Antiphishers Anti-Phishers Anti-phishing

From:
"Sunny"
Add sender to Contacts
To:

Dear Sir or Madam 2009-9-2

We are a domain name registration service company in Asia,

Resently we received a formal application submited by Peter Lee who wanted to use the keyword "???" to register the Internet Brand and with suffix such as .cn /.com.cn /.net.cn/.hk/ .asia/ domain names.

Facebook Account Confirmation
Monday, August 10, 2009 9:37 AM
From:
"Facebook"
Add sender to Contacts
To:
undisclosed-recipients
Message contains attachments
Facebook_Account_Confirmation.html (48KB)
Dear Facebook user,

As part of our security measures, we regularly screen activity in
the Facebook system. We recently contacted you after noticing an
issue on your account.

We requested information from you for the following reason:

We recently received a report of unauthorized credit card use
associated with this account. As a precaution, we have limited
access to your Facebook account in order to protect against future
unauthorized transactions.

Confirmation Code #: 15547872134

The link hiding is bodyriches.com.au instead of the vonage.com site.

[ Unauthorized Access ] - You have 1 new alert message!
Friday, August 7, 2009 9:46 AM
From:
"Vonage@yahoo.com"
Add sender to Contacts
To:

Dear Vonage Member,

We have reason to believe that your Vonage account has been fraudulently accessed by a third party using other ISP (Internet Service Provider).

This might have happened due to the following reasons:

- You accessed your account from a different computer or you have changed your Operating System.
- You have dynamic IP address and due to that our system might have interpretated it as an unauthorized attempt.
- You entered a wrong password 3 times when you tried to connect to your Vonage account.

Attention
Tuesday, July 14, 2009 6:38 PM
From:
"cpa"
Add sender to Contacts
To:
undisclosed-recipients

Attention

I have previously sent you an email;
Please confirm the receipt of this mail due to the urgency of this
matter. If you are not in position to represent us at this moment
kindly advice immediately.our recruiting staff got your info through the chamber of
commerce and after care-full review we decided to cont ant your firm to represent our
company in north America and specifically in your location you are entitled to 11.5%
of each transaction processed through you or(firm) and this

the following is trying to phish you.

Tax Refund Number 2009IRS55841476X/USA621
Sunday, July 12, 2009 9:54 AM
From:
"Internal Revenue Service"
Add sender to Contacts
To:
undisclosed-recipients
Message contains attachments
payment_form.pdf.htm (12KB)

ATTN: Dear Applicant,
2009 - Recalculation Tax Refund

After the last annual calculation of your fiscal activity we have determined that you are eligible to receive a tax refund of $284.23
Your TRN (TAX REFUND NUMBER): 2 7 9 0 2 1 6 8 1 5, please fill the payment form attached in the email.
Please submit the tax refund and allow us 3-9 business days in order to process it.

you earned $197 today
Sunday, July 5, 2009 5:20 AM
From:
"MichaelVincent"
Add sender to Contacts
To:
If you can't read or see this email, Click Here

To unsubscribe please go here
or send mail to:
3867 W. Market Street � Suite 256
Akron, OH 44333

2010 CANADA LOTTERY WINNING NOTIFICATION.
Tuesday, July 7, 2009 5:37 AM
From: "LOC SA"
Add sender to Contacts
To:
undisclosed-recipients
Message contains attachments
congratulations.pdf (41KB)

2010 CANADA LOTTERY WINNING NOTIFICATION

Attn: Winner,
Find your attached copy of your winning letter and contact the fiduciary agent for your claim.

Thank you for being part of our Promotional Lottery program.

Yours Sincerely,

Tim Modise.
(Co-ordinator Officer

the link actually is hidden, it is linked to pl3y.com

Alert : Your account has been temporally suspended
Thursday, June 11, 2009 3:06 PM
From:
"Bank Of America"
Add sender to Contacts
To:
undisclosed-recipients

Unfortunately, you have just reached that critical number of login attempts,
so your account has been temporally suspended for security purposes.

http://www.bankofamerica.com/login/sitekey/SSL/signon.php?SSL512=yes

© Bank of America Corporation. All rights reserved.

