2011 e-Scams-ISP Alerts

2011 Email Scams

The following email messages are examples of actual email phishing scams or attempts to deliver a virus via email. Most of these examples appear to have been sent by your Internet Service Provider (ISP).

You may also receive this type of email scam that appears to have been sent by Facebook, Twitter, Amazon, Ebay, Paypal, or a familiar
credit card or bank.

If you do receive one of the following emails or a similar email message
in your inbox, please avoid opening any attachments and delete
the email.

NOTE: If you receive a questionable email and it is not listed here, 
do not assume that the email is valid. This list is simply a small sample of the large amount of scam emails that are circulating.

12/21/2011 Phishing Scam (includes malicious link)

From: Your ISP Webmaster
To: undisclosed-recipients:;
Date: Wednesday, December 21, 2011 1:20 AM
Subject: Read Immediately

Dear Email User

Your Email box has been temporarily suspended due to maintenance,To re-activate your email account Login into our message  center to activate your account

Click here to activate your email account

11/28/2011 Phishing Scam (includes malicious link)

From: support@yourdomain.net
To: username@yourdomain.net
Sent: Monday, November 28, 2011 6:51 PM
Subject: Fwd: Re: Your Flight Order N0063-697289

Dear Customer,

DATE & TIME / DECEMBER 20, 2011, 16:12 PM
PRICE : 974.12 USD

Please download and print out your ticket here:


Airlines America

11/22/2011 Phishing Scam (includes malicious link)

From: Sue Hartman [mailto:robert.bitter@symbolic.com]
Sent: Monday, November 21, 2011 4:17 AM
To: username@yourdomain.com
Subject: ACH transfer error

This message is related to the ACH transaction (ID: 33688488222) that you or any other person recently sent from your banking account.

The current status of the above mentioned transfer is: failed due to the system malfunctioning. Please view the detailed information in the report below:


Best regards,

Sue Hartman
2011 NACHA - The Electronic Payments Association
13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171

11/14/2011 Phishing Scam

From: Boggs, Sharon
To: user@yourdomain.com
Sent: Saturday, November 12, 2011 1:28 AM
Subject: Contact ( ups_dispatch@hotmail.com )

After much attempts to reach you on phone, I deemed it necessary and urgent to contact you via your e-mail and to notify you finally about your outstanding compensation payment.

During our last annual calculation of your banking activities we have realized that you are eligible to receive a compensation payment of $2,811,041.00 USD.

This compensation is being made to all of you who have suffered loss as a result of fraud, accident or illness.

For more info, contact the assigned UPS agent Collins Abah for the delivery of your cashier check Send Name, Address, City, State, Zip Code, Country and telephone number.

(United Parcel Service (UPS)
Contact Name: Collins Abah
Tel: +2348138900697
E-mail: ups_dispatch@hotmail.com

Please take note that you will pay a shipping/handling fee of $97.00 USD to UPS.Thanks for your patience.

Merry Christmas.

Boggs, Sharon
Programme Manager
United Nations Human Settlements Programme

11/04/2011 Phishing Scam with suspicious attachment

New York State Department of Motor Vehicles


Local Police Code 8309


Time: 7:25 AM
Date of Offense: 10/10/2011

6969 Description of Violation



10/17/2011 Phishing Scam

From: DHL Global Mail                 
Monday, October 17, 2011 10:35 AM
Shipment Notification REF: 449776860.63678000 1318865730

Notification for shipment event group "Customs clearance"
for 16 Oct 11.

AWB Number: 1361202660                          
Service: P
Pieces:  2
Cust. Ref:

Ship From:                                                      Ship To:  US


1112 SQR
NINGBO, 84075530

16 Oct 11 06:35 AM - Clearance processing complete -

Please do not reply to this email. This is an automated application
used only for sending proactive notifications.

