SPAM OF THE WEEK!

[playthatbeat]

another irish phisher, via brazil!

Date: Tue Aug 25 06:58:29 CDT 2009

Sender: "AIB Bank"

Subject: Alert from AIB


Dear AIB Customer,



For security reasons your Personal Access Code (PAC) has been locked.

Please confirm your identity to unlock your PAC.

Failure will lead to access suspension.

Previous notifications have been sent.




Copyright Allied Irish Banks p.l.c. 1995

link to: http://m130.ijetcable54.libnet.com.br/xampp/ssi.php

also available with...

http://40.red-212-170-96.staticip.ri.../README-cn.php

[playthatbeat]

Sneaky PRETEND TO BE SOMETHING ABOUT TUNES spam

Your feedback, please << sneaky cnut tried to pretend he was after feedback on a tune
Tuesday, September 15, 2009 8:18 AM
From:
This sender is DomainKeys verified
"Omar Tamimi"
Add sender to Contacts
To:
undisclosed-recipients
Good Day,


I am Mr. Omar Tamimi , Branch Manager National Bank of Abu Dhabi Branch, I have urgent and very confidential business proposition for you. An American Iraqi foreign oil consultant /Contractor with Chevron Petroleum Corporation named Mr. Thomas Stone (Late) made a numbered Term (Fixed) Deposit for twelve (12) calendar months, valued at Twelve Million United States Dollars ($12,000,000.00) in my branch.

Late Thomas Stone who died in a plane crash in a 1999 air crash involving Egypt Air Flight 990. If you wish to access more information about this crash and person you can contact this website:

http://www.cbsnews.com/stories/1999/...ain49778.shtml
http://news.bbc.co.uk/1/hi/world/americas/502503.stm

I shall furnish you with due process of concluding this transaction should you agree to a mutually beneficial proposal of mine. I would like you to provide me with your personal telephone contact number and your full name to enable us communicate easily. Please I urge you to kindly. reply me via my private email address as depicted below. omararty2@gmail.com


Sincere regards,

Omar Tamimi

[Rikand]

rom Mrs. Barbara Gunnarsson
reply-to barb_narsson4@live.com
to
date Mon, Sep 28, 2009 at 1:24 PM
subject PLEASE DO NOT IGNORE
mailed-by st-andrews.ac.uk

Dear Friend,
I am Mrs. Barbara Gunnarsson from Iceland, married to Late Engr Brown Gunnarsson
{PhD} who worked with MULTINATIONAL OIL COMPANY EXXON AS A DRILLING RIG

SUPPLIER in Saudi Arabia for 19 years before he died on the 25th of August,
2008. We were married for twenty four years without a child. He died after a

brief illness that lasted for only four days. Before his death, he deposited the
sum of 6,142,728.00 US Dollars with a bank In Canada and this fund is

presently with the bank awaiting my disbursement as beneficiary and next of kin
to the funds. Recently, my Doctor told me that I would not last for the next

eight months due to cancer problem. Having known my condition, I decided to
donate this fund to a church, organization or good person that will utilize this

money in good faith.
I took this decision because I don't have any child that will inherit this
money. I kept this deposit secret till date, this is why I am taking this

decision. I don't think I will need any telephone communication in this regard
because of the confidentiality of this transfer. Upon your reply I shall give

you the contact of the bank. I will also issue a letter of authorization to the
bank that will prove you the present beneficiary of this money. Reply to my

very confidential email address barb_narsson4@live.com
Await your responds and God bless you.
Mrs. Barbara Gunnarsson
Email: barb_narsson4@live.com

[XL-R8]

ffs, must have been the mine flu that killed old Engr Brown Gunnarsson {PhD} /\ its a killer being a driller lolz

[playthatbeat]

Crappiest attempt at phishing yet!!!

This is special, must be attempting the 'this is so shite it must be for real' script:


Email Quota Alert
Wednesday, October 7, 2009 9:58 AM
From:
"THIS MESSAGE IS FROM OUR TECHNICAL SUPPORT TEAM"
Add sender to Contacts
To:
undisclosed-recipients
Dear Webmail User,
This message was sent automatically by a program on Webmail which
periodically
checks the size of inboxes, where new messages are received. The program
is run
weekly to ensure no one's inbox grows too large. If your inbox becomes too
large, you will be unable to receive new email. Just before this message was
sent, you had 18 Megabytes (MB) or more of messages stored in your inbox on
your Webmail. To help us re-set your SPACE on our database prior to maintain
your INBOX, you must reply to this e-mail and enter your:

Current User name: { }
and Password: { }

You will continue to receive this warning message periodically if your inbox
size continues to be between 18 and 20 MB. If your inbox size grows to 20 MB,
then a program on Bates Webmail will move your oldest email to a folder in
your
home directory to ensure that you will continue to be able to receive
incoming
email. You will be notified by email that this has taken place. If your inbox
grows to 25 MB, you will be unable to receive new email as it will be
returned
to the sender.
After you read a message, it is best to REPLY and SAVE a copy.
Thank you for your cooperation. Webmail Help Desk.

