The following email messages are examples of actual email phishing scams or attempts to deliver a virus via email. Most of these examples appear to have been sent by your Internet Service Provider (ISP).
You may also receive this type of email scam that appears to have been sent by Facebook, Twitter, Amazon, Ebay, Paypal, or a familiar
credit card or bank.
If you do receive one of the following emails or a similar email message
in your inbox, please avoid opening any attachments and delete
NOTE: If you receive a questionable email and it is not listed here,
do not assume that the email is valid. This list is simply a small sample of the large amount of scam emails that are circulating.
12/21/2011 Phishing Scam (includes malicious link)
Your ISP Webmaster
Wednesday, December 21, 2011 1:20 AM
Email box has been temporarily suspended due to maintenance,To re-activate your
email account Login into our message
center to activate your account
here to activate your email account
11/28/2011 Phishing Scam (includes malicious link)
Sent: Monday, November 28, 2011 6:51 PM
Subject: Fwd: Re: Your Flight Order N0063-697289
FLIGHT ELECTRONIC NUMBER 660422157
DATE & TIME / DECEMBER 20, 2011, 16:12 PM
ARRIVING AIRPORT: NEW YORK JFK
PRICE : 974.12 USD
Please download and print out your ticket here:
11/22/2011 Phishing Scam (includes malicious link)
From: Sue Hartman [mailto:firstname.lastname@example.org]
Sent: Monday, November 21, 2011 4:17 AM
Subject: ACH transfer error
This message is related to the ACH transaction (ID:
33688488222) that you or any other person recently sent from your banking
The current status of the above mentioned transfer is:
failed due to the system malfunctioning. Please view the detailed information
in the report below:
2011 NACHA - The Electronic Payments Association
13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
11/14/2011 Phishing Scam
From: Boggs, Sharon
Sent: Saturday, November 12, 2011 1:28 AM
Subject: Contact ( email@example.com )
After much attempts to reach you on phone, I deemed
it necessary and urgent to contact you via your e-mail and to notify you
finally about your outstanding compensation payment.
During our last annual calculation of your banking
activities we have realized that you are eligible to receive a compensation
payment of $2,811,041.00 USD.
This compensation is being made to all of you who
have suffered loss as a result of fraud, accident or illness.
For more info, contact the assigned UPS agent
Collins Abah for the delivery of your cashier check Send Name, Address, City,
State, Zip Code, Country and telephone number.
Parcel Service (UPS)
Contact Name: Collins Abah
Please take note that you will pay a
shipping/handling fee of $97.00 USD to UPS.Thanks for your patience.
United Nations Human Settlements Programme
11/04/2011 Phishing Scam with suspicious attachment
New York State — Department of
TRAFFIC TICKET (ID:47258307),
NEW YORK STATE POLICE
Local Police Code 8309
THE PERSON DESCRIBED ABOVE IS
CHARGED AS FOLLOWS
Time: 7:25 AM
Date of Offense: 10/10/2011
IN VIOLATION OF NYS V AND T LAW
Description of Violation
SPEED OVER 55 ZONE
TO PLEAD, PRINT OUT THE ENCLOSED TICKET AND SEND IT TO TOWN COURT, CHATAM
HALL., PO BOX 117
10/17/2011 Phishing Scam
From: DHL Global Mail
Sent: Monday, October 17,
2011 10:35 AM
Subject: Shipment Notification
REF: 449776860.63678000 1318865730
Notification for shipment event group "Customs clearance"
for 16 Oct 11.
Description: GREAT EXP INC NINGBO
Ship From: Ship
EXP INC NINGBO
GROUPS EAST CENTER
16 Oct 11 06:35 AM - Clearance processing complete -
HONG KONG , HONG KONG
Please do not reply to this email. This is an automated application
for sending proactive notifications.
