Meet the Phishers

If you think you are being scammed by advanced cyber hacker warriors, think again

Spy Service Exposes Nigerian ‘Yahoo Boys’ Krebs on Security

 Modern Ghana news site  - scammer news

Password Phishing - "Faculty & Staff Notification !!"

Sent: Thursday, October 31, 2013 11:28 AM
Subject: Faculty & Staff Notification !!
Dear User,
The following evaluations have been assigned to your account. Please  complete these evaluations.
NOTE: Your account evaluations will time out after  an 12hours of getting this notification. Your responses will be lost if you do not click on the "evaluate" button before 60 minutes lapses. There is no prompt when your 60 minute session has expired. Please save extensive comments periodically and check your time.
Current size

Maximum size
Please reduce your mailbox size. Delete any items you don't need from your mailbox and empty your Deleted Items folder.

Help Desk.

Fake UN internship - "United Nations Internship Programme"

 Nigerian 419 scam

From: UNDSD eInternship Services <>
Date: Thu, Oct 31, 2013 at 3:30 PM
Subject: United Nations Internship Programme

Dear Recipient,

You may wish to go through the attachment to see the details of the
international internship programme openings for this time at United
Nations Division for Sustainable Development (UNDSD).

Best Wishes,

eRecruitment Team


PDF attachment text
The United Nations provides opportunities for students enrolled in a graduate programme to undertake an internship at its Headquarters in New York, Geneva, Vienna, Nairobi, Addis Ababa, Bangkok, Beirut,Santiago,Arusha and The Hague.
Eligible candidates interested in doing an internship at the United Nations Headquarters in New York or any of the mentioned countries can apply.
The objective of the Internship Programme is threefold:
To provide a framework by which graduate and under graduate students from diverse academic backgrounds may be assigned to United Nations Offices where their educational experience can be enhanced through practical work assignments.
To expose them to the work of the United Nations.
To provide UN offices with the assistance of highly qualified students specialized in various professional fields.
The United Nations Headquarters Internship Programme is offered on a two-month basis three times a year:
• January to March (Spring Session,2014):Deadline for submission of Application documents is: November 19,2013
• June to August (Summer Session,2014): Deadline for submission of Application documents is: February 20,2014
• October to December (Fall Session,2014): Deadline for submission of Application documents is: July 15,2014
To qualify for the United Nations Headquarters Internship Programme, the following conditions must be met:
1. Applicants must be enrolled in a degree programme in a graduate school (second university degree or higher) at the time of application and during the internship; or
2. Applicants pursuing their studies in countries where higher education is not divided into undergraduate and graduate stages must have completed at least four years of full-time studies at a university or equivalent institution towards the completion of a degree.
3. Development-related fields such as economics, international relations, anthropology, sociology, public or business administration, or environmental studies. Other fields of study may be considered depending on the type of assignment;
Any work produced by interns during their internship within the framework of the duties assigned to them should be used for academic purposes exclusively. All economic and moral rights (copyright) pertaining to such work will remain the exclusive property of the United Nations.
Interested undergraduate or graduate students should write via EMAIL ONLY to the :
Ad Hoc Internship Coordinator,
Human Resources Operations Section,
Human Resources Management Service,
United Nations Office
Applications (in English) should include the following:
a) A covering letter stating the grounds for their application;
b) Recent curriculum vitae (CV);
c) Copies of their university degrees or a list of courses attended or attending;
d) Abstracts of academic papers they have written if any.
All applicants must be currently enrolled in undergraduate or graduate programs. No phone calls, please.
After careful consideration of all documents submitted, only successful candidates will be notified of their selection.
Kindly send the requested applications documents to the following email address:

Password phishing scam - Mailbox Upgrade Routine

from compromised student account at

Sent: Thu 10/31/2013 11:30 AM
Subject: Mailbox Upgrade Routine
Due to our latest IP Security upgrades we have reason to believe that your mail account will be
easily accessed by a third party.You are advice to verify this account To avoid loosing access to
your account. To verify click UPGRADE  <>
Failure to do this you will have your account deactivated. Protecting your webmail account is our primary concern.
ITS help desk
© Copyright 2013.
All Rights Reserved

Email phishing - Email Account Re-Activation

From: Collura, Rita <>
Date: Tue, Oct 29, 2013 at 6:27 PM
Subject: Email Account Re-Activation

We are having a system Re-activation of all Web-mail accounts due to some technical issues on our system Please Kindly CLICK HERE to Re-activate your account.   <>
WARNING: Failure to Re-activate your account may lead to permanent limitation.