This is a classical phishing, however this redirect to reget3.com site, a different site!!!!!

Notice : Your account has been suspended
Tuesday, June 9, 2009 10:25 AM
From:
"Bank Of America"
Add sender to Contacts
To:
undisclosed-recipients

Unfortunately, you have just reached that critical number of login attempts,
so your account has been temporally suspended for security purposes.

http://www.bankofamerica.com/login/sitekey/SSL/signon.php?SSL512=yes

© Bank of America Corporation. All rights reserved.

Urgent Attention Needed (805)
FBI
--
Anti-Terrorist And Monitory Crime Division.
Federal Bureau Of Investigation.
J.Edgar.Hoover Building Washington Dc

Attn: Beneficiary,

This is to Officially inform you that it has come to our notice and we have
thoroughly Investigated with the help of our Intelligence Monitoring Network
System that you are having an illegal Transaction with Impostors claiming to
be Prof. Charles C. Soludo of the Central Bank Of Nigeria, Mr. Patrick Aziza,
Mr Frank Nweke, none officials of Oceanic Bank, Zenith Banks, kelvin Young of
HSBC,Ben of FedEx, Ibrahim Sule,Larry Christopher, Dr. Usman Shamsuddeen,
Puppy Scammers are impostors claiming to be the Federal Bureau Of
Investigation.During our Investigation, we noticed that the reason why you

This post does not copy the link, but if you move your cursor over
to your own email, you will notice that the link actually goes to an executable program at:
volkhov.info/VeryFunny.jpg.exe

You've received A Hallmark E-Card!
Friday, April 17, 2009 10:55 PM
From:
"hallmark.com"

A Friend has sent you a Hallmark E-Card.

If you recognize this name, click the link to see your E-Card.
.hallmark.com/ECardWeb/ECV.jsp?a=EG0694272732475M245925860Y&product_id=

If this name is not familiar to you and you're concerned about online security, please use the following steps:

1. Visit http://www.hallmark.com/getecard
2. Enter your e-mail address in the Original Recipient.s E-Mail Address box.

From: "Mr Walter L Drenth" Add sender to ContactsTo: undisclosed-recipientsWINNING NOTIFICATION FOR CATEGORY "C" WINNERs ONLY (HEINEKENINTERNATIONAL
PROMOTIONS).

After this automated computer ballot, your e-mail address emerged as a
winnerin the category "C" with the following numbers attached Ref
Number:MSW/56B-672GH/L and winning No:(12)(77)(49)(33)(55)(80). You are
therefore toreceive a cash prize of $($550,000.00 USD) .You are hereby
notified that yourwinning falls under our AFRICAN REGIONAL ZONE.To file in
for the processing ofyour prize winnings, you are advised to contact our
Certified and Accreditedclaims agent for category "C" winners with the
information below:

HEINEKEN PROMOTION DEPARTMENT
Promotion Manager:

YOU WON
Friday, April 10, 2009 3:26 AM
From:
"ONLINE CYBER PROMO"
Add sender to Contacts
To:
undisclosed-recipients
Online Cyber
20 Craven Park, Harlesden
London NW10
United Kingdom
Ref Number: EH 9590 OG 0612
Batch Number: 563881 545-NL/2009

Dear Winner,

WINNING NOTIFICATION

Your email address as indicated was drawn and attached to Ref
Number:EH9590OG 0612, Batch Number: 563881545-NL/2009 and Ticket
Number:PP3502/8707-01which subsequently won you Ј1,000,000(One Million
Britain pounds sterlings) in cash credited to file YL/26510460037/09.

To file for your claim, please contact our claims agent:

Name: Raymond Pascal
Phone: +44-7024014104 +44-7024014430
Emai dr.raymondpascal@msn.com

Provide him with the information below:

HELLO!!!
Thursday, April 2, 2009 11:18 AM
From:
"DELTA LLOYD"
Add sender to Contacts
To:
undisclosed-recipients
Hello,

My name is Jacob Klaas I work as an international auditor for the delta lloyd Bank (ALM) Asset Liability
Managerial department monitoring five branches including Singapore, Belgium and Netherlands.