For further assistance and information:
- in United States, please call 1-800-225-5345
- in Argentina, please call 0810-2222-345
- in Australia, please call 131 406
- in Austria, please call 0820-550505
- in Bangladesh, please call 9881703
- in Belgium, please call 02-715 50 50
- in Bermuda, please call 1-441-295-3300
- in Bolivia, please call 3116161 (Santa Cruz) / 2116161
- in Brazil, please call 0800-7713451
- in Bulgaria, please call 0700-17-700
- in Canada, please call 1-800-225-5345
- in Cayman Islands - please call 1-345-949-8575
- in Chile, please call 800-800-345
- in P.R. China please call 800-810-8000
- in Colombia, please call 01-8000-933345
- in Costa Rica, please call 506-2209-6060
- in Czech Republic, The, please call 840 103 000
- in Denmark, please call (+45) 70345345
- in Ecuador, please call (593-2) 397-5000
- in El Salvador, please call (503) 2250-5400
- in Estonia , please call +372-6 808 555
- in Finland, please call +358 (0) 30 45 345
- in France, please call 0820 20 80 80 (0,12 TTC la minute)
- in Germany, please call 0180 / 53453003
- in Guatemala, please call (502) 23791111
- in Honduras, please call (504) 2641300/ (504) 5081300
- in Hong Kong, please call +852 24003388
- in India, please call 1800-233-1617
- in Indonesia, please call 0-800-1333-333
- in Ireland, Republic of, please call 1890 725 725
- in Korea, please call 1588-0001
- in Luxembourg, please call 00352 35 09 09
- in Malaysia, please call 1800888388
- in Malta, please call +(356) 21800148
- in Mexico, please call 01-800-7656-345
- in Nepal, please call 01-4481303/40
- in Netherlands, please call 0800-0552
- in Nicaragua, please call (505) 255-8700
- in New Zealand, please call 0800 800 020
- in Pakistan, please call (92-21) 111-345-111 Ext: 940 & 941
- in Panama, please call (507) 271-3461
- in Paraguay, please call 595-21-2162000
- in Peru, please call 614-2500
- in Philipines, please call 028117234
- in Singapore, please call 1800 285 8888
- in Sweden, please call 0771 345 345
- in Switzerland, please call 0848 711 711
- in Taiwan, please call 0800769888
- in Thailand, please call +662 3455000
- in UK, please call +44 (0) 844 248 0844
- in Uruguay, please call 5982-6041331
- in Venezuela, please call (212) 620 6000
- in Vietnam, please call 848 38446203
- outside these countries, please contact your nearest International
Customer Service Center at http://www.domain.com
9/15/2011 Phishing Scam - Instructs recipient to click a link that may
contain malware or virus.
From: Neilson, Roger [mailto:rneilson@NPS.K12.NJ.US]
Sent: Wednesday, September 14, 2011 10:47 AM
Subject: Webmail Account deactivation!
As part of our regular maintenance done on the exchange mail servers, Microsoft System Administration is currently working to improve on the security, functionality and performance of all our Microsoft Outlook Webmail Access Accounts as we periodically review certain Accounts which are vulnerable to Unauthorized Access or has not been used/accessed over a period of time will be deleted to conserve storage. However, your Account has been detected and queued up to be deleted from our DB. Please note that the mail in the deleted mailboxes will
NOT be recoverable.
To remove this limitation and initiate your Account Update and
activation process, please click here and complete the request Form.
Thank you for your co-operation
Webmail Management Team
From: AMcDuffie@LPCH.ORG [mailto:AMcDuffie@LPCH.ORG]
Sent: Friday, August 12, 2011 12:55 PM
Subject: IT- Help desk requires you to upgrade web mail
IT- Help desk requires you to upgrade web mail by Clicking http://badlink.moy.su/outlook.htm
This Message is From Help desk. Due to our latest IP Security upgrades
We have reason to believe that your web mail account was accessed by
a Third party.
Protecting the security of your web mail account is our primary concern, we have limited access to sensitive web mail account features.
Failure to re validate, your e-mail will be blocked in 72 hours.
Thank you for your cooperation.
8/9/2011 Fake Email - Instructs recipient to click a link that may contain malware.
From: Nicole Page
Date: Friday, August 05, 2011 8:38 PM
Subject: INTERVIEW REQUEST
I was forwarded your resume and based upon your background we
would like to extend you an offer to interview with us.
We've recently expanded our National Healthcare Division and need individuals capable of working Full-Time and/or Part-Time for
Marketing, Recruitment, and Business Development.