This message may contain confidential and/or proprietary information and is intended for the person/entity to whom it was originally addressed. Any use by others is strictly prohibited

Money Mule phishing job scam - A student payroll officer needed

---------- Forwarded message ----------
From: University Employment Portal <>
Date: Tue, Oct 29, 2013 at 4:15 AM
Subject: A student payroll officer needed

A position is open for a part time book keeper/ funds processor for a private client. He needs to employ urgently and applicant should be willingly to work 1hr daily undertaking in the following jobs as highlighted below:

a) Cash Receivables

Employee should be able to receive, process and keep cash flow for weekly, bi-weekly or monthly remittance to the company.

b) Flow Chart Success

Employee should be able to record all cash receivables through excel spread sheets,hence after each month calculate his/her flow chart success rate.
Employee with a high flow chart success rate will receive remuneration and other incentives aside her monthly earnings

Monthly rate of $1000 is paid, that is $250 per week. No formal knowledge is required employee must be ready to learn and will be trained for all task.

Interested? Get back asap for the processing of your details.The employer's direct email has been attached to this ad, hence respond only if you are interested.

Thank you,

Huang Gong
Employment Bureau
University Employment Portal

Email storage limit phishing - password theft

From: [redacted]>
Date: October 29, 2013, 12:48:21 PM EDT

Dear email user,

Your email storage limit has been exceeded; you are required to validate your account by click on the link bellow

login your email account details and click on Submit, automatically your account will be verified and upgraded. Note: failure to validate your email account within the next three days of receiving this message’ your account will automatically be closed.

Thanks for Cooperation!

Webmail Admin Team

Redirects to
Envelope From:

Accept-Language: en-US
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="Windows-1252"
Date: Tue, 29 Oct 2013 16:55:58 +0000
From: [redacted]>
MIME-Version: 1.0

Received: from ([]) by with ESMTP/TLS/DHE-RSA-AES256-SHA; 29 Oct 2013 12:57:41 -0400
Received: from ([]) (using TLSv1) by ([]) with SMTP ID DSNKUm/; Tue, 29 Oct 2013 16:57:39 UTC
Received: from DPCHM07.DPECSP.UNICC.ORG (unknown []) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 0390560C61; Tue, 29 Oct 2013 16:56:03 +0000 (UTC)
Received: from DPCHM08.DPECSP.UNICC.ORG ([]) by DPCHM07.DPECSP.UNICC.ORG ([]) with mapi id 14.03.0123.003; Tue, 29 Oct 2013 16:55:58 +0000
Thread-Index: Ac7Ux72s48jJCbrSQn28hVG+ZDulyQ==
X-Ironport-Anti-Spam-Filtered: true
X-Ironport-Av: E=Sophos;i="4.93,594,1378872000"; d="scan'208";a="317136701"
X-Originating-Ip: []
X-Senderbase: 2.7

Password phishing - Notification

From: SRT Team < >
Date: Sun, Oct 27, 2013 at 9:02 PM
Subject: Notification

We detect spam-like activity in your webmail account,
which is against our Acceptable Use Policy (AUP).

Kindly click here to verify that you're the owner of the
account and not a spammer.

We apologize  for any inconvenience this may cause you.

SRT Team

Fake Banner Web phishing - "UREGNT: Phishing Alert"

From: [redacted] IT Alert <ithelp@[redacted].edu>
Date: Sat, Oct 26, 2013 at 6:23 AM
Subject: UREGNT: [redacted] Phishing Alert
To secure our system and all employees details from all forms of cyber attacks and phishing threats following the latest compromise on our database yesterday, the IT Services and the Human Resources have unanimously agreed to immediately upgrade all employees details on our system to the latest OLTP Microsoft Server . Hence to secure your profile and details you are required to immediately upgrade to this platform.

It takes less than 2 minutes to update your profile. Follow the link below to have your details immediately upgraded:
http://secure.its.[redacted].edu/oltp-upgrade14.employeeHRMS/?cm=login <[redacted].eduHRMS.ITupdate/login/Login.htm>

This is mandatory, hence follow the instructions above.
Thank you,
IT Services & HR Management System

Redirects again to 


Received: from xxxxxxxxxxxxxxxxxxx by ([]) with SMTP;
    Sat, 26 Oct 2013 04:49:55 PDT
Received: from (HELO ([])
  by xxxxxxxxxxxxx with ESMTP/TLS/DHE-RSA-AES256-SHA; 26 Oct 2013 07:49:31 -0400
Received: from max6782 by with local (Exim 4.80.1)
    (envelope-from <>)
    id 1Va1CX-0008Qf-TH
    for xxxxxxxxxxxxxxxx; Sat, 26 Oct 2013 18:34:37 +0800
To: xxxxxxxxxxxxxxxx
Subject: UREGNT: GWU Phishing Alert
X-PHP-Script: for
From: [redacted] IT Alert <ithelp@[redacted].edu>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <>
Sender:  <>
Date: Sat, 26 Oct 2013 18:34:37 +0800


Email Password phishing - "Important Document" - Google drive document lure

Subject: Important Document.