I have taken pains to find your contact through personal endeavors which I may explain to you upon your response.
A possible family member of yours (name withheld for security reason) died nine months ago leaving behind
an investment total of EU5.95M (Five Million Nine hundred and Fifty Thousand Euros) with my bank.With interest at today's value, the said investment is now worth EU9M (Nine Million Euros)

EMPLOYMENT REQUEST
Wednesday, April 1, 2009 7:42 AM
From:
"alex james"
Add sender to Contacts
To:
undisclosed-recipients

H&S TEXTILE COMPANY
Brookside Farm Compton
Marldon, Paignton,
TQ3 1TD.Devon
United Kingdom

DEAR CANDIDATE,
WE HAVE A JOB OFFER AVAILABLE FOR YOU IN RESPONSE TO YOUR INITIAL
REQUESTING THE JOB SEARCH DIRECTORY.WE ARE A COMPANY BASED IN UNITED
KINGDOM. WHICH OUR COMPANY IS REGISTERED IN U.K CHAMBERS OF COMMERCE. WE HAVE
BEEN RECEIVING ORDERS FROM NORTHERN AMERICA, AUSTRALIA, AND
EUROPE WHICH WE HAVE NOT BEEN ABLE TO PROCESS COMPELETELY SINCE WE DO
NOT HAVE A PAYMENT RECEIVING PERSONNEL IN THESE AREAS.WE HAVE DECIDED
TO RECRUIT PAYMENT OFFICERS ONLINE HENCE WE WILL BE NEEDING A

Bank Of America Online Alert : Verify Your Information
Friday, March 27, 2009 2:56 PM
From:
"Bank Of America"
Add sender to Contacts
To:
undisclosed-recipients

Bank of America Higher Standards
Customer using a laptop for Online Banking Online Banking Alert

Remember:
Always look for your
SiteKey before you
Sign In »

Account Update
Dear client of Bank of America

Technical services of Bank of America are carrying out a planned software upgrade. We earnstly ask you to visit the following link to start procedure of confirmation on customers date.

to get started, Please click on the link below:

http://www.bankofamerica.com/update=&cookiecheck=yes&destination=nba/onl...

Your card has been deactivated
Wednesday, March 25, 2009 9:17 AM
From:
"service@visa.com"
Add sender to Contacts
To:
undisclosed-recipients
Dear Visa card holder,

During our regular update and verification of the clients data, we detected a serious error on your card.

For your security, your card has been deactivated.

Please take a moment to reactivate your card using the link below:

https://usa.visa.com/personal/security/vbv/index.html?ep=v_sym_/verified

We thank you for your prompt attention to this matter. Please understand that this is a security measure intended to help protect you and your card.

Sincerely, Visa 2009

Dear Sir/Madam
Wednesday, March 18, 2009 6:55 PM
From:
"Mrs Judith Williams"
Add sender to Contacts
To:
undisclosed-recipients
Dear Sir/Madam

This could be :
Appraisal Scam, Paypal Phishing or Valid Email Harvesting
=====================================
"Hi,

my name is Brandon Birdwell and I would be interested in buying your domain ________ from you. Are you interested in selling it? If yes, how much would you want for it? What payment method would you prefer?

And just in case you are wondering how I got your email, anyone can get that info at whois.net

Regards,

Brandon Birdwell"

"Hi,

my name is Peter Bauer and I would be interested in buying your domain _______ from you. Are you interested in selling it? If yes, how much would you want for it?

I would prefer to pay you via paypal. And just incase you are wondering how I got your email, anyone can get that info at whois.net

Regards,

Peter Bauer"

Note: the phisher did hide the hallmark website with its own link:
"http://mail.mosetti.ts.it/postcard.exe",

You've got a postcard, check it out
Tuesday, February 24, 2009 3:47 PM
From:
"Hallmark Postcards"
Add sender to Contacts
To:
undisclosed-recipients

Hello there. You've got a postcard from someone who cares for you.

In order to downoad your postcard, click on the link below:

http://www.hallmark.com/postcards/client726371
"http://mail.mosetti.ts.it/postcard.exe",

Thank you for usin Hallmark services.

Regards, Hallmark

www.halmark.com