that will be billed and sent to you within a 7 day timeframe, after missing the 10-day validation timeframe.
To complete the necessary validation, please visit the link below by clicking on it and entering the characters in the image:
--------------------------------------------------------------------------------------------
CLICK HERE TO VALIDATE YOUR INFORMATION WITH THE IRS
--------------------------------------------------------------------------------------------
If clicking the link above does not work, copy and paste the following URL in a new browser window: wlwbands.com/irs/irs.gov/taxpayerverification/returns/index.php
Thank you for your cooperation with this security check.
The Internal Revenue Service (IRS) of the United States of America
Department of Treasury Bureau
The validation webpage will remain active for 10 days after you receive this email. Failure to comply with the requirement, outlined above, will result in a fine of $250.00, that will be billed and sent to you within a 7 day timeframe, after missing the 10-day validation timeframe.
To complete the necessary validation, please visit the link below by clicking on it and entering the characters in the image:
--------------------------------------------------------------------------------------------
CLICK HERE TO VALIDATE YOUR INFORMATION WITH THE IRS
--------------------------------------------------------------------------------------------
If clicking the link above does not work, copy and paste the following URL in a new browser window: wlwbands.com/irs/irs.gov/taxpayerverification/returns/index.php
Thank you for your cooperation with this security check.
The Internal Revenue Service (IRS) of the United States of America
Department of Treasury Bureau
------------------------------------------------------------------------------------------------------
+++ Я не воюю с Россией +++
+++ The FAQ / FAQ in deutsch +++
+++ Я не воюю с Россией +++
+++ The FAQ / FAQ in deutsch +++
-
IceFM
- Moderator
- Posts: 100082
- Joined: Fri Nov 16, 2007 10:06 am
- Location: .... on the Baltic Beach
Dr. Thomas John; <mr.sarawutgan6@yahoo.es>
ATTENTION FUND BENEFICIARY
This is to notify you about the latest development concerning all the consignment boxes that are left in our custody, which yours are inclusive, In the past you where given a bill in order to receive your consignment of which we did not hear from you for sometime now and the Diplomatic Courier who conveyed this consignment box to United States because his visa has expired left for his country about a month ago.
Hence, the custom agency has decided to release all consignment boxes to enable all beneficiaries invest with their consignment box before on MAY 30TH 2015. And we are now offering a Special BONUS to help all our customers that are having their Consignment boxes in our custody due prices. In order words we are now requesting that those involve should pay only the sum of $220 to receive all their payment abandoned in our custody.
Further more you should be aware that we have scanned most of the consignment boxes and the scanned result of ten consignment boxes shows united states currency including yours while other consignment boxes contains family treasures and documentations so you are advised to use this opportunity to receive your consignment box contains ($5.5Million usd)
But remember that after (3DAYS) you did not make the payment then we will divert your consignment to Government treasury department, Again after (THREE DAYS) We will enter A new project for the Month which will make it impossible for you to receive your fund in future and that is the reason why we decided to help all our customers before we enter into the new project.
Below are the information to send the required fee to our office in Nigeria to enable them send us the delivery permit to enable our diplomat agent personal bring your consignment box within 48hours.
Here is the information you will use to send the $220 Via Western Union /Money Gram Or Ria Money Transfer
Receives Name: OKORO UCHECHUKWU
Receives Address: LAGOS NIGERIA
Text Question: TRUST
Text Answer: IN GOD
Amount: $220
MTCN:
Senders Name and Address:
Do let us know you received this email for record purposes and send payment details to our head office?
Thanks for your cooperation
DR THOMAS JOHN,
Acting Commissioner of U.S. Customs and Border Protection
This is to notify you about the latest development concerning all the consignment boxes that are left in our custody, which yours are inclusive, In the past you where given a bill in order to receive your consignment of which we did not hear from you for sometime now and the Diplomatic Courier who conveyed this consignment box to United States because his visa has expired left for his country about a month ago.
Hence, the custom agency has decided to release all consignment boxes to enable all beneficiaries invest with their consignment box before on MAY 30TH 2015. And we are now offering a Special BONUS to help all our customers that are having their Consignment boxes in our custody due prices. In order words we are now requesting that those involve should pay only the sum of $220 to receive all their payment abandoned in our custody.