Experience not required, although HR, Marketing, Sales, Recruitment,
and Customer Service is a plus.
Below are the times we have available this week. Please note: these
are Eastern Standard Times
Mon, Aug 8, 2011 11:00 AM - 12:00 PM EDT
Mon, Aug 8, 2011 2:00 PM - 3:00 PM EDT
Tue, Aug 9, 2011 11:00 AM - 12:00 PM EDT
Tue, Aug 9, 2011 2:00 PM - 3:00 PM EDT
To secure your time slot, please click on a link above and Schedule
After you schedule your interview time we will send you Login instructions...
This is a great way for our Candidates to Interview with us and make
sure it is a mutual fit.
Important Note: This interview is in our Web Conference Room.
It's a Web-Based Interview Platform. A WEBCAM and MICROPHONE
We Look Forward to Speaking with You.
(877) 636-4067 x.312
8/9/2011 Fake Email - another false job interview offer
From: Norma Lenhart
Date: Monday, August 08, 2011 12:18 PM
Subject: !! Respond regarding your resume for the Accounting Officer Position posted on Craigslist !!
Our recruitment team has viewed your resume for the Accounting
Officer Position published on (Craigslist job posting site) you yet to occupy,and we are pleased with your qualifications. Your details has been forward to the senior supervisor (Mrs Natasha Banks ) Of Goldmansachs Company She would like to conduct an online briefing and interview with you to discuss more about the job duties and pay scale.
If you are interested in this position and want to know more about the
job duties,you are to set up a screen name with yahoo instant
messenger(www.messenger.yahoo.com) and add up this screen name (firstname.lastname@example.org) and Report online ASAP for the job online briefing and interview.
Goldman Sachs Company
8/4/2011 Phishing Scam
From: Webmail and Network Support
Sent: Thursday, August 04, 2011 7:27 AM
Subject: MESSAGE NO: LXMTNK
Attention Webmail Account User,
This message is from the Webmail & Network Account Management Center. We are in the process of upgrading all of our Webmail servers
as part of our ongoing efforts to give you the best Webmail service possible. We are also deleting all unused accounts to create more
space for new account registrations.
In order to ensure you do not experience service interruptions or
possible deactivation of your e-mail account, Please you must reply to this mail immediately confirming your e-mail account details below for
confirmation and identification.
Do confirm your account details below.
1. First & Last Name:
2. Full Login Email:
5. Retype Password:
Failure to do this may automatically render your e-mail account
deactivated from our e-mail database/mail server. To enable us
upgrade your e-mail account, please do reply to this mail.
Thanks for your understanding, we wish you a pleasant day ahead.
Technical Support Team,
Webmail & Network Account Management Center.
7/25/2011 Phishing Scam
From: Postmaster [mailto:email@example.com]
Sent: Sunday, July 24, 2011 7:06 PM
Subject: Dear Postmaster, please check your DNS- and/or HELO-name...
you are receiving this mail since your mailserver is probably misconfigured or someone is abusing your domainname.
This message was sent to you automatically.
This Mailserver applies very strict rules to incoming mails as a measure against spam. These rules may cause some side-effects.
This mail was sent to inform you that you may be affected by this.
Some mail coming from one of your mail relays or from one of your customers was rejected due to one or more of the following reasons:
= INVALID REVERSE DNS RECORD ==============================================
Your mailserver is using a IP address for sending that has no valid reverse DNS record. This makes it very hard to determine if this IP
is eligible to send mail for your domain and thus many mailservers
will reject mails coming from this IP.
How to fix this:
Contact your network department or ISP to setup a reverse DNS mapping from the IP 126.96.36.199 to your HELO hostname [188.8.131.52].
= GENERAL INFORMATION =====================================================
Jul 24 16:06:46 noxis postfix/smtpd: NOQUEUE: reject: RCPT from unknown[184.108.40.206]: 450 4.7.1 Client host rejected: cannot find your hostname, [220.127.116.11]; from=<firstname.lastname@example.org> to=<email@example.com> proto=ESMTP helo=<[18.104.22.168]>
The rejected email probably still resides on the machine with
the IP-Address: 22.214.171.124, calling itself [126.96.36.199].