For further assistance and information:
- in United States, please call 1-800-225-5345
- in Argentina, please call 0810-2222-345
- in Australia, please call 131 406
- in Austria, please call 0820-550505
- in Bangladesh, please call 9881703
- in Belgium, please call 02-715 50 50
- in Bermuda, please call 1-441-295-3300
- in Bolivia, please call 3116161 (Santa Cruz) / 2116161
- in Brazil, please call 0800-7713451
- in Bulgaria, please call 0700-17-700
- in Canada, please call 1-800-225-5345
- in Cayman Islands - please call 1-345-949-8575
- in Chile, please call 800-800-345
- in P.R. China please call 800-810-8000
- in Colombia, please call 01-8000-933345
- in Costa Rica, please call 506-2209-6060
- in Czech Republic, The, please call 840 103 000
- in Denmark, please call (+45) 70345345
- in Ecuador, please call (593-2) 397-5000
- in El Salvador, please call (503) 2250-5400
- in Estonia , please call +372-6 808 555
- in Finland, please call +358 (0) 30 45 345
- in France, please call 0820 20 80 80 (0,12 TTC la minute)
- in Germany, please call 0180 / 53453003
- in Guatemala, please call (502) 23791111
- in Honduras, please call (504) 2641300/ (504) 5081300
- in Hong Kong, please call +852 24003388
- in India, please call 1800-233-1617
- in Indonesia, please call 0-800-1333-333
- in Ireland, Republic of, please call 1890 725 725
- in Korea, please call 1588-0001
- in Luxembourg, please call 00352 35 09 09
- in Malaysia, please call 1800888388
- in Malta, please call +(356) 21800148
- in Mexico, please call 01-800-7656-345
- in Nepal, please call 01-4481303/40
- in Netherlands, please call 0800-0552
- in Nicaragua, please call (505) 255-8700
- in New Zealand, please call 0800 800 020
- in Pakistan, please call (92-21) 111-345-111 Ext: 940 & 941
- in Panama, please call (507) 271-3461
- in Paraguay, please call 595-21-2162000
- in Peru, please call 614-2500
- in Philipines, please call 028117234
- in Singapore, please call 1800 285 8888
- in Sweden, please call 0771 345 345
- in Switzerland, please call 0848 711 711
- in Taiwan, please call 0800769888
- in Thailand, please call +662 3455000
- in UK, please call +44 (0) 844 248 0844
- in Uruguay, please call 5982-6041331
- in Venezuela, please call (212) 620 6000
- in Vietnam, please call 848 38446203
- outside these countries, please contact your nearest International
Customer Service Center at http://www.domain.com

9/15/2011 Phishing Scam - Instructs recipient to click a link that may
contain malware or virus.

From: Neilson, Roger [mailto:rneilson@NPS.K12.NJ.US]
TO: subscriber@yourdomain.com
Sent: Wednesday, September 14, 2011 10:47 AM
Subject: Webmail Account deactivation!

Dear User,

As part of our regular maintenance done on the exchange mail servers, Microsoft System Administration is currently working to improve on the security, functionality and performance of all our Microsoft Outlook Webmail Access Accounts as we periodically review certain Accounts which are vulnerable to Unauthorized Access or has not been used/accessed over a period of time will be deleted to conserve storage. However, your Account has been detected and queued up to be deleted from our DB. Please note that the mail in the deleted mailboxes will 
NOT be recoverable.

To remove this limitation and initiate your Account Update and 
activation process, please click here and complete the request Form.

Thank you for your co-operation

Webmail Management Team

8/12/2011 Phishing Scam

From: AMcDuffie@LPCH.ORG [mailto:AMcDuffie@LPCH.ORG]
To: user@yourdomain.com
Sent: Friday, August 12, 2011 12:55 PM
Subject: IT- Help desk requires you to upgrade web mail

IT- Help desk requires you to upgrade web mail by Clicking http://badlink.moy.su/outlook.htm

This Message is From Help desk. Due to our latest IP Security upgrades
We have reason to believe that your web mail account was accessed by
a Third party.

Protecting the security of your web mail account is our primary concern, we have limited access to sensitive web mail account features.

Failure to re validate, your e-mail will be blocked in 72 hours.

Thank you for your cooperation.

Help Desk

8/9/2011 Fake Email - Instructs recipient to click a link that may contain malware.

From: Nicole Page
To: user@yourdomain.com
Date: Friday, August 05, 2011 8:38 PM

Hello Username

I was forwarded your resume and based upon your background we
would like to extend you an offer to interview with us.

We've recently expanded our National Healthcare Division and need individuals capable of working Full-Time and/or Part-Time for 
Marketing, Recruitment, and Business Development.

