Password phishing emails originating from West Africa

[FrumpyBB]

YAHOO! MAIL


Dear Customer,

This message is for all email accounts powered by Yahoo!.

Your E-mail account has exceeded its limit and needs to be verified, if not verified within 24 hours, we shall suspend your account.

VALIDATE

Thank you
Yahoo Team


From: "Y_A_H_O_O" <kucukogluk@yahoo.com.tr>
Subject: Email Account Final Notification

[FrumpyBB]

Your mailbox has exceeded one or more size limits set by your administrator.
Your mailbox size is 1098957 KB.

Mailbox size limits:
You will receive a warning when your mailbox reaches 900000 KB.You may not be able to send or receive new mail until you reduce your mailbox size.
To make more space available, Login Here to increase your mail storage space.

See client Help for more information.

Help Desk.


Received: from 127.0.0.1 (EHLO mail.kk.usm.my) (202.170.49.111)
From: System Administrator <asmak@kb.usm.my>
Reply-To: cutestephrydar@yahoo.com
Subject: Mailbox Alert!!

IP: 202.170.49.111
Hostname: mail.kk.usm.my
ISP: Universiti Sains Malaysia, Penang, Malaysia
Organization: TM Net

Nigerian in Malaysia

[FrumpyBB]

Dear Yahoo! User,
Yahoo! mail is upgrading CLICK HERE to update and verify your account
Regards.

Received: from 127.0.0.1 (EHLO txasav-vm06.suddenlink.net) (208.180.40.75)
Received: from ccsmonitor ([64.88.5.21]) by txasav-vm06.suddenlink.net
From: "2013-2014 Yahoo! Mail"<aeds@suddenlink.net>
Subject: Yahoo Warning!!!

IP: 64.88.5.21
ISP: Macomb Intermediate School District
Organization: Macomb Intermediate School District
Assignment: Static IP
Country: United States us flag
State/Region: Michigan
City: Fraser

hacked school server?

[FrumpyBB]

Service Department


Your profile update is required.
Please update your account profile to avoid fraudulent activity.

Use the link provide.

xxxx

Yahoo Security
Copyright 2013


Received: from SERVER2 ([74.7.112.90])
From: "Member Service"<cataberry@suddenlink.net>
Subject: Account Update
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

[FrumpyBB]

Yahoo! Mail
Dear Customer,

We require you to verify your YAHOO! account, because we are about to close some email registered under yahoo which are causing our system to malfunction due to none usage of these emails. To avoid YAHOO! closing your email, do verify your email below.

For immediate access to verification, please click on the link below:
Click here to Login and confirm in one simple step

This is to improve our service quality. We are sorry for inconveniences

NOTE: You are required to update your account.

Yahoo!
Case number: 894162450
Property: Account Security
Copyright 2013 Yahoo! Inc. All rights reserved.



Received: from [74.7.112.90]
From: "Yahoo Account Service"<noreply@email-yahoo.com>
To: update-inc@yahoo.com
Subject: Your Account Information has changed
X-Mailer: Microsoft Outlook Express 6.00.2800.1081

[FrumpyBB]

Service Department


Your profile update is required.
Please update your account profile to avoid fraudulent activity.

Use the link provide.

http://tinyurl.com/profile-" onclick="window.open(this.href);return false; upd-yahoo-sec

Yahoo Security
Copyright 2013


Received: from 127.0.0.1 (EHLO txasav-vm06.suddenlink.net) (208.180.40.75)
Received: from tqlsts1 ([97.67.40.35])
From: "Yahoo Account"<jpcorey@suddenlink.net>
Subject: Verification: Last Warning!

[FrumpyBB]

Dear Yahoo! Member,

As part of our continuing effort to provide you with a wonderful experience, we want to make sure the mail you send gets to the friends, family or other contacts you are trying to reach. In support of this commitment, we required you to validate your account immediately.

For immediate access, please VALIDATE your account now.

aldersgateritual.org/components/com_jnews/includes/openflashchart/tmp-upload-images/zic/logintoyahoomail.htm

Regards,
Yahoo! Mail Account Service


X-Originating-IP: [208.180.40.72]
Received: from 127.0.0.1 (EHLO txofep02.suddenlink.net) (208.180.40.7
From: "Yahoo! Service Department"<juliataylor@suddenlink.net>
X-Mailer: Microsoft Outlook Express 6.00.2600.0000

[FrumpyBB]

YAHOO! MAIL ACCOUNT SERVICES.
DEAR MEMBER,
YOUR INFORMATION DID NOT MATCH THE RECORD ON OUR FILE, TO AVOID CLOSING
YOUR YAHOO! MAIL ACCOUNT, BE ADVISED TO DOWNLOAD THE ATTACHED FILE TO
COMPLETE THE VERIFICATION PROCESS.


Received: from [88.190.253.75]
From: Yahoo Member service <ya38@sarahdd.fr>
To: undisclosed-recipients:;
Subject: Warning Yahoo security team, verify your free internet/ yahoo
account now
Organization: Yahoo Member service
Reply-To: akw_me11@yahoo.co.jp
Mail-Reply-To: akw_me11@yahoo.co.jp
X-Sender: ya38@sarahdd.fr
User-Agent: Roundcube Webmail/0.9.0

[FrumpyBB]

mailsecurity@verify.cc
To
Dec 26 at 10:33 PM
Dear Valued User,

We noticed a log in to your Yahoo account from an un-recognized device on Thursday, Dec 26, 2013 10:06 AM P.D.T from Mexico.