[playthatbeat]

Awesome!! the IRS want me, or something..

Taxpayer ID: mrspring-00000759209484US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax statement on Internal Revenue Service (IRS) website (click on the link below):

review tax statement for taxpayer id: mrspring-00000759209484US

Internal Revenue Service

Link was: h t t p://www.irs.gov.lllikill.co.uk/fraud_application/directory/statement.php?email=mrspring@mrspring.net&tid=mrspring-00000759209484US

Domain name:
lllikill.co.uk

Registrant:
Evelyn Foo

Registrant type:
Non-UK Individual

Registrant's address:
13 Belimbing Avenue
Barselona
25956
France

Registrar:
Webfusion Ltd t/a 123-Reg.co.uk [Tag = 123-REG]
URL: http://www.123-reg.co.uk

Relevant dates:
Registered on: 15-Oct-2009
Renewal date: 15-Oct-2011
Last updated: 17-Oct-2009

Registration status:
Registration request being processed.

Name servers:
No name servers listed.

WHOIS lookup made at 18:09:46 21-Oct-2009

--
This WHOIS information is provided for free by Nominet UK the central registry
for .uk domain names. This information and the .uk WHOIS are:

Copyright Nominet UK 1996 - 2009.

You may not access the .uk WHOIS or use any data from it except as permitted
by the terms of use available in full at http://www.nominet.org.uk/whois, which
includes restrictions on: (A) use of the data for advertising, or its
repackaging, recompilation, redistribution or reuse (B) obscuring, removing
or hiding any or all of this notice and (C) exceeding query rate or volume
limits. The data is provided on an 'as-is' basis and may lag behind the
register. Access may be withdrawn or restricted at any time.

[playthatbeat]

QUICK UPDATE UR MICR0$0FT MAILYOLK!!!!!1!!!!!

Fun that this phish directly addresses stupid people: ie: people using a Microsoft Mail client. Anyone NOT using Thunderbird or Webmail now DESERVES to fund a holiday for these cnuts...

Critical Update
Update for Microsoft Outlook / Outlook Express (KB910721)
Brief Description
Microsoft has released an update for Microsoft Outlook / Outlook Express. This update is critical and provides you with the latest version of the Microsoft Outlook / Outlook Express and offers the highest level of security and stability.
Instructions

* To install Update for Microsoft Outlook / Outlook Express (KB910721) please visit Microsoft Update Center:
http://update.microsoft.com/microsof...44407735250465

Quick Details

* File Name: officexp-KB910721-FullFile-ENU.exe
* Version: 1.5
* Date Published: Wed, 21 Oct 2009 21:50:42 -0300
* Language: English
* File Size: 100 KB

System Requirements

* Supported Operating Systems: Windows 2000; Windows 98; Windows ME; Windows NT; Windows Server 2003; Windows XP; Windows Vista

* This update applies to the following product: Microsoft Outlook / Outlook Express

Contact Us
© 2009 Microsoft Corporation. All rights reserved. Contact Us |Terms of Use |Trademarks |Privacy Statement

=============


Contianed this link: h t t p://update.microsoft.com.lllliok.me.uk/microsoftofficeupdate/KB910737/default.aspx?ln=en-us&email=mrspring@mrspring.net&id=22931343467725039890093576972899633363503185124 4407735250465



Our pals at llliok.co.uk again!!!!

[playthatbeat]

So i am on FACEBOOK now eh?

Dear Facebook user,

Due to Facebook policy changes, all Facebook users must submit a new, updated account agreement, regardless of their original account start date.
Accounts that do not submit the updated account agreement by the deadline will have restricted.

Please unzip the attached file and run "agreement.exe" by double-clicking it.