Experience not required, although HR, Marketing, Sales, Recruitment,
and Customer Service is a plus.

Below are the times we have available this week. Please note: these 
are Eastern Standard Times

Mon, Aug 8, 2011 11:00 AM - 12:00 PM EDT
Mon, Aug 8, 2011 2:00 PM - 3:00 PM EDT
Tue, Aug 9, 2011 11:00 AM - 12:00 PM EDT
Tue, Aug 9, 2011 2:00 PM - 3:00 PM EDT

To secure your time slot, please click on a link above and Schedule 
your Interview.

After you schedule your interview time we will send you Login instructions...

This is a great way for our Candidates to Interview with us and make
sure it is a mutual fit.

Important Note: This interview is in our Web Conference Room.

It's a Web-Based Interview Platform. A WEBCAM and MICROPHONE 
not required!

We Look Forward to Speaking with You.

Thank you,

Nicole Page
HR/Employment Generalist
HRP Staffing
(877) 636-4067 x.312

8/9/2011 Fake Email - another false job interview offer

From: Norma Lenhart
To: user@yourdomain.com
Date: Monday, August 08, 2011 12:18 PM
Subject: !! Respond regarding your resume for the Accounting Officer Position posted on Craigslist !!

Hello Applicant,

Our recruitment team has viewed your resume for theAccounting 
Officer Position published on (Craigslist job posting site) you yet to occupy,and we are pleased with your qualifications. Your details has been forward to the senior supervisor (Mrs Natasha Banks ) Of Goldmansachs Company She would like to conduct an online briefing and interview with you to discuss more about the job duties and pay scale.

If you are interested in this position and want to know more about the 
job duties,you are to set up a screen name with yahoo instant 
messenger(www.messenger.yahoo.com) and add up this screen name (bnatasha70@yahoo.com) and Report online ASAP for the job online briefing and interview.

Best regard

Human Resource
Goldman Sachs Company

8/4/2011 Phishing Scam

From: Webmail and Network Support
Sent: Thursday, August 04, 2011 7:27 AM

Attention Webmail Account User,

This message is from the Webmail & Network Account Management Center. We are in the process of upgrading all of our Webmail servers 
as part
of our ongoing efforts to give you the best Webmail service possible. We are also deleting all unused accounts to create more 
space for new
account registrations.

In order to ensure you do not experience service interruptions or 
deactivation of your e-mail account, Please you must reply to this mail immediately confirming your e-mail account details below for
and identification.

Do confirm your account details below.

1. First & Last Name:
2. Full Login Email:

3. Username:

4. Password:

5. Retype Password:


Failure to do this may automatically render your e-mail account
deactivated from our e-mail database/mail server. To enable us 
your e-mail account, please do reply to this mail.

Thanks for your understanding, we wish you a pleasant day ahead.

Technical Support Team,

Webmail & Network Account Management Center.

7/25/2011 Phishing Scam

From: Postmaster [mailto:postmaster@noxis.net]
Sent: Sunday, July 24, 2011 7:06 PM
To: postmaster@yourdomain.net
Subject: Dear Postmaster, please check your DNS- and/or HELO-name...

Dear Postmaster,

you are receiving this mail since your mailserver is probably misconfigured or someone is abusing your domainname.

This message was sent to you automatically.

This Mailserver applies very strict rules to incoming mails as a measure against spam. These rules may cause some side-effects.
This mail was sent to inform you that you may be affected by this.

Some mail coming from one of your mail relays or from one of your customers was rejected due to one or more of the following reasons:

= INVALID REVERSE DNS RECORD ==============================================

Your mailserver is using a IP address for sending that has no valid reverse DNS record. This makes it very hard to determine if this IP
is eligible to send mail for your domain and thus many mailservers
will reject mails coming from this IP.

How to fix this:
Contact your network department or ISP to setup a reverse DNS mapping from the IP to your HELO hostname [].


= GENERAL INFORMATION =====================================================

Jul 24 16:06:46 noxis postfix/smtpd[5715]: NOQUEUE: reject: RCPT from unknown[]: 450 4.7.1 Client host rejected: cannot find your hostname, []; from=<user@yourdomain.net> to=<disho@noxis.net> proto=ESMTP helo=<[]>

The rejected email probably still resides on the machine with 
the IP-Address:, calling itself [].