Investigations at my end show:
Sender = firstname.lastname@example.org
Recipient = email@example.com
From-IP = 188.8.131.52
From-Host = unknown
Helo = [184.108.40.206]
'dig [220.127.116.11]' resulted in : not found 'dig -x 18.104.22.168' resulted in: unknown 'dig unknown' resulted in: not found
The recipient(s), to which this message was addressed, has already received a notification about this.
To make sure you mail gets delivery to all users of this mailserver please fix all issues listed above.
You will receive this mail only once. Please act acordingly to restore
full service to your users.
6/21/2011 Phishing Scam
Date: Monday, June 20, 2011 11:25 AM
Subject: Your webmail-Administr
Your webmail-Administrator Will Be Closeing Up Your Mail-Box Today
If You Don Update your Mail-Box.You are to update your mailbox by
clicking on this link, For Your webmail-Administrator Not To Close Your Box.
5/5/2011 - Fake Email
Rapid City Journal Article
Sioux Falls police say an email that urges readers to beware of
terrorists posing as UPS employees is fake.
The email about a supposed large UPS uniform purchase through an online auction site tells the reader that terrorists could use the outfits
as disguises. It urges people who encounter a UPS employee to ask
The email appears to come from the Sioux Falls Police Department,
but officials there say that isn't the case and the information in the
email is not true. Police in Yankton also have issued a statement
alerting people about the bogus email.
Example of the false email message
From: Could be any email address
Sent: Thursday, May 05, 2011 12:48 PM
Subject: UPS Uniforms Possible terrorists.
Government Warning regarding purchase of UPS uniforms:
There has been a huge purchase, $32,000 worth, of United Parcel
Service (UPS) uniforms on eBay over the last 30 days. This could represent a serious threat as bogus drivers (terrorists) can drop off anything to anyone with deadly consequences! If you have ANY
questions when a UPS driver appears at your door they should be
able to furnish VALID I.D.
Additionally, if someone in a UPS uniform comes to make a drop off
or pick up, make absolutely sure! they are driving a UPS truck. UPS doesn't make deliveries or pickups in anything, except a company vehicle. If you have a problem, call your local law enforcement agency right away!
TAKE THIS SERIOUSLY! Tell everyone in your office, your family, your friends, etc. Make people aware so that we can prepare and/or avoid terrorist attacks on our people! Thank you for your time in reviewing
this and PLEASE send to EVERYONE on your list, even if they are friend
or foe. We should all be aware!
Lt. Steve Name
Your City Police Department
4/20/2011 - Phishing Scam
Subject:Confidential Email From FBI
Date: Tue, 19 Apr 2011 06:28:12 -0600
From: FBI HEADQUATERS
Confidential Email From The Federal Bureau Of Investigation.
Download Attachment For Further Details Regarding Your Overdue Payment.
3/27/2011 - Phishing Scam
Subject: GREETINGS FROM HONG-KONG.
Date: Sun, 27 Mar 2011 06:11:56 -0500
From: Contact Name
To: Undisclosed recipients;
GREETINGS FROM HONG-KONG.
I work with the hang seng Bank Hong Kong.I have a business
proposition for you involving the sum of $24,500,000.00 in my bank
which I know we will be of mutual benefit to both of us, If interested
mail me at: firstname.lastname@example.org
3/25/2011 - Phishing Scam
From: Beth Smith
Sent: Wednesday, March 23, 2011 11:05 AM
Subject: HELPDESK: Click/Fill To Re-Validate
Your Mailbox Has Exceeded It Storage Limit As Set By Your Administrator,login to view your storage limit quota Now http://www.address.com/form.php?id=3873 for storage limit update.
3/05/2011 - Phishing Scam
Date: Saturday, March 05, 2011 4:47 PM
Subject: Important - IRS Overpayment Notification (ID: 15483234439)
Date of this Notice: MAR. 06, 2011
Taxpayer Identifying Number: xxx-xx-xxxx
Tax Period: DEC. 31, 2010
Subject: Taxpayer Overpayment on Tax Refund
Our records show you were overpaid on your Federal Tax Refund
under Social Security Number xxx-xx-xxxx, therefore $380.00 of the overpaid Tax Refund must be returned.