Thanks,
The Facebook Team


Confirmation Code #: 0408690658835


From: auto+viyypqbpgalgt@facebookmail.com

Encl: agreement.zip (contains a 57k .exe titled: agreement.exe)

[playthatbeat]

Not really Spam.. But flattering..

We are contacting you in regards to an unusual activity that was identified in your mailbox. As a result, your mailbox has been deactivated. To restore your mailbox, you are required to extract and run the attached mailbox utility.

Best regards, mrspring.net technical support.

Attached: Utility.zip, 19k expanded, Trojan.

Trace:

From - Wed Nov 18 13:02:53 2009
X-Account-Key: account4
X-UIDL: UID214-1249645193
X-Mozilla-Status: 0001
X-Mozilla-Status2: 10000000
X-Mozilla-Keys:                                                                                 
[COLOR="Yellow"]Return-path: [/COLOR]
Envelope-to: mrspring@mrspring.net
Delivery-date: Mon, 16 Nov 2009 18:54:16 +0000
Received: from [187.13.68.69] (helo=18713068069.user.veloxzone.com.br)
	by lh8242.dnsireland.com with esmtp (Exim 4.69)
	(envelope-from )
	id 1NA6ho-0007GJ-TV
	for mrspring@mrspring.net; Mon, 16 Nov 2009 18:54:15 +0000
[COLOR="#ffff00"]Received: from 187.13.68.69 by barracuda.saintpaulhotel.com; Mon, 16 Nov 2009 16:57:18 -0300[/COLOR]
Message-ID: <000d01ca66ee$9f082080$6400a8c0@employej40>
From: "alert@mrspring.net" 
To: 
Subject: your mailbox has been deactivated
Date: Mon, 16 Nov 2009 16:57:18 -0300
MIME-Version: 1.0
Content-Type: multipart/mixed;
  boundary="----=_NextPart_000_0006_01CA66EE.9F082080"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-Spam-Status: No, score=0.1
X-Spam-Score: 1
X-Spam-Bar: /
X-Spam-Flag: NO

This is a multi-part message in MIME format.

------=_NextPart_000_0006_01CA66EE.9F082080
Content-Type: text/plain;
	format=flowed;
	charset="Windows-1252";
	reply-type=original
Content-Transfer-Encoding: 7bit

We are contacting you in regards to an unusual activity that was identified in your mailbox. As a result, your mailbox has been deactivated. To restore your mailbox, you are required to extract and run the attached mailbox utility.

Best regards, mrspring.net technical support.

------=_NextPart_000_0006_01CA66EE.9F082080
Content-Type: application/zip;
	name="utility.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
	filename="utility.zip"

[jasonmcareedj]

CONGRATULATIONS TOYOTA SECOND PRIZE WINNER
From: A SECOND PRIZE WINNER (toyotap208@yahoo.cn)
You may not know this sender.Mark as safe|Mark as junk
Sent: 01 January 2010 23:46:17
To:
TOYOTA INTERNATIONAL LOTTO (HEADQUARTERS)
Customer Service Department Affiliate of Toyota Japan And China .
#28 Kanashiwa road Tokyo JP
We are pleased to inform you of the announcement made today, You are among the winners of the TOYOTA CAR INTERNATIONAL PROMOTION PROGRAM Participants were selected through a computer ballot system drawn from 2,500,000 email addresses of individuals and companies from all part of the world as part of our electronic business Promotions Program.

As a result of your visiting various websites we are running the e-business promotions for. You/Your Company email address, attached to ticket number 719-266-1319, with serial number 902-66 drew the lucky numbers 5,12,30,11,17,43 and Bonus number 10, Your INSURANCE Number: FLS433/ 453L /GMSA and consequently you won in the Second Category of the TOYOTA FORTUNE LOTTO DRAW.

You have therefore been approved for the payment of the sum of US$500,000.00 (Five Hundred Thousand United States Dollars) in cash, including a Toyota car which is the winning present /amount for the Second category winners. This is from the total prize money of US$2,650,000.00 shared among the international winners in the Second category.
CONGRATULATIONS!!!

Please be informed that your won fund of the sum of US$500,000.00 is now with the payee center. Contact your agent and give them your full names so that they will re-insure your winning under your full names. Together with the port where your winning car should be ship to.