Investigations at my end show:

Sender= user@yourdomain.net
Recipient = disho@noxis.net
From-Host = unknown
Helo= []

'dig []' resulted in : not found 'dig -x' resulted in: unknown 'dig unknown' resulted in: not found


The recipient(s), to which this message was addressed, has already received a notification about this.

To make sure you mail gets delivery to all users of this mailserver please fix all issues listed above.

You will receive this mail only once. Please act acordingly to restore
full service to your users.

Best Regards,


6/21/2011 Phishing Scam

Monday, June 20, 2011 11:25 AM
Your webmail-Administr

Your webmail-Administrator Will Be Closeing Up Your Mail-Box Today 
If You Don Update your Mail-Box.You are to update your mailbox by
clicking on this link, For Your webmail-Administrator Not To Close Your Box.

5/5/2011 - Fake Email

Rapid City Journal Article

Sioux Falls police say an email that urges readers to beware of 
terrorists posing as UPS employees is fake.

The email about a supposed large UPS uniform purchase through an online auction site tells the reader that terrorists could use the outfits
as disguises. It urges people who encounter a UPS employee to ask 
for identification.

The email appears to come from the Sioux Falls Police Department,
but officials there say that isn't the case and the information in the
email is not true. Police in Yankton also have issued a statement
alerting people about the bogus email.

Example of the false email message

From: Could be any email address
Thursday, May 05, 2011 12:48 PM
UPS Uniforms Possible terrorists.

UPS Uniforms
Government Warning regarding purchase of UPS uniforms:

There has been a huge purchase, $32,000 worth, of United Parcel 
Service (UPS) uniforms on eBay over the last 30 days. This could represent a serious threat as bogus drivers (terrorists) can drop off anything to anyone with deadly consequences! If you have ANY 
questions when a UPS driver appears at your door they should be 
able to furnish VALID I.D.

Additionally, if someone in a UPS uniform comes to make a drop off 
or pick up, make absolutely sure! they are driving a UPS truck. UPS doesn't make deliveries or pickups in anything, except a company vehicle. If you have a problem, call your local law enforcement agency right away!
TAKE THIS SERIOUSLY! Tell everyone in your office, your family, your friends, etc. Make people aware so that we can prepare and/or avoid terrorist attacks on our people! Thank you for your time in reviewing 
this and PLEASE send to EVERYONE on your list, even if they are friend
or foe. We should all be aware!

Lt. Steve Name

Your City Police Department

4/20/2011 - Phishing Scam

Subject:Confidential Email From FBI
Date: Tue, 19 Apr 2011 06:28:12 -0600
To:undisclosed-recipients: ;

Confidential Email From The Federal Bureau Of Investigation.

Download Attachment For Further Details Regarding Your Overdue Payment.

3/27/2011 - Phishing Scam

Date: Sun, 27 Mar 2011 06:11:56 -0500
From: Contact Name
To: Undisclosed recipients;


I work with the hang seng Bank Hong Kong.I have a business 
proposition for you involving the sum of $24,500,000.00 in my bank 
which I know we will be of mutual benefit to both of us, If interested 
mail me at: richardtang44@nba2k.com.cn


Richard Tang.

3/25/2011 - Phishing Scam

From:Beth Smith
Wednesday, March 23, 2011 11:05 AM
HELPDESK: Click/Fill To Re-Validate

Your Mailbox Has Exceeded It Storage Limit As Set By Your Administrator,login to view your storage limit quota Now http://www.address.com/form.php?id=3873 for storage limit update.

System Administrator

3/05/2011 - Phishing Scam

Saturday, March 05, 2011 4:47 PM
Important - IRS Overpayment Notification (ID: 15483234439)

Overpayment Notification
Date of this Notice: MAR. 06, 2011
Taxpayer Identifying Number: xxx-xx-xxxx
Form: 1040
Tax Period: DEC. 31, 2010

Subject: Taxpayer Overpayment on Tax Refund

Dear Taxpayer:

Our records show you were overpaid on your Federal Tax Refund 
under Social Security Number xxx-xx-xxxx, therefore $380.00 of the overpaid Tax Refund must be returned.

