Password phishing - "RE: ACCOUNT COMPROMISE NOTIFICATION WARNING !!"

From: , John @ttuhsc.edu>
Date: Fri, Nov 29, 2013 at 8:34 AM
Subject: RE: ACCOUNT COMPROMISE NOTIFICATION WARNING !!
To: "@ttuhsc.edu>

 Dear user,

your Account was login from an unusual location. We prevented the sign-in attempt in case this was an unauthorized access into your account. Please review the login attempt details below:

Friday, 29th November, 2013.
Central Daylight Time (CDT) -0500
UTC Server Address: 72.234.198.59
Location: Honolulu, Hawaii.

 We urge you to immediately follow this secure link below to enable us verify your account.
   
Accountverification <https://secure.blueoctane.net/forms/T2BV2E8LWH2Y>

Sincerely,
IT Services



Nigerian 419 Scam - Microsoft Notification Letter

419 scam from Nigerians/Ghanians  - whoever they are 

Ip to block - 
 41.203.69.1 - Nigeria


awww, flowers
Date:  Sat, 23 Nov 2013 23:58:28 -0500 (ECT)
From:  MICROSOFT® CORPORATION <doracila.sarango@educacion.gob.ec>
To:  undisclosed-recipients:;
Subject:  NOTIFICATION LETTER
Attachments: MICROSOFT® CORPORATION.pdf
MICROSOFT® CORPORATION.rtf

MICROSOFT® CORPORATION Edinburgh Regional Office Microsoft Edinburgh
Waverley Gate
2-4 Waterloo Place
Edinburgh EH1 3EG United Kingdom.

PRODUCT AWARD NOTIFICATION LETTER

On behalf of Microsoft Corporation Edinburgh UK, we wish to notify all our online customers as we celebrate the Microsoft Edinburgh product Award for 2013 and also to congratulate you for emerging as the third (3rd) prize winner in our E-mail Electronic Online Random Selection program Organized for the year 2013 Microsoft Edinburgh Products Award. The Programme is held every year with an aim of encouraging the use of Microsoft Products on the Internet and promote computer literacy worldwide in 2013.

A Cheque will be issued in your name by Microsoft Corporation Board Edinburgh UK, you have therefore been cleared to receive the sum of£850, 000, 00GBP (Eight Hundred And Fifty thousand Great British Pounds Sterling) and a Brand new HCL Mileap L Series Laptop which consequently was staked to be won in the 3rd category. You are advised to e-mail the MICROSOFT EDINBURGH UK Payment Consultant belowwith the following details below for your Claims Personally.

Contact: Foreign Payment Consultant.
Mrs. Audrey Collins  

Provide below information for Your Payment.
.Permanent Residential Address:
.Tel (Mobile):
.Nationality/Country:
.Full Name:
.Age/Sex:
.Private email address:
.Occupation/Position:
.What is your comment On Microsoft Products?

NOTE!!! For security reasons, you are advised to keep your winning information confidential till your claims are processed and your money remitted to you. This is part of our precautionarymeasure to avoid double claiming and unwarranted abuse of this program by some unscrupulous elements. Please be WARNED!!!!

Congratulations from the Staffs & Members of Microsoft Board Commission. Derrick McCourt.
Regional Director,
Microsoft Edinburgh, Scotland & Wales at Microsoft Corporation UK.
                                           
                                           ©2013 Microsoft Corporatio


Header


Envelope From: doracila.sarango@educacion.gob.ec
Envelope To:

 Content-Type: multipart/mixed; boundary="----=_Part_908086_2050758738.1385269107821"
Date: Sat, 23 Nov 2013 23:58:28 -0500 (ECT)
From: =?utf-8?Q?MICROSOFT=C2=AE?= CORPORATION <doracila.sarango@educacion.gob.ec>
MIME-Version: 1.0
Message-ID: <2084712122.908089.1385269107910.JavaMail.root@educacion.gob.ec>

Received: from mail.educacion.gob.ec ([200.107.59.148]) 
Received: from localhost (localhost [127.0.0.1]) by mail.educacion.gob.ec (Postfix) with ESMTP id 03E552184D70; Sat, 23 Nov 2013 23:58:34 -0500 (ECT)
Received: from mail.educacion.gob.ec ([127.0.0.1]) by localhost (mail.educacion.gob.ec [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w5GEI-GXN27k; Sat, 23 Nov 2013 23:58:28 -0500 (ECT)
Received: from mail.educacion.gob.ec (mail.educacion.gob.ec [10.2.30.119]) by mail.educacion.gob.ec (Postfix) with ESMTP id 027B32184D6D; Sat, 23 Nov 2013 23:58:28 -0500 (ECT)
Reply-To: "anthony.chris210@qq.com" <anthony.chris210@qq.com>
To: undisclosed-recipients:;
X-Ironport-Av: E=Sophos;i="4.93,766,1378872000"; d="pdf'?rtf'212?scan'212,208,212";a="551543629"
X-Mailer: Zimbra 7.2.0_GA_2669 (zclient/7.2.0_GA_2669)
X-Originating-Ip: [41.203.69.1]
X-Senderbase: -3.9
X-Virus-Scanned: amavisd-new at mail.educacion.gob.ec



IP:41.203.69.1
Decimal:701187329
Hostname:41.203.69.1
ISP:Globacom Ltd
Organization:Globacom Ltd
Services:Network sharing device or proxy server
Recently reported forum spam source. (1)
Type:
Assignment:Static IP
Blacklist:

Geolocation Information

Country:Nigeria ng flag