Was this you? If so, please disregard the rest of this email.
If this was not you, please follow any of the secure links below to keep your account safe :

ACTIVATE HERE

Please do not disregard this service message as it is used to ensure your safety on-line.


Regards,

Yahoo Secure Team © 2013

Received: from [41.58.209.254]
From: "mailsecurity@verify.cc" <westcottpc@btinternet.com>
Subject: Update!
To: undisclosed recipients: ;

[FrumpyBB]

Yahoo Mail
CLICK HERE TO UPDATE YOUR YAHOO ACCOUNT

euragglo.com/media/system/js/GKB/logintoyahoomail.htm


X-Originating-IP: [208.180.40.75]
From: "Yahoo! Admin"<athjm@suddenlink.net>
Subject: Last Warning

[FrumpyBB]

Return-Path: <olalusioyedele@gmail.com>
Received: from localhost (host109-152-192-120.range109-152.btcentralplus.com. [109.152.192.120])
From: olalusioyedele@gmail.com
Return-Path: olalusioyedele@gmail.com


olalusioyedele@gmail.com sent you a wikipedia message

CHECK YOUR CONFIDENTIAL MESSAGE HERE

http: // 147.255.184.133/d/?ficu=fi&ficuwupigogidu=b2xhbHVzaW95ZWRlbGVAZ21haWwuY29t&id=Z2luYWF0bWRmQHlhaG9vLmNvbQ==&ficuwupi=Z2luYWF0bWRm

[FrumpyBB]

Received: from localhost (host109-152-192-120.range109-152.btcentralplus.com. [109.152.192.120])
From: olakunletower@gmail.com
Return-Path: olakunletower@gmail.com
Subject: E mphasized

i've sent you a Offline message

read your mail friend request here

http: // 147.255.184.91/d/?muwivu=muwi&muwivuwiyu=b2xha3VubGV0b3dlckBnbWFpbC5jb20=&id=Z2luYWF0bWRmQHlhaG9vLmNvbQ==&muwivuwiyu=Z2luYWF0bWRm

[FrumpyBB]

Dear valued customer,

You are required to synchronize your token device for effective online transactions

This process is in line with the cbn cashless policy

Failure to synchronize your token device will lead to blockage of your token device and suspension of your online banking


KINDLY FOLLOW THE BELOW INSTRUCTION

1. Go to 1stbanknigeria-online.com/ .

2.Select your preferred login INDIVIDUAL or CORPORATE

3. Provide the Answer to your secret questions

4. Lastly, enter the code generated buy your FBN hardware token device

KINDLY NOTE THAT YOU ARE REQUIRED TO IN PUT YOUR TOKEN CODE TWICE AND BOTH CODES MOST BE GENERATED DIFFRENTLY



You must Synchronize your token to avoid locking of your token thereby making it impossible to carry out transactions online.

Thank you for banking with us.

To sign up for your free e-statement, and for enquiries on FirstBank products and services, please call 0700FIRSTCONTACT (0700-34778-2668228), 01-4485500, 0708-062-5000, SMS Short Code 30012 or email firstcontact@firstbanknigeria.com ****************************************************************************** This e-mail and the attachments transmitted with it are confi dential and intended solely for the use of the addressee. If y ou have received this e-mail in error, kindly notify the sender. If you are not the addressee, you should not disseminate, distribute or copy this e-mail. Any views or opinions expressed in this e-mail or attachments are solely those of the sender and may not necessarily represent the views and opinions of First Bank Of Nigeria Ltd. This e-mail may however contain information which is protected by legal, professional or other privileges. The contents of this e-mail and its attachments have been scanned for all viruses and all reasonable precautions have been taken to ensure that no viruses are present. You should however carry out your own virus checks before opening this e-mail or its attachments as First Bank Of Nigeria Ltd cannot accept responsibility for any loss or damage arising from the use of this e-mail or its attachments. ******************************************************************************



Return-Path: <oulach1@googlemail.com>
Received-SPF: softfail (transitioning domain of googlemail.com does not designate 213.171.216.60 as permitted sender)
X-Originating-IP: [213.171.216.60]
Authentication-Results: mta1199.mail.gq1.yahoo.com from=googlemail.com; domainkeys=neutral (no sig); from=googlemail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO cust-smtp-195.fasthosts.co.uk) (213.171.216.60)
by mta1199.mail.gq1.yahoo.com with SMTP; Fri, 17 Jan 2014 22:27:28 -0800
Received: from Envisage256 (server213-171-219-5.livedns.org.uk [213.171.219.5])
by cust-smtp-195.fasthosts.co.uk (Postfix) with SMTP id EEC2D19C119
for
Subject: FirstOnline: Server Migration
To:
From: FirstOlineBanking <oulach1@googlemail.com>
Reply-To:
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <20140118062726.EEC2D19C119@cust-smtp-195.fasthosts.co.uk>
Content-Length: 2710

[FrumpyBB]

Dear Customer,


Your account has some security Issues and need to be fixed at once
In order to avoid suspension.

CLICK HERE and Log in To fix the issues.

Regards,
Customer Team


Return-Path: <wclive5@aol.com>
Received: from LENOVO-PC (unknown [197.255.167.27]) Lagos, Nigeria

[FrumpyBB]

Dear User

Your two incoming mails were placed on pending status due to the recent upgrade on our database, In order to receive the messages Click Here to Validate your account.

Thank you for being a loyal Yahoo! Mail user.


Received: from LENOVO-PC (unknown [197.255.167.27]) Lagos, Nigeria
From: "Yahoo! Mail Team" <mjaelings@aol.com>
Subject: Warning! Email Suspension