Further more you should be aware that we have scanned most of the consignment boxes and the scanned result of ten consignment boxes shows united states currency including yours while other consignment boxes contains family treasures and documentations so you are advised to use this opportunity to receive your consignment box contains ($5.5Million usd)
But remember that after (3DAYS) you did not make the payment then we will divert your consignment to Government treasury department, Again after (THREE DAYS) We will enter A new project for the Month which will make it impossible for you to receive your fund in future and that is the reason why we decided to help all our customers before we enter into the new project.
Below are the information to send the required fee to our office in Nigeria to enable them send us the delivery permit to enable our diplomat agent personal bring your consignment box within 48hours.
Here is the information you will use to send the $220 Via Western Union /Money Gram Or Ria Money Transfer
Receives Name: OKORO UCHECHUKWU
Receives Address: LAGOS NIGERIA
Text Question: TRUST
Text Answer: IN GOD
Amount: $220
MTCN:
Senders Name and Address:
Do let us know you received this email for record purposes and send payment details to our head office?
Thanks for your cooperation
DR THOMAS JOHN,
Acting Commissioner of U.S. Customs and Border Protection
------------------------------------------------------------------------------------------------------
+++ Я не воюю с Россией +++
+++ The FAQ / FAQ in deutsch +++
+++ Я не воюю с Россией +++
+++ The FAQ / FAQ in deutsch +++
-
spanky
- Scam Buster
- Posts: 1233
- Joined: Sun Jul 21, 2013 5:45 pm
- Location: USA
Re: Password phishing emails originating from West Africa
Yahoo IP
From: michael michael <michaeltonio101@yahoo.com>
Date: Fri, 29 May 2015
DOCUMENT DELIVERY NOTICE
You have received a Secure Mail from Michael Antonio (michaeltonio101@yahoo.com). Email Encryption Service waiting to be read. The message link will expire in 2 days.
To view the attached files: You will be required to successfully sign in to your Secure Mail to read this message with your valid e-mail and password
Click here to accept Dropbox terms and conditions
From: michael michael <michaeltonio101@yahoo.com>
Date: Fri, 29 May 2015
DOCUMENT DELIVERY NOTICE
You have received a Secure Mail from Michael Antonio (michaeltonio101@yahoo.com). Email Encryption Service waiting to be read. The message link will expire in 2 days.
To view the attached files: You will be required to successfully sign in to your Secure Mail to read this message with your valid e-mail and password
Click here to accept Dropbox terms and conditions
We were not foolish to fall in love with them. Our mistake was not knowing that we fell in love with fools.
-
coolbreeze1975
- R.I.P.
- Posts: 13721
- Joined: Thu Nov 10, 2011 4:38 pm
- Location: Somewhere over the rainbow with a Martini, stirred, not shaken
Re: Password phishing emails originating from West Africa
Damaging records - (3) new posts
From Updated Records
email addy = info@rasterspecials.com
IP NOT IN RS DB - I will post to MF
IP: 209.73.247.200
ISP: Quality Technology Services, N.J., LLC
Country: United States
State/Region: Kansas
City: Overland Park
header =
Return-Path: <info=rasterspecials.com@mail-6-200.emnt.net>
Received: from mail-6-200.emnt.net (mail-6-200.emnt.net [209.73.247.200])
email
Background Search Initiated
the following was released about you 06/17/2015
IMPORTANT: Someone may have browsed for personal information about you online.
Your Active File #001929DDFK3392
Your personal info could be seen by everyone you must see this before its too late
23638 West Lyons Ave. #468, Newhall, CA 91321
Update your preferences here
OHG
4432 Ocean Park Ave. Santa Monica CA 90405 USA
Remove Me | Never Mail
From Updated Records
email addy = info@rasterspecials.com
IP NOT IN RS DB - I will post to MF
IP: 209.73.247.200
ISP: Quality Technology Services, N.J., LLC
Country: United States
State/Region: Kansas
City: Overland Park
header =
Return-Path: <info=rasterspecials.com@mail-6-200.emnt.net>
Received: from mail-6-200.emnt.net (mail-6-200.emnt.net [209.73.247.200])
Background Search Initiated
the following was released about you 06/17/2015
IMPORTANT: Someone may have browsed for personal information about you online.