To begin your claim, please call or send an email immediately to your clams agent / online consultant:
Mr. James Chang,
Foreign Services Manager,
Transglobe Financial Security,
Tel: +86 13568724689
Fax: +860267876588
Email: promotionprogram@126.com
WWW.TOYOTA.CN

NOTE: In order to avoid unnecessary delays and complications, Please quote your

1. Full name:
2. Address / contact number:
3. Occupation:
4. Age:
5. Sex:
6. Nationality:
7. Email:
Send above information in your correspondences with your claims agent / online consultant. Congratulations once again from all our staffs and thank you for being part of our promotions program.

Sincerely ,
Mrs. Ing Chuny Liu,
Online Corordinator.
EMAIL: toyotap208@yahoo.cn

Our First Quarter Winner Mrs. Lucy Bailay from Australia receiving her winning cheque of US$500,000.00 also on the picture is her husband and friends rejoicing with them.

[Deedo08]

Yes

Account Alert™
From: Windows Live™ (kbrooks75@hotmail.com)
You may not know this sender.Mark as safe|Mark as junk
Sent: 20 January 2010 15:25:16
To: customers10000@live.com




Windows Live Hotmail Alert!!!



Dear Account Owner

This Email is from Hotmail Customer Care and we are sending it to every Hotmail Email User Accounts Owner for safety. we are having congestions due to the anonymous registration of Hotmail accounts so we are shutting down some Hotmail accounts and your account was among those to be deleted. We are sending this email to you so that you can verify and let us know if you still want to use this account. If you are still interested please confirm your account by filling the space below.Your User name, password, date of birth and your country information would be needed to verify your account.

* Username: ...............................
* Password: ................................
* Date of Birth: ............................
* Country Or Territory: ................

Warning!!! Account owner that refuses to update his/her account after receiving this warning will lose his or her account permanently.
Sincerely,
The Windows Live Hotmail Team

[playthatbeat]

Get in! Toyota is now in china!!!

Toyota Japan Lottery for 2010 China Award
Customer Service Department
Affiliate of Toyota Branch China.
28 Tanfield Road Tiaxiu lio Beijing
ChinaPRIZE AWARD NOTIFICATION

We are pleased to inform you of the announcement made today, You are among the winners of the TOYOTA CAR INTERNATIONAL PROMOTION PROGRAM Participants were selected through a computer ballot system drawn from 2,500,000 email addresses of individuals and companies from all part of the world as part of our electronic business Promotions Program.As a result of your visiting various websites we are running the E-business promotions for. You/Your Company email address, attached to ticket number 719-226-1319 , with serial number 902-66 drew the lucky numbers 05,12,30,11,17,43 and Bonus number 10 , Your INSURANCE Number: FLS433/ 453L /GMSA and consequently you won in the Second Category of the TOYOTA FORTUNE LOTTO DRAW.You have therefore been approved for the payment of the sum of US$1,000, 000, 00 in cash, including a Toyota car which is the winning present /amount for the Second category winners. This is from the total prize money of US$12,650,000.00 shared among the int
ernational winners in the Second
ategory.CONGRATULATIONS!!!
Please be informed that your won fund of the sum of US$1,000,000.00 is now with the payee center. Contact our agent and give them your full names so that they will re-insure your winning fund under your full names. Together with the port where your winning car should be shipped to.To begin your claim, please call our claim agent or send email immediately to:-

GIBSON DAVID
Foreign Services Manager,
Transglobe Finance Securities
E-mail:toyoat@163.com
Tel:+8613434352236
1. Full Name:
2. Address:
3. Occupation:
4. Age:
5. Sex:
6. Nationality:
7. Country of Residence:
8. Telephone/Fax Number:

NOTE: In order to avoid unnecessary delays and complications, please remember to quote your reference and batch numbers and other information provided above and below in every one of your correspondences to your claiming agent.
Congratulations'' once again from all our staff and thank you for being part of our promotions program.
Sincerely,
Mr.Baye Lofo
Online coordinator
www.Toyota.com.cn

[jasonmcareedj]

i got the same one from toyota a few weeks aback lol

[playthatbeat]

Another pair of AIB-Scams...

