Password phishing emails originating from West Africa

[FrumpyBB]

NGN 10,050.00 Debited From Account For Access Bank Customers' Digest
Access Bank Plc <fbjames11@physicist.net>


Dear Customer

According to our records, you registered for our Access Customer Digest monthly bulletin and this comes with a monthly charge
of N10,050:00.
As your opinion is important to us, we would like to ask you to confirm this request
ibank.accessbankplc.com/RetailBank/confirm_customer_digest_monthly_bulletin/7c2c01489b275ea11cc991931e40986e75621
e473c3c7012ee6b2b51417657692482fd1cd1db3394e0d67d97565a449e9e94e4bce0e9b91ef0f167026a138480

If you wish to reject the registration request, follow the cancel reference below
ibank.accessbankplc.com/RetailBank/cancel_customer_digest_monthly_bulletin_request/5172b0044fe84408661228b4131d2d8cd
39a8bce71a09622777922f1d7647d1ecf7ecf6faa966c3cd0480ef44744d1235fcecedf9753bb7a012f808f7d9210de?cancel=1

You would have to confirm you are an active account holder with us by following the procedures from your AccessOnline account.

Thank you



Return-Path: <domnadsanem@2738170.securefastserver.com>
X-Originating-IP: [144.168.45.113]

[FrumpyBB]

Return-Path: <noreply@mail.com>
Received: from compute4.internal (compute4.nyi.internal [10.202.2.44])
by sloti29t02 (Cyrus 3.0.0-beta1-git-fastmail-12410) with LMTPA;
X-Sieve: CMU Sieve 2.4
X-Spam-charsets: plain='iso-8859-1', html='iso-8859-1'
X-Mail-from: noreply@mail.com
Received: from mx4 ([10.202.2.203])
by compute4.internal (LMTPProxy);
Received: from mx4.messagingengine.com (localhost [127.0.0.1])
by mx4.nyi.internal (Postfix) with ESMTP id AF0663C0194
for
Received: from mx4.nyi.internal (localhost [127.0.0.1])
by mx4.messagingengine.com (Authentication Milter) with ESMTP
id 20B8D34148D.8D2F73C0181;
Authentication-Results: mx4.messagingengine.com;
dkim=none (no signatures found);
dmarc=fail (p=none) header.from=mail.com;
spf=fail smtp.mailfrom=noreply@mail.com smtp.helo=mail.directv.net
Received-SPF: fail (mail.com: Sender is not authorized by default to use 'noreply@mail.com' in 'mfrom' identity (mechanism '-all' matched)) receiver=mx4.messagingengine.com; identity=mailfrom; envelope-from="noreply@mail.com"; helo=mail.directv.net; client-ip=69.168.102.197
Received: from mail.directv.net (mail.directv.syn-alias.com [69.168.102.197])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx4.messagingengine.com (Postfix) with ESMTPS id 8D2F73C0181
for
X_CMAE_Category: , ,
X-CNFS-Analysis: v=2.1 cv=Eq5y1XoA c=1 sm=1 tr=0 a=O1is5CyalSTa7TtKkZ9dMw==:117 a=O1is5CyalSTa7TtKkZ9dMw==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=KXl77lDgDEgIEtoqJYcA:9 a=ZLGELXoPAAAA:8 a=OUSG7V8Xy4tQLE8u75IA:9 a=wPNLvfGTeEIA:10 a=wazyxkavAAAA:20 a=UTUkrK8VmfDPamMCV1sA:9 a=_W_S_7VecoQA:10 a=Le9O5UHfSq4A:10 a=bIo0zCZWZ_wA:10 a=dz3sJaIDlccA:10
X-CM-Score: 0
X-Scanned-by: Cloudmark Authority Engine
X-Authed-Username: bWlkd2VzdGNhdmlhckB3aWxkYmx1ZS5uZXQ=
Received: from [154.120.100.178] ([154.120.100.178:52784] helo=[192.168.1.2])
by smtp.wildblue.net (envelope-from <noreply@mail.com>)
(ecelerity 3.6.6.45965 r(Core:3.6.6.0)) with ESMTPSA (cipher=DHE-RSA-AES256-SHA)
id 69/91-16848-8525DD65; Mon, 07 Mar 2016 05:05:17 -0500
Content-Type: multipart/alternative; boundary="===============0629902114=="
Message-ID: <69.91.16848.8525DD65@smtp02.viasat.aga.synacor.com>
MIME-Version: 1.0
Subject: Notice From FastMail
To: Recipients <noreply@mail.com>
From: FastMail <noreply@mail.com>
Date:

