Antiphishers Anti-Phishers Anti-phishing

Consignment Delivery.
FROM: USCA cs@sh.vnet.cn

Monday, January 16, 2012 12:14 PM
Good Day

This is to let you know that we discovered two trunk boxes that bears your name and your address so we decided to find out the name of the delivery agent who suppose to deliver it to your final destination. Based on this discovery we decided to contact you to work out modalities of delivery to you.
Make sure you reply without much delay as every arrangement to deliver it to you is in perfect order. If you wish you know any thing about this consignment packages then kindly get back for more directives on how to received it by America Express Home Delivery with low cost.

This one is very convincing, it has yahoo's logo, but it hides the phisher's following link:
http:// wm.lpck.ru/docs/file/Online/webmail/yahoo/yahoomail/yahoomail.html

=========================================================
Pending Messages!

FROM: Yahoo!
TO: xxxx
Saturday, January 7, 2012 2:25 PM

https:// s.yimg.com/lq/i/brand/purplelogo/uh/us/base.gif

Dear Yahoo User,

your two incoming mails were placed on pending status due to the recent upgrade to our database,

In order to recieve the messages Click here.to login and wait for responds from Yahoo.

We apologise for any inconvenience and appreciate your understanding.

Regards, Yahoo.

Bank of America Alert : Account Locked!
FROM: Bank of America Alert
Thursday, January 5, 2012 12:16 AM
Bank of America Higher Standards
Customer using a laptop for Online Banking Online Banking Alert

Remember:
Always look for
your SiteKey before
you enter your
passcode during
Sign In »

Account Locked

Dear Bank of America Customer,

There are a number of invalid login attempts on your account. We had to believe that, there might be some security problems on your account. So we have decided to put an extra verification process to ensure your identity and your account security.

Please click here to continue the verification process and ensure your account security.

Thank you for your cooperation.

this notice of Notice about godady account activation, it really looks like an official godaddy's email, however it does hide the address "t.cn/SfThwr"

=============================
Thursday, December 22, 2011 6:01 AM

Dear Godaddy User:

This notification is generated automatically as a service to you because you subscribe to DomainAlert .

Because of the Comprehensive upgrade of the website system,

please log in and re-activate your account

Click here to login

To view or manage changes:

Go to the GoDaddy.com home page and log in at the top of the screen with your username or customer number and password. Click on the "My Account" tab to launch the product dashboard.

This phisher used hidden link http:// ebizevleniyoruz.com/alert/id/BOFAO817934821/ even though the link appeared to be bankofamerica.com

==============================================
Date: Thu, 15 Dec 2011 08:41:10 -0500
From: "Clifton Pruitt"
To:
Subject: Bank of America: Bill payment canceled

To: Dear Bank of America customer

Account: CHECKING

Date: 12/14/2011

The recent ALERTS for your account are now available to download online.

Please follow the link to read ALERT message here: https ://w ww.bankofamerica.com/secure/KYL0W6UKFK/

Your Chase Account Has Been Compromised
The website link looks like from chase.com, however this phisher did hide the real URL:
i-library.ib2hosting.com/~secure/~/https:/www.chase.com/index.jsp?pg_name=ccpmapp/privacy_security/protection/page/security_home.html

========================================================
Dear Chase OnlineSM Customer,

Our records indicate that your account information has been updated from two different computer internet protocol locations within 10mins intervals which is unusual and has been identified as phishing threats. A Chase account verification is hereby required for your online account banking service not to be suspended. If this update was not performed by you, please click the link below:

BANK OF AMERICA
1680 BROADWAY, NEW YORK,
N.Y 11019, USA
CREDIT CONTROL / TELEX DEPT.
PHONE: +1 716 800 1111
FAX: +1 716 800 3333
www.bankofamerica.com
info@bankofamerica.com
bank_america@yahoo.cn

TELEGRAPHIC TRANSFER NOTICE.

THIS EMAIL IS SENT TO 100 BENEFICIARY OF DECEMBER 2011.

WE ARE HEREBY OFFICIALLY NOTIFY YOU CONCERNING YOUR FUND TELEGRAPHIC TRANSFER THROUGH OUR BANK, BANK OF AMERICA, NEW YORK, TO YOUR BANK ACCOUNT, WHICH HAS BEEN OFFICIALLY APPROVED BY THE MANAGEMENT OF WORLD BANK SWISS (WBS) TO CREDIT THE SUM OF US$18.500,000.00 MILLION DOLLARS INTO YOUR BANK ACCOUNT.

This is very very urgent!!!!
FROM: Kwajo Steve

Sunday, December 11, 2011 5:20 AM
Can we be partners?
Beloved.

My name is Kwajo Steve a lawyer who reside in Lome Togo. I need your assistance in getting 18.5 million united state dollars (U.S. $ 18, 5 million) transferred from a bank here to your personal account in your country. I need to introduce someone as next of kin to my late client to this bank for them to release the fund to him / her. I decided to give you this blind trust after I came across your contact through my search in the net . My instinct tells me that we can work together for the success of this deal.