More rare Paddy-Spam, in fact 2 claiming to be from AIB that present a white space, expecting you to click on them after readign the seductive title: REMINDER: Your are required to confirm your email address

Return-path: 
Envelope-to: *****@iol.ie
Delivery-date: Mon, 08 Feb 2010 05:09:03 +0000
Received: from Debian-exim by hub11.mail.esat.net with spam-scanned (Exim 4.69)
	(envelope-from )
	id 1NeLrm-0003N4-W6
	for *****@iol.ie; Mon, 08 Feb 2010 05:09:03 +0000
X-Spam-Flag: _YESNOCAPS
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on hub11.mail.esat.net
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.6 required=4.5 tests=HTML_IMAGE_ONLY_04,
	HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_SHORT_LINK_IMG_1,MIME_HEADER_CTYPE_ONLY,
	MIME_HTML_ONLY,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,
	RAZOR2_CF_RANGE_E8_51_100,RAZOR2_CHECK autolearn=disabled version=3.2.5
X-Spam-Report: *  0.0 HTML_MESSAGE BODY: HTML included in message
	*  1.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
	*  0.6 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area
	*  1.5 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words
	*  1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
	*      above 50%
	*      [cf: 100]
	*  1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level
	*      above 50%
	*      [cf: 100]
	*  0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
	*  0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
	*      [cf: 100]
	*  0.9 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required MIME
	*      headers
	*  1.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image
Received: from vt35.dns.net.vn ([203.113.173.35])
	by hub11.mail.esat.net with esmtp (Exim 4.69)
	(envelope-from )
	id 1NeLrm-0003Mj-Gv
	for atrisk@iol.ie; Mon, 08 Feb 2010 05:08:58 +0000
Received: from root by vt35.dns.net.vn with local (Exim 4.67)
	(envelope-from )
	id 1NeLjy-0001cH-EY
	for *****@iol.ie; Mon, 08 Feb 2010 12:00:54 +0700
To: *****@iol.ie
Subject: IMPORTANT: Your are required to confirm your email address
From: A I B Internet Banking 
Content-Type: text/html
Message-Id: 
Date: Mon, 08 Feb 2010 12:00:54 +0700
X-SA-Poll-Id: 1265605889559..073d69551d245fab7ed79aa756c74da7..1..1265605254000
X-SA-USERIDNR: 260430
Received-SPF: unknown(alliedirish.ie: domain of alliedirish.ie uses a mechanism not recognized by this client)
X-SA-CTIP: 0
X-SA-MPREASON: UNVERIFIED




AIB(c)2010

Yawn...

WHOIS information for 2xp7m0t4bk.com :
Domain ID:
Domain Name: 2xp7m0t4bk.com
Created On: 05-Feb-2010 00:00:00
Expiration Date: 05-Feb-2011 00:00:00
Sponsoring Registrar: 'Check Whois' (XIN NET TECHNOLOGY CORPORATION) (XIN NET TECHNOLOGY CORPORATION)
Status: client_delete_prohibited,client_hold,client_transf er_prohibited,client_update_prohibited
Name Server: ns2.the-thoko-dns.com
Name Server: ns3.the-thoko-dns.com
Registrant ID: Unknown
Registrant Name: Unknown
Registrant Organization: Unknown
Registrant Street1: Unknown
Registrant Street2: Unknown
Registrant Street3: Unknown
Registrant City: Unknown
Registrant State/Province: Unknown
Registrant Postal Code: Unknown
Registrant Country: Unknown
Registrant Phone: Unknown
Registrant Fax: Unknown
Registrant Email: Unknown
Admin ID: Unknown
Admin Name: Unknown
Admin Organization: Unknown
Admin Street1: Unknown
Admin Street2: Unknown
Admin Street3: Unknown
Admin City: Unknown
Admin State: Unknown
Admin Postal Code: Unknown
Admin Country: Unknown
Admin Phone: Unknown
Admin Fax: Unknown
Admin Email: Unknown

[brain]

Here one from our Chinese cousins. Looks like Nigeria has a provence in the far east:

Patrick Chan
show details 13:34 (19 hours ago)

Dear Frined,

It is understandable that you might be a little bit apprehensive because you do not know me but I have a lucrative business proposal of mutual interest to share with you. I got your reference in my search for someone who suits my proposed business relationship.
I am Mr. Patrick K. W. Chan Executive Director & Chief financial Officer of Hang Seng Bank Ltd. I will need you to assist me in executing a business project from Hong Kong to your country. It involves the transfer of money. Everything concerning this transaction shall be legally done without hitch. Please endeavour to observe utmost discretion in all matters concerning this issue.
Once the funds have been successfully transferred into your account, we shall share in the ratio to be agreed by both of us. I will prefer you reach me on my confidential email address
(patrickchan_hsbcb@yahoo.cn )

I shall furnish you with more information about this operation immediately i receive a positive response from you.
Your earliest response to this letter will be appreciated.

Kind Regards,
Mr. Patrick Chan