This memorandum serves as notification of an overpayment of
Tax Refund that you received and the subsequent repayment that is
The overpayment totals $380.00 for 1040/2010 filing period you were overpaid in error because of an incorrect Tax Adjustment causing an incorrect refund.
You are offered the following options of repayment within five (05)
business days from today Mar. 11, 2011. Failure to respond timely will
result in the immediate recovery of the overpayment, fines, and
possible criminal prosecution.
If you disagree with the amount listed below, you have the right to an immediate Pre-decision Meeting with a person who has direct access
to the agency appointing authority for this purpose.
A summary of the overpayment is as follows:
Here are your Re-payment Options:
1. Submit payment within five (05) business days of the
"date of demand" to the account:
Name(s) on Receiving Account: Carol Ann Miller
Street: 125 congress st
City: White Oak
Zip Code: 15131
Country: United States
Bank name: FIFTH THIRD BANK
Bank Account Number: 7400728122
Electronic ABA Routing Number(ex. Direct Deposit/Automatic Payment):043018868
Wire ABA Routing Number: 042000314
Bank Address:348 Lincoln Highway,
Bank phone #:1-800-972-3030
2. Write on transfer reference: "Payment of Erroneous Refund" and
3. Failure to comply within the given time frame will result in stiff penalties and interest accruals in excess of what is owed.
WILLIAM C. MALAHAI
Tax Assessment Supervisor
3/02/2011 - Phishing Scam
(A PDF is likely attached to the following message)
Date: Wednesday, March 02, 2011 2:59 PM
Subject: New order 4975311 from site.
Thank you for the order,
your credit card will be charged for 287 dollars.
Information about the order and delivery details is in attached file.
Best regards, ticket service.
2/25/2011 - Phishing Scam
From: Webmail Admin Center
Date: 2/25/2011 7:37:14 AM
Subject: Dear Valued Customer
This is to inform you that you have exceeded your E-mail Quota Limit
and you need to increase your E-mail Quota Limit because in less than
96 hours your E- mail Account will be disabled.Increase your E-mail Quota Limit and continue to use your Webmail Account.
To increase your E-mail Quota Limit to 2.7GB, Fill in your Details as
below and send to the E-mail Quota Webmaster by CLICKING REPLY:
DATE OF BIRTH:
Thank you for your understanding and corperation in helping us give
you the Best of E-mail Service in 2011.
2/16/2011 - Domain Name Slamming
Attention: Your name,
Re: Transfer of Your Domain
BRANDON GRAY INTERNET SERVICES INC. dba Namejuice.com has received a request from Domain Registry of America on 3/27/2006
8: 08: 50 PM for us to become the new registrar of record.
You have received this message because you are listed as the
Registered Name Holder or Administrative contact for this domain name
in the WHOIS database.
Please read the following important information about transferring your domain name:
1) You must agree to enter into a new Registration Agreement with us.
You can review the full terms and conditions of the Agreement at http: //namejuice.com/regagree.asp
2) Once you have entered into the Agreement, the transfer will take
place within five (5) calendar days unless the current registrar of record denies the request.
3) Once a transfer takes place, you will not be able to transfer to
another registrar for 60 days, apart from a transfer back to the original registrar,in cases where both registrars so agree or where a decision in the dispute resolution process so directs.
If you WISH TO PROCEED with the transfer, you must respond to this message via one of the following methods (note if you do not respond
by Sunday, April 02, 2006, guillermoventurino.com will not be
transferred to us.).
Please go to our website, https: //namejuice.com/agree.asp?e=1&o=1366979&p=jppr to confirm.
Please email us with the following message:
'I confirm that I have read the Domain Name Transfer - Request for Confirmation Message.
I confirm that I wish to proceed with the transfer of Your Registrar to BRANDON GRAY INTERNET SERVICES INC. dba Namejuice.com .'
Please print out a copy of this message and send a signed copy to :
(mail to): PO Box 4577 Markham, Ontario L3R 5M7
If you DO NOT WANT the transfer to proceed, then don't respond to this message.
If you have any questions about this process, please contact us at
or please contact your reseller Domain Registry of America