I've shared a document with you , It's not an attachment -- it's stored on-line at Google Drive. To open this document, Go to and just sign in with your email to view

Note: You'll need to sign into Google Drive with your email address. 
Google phishing 
Redirects to  
or many other hacked sites

Nigerian scam - "Conflict Of/In Information"

From: Philip III Tinsley <>
Date: Wed, Oct 23, 2013 at 2:04 PM
Subject: Conflict Of/In Information
Cc:, "APIS.TAS" <>,

October 23, 2013
Commissioner Tony Negus APM
Australian Federal Police (AFP)
Coordinator OMC
Locked Bag A3000
Sydney South NSW 1232
Dear Sir:
I am emailing this letter to you in order to attempt to promptly clarify important and conflicting information from your police force and from the Passport Division of the Australian Embassy in Washington, DC ... .
I was informed by one of your staff members, "Emma", in a September 2013, telephone conversation that My Australian File Reference Number, 2013098680, was a "... passport number ..." .  However, when I telephoned the Passport Division of the Australian Embassy, in Washington, DC, on October 21, 2013, at approximately 9:10 AM E.S.T., a unnamed woman stated that the aforementioned number was "... a VISA number [and] not a passport number ... ".  My question to you/your department is, "Who is lying?!"
In addition, when I spoke to the AFP via telephone on October 21, 2013, at approximately 9:05 AM E.S.T., a woman named, "Emily" wanted to know what I expected the AFP to do for Me?  Naturally, I replied that I wanted the AFP to relay information to the proper Australian Embassy officials, since I was unable to contact them via telephone or even email ... .  However, I deem it My duty to inform you that even though your government officials have placed themselves and the Commonwealth of Australia into a legal situation with the delay of rendering My passport orVISA (see Australia's ratification of the UN's ICCPR & CAT treaties along with Its ratification of the USA's Title 18 Section 3181 USC*), I do not expect your department to effect the arrests of the offending individuals upon My written accounts... .  Nevertheless, I will expect members of your police force to render accurate and veracious testimony as to our prior conversations and the information contained within ... .
Please respond to this email message promptly, since I am attempting to secure legal assistance to obtain My Australian passport.  Thank you.
Yours Sincerely,
Philip Tinsley III, House of York, Stuart & Leicester (Lester), Spanish nobleman (2X), Scottish knight (Order of The Thistle), King of Virginia (see Treaty of Lancaster, 1744), and Unofficial King of Great Britain (see Naturalization Act of 1870, 'John Thomas Hewin Sr.', "1910 Richmond City, VA Census Report", U.S. Census; and CONSTITUTIONAL MONARCHY OF THE COMMONWEALTH OF VIRGINIA v. USA and UK/GB, 2011, ICJ, Den Hague, The Kingdom of The Netherlands)
cc:  Mr. Andrew Wood, CEO, AFP
*I have been kidnapped and tortured numerous times in the Commonwealth of Virginia and My parents, English royals, were murdered in the Commonwealth of Virginia ... .
Sent By Email

Password Phishing - ACCOUNT UPGRADE

-------- Forwarded message ----------
From: GMAIL <>
Date: Thu, Oct 24, 2013 at 10:31 AM

We are currently experiencing technical difficulties on our servers. Your incoming emails are pending. Click Inbox to login  <> and fix this issue.
We apologize for any inconveniences caused.
Thank You.
Redirects to <>

Password phishing - "ICT helpdesk"

Phishing message:

Date: Wed, Oct 23, 2013 at 11:59 AM
Subject: ICT helpdesk

Confirm Your Webmail: Faculty/Staff/Student.Web mail Confirmation/upgrade. ICT helpdesk requires all web user to confirm their Webmail. Owner confirmation most be done or new mails will be Block and Filter. For full access of your Webmail, please click on the link below.

ICT Helpdesk Webmail Login link <>

to confirm your web mail. Confirmation should be done within 24 hours of receiving this notification or your webmail account will be block.
This has become necessary to  serve you better. © Copyright 2013 ICT helpdesk Management Team.


Password Phishing - Warning!

Subject:    Warning
Date:    Mon, 21 Oct 2013 00:56:31 +0000
To:    Undisclosed recipients:;

Dear email User,

Your Email mail account has been temporally suspended, and this means that you will not be able to send and receive new email messages. This is because of the on-going yearly web maintenance and deleting of inactive email accounts. You are then requested to verify your email account below for upgrading.


Thanks for your cooperation in advance!

redirects to