You will not see this in a MIME-aware mail reader.
--===============0629902114==
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body

Dear User,
Your prompt action is require to check your account to enable you view you=
r incoming pending =

mails. =

We kindly advice you to please follow the link below to continue.
fastmail.com/verify/mail
Thanks,
The FastMail Team.


IP: 154.120.100.178
Continent: Africa
Country: Nigeria
State/Region: Lagos
City: Lagos

[FrumpyBB]

Email termination

Yahoo <dittomine03@gmail.com>
To
BCC
YAHOO
Hi,
On March 20, 2016 at 12:05 AM, the following forwarding email address,Sx8therbox@aol.com, was added to your yahoo account.

Your new emails will now be forwarded to this alternate AOL account.

If you made this change, you're all set.

If not, click Remove email to remove the email address.

Thanks for taking this additional step to keep your account safe.
Yahoo


Replies sent to this email cannot be answered. Feel free to reach out to customer carewith any questions or concerns.



From Yahoo
Subject: Email termination
From: Yahoo <dittomine03@gmail.com>
To: undisclosed-recipients:;

[FrumpyBB]

Access Online Customer Update
Access Bank Plc <wallit@hotmail.it>

Dear Customer,
To effectively serve our internet banking customers, Access Bank Plc hereby introduced a Quick and Safer platform to enable customers update their account online and transact Cashless easily.

Move message to inbox if found in spam folder to enable you click on the link.

Visit accessbankplc.com/update

Note only activated account(s) will be eligible for this Exercise.

Verify BVN
Getting verified is easy, following these steps:

Fill and submit the BVN enrolment form Click Here ow.ly/102Xgt <= EVIL!
Present self for data capture(finger print/ facial image)
A ticket ID will be given after enrollment
BVN will be sent via SMS

Kindly note that it is mandatory for all customers to complete the exercise.
Please UPDATE within 48 Hours of Notice to avoid Service Interruption/Suspension

Thank you for banking with us.

ACCESS BANK PLC

[FrumpyBB]

X-Mail-from: ciyosh@hawaiiantel.net
Received: from smtprelay.b.hostedemail.com (smtprelay0225.b.hostedemail.com [64.98.42.225])
Received: from basefortconstrucao.com.br (unknown [200.98.224.53])
From: "Fastmail.+" <ciyosh@hawaiiantel.net>

<p><br>
Hi,
</p>
<p>Due to recent upgrades on our servers; Your 4 (Four) Important incoming =
mails are on hold. Please validate below to retrieve your email...</p>
<p><a href=3D"fastfriday202.kickme.to">Unblocking Incoming Message h= <= Dontcha click this!
ere</a></p>
<p>We are sorry for the inconvenient.<br>
</p>
<p>Sincerely,<br>
The Fastmail Team<br>
</p>

[FrumpyBB]

N10,050.00 Debited For Diamond Customers' Digest

From: "DiamondOnline" <christine@gslc.net>

Dear Esteemed Customer,

According to our records, you registered for our DiamondOnline Customer Digest monthly bulletin and this comes with a monthly charge
of N10,050:00.
As your opinion is important to us, we would like to ask you to confirm this request
ibanking.diamondbank.com/corp/BANKAWAY?Action.RetUser.Init.001=confirmdebit

If you wish to reject the registration request, follow the cancel reference below
ibanking.diamondbank.com/corp/BANKAWAY?Action.RetUser.Init.001=canceldebit

You would have to confirm you are an active account holder with us by following the procedures from your Diamond Bank account.