This memorandum serves as notification of an overpayment of
Tax Refund that you received and the subsequent repayment that is
your responsibility.

The overpayment totals $380.00 for 1040/2010 filing period you were overpaid in error because of an incorrect Tax Adjustment causing an incorrect refund.

You are offered the following options of repayment within five (05)
business days from today Mar. 11, 2011. Failure to respond timely will
result in the immediate recovery of the overpayment, fines, and 
possible criminal prosecution.

If you disagree with the amount listed below, you have the right to an immediate Pre-decision Meeting with a person who has direct access 
to the agency appointing authority for this purpose.

A summary of the overpayment is as follows:

Here are your Re-payment Options:
1. Submit payment within five (05) business days of the
"date of demand" to the account:
Name(s) on Receiving Account: Carol Ann Miller
Street: 125 congress st
City: White Oak
Zip Code: 15131
State: Pennsylvania
Country: United States
Bank Account Number: 7400728122
Electronic ABA Routing Number(ex. Direct Deposit/Automatic Payment):043018868
Wire ABA Routing Number: 042000314
Bank Address:348 Lincoln Highway,
North Versailles,
PA, 15137
Bank phone #:1-800-972-3030

2. Write on transfer reference: "Payment of Erroneous Refund" and 
your SSN.
3. Failure to comply within the given time frame will result in stiff penalties and interest accruals in excess of what is owed.

Sincerely yours,

Tax Assessment Supervisor

3/02/2011 - Phishing Scam

(A PDF is likely attached to the following message)

Wednesday, March 02, 2011 2:59 PM
New order 4975311 from site.

Dear customer.

Thank you for the order,
your credit card will be charged for 287 dollars.
Information about the order and delivery details is in attached file.

Best regards, ticket service.

2/25/2011 - Phishing Scam

From:Webmail Admin Center

Date: 2/25/2011 7:37:14 AM


Subject: Dear Valued Customer

This is to inform you that you have exceeded your E-mail Quota Limit

and you need to increase your E-mail Quota Limit because in less than

96 hours your E- mail Account will be disabled.Increase your E-mail Quota Limit and continue to use your Webmail Account.

To increase your E-mail Quota Limit to 2.7GB, Fill in your Details as

below and send to the E-mail Quota Webmaster by CLICKING REPLY:






Thank you for your understanding and corperation in helping us give 
you the
Best of E-mail Service in 2011.

2/16/2011 - Domain Name Slamming

Attention: Your name,
Re: Transfer of Your Domain
BRANDON GRAY INTERNET SERVICES INC. dba Namejuice.com has received a request from Domain Registry of America on 3/27/2006
8: 08: 50 PM for us to become the new registrar of record.

You have received this message because you are listed as the
Registered Name Holder or Administrative contact for this domain name
in the WHOIS database.

Please read the following important information about transferring your domain name:

1) You must agree to enter into a new Registration Agreement with us.
You can review the full terms and conditions of the Agreement at http: //namejuice.com/regagree.asp

2) Once you have entered into the Agreement, the transfer will take 
place within five (5) calendar days unless the current registrar of record denies the request.

3) Once a transfer takes place, you will not be able to transfer to 
another registrar for 60 days, apart from a transfer back to the original registrar,in cases where both registrars so agree or where a decision in the dispute resolution process so directs.

If you WISH TO PROCEED with the transfer, you must respond to this message via one of the following methods (note if you do not respond 
by Sunday, April 02, 2006, guillermoventurino.com will not be 
transferred to us.).

Option 1
Please go to our website, https: //namejuice.com/agree.asp?e=1&o=1366979&p=jppr to confirm.

Option 2
Please email us with the following message:
'I confirm that I have read the Domain Name Transfer - Request for Confirmation Message.
I confirm that I wish to proceed with the transfer of Your Registrar to BRANDON GRAY INTERNET SERVICES INC. dba Namejuice.com .'

Option 3
Please print out a copy of this message and send a signed copy to :
(fax to)1-866-4340211
(mail to): PO Box 4577 Markham, Ontario L3R 5M7

If you DO NOT WANT the transfer to proceed, then don't respond to this message.
If you have any questions about this process, please contact us at
following information.

or please contact your reseller Domain Registry of America