This is another version of the Spain travel phisher.
=========================
Emergency
FROM: Barry Tomalin
Monday, December 5, 2011 12:55 AM

Hi

Hope you get this on time, I made a trip to Madrid, Spain and had my bag stolen from me with my passport, cash and credit cards in it. Unfortunately for me, I've made contact with my bank but they are not providing a fast solution. I need you to lend me some money to sort my self out of this predicament, I will pay back as soon as I return.

Western Union transfer is the best option to send money to me. Let me know if you need my details(Full names/location) to make the transfer. You can reach me via email or the Blue Island hotel's desk phone +34962463149.

I await your response...
Mei

Upon close examination, the link provided below is not from cibc.com, instead the phisher embedded http:// gsjzsc.com.cn/html/lm_74/20090334985020.html

=======================================
CIBC Security Measure
Hide Details

FROM:
Canadian Imperial Bank of Commerce
TO:
cibc_customers@yahoo.com

Message flagged
Wednesday, November 23, 2011 5:09 AM

Dear CIBC Customer,

A high number of failed login attempts have been recorded on your CIBC Online Banking account.
You are kindly advised to Sign On to your account and follow the instructions on your screen.

Sign On to your account at https ://www.cibconline.cibc.com/olbtxn/authentication/PreSignOn.cibc?locale=en_CA

Thank you
Canadian Imperial Bank of Commerce Online Security

the phisher used some legit paypal links, but some critical link has website domain lkurtoyp.com in it.
===================================================================

Your account has been limited until we hear from you
Hide Details

FROM:

service@paypal.com

Message flagged
Monday, November 21, 2011 8:08 AM

the sneaky phishers hide the real address http://steamcommunity.com.ranchocasian.com/

=================================================================
FROM:
Steam support
TO:
????@yahoo.com

Message flagged
Sunday, September 25, 2011 12:12 PM
Message body
STEAM

Dear client,

We recently determined that different computers connected to your Steam account,
multiple errors and password were present before the login.
We now need you to confirm , your account information to us.
If not completed, we will be forced to suspend your account indefinitely..

To confirm your account, please follow this link

http://www.steamcommunity.com/actions/ValidateEmailAddress?stoken=942452....

This "delivery failed 1" message has an attachment, don't click on them, it is phishing.

=================
delivery failed 1
FROM:

Returned mail ,
TO:
Message flagged
Tuesday, September 13, 2011 5:46 PM
Message body
The original message was received at Wed, 14 Sep 2011 10:46:10 +1000
from yahoo.com [123.230.142.131]

----- The following addresses had permanent fatal errors -----

1 Attached files|27KB

message.zip

==============================
Re: Hi
FROM:

ericichurchil@yahoo.com

TO:

search@mail.com

Message flagged
Tuesday, September 13, 2011 5:34 PM
Message body
Dear Website Visitor,

Thank you for visiting one of our Promotional Websites! As the hourly winner on one of our various promotional websites, your Email Address has won a Grant BONUS of (Nine Hundred and Ninety-Five Thousand British Pounds) Thank you for visiting our website!
Send "your name, address, age, phone number" to the email below for Details on your claims.
-------------------
Email sent using Masaka mail (http://www.masaka.com/mail/ )

phishers use attached files to trick you. See below this titled "Returned mail: see transcript for details", so if you see any attached files, attached transcripts, don't click!!!

The original message was received at Fri, 9 Sep 2011 02:32:04 +1000
from yahoo.com [82.58.182.169]

----- The following addresses had permanent fatal errors -----

----- Transcript of session follows -----
while talking to yahoo.com.:
>>> MAIL From:"Mail Delivery Subsystem"
<<< 501 "Mail Delivery Subsystem" ... Refused

1 Attached files|27KB

This is worse than phishing.

According to Reuters, Harwell is accused of installing a program, which gave him remote access to the user's computer and webcam, while working as a technician for a local computer repair company. "Once he had access, he would take photographs of the users, usually women. Often, the female victims were undressed or changing clothes".

Police say they began investigating Harwell after a Fullerton resident contacted authorities over a suspicious message on his daughter's computer.

The message mimicked a system error advising her of a problem with an "internal sensor" and advised: "If unsure what to do, try putting your laptop near hot steam for several minutes to clean the sensor."

ASSISRANCE
Tuesday, May 24, 2011 6:36 AM
From:
"JAMMAL TALABI"
Add sender to Contacts
To:
undisclosed-recipients
My name is Jammal Talabi i am Ethiopian national presently residing in Ghana West Africa.

I work for Hosni Mubarak former president of Egypt (dictator)for twenty two years as one of

his house keeping cabinet, during the uprising i stumbled on some valuables Gold bars, and

huge amount of funds in boxes which i have kept under one of the deposit houses in Accra

Ghana.

I need some one from overseas to assist me in investing this funds as i do not know much in

business as a cook, percentage for helping me is negotiable before putting the funds into