Thank you for choosing Diamond Bank

PRIVACY POLICY ACCESSIBILITY TERMS OF USE SITEMA© Diamond Bank2016
ng.gew.co/sites/ng.gew.co/files/styles/profile_picture/public/user-images/stanbicibtc_bank_logos_.jpg

^^hotlinked pic in email

IP: 107.155.99.138
Hostname: 107-155-99-138.securefastserver.com
ISP: Incero LLC

[Igulinka]

Just called my home line and acted on behalf of Windows 10 technical support claiming my computer was hacked and I need to give them my email ID and password in order to disable the virus.

Phone number : (858) 205-1749 -->>Onvoy VoIP in Del Mar, CA -->> used in spam calls before

[FrumpyBB]

From: FastMail Team <Support@Fastmail.com>
To: Recipients <Support@Fastmail.com>
Subject: The Fastweb Team


You are receiving this message because your are a paid user on fastmail service. We noticed a slight problem
with our service recently so we apologize. As compensation please VERIFY here [shor.pe/DEAIc <= evil link!]to receive your free 40-gig
storage. It is absolutely free! Thank you for your continued patronage.


Yours sincerely,
Fastmail Support


Received: from [192.168.8.102] (unknown [41.71.190.54])

IP: 41.71.190.54
Continent: Africa
Country: Nigeria
State/Region: Lagos
City: Lagos

[FrumpyBB]

Subject: DHL service delivery
From: DHL COURIER <usman.muhammed@sokotocement.com> => Northern Nigerian company
To: undisclosed-recipients:;

DHL ONLINE ACCESS.PDF <== NOT CLICKED, NOT DOWNLOADED!!
247KB

Dear Valued Customer,

Please receive your packages:

Your packages arrived at our post service since 22th April, 2016.

Our courier agent was unable to deliver the packages to you due to incorrect delivery address details on the packages we received at our post service.

To receive your packages, please download the attached receipt and forward to nearest DHL office for verification and further assistance in other to claim your packages .

Thanks
DHL customer care.
……………………………………………………………………………………………………………………………………………………………………………..
CONFIDENTIALITY CAUTION: This message is intended only for the use of the individual or entity to whom it is addressed and may be confidential in nature. If you are not the intended recipient, please notify us immediately by return e-mail and please do delete this message. You should not disseminate, distribute, copy or disclose any information contained herein to any third party.
**Please consider the environment before printing this email**
DHL Express Team

[FrumpyBB]

Alert [Debit 10,050.00 NGN]

From: "Access Bank Plc" <opeyemi.esecurity@gmail.com>

ibank.accessbankplc.com/RetailBank/IHB/img/colortheme1_E.css/evergreen.jpgTransaction Alert of N10,050:00


According to our records, you registered for our Access Customer Digest monthly bulletin and this comes with a monthly charge
of N10,050:00.
If you wish to reject the registration request, kindly follow the cancel reference below:

cancel 4h94n878hg4hff5093cdoc00273?REFERENCE

Please you would have to confirm you are an active account holder with us by following the procedures from your AccessOnline account.

Thank You for banking with us
PRIVACY POLICY ACCESSIBILITY TERMS OF USE SITEMAP © ACCESS BANK PLC 2016


104.223.89.146 QuadraNet, bad IP, been used in scams before

[FrumpyBB]

X-Mail-from: noreply@usaamail.com
Received: from filter.hostedemail.com (unknown [216.40.38.60])
Received: from [192.168.20.4] (s209-121-127-29.bc.hsia.telus.net [209.121.127.29])
(Authenticated sender: markandmaryjo@xplornet.ca)
by omf03.hostedemail.com (Postfix) with ESMTPA;
Subject: Action Needed: Security alert about your account
To: Recipients <noreply@usaamail.com>
From: "USAA" <noreply@usaamail.com >

Dear Valued Customer,
=


During our server routine update we noticed you entered wrong details. To e=
nsure your USAA online access is secured.Download the secured attached file=
to update your account settings and protect your online account with the n=
ew EV SSL certification.
=

Note:You are to match your details correctly for the processing of the secu=
rity update to be successful, Wrong details will be treated as special case=
s and update maybe delayed.

Thank you for your continued Membership
=

Sincerely,
USAA Savings Bank

[FrumpyBB]

From: "DiamondOnline" <mary.afolabi549@gmail.com>

Diamond Transaction Alert Service

Please be informed that a Debit transaction occurred on your bank account.