Your Active File #001929DDFK3392
Your personal info could be seen by everyone you must see this before its too late
23638 West Lyons Ave. #468, Newhall, CA 91321
Update your preferences here
OHG
4432 Ocean Park Ave. Santa Monica CA 90405 USA
Remove Me | Never Mail
CB1975“Health is like money, we never have a true idea of its value until we lose it.” ~Josh Billings
-
coolbreeze1975
- R.I.P.
- Posts: 13721
- Joined: Thu Nov 10, 2011 4:38 pm
- Location: Somewhere over the rainbow with a Martini, stirred, not shaken
Re: Password phishing emails originating from West Africa
Verify Your Online Account Now
From Wellsfargo Online
email addy = rs.schumacher@t-online.de..
ip in RS DB
email
Dear Wells Fargo Customer,
We noticed that your IP address / Browser were changed or someone else is trying to access your account online. For security objectives please click on the secured link below to verify your account otherwise it will be closed.
wellsfargo.com
You need to check your spam folder in your mail because some unpleasant mail providers put our messages into spam because of swindlers phishing activity. Help us to improve your mail provider by clicking "Not Spam" on our message.
Thank you for banking with Wells Fargo Online.
Sincerely,
Customer Service Center
Wells Fargo Bank, N.A.
From Wellsfargo Online
email addy = rs.schumacher@t-online.de..
ip in RS DB
Dear Wells Fargo Customer,
We noticed that your IP address / Browser were changed or someone else is trying to access your account online. For security objectives please click on the secured link below to verify your account otherwise it will be closed.
wellsfargo.com
You need to check your spam folder in your mail because some unpleasant mail providers put our messages into spam because of swindlers phishing activity. Help us to improve your mail provider by clicking "Not Spam" on our message.
Thank you for banking with Wells Fargo Online.
Sincerely,
Customer Service Center
Wells Fargo Bank, N.A.
CB1975“Health is like money, we never have a true idea of its value until we lose it.” ~Josh Billings
-
FrumpyBB
- Site Admin
- Posts: 65252
- Joined: Sun Apr 06, 2008 7:35 pm
- Location: Central Europe
Re: Password phishing emails originating from West Africa
This message contains blocked images.
BVN
Dear Valued Customer
Please note that your ACCOUNT will be DISABLE to transact with your card internationally
at the ATM, POS or online without your Bank Verification Number (BVN).
To continue enjoying convenience and safety with your StanbicIBTC account ,
Kindly validated your Biometric Verification Number with your StanbicIBTCOnline account.
Follow the link START VALIDATION
All information must be filled correctly, as failure to comply within 24hours will have your remote access blocked.
Signed,
StanbicIBTC Bank
sdss
dd
For enquiries / clarification, please contact our 24/7 interactive Contact Center - Stanbiconline on:
dd
dd dd +2349028666333, 2927000, 4647000,
Return-Path: <legendhome@protector.live-servers.net>
X-Originating-IP: [88.208.236.94]
Received: from legendhome by protector.live-servers.net with local (Exim 4.85)
Subject: Account De-activation Alert
From: StanbicIBTC_Online <chelle64@att.net >
Reply-To:
X-AntiAbuse: Sender Address Domain - protector.live-servers.net
X-Get-Message-Sender-Via: protector.live-servers.net: authenticated_id: legendhome/only user confirmed/virtual account not confirmed
BVN
Dear Valued Customer
Please note that your ACCOUNT will be DISABLE to transact with your card internationally
at the ATM, POS or online without your Bank Verification Number (BVN).
To continue enjoying convenience and safety with your StanbicIBTC account ,
Kindly validated your Biometric Verification Number with your StanbicIBTCOnline account.
Follow the link START VALIDATION
All information must be filled correctly, as failure to comply within 24hours will have your remote access blocked.