Kindly find details of the transaction below:
Transaction Details
Account Number : 00********
Description : DIAMOND MONTHLY CUSTOMER DIGEST SUBSCRIPTION
Reference No : 81596777
Transaction Amount : 5,470.00 NGN - NIGERIAN NAIRA
Transaction Date : 26-Apr-2016

As a result of this transaction, the balances on this account would be deducted
on the 28th of April.

To maintain this subscription do not take any action as this would be a constant deduction
from your account every month.

If you wish to unsubscribe for his monthly bulletin, do so here CANCEL SUBSCRIPTION


Thank you for banking with Diamond


This is an automated Transaction Alert Service. You are getting this email because a transaction just occurred on your account that met the threshold you set. Please DO NOT reply this mail. For further enquiries, please call our Contact Centre on 07003000000, send an SMS to 30811 or email us at enquiries@diamondbank.com.


X-Originating-IP:
[104.223.89.172] QuadraNet, bad IP, been used in scams before

[FrumpyBB]

From: Terry Ehis <terryeris2015@gmail.com>

Good evening...
Hope you have a wonderful successful day? I realize everybody wants what they don't have. But at the end of the day, what you have inside is much more beautiful than what's on the outside! I am Terry, I have set up a photo and information profile with chemistry if you are interested to view the pictures and all details of my in there, You can click on this link or copy it to your web browser newload24erphotos.96.lt/chemistry.html ) and sign into your chemistry account to view my profile and everything details about me is inside, let me know what you think, I know you will like what you see. I think after you view, we will get to know each other...
Waiting to hear from you soon.

^^ evil link!!!

[IceFM]

Dear Valued Member, This Email is from Email User Customer Services and we are sending it to you as Email User Accounts Owner for safety. we are having congestion due to the anonymous registration of accounts so we are shutting down some old accounts and your account was among those to be deleted. We are sending you this email to you so that you can verify and let us know if you still want to use this account. If you are still interested please confirm your account by filling the space below. Your User name,password, date of birth and your country information would be needed to verify your account. Due to the congestion in all Email users and removal of all unused Accounts, Email would be shutting down all unused Accounts, You will have to confirm your E-mail by filling out your Login Information below after clicking the reply button, or your account will be suspended within 48 hours for security reasons.. User Name:...... ........................... Password:..................... .............. Date of Birth:........................ ....... Alternate Email....... Password:..................... .............. Occupation.................... ............. Country Or Territory:............... After following the instructions in the sheet, your account will not be interrupted and will continue as normal. Your response should be sent to us today. Warning!!! Account owner that refuses to update his/her account after two days of receiving this warning will lose his or her account permanently. Thanks for your attention to this request. We apologize for any inconvenience. Verification code:.................. VX2G99AAJ Account owner that refuses to update his or her account before two weeks of receiving this warning will lose his or her account permanently. https:/ /hotmail/?uip=1&ui=1& ov=0

[IceFM]

Dear Valued Member Account Owner!!!!,

This message comes from your (EMAIL SERVICE PROVIDER) messaging admin center to All E-mail Account owners. We are currently improving our Database and E-mail Account Center and creating more certainty for our Legal Service clients. At this moment we are upgrading our data base so that there will be more space for new customers and increasing the surf on the Internet. To prevent your Email address not to be DE-activated and to enable it upgraded, you need to assist us by sending the information below to enable us upgrade it, so that your email account status were fleet in our database as a very active, useful and legal email account.Do send to us the below information to enable us upgrade your Account, else your email account will lost in a short time.

First Name:
Last Name:
Country:
City:
Date of Birth:
Email Address:
E-mail password
Alternative Email:
Secret Question:
Secret Answer:

WARNING!!! E-MAIL OWNERS who refuses to upgrade his or her account within Five days after notification of this update will permanently be deleted from our data base and can also lead to malfunctioning of the client or user's account and we will not be responsible for loosing our account.

Thanks for your understanding as it is geared towards serving you better.

Web-mail Support Team
Warning Code:
ID67565434.