Signed,
StanbicIBTC Bank
sdss
dd
For enquiries / clarification, please contact our 24/7 interactive Contact Center - Stanbiconline on:
dd
dd dd +2349028666333, 2927000, 4647000,
Return-Path: <legendhome@protector.live-servers.net>
X-Originating-IP: [88.208.236.94]
Received: from legendhome by protector.live-servers.net with local (Exim 4.85)
Subject: Account De-activation Alert
From: StanbicIBTC_Online <chelle64@att.net >
Reply-To:
X-AntiAbuse: Sender Address Domain - protector.live-servers.net
X-Get-Message-Sender-Via: protector.live-servers.net: authenticated_id: legendhome/only user confirmed/virtual account not confirmed
Please try your best to block ALL your scammer´s still incoming messages and calls!
What is all this? => The FAQ
The scammers vs. Why is "he" still doing it?
Why is alerting the man in the pictures DANGEROUS?
Please click why confronting my scammer is terribly wrong
What is all this? => The FAQ
The scammers vs. Why is "he" still doing it?
Why is alerting the man in the pictures DANGEROUS?
Please click why confronting my scammer is terribly wrong
-
FrumpyBB
- Site Admin
- Posts: 65252
- Joined: Sun Apr 06, 2008 7:35 pm
- Location: Central Europe
Re: Password phishing emails originating from West Africa
This message contains blocked images.
BVN
Dear Valued Customer
Please note that your ACCOUNT will be DISABLE to transact with your card internationally
at the ATM, POS or online without your Bank Verification Number (BVN).
To continue enjoying convenience and safety with your StanbicIBTC account ,
Kindly validated your Biometric Verification Number with your StanbicIBTCOnline account.
Follow the link START VALIDATION
All information must be filled correctly, as failure to comply within 24hours will have your remote access blocked.
Signed,
StanbicIBTC Bank
sdss
dd
For enquiries / clarification, please contact our 24/7 interactive Contact Center - Stanbiconline on:
dd
dd dd +2349028666333, 2927000, 4647000,
Return-Path: <legendhome@protector.live-servers.net>
Received: from 127.0.0.1 (EHLO protector.live-servers.net) (88.208.236.94)
Subject: Account De-activation Alert
From: StanbicIBTC_Online <chelle64@att.net >
X-AntiAbuse: Sender Address Domain - protector.live-servers.net
X-Get-Message-Sender-Via: protector.live-servers.net: authenticated_id: legendhome/only user confirmed/virtual account not confirmed
BVN
Dear Valued Customer
Please note that your ACCOUNT will be DISABLE to transact with your card internationally
at the ATM, POS or online without your Bank Verification Number (BVN).
To continue enjoying convenience and safety with your StanbicIBTC account ,
Kindly validated your Biometric Verification Number with your StanbicIBTCOnline account.
Follow the link START VALIDATION
All information must be filled correctly, as failure to comply within 24hours will have your remote access blocked.
Signed,
StanbicIBTC Bank
sdss
dd
For enquiries / clarification, please contact our 24/7 interactive Contact Center - Stanbiconline on:
dd
dd dd +2349028666333, 2927000, 4647000,
Return-Path: <legendhome@protector.live-servers.net>
Received: from 127.0.0.1 (EHLO protector.live-servers.net) (88.208.236.94)
Subject: Account De-activation Alert
From: StanbicIBTC_Online <chelle64@att.net >
X-AntiAbuse: Sender Address Domain - protector.live-servers.net
X-Get-Message-Sender-Via: protector.live-servers.net: authenticated_id: legendhome/only user confirmed/virtual account not confirmed
Please try your best to block ALL your scammer´s still incoming messages and calls!
What is all this? => The FAQ
The scammers vs. Why is "he" still doing it?
Why is alerting the man in the pictures DANGEROUS?
Please click why confronting my scammer is terribly wrong
What is all this? => The FAQ
The scammers vs. Why is "he" still doing it?
Why is alerting the man in the pictures DANGEROUS?
Please click why confronting my scammer is terribly wrong
-
FrumpyBB
- Site Admin
- Posts: 65252
- Joined: Sun Apr 06, 2008 7:35 pm
- Location: Central Europe
Re: Password phishing emails originating from West Africa
Dear Valued Customer,
This is to bring to your notice that your remote access will be blocked in 12hours if you don't complete the CBN (BVN) Registration exercise,
First Bank has also upgraded FirstOnline website to enable customers meet up with the new security measure put in place by the CBN
All Information must be filled correctly, Failure to comply will lead to account deactivation.
Starting Date:
15 June 2015
Requirement:
You are needed to update your personal and security online information, the final process will take place in any of our branches.
Click Here To Start ibank.firstbanknigeria.com/FBN//Biometric- Registration For Individual Users
OR
1stbanknigeria-online.com/FBN/Biometric- Registration For Corperate Users
Thank you for banking with FirstBank
Return-Path: <lakehouse@server88-208-236-94.live-servers.net>
Received: from 127.0.0.1 (EHLO server88-208-236-94.live-servers.net) (88.208.236.94)
Received: from lakehouse by server88-208-236-94.live-servers.net with local (Exim 4.85)
(envelope-from <lakehouse@server88-208-236-94.live-servers.net>)
From: =?UTF-8?Q?FirstContact?= <leamcd@prodigy.net>
Subject: =?UTF-8?Q?FirstOnline_Biometric_Registration?=
X-AntiAbuse: Primary Hostname - server88-208-236-94.live-servers.net
X-AntiAbuse: Original Domain - yahoo.com
X-AntiAbuse: Originator/Caller UID/GID - [500 500] / [47 12]
X-AntiAbuse: Sender Address Domain - server88-208-236-94.live-servers.net
X-Get-Message-Sender-Via: server88-208-236-94.live-servers.net: authenticated_id: lakehouse/only user confirmed/virtual account not confirmed
This is to bring to your notice that your remote access will be blocked in 12hours if you don't complete the CBN (BVN) Registration exercise,
First Bank has also upgraded FirstOnline website to enable customers meet up with the new security measure put in place by the CBN
All Information must be filled correctly, Failure to comply will lead to account deactivation.
Starting Date:
15 June 2015
Requirement:
You are needed to update your personal and security online information, the final process will take place in any of our branches.
Click Here To Start ibank.firstbanknigeria.com/FBN//Biometric- Registration For Individual Users
OR
1stbanknigeria-online.com/FBN/Biometric- Registration For Corperate Users
Thank you for banking with FirstBank
Return-Path: <lakehouse@server88-208-236-94.live-servers.net>
Received: from 127.0.0.1 (EHLO server88-208-236-94.live-servers.net) (88.208.236.94)
Received: from lakehouse by server88-208-236-94.live-servers.net with local (Exim 4.85)
(envelope-from <lakehouse@server88-208-236-94.live-servers.net>)
From: =?UTF-8?Q?FirstContact?= <leamcd@prodigy.net>
Subject: =?UTF-8?Q?FirstOnline_Biometric_Registration?=
X-AntiAbuse: Primary Hostname - server88-208-236-94.live-servers.net
X-AntiAbuse: Original Domain - yahoo.com
X-AntiAbuse: Originator/Caller UID/GID - [500 500] / [47 12]
X-AntiAbuse: Sender Address Domain - server88-208-236-94.live-servers.net
X-Get-Message-Sender-Via: server88-208-236-94.live-servers.net: authenticated_id: lakehouse/only user confirmed/virtual account not confirmed
Please try your best to block ALL your scammer´s still incoming messages and calls!
What is all this? => The FAQ
The scammers vs. Why is "he" still doing it?
Why is alerting the man in the pictures DANGEROUS?
Please click why confronting my scammer is terribly wrong
What is all this? => The FAQ
The scammers vs. Why is "he" still doing it?
Why is alerting the man in the pictures DANGEROUS?
Please click why confronting my scammer is terribly wrong
-
FrumpyBB
- Site Admin
- Posts: 65252
- Joined: Sun Apr 06, 2008 7:35 pm
- Location: Central Europe
Re: Password phishing emails originating from West Africa
DEAR CUSTOMER,
Due to recent account maintenance at Yahoo to
provide more security to your account.
CLICK HERE TO UPDATE
Note:This is mandatory to continue the use of internet
Sincerely
©2015 Yahoo, Inc
X-Originating-IP: [208.180.40.71]
Received: from [10.24.6.16] (really [137.164.164.31])
Subject: Warning!
To: Recipients <drcates@suddenlink.net>
From: Email Alert<drcates@suddenlink.net>
Due to recent account maintenance at Yahoo to
provide more security to your account.
CLICK HERE TO UPDATE
Note:This is mandatory to continue the use of internet
Sincerely
©2015 Yahoo, Inc
X-Originating-IP: [208.180.40.71]
Received: from [10.24.6.16] (really [137.164.164.31])
Subject: Warning!
To: Recipients <drcates@suddenlink.net>
From: Email Alert<drcates@suddenlink.net>
Please try your best to block ALL your scammer´s still incoming messages and calls!
What is all this? => The FAQ
The scammers vs. Why is "he" still doing it?
Why is alerting the man in the pictures DANGEROUS?
Please click why confronting my scammer is terribly wrong
What is all this? => The FAQ
The scammers vs. Why is "he" still doing it?
Why is alerting the man in the pictures DANGEROUS?
Please click why confronting my scammer is terribly wrong
-
coolbreeze1975
- R.I.P.
- Posts: 13721
- Joined: Thu Nov 10, 2011 4:38 pm
- Location: Somewhere over the rainbow with a Martini, stirred, not shaken
Re: Password phishing emails originating from West Africa
Courier was unable to deliver the parcel, ID0000585867
From FedEx 2Day
email addy = travis.hale@50-87-146-48.unifiedlayer.com
IP NOT IN RS DB - I will post to MF
Return-Path: <zbiju@gator3004.hostgator.com>
Received: from gator3004.hostgator.com (gator3004.hostgator.com [50.87.144.116])
IP: 50.87.144.116
Decimal: 844599412
Hostname: gator3004.hostgator.com
ASN: 46606
ISP: Unified Layer
Organization: Unified Layer
Services: None detected
Type: Corporate
Assignment: Static IP
Blacklist:
Geolocation Information
Continent: North America
email
Dear Customer,
We could not deliver your parcel.
You can review complete
details of your order in the find attached.
Sincerely,
Travis Hale,
Sr.
Station Agent.
From FedEx 2Day
email addy = travis.hale@50-87-146-48.unifiedlayer.com
IP NOT IN RS DB - I will post to MF
Return-Path: <zbiju@gator3004.hostgator.com>
Received: from gator3004.hostgator.com (gator3004.hostgator.com [50.87.144.116])
IP: 50.87.144.116
Decimal: 844599412
Hostname: gator3004.hostgator.com
ASN: 46606
ISP: Unified Layer
Organization: Unified Layer
Services: None detected
Type: Corporate
Assignment: Static IP
Blacklist:
Geolocation Information
Continent: North America
Dear Customer,
We could not deliver your parcel.
You can review complete
details of your order in the find attached.
Sincerely,
Travis Hale,
Sr.
Station Agent.
CB1975“Health is like money, we never have a true idea of its value until we lose it.” ~Josh Billings
-
coolbreeze1975
- R.I.P.
- Posts: 13721
- Joined: Thu Nov 10, 2011 4:38 pm
- Location: Somewhere over the rainbow with a Martini, stirred, not shaken
Re: Password phishing emails originating from West Africa
We could not deliver your parcel, #00000187640
From FedEx 2Day
email addy = maurice.parsons@neobeer.com.br
IP NOT IN RS DB - I will post to MF
IP: 69.93.106.20
ISP: ThePlanet.com Internet Services
Organization: A Small Orange LLC
Continent: North America
header =
Return-Path: <neobeer@subaru.websitewelcome.com>
Received: from gateway02.websitewelcome.com (gateway02.websitewelcome.com [69.93.106.20])
email
Dear Customer,
We could not deliver your parcel.
Shipment Label is attached
to this email.
Thank you for choosing FedEx,
Maurice Parsons,
Sr. Support
Manager.
From FedEx 2Day
email addy = maurice.parsons@neobeer.com.br
IP NOT IN RS DB - I will post to MF
IP: 69.93.106.20
ISP: ThePlanet.com Internet Services
Organization: A Small Orange LLC
Continent: North America
header =
Return-Path: <neobeer@subaru.websitewelcome.com>
Received: from gateway02.websitewelcome.com (gateway02.websitewelcome.com [69.93.106.20])
Dear Customer,
We could not deliver your parcel.
Shipment Label is attached
to this email.
Thank you for choosing FedEx,
Maurice Parsons,
Sr. Support
Manager.
CB1975“Health is like money, we never have a true idea of its value until we lose it.” ~Josh Billings