phishing email corpus

This corpus includes each email I've used for my analyses, recreated as close as possible to the original form. If you'd like to view a specific email, select it from the list. I've removed all links towards malicious sites or programs, so you can feel confident in browsing these materials.

sender	subject	category	source
Amazon <aw-confirm@ebay.com>	Customer Support Notification	Bulk	Enron Corpus
Amazon <support@amazon.com>	Amazon Inquiry	Bulk	Enron Corpus
Amazon Service <service101@amazon.com>	Please Update Your Profile - Personal Information Error	Bulk	Enron Corpus
Amazon <service@amazon.com>	*Urgent Fraud Prevention Group Notice*	Bulk	Enron Corpus
Amazon Customer Service <payment-update@amazon.com>	Important Notice: Your Amazon.com Order (#002-5081318-3276061).	Bulk	Enron Corpus
Chase Bank Inc. <security@chase.com>	Security Update Notification	Bulk	Enron Corpus
Chase <service@chaseonline.com>	Please restore your account.	Bulk	Enron Corpus
Chase <account@chase.com>	Account Authentication Required	Bulk	Enron Corpus
Trashcan G. Straitjacket <aw-confirm@chase.com>	Chase Security Measures	Bulk/Possible Clone	Enron Corpus
Chase <service@chase.server1.com>	Alert: Account Locked!	Bulk	Enron Corpus
moreinfo@ebay.com <moreinfo@ebay.com>	Question about item - Respond now !	Clone	Enron Corpus
ebay <service@chase.com>	Question from member	Bulk/Clone	Enron Corpus
eBay France <aw-service@maiI.ebay.fr.asilefx.com>	Question for item #250026510836 - Respond Now	Clone	Enron Corpus
eBay <account2@masonproper.com>	Account Authentication Required	Bulk	Enron Corpus
eBay <vote@eBay.com>	Your opinion counts	Bulk	Enron Corpus
service@paypal.com <service@paypal.com>	Unauthorized access to your PayPal account !	Bulk	Enron Corpus
PayPal <accounts@paypal.com>	Confirm Your Account	Bulk	Enron Corpus
PayPal Security<security@paypal.com>	Information Regarding Your account	Bulk	Enron Corpus
message <support@securesite.com>	Your payment has been sent to sales@configure.us.dell.com	Bulk	Enron Corpus
service@paypal.com <service@paypal.com>	Your PayPal Billing Information records are out of date. Please update them immediately to restore your account.	Bulk	Enron Corpus
{Pullman & Assoc. \| Wiseman & Assoc.\| Steinburg & Assoc. \| Swartz & Assoc. \| Quartermain & Assoc.} <legal@wpslaw.com>	none provided - see link	Malware	Krebs on Security
Antonio Capilla <test@kr.ir>	FOR MUTUAL BENEFIT	PSE	Personal e-mail
Givanildo S. <givanildo@csemil.com.br> \| Reply-To: Maria Elisa <patriciachandler0@gmail.com>	Grant Donation of €1,700,000	Bulk	Personal e-mail
Maria <ufpomodhupur@dgfp.gov.bd>	Grant Donation of €1,700,000	PSE	Personal e-mail
Maria Elisabeth <elisabethmaria600@gmail.com>	Re: Grants Donations.	PSE	Personal e-mail
Reverend Joseph Cameron King <Landlord1453@outlook.com>	Re: $730 / 3br - 1200ft2 on Craigslist	PSE	Personal e-mail
Elizabeth Lyonsfield <naoko@koinonia.or.jp>	BEEN TRYING TO REACH YOU	PSE	Personal e-mail
D T Leong <dteoh@dbsgroup.org>	[PROJECT]	PSE	Personal e-mail
nfrancisou@mail2sal.com <nfrancisou@mail2sal.com>	Frauders known your old passwords. Access data must be changed.	Spearphishing	Personal e-mail
FreeIphone79105 <DeviantArt User>	Hello, linuxfingers!	Spearphishing	DeviantArt Message
gok_wed@aol.com <gok_wed@aol.com>	House for rent: 12th Ave N, Saint Cloud, MN	PSE	Personal e-mail
INDIANA.EDU SUPPORT TEAM <supportteam01@indiana.edu> \| Reply-To: INDIANA.EDU SUPPORT TEAM <spupportteam@info.lt>	CONFIRM YOUR ACCOUNT	Bulk	Indiana.edu Knowledge Base
Apple <REDJANG-DANCE959@APPLE.com>	Re: ( Payment Confirmed ) Your Invoice From Apple on May 6, 2018 9:48 am # AFW4ETGQOIF34GDR \| [DRONE SELLER]	Spearphishin/Clone	NetSecOps
Forensic <info@isgec.com>	“Fwd: Airlines plane crash Boeing 737 Max 8	Bulk/Malware	Security Affairs
Anonymous Hacker - Kimbery <kimbery899@b.anonymous-observer.ml>	This is my last warning <subject's email address!>	Spearphishing	Malware Traffic Analysis (Pastebin)
Melinda O'Toole <rohitha@amadili.info>	Re: Re: Meeting on Wednesday	Malspam	Malware Traffic Analysis (Pastebin)
Steve Wolfram < >	RE: Steve Wolfram Payment Remittance Advice	Malspam	Malware Traffic Analysis (Pastebin)
Accounting <contabilidadcc@ruhega.com>	March Statement	Malspam	Malware Traffic Analysis (Pastebin)
HelloFax <hellofax@santuariohotel.comgt;	HelloFax, Someone Sent You a Fax	Malspam/Clone	Malware Traffic Analysis (Pastebin)
DocuSign Signature <docusign@milaromanoff.com>	You got an invoice from DocuSign Electronic Service	Malspam/Clone	Malware Traffic Analysis
hidrohan otomotiv <bilgi@hidrohan.com>	New Purchase & Catalogue Requisition	Malspam	Malware Traffic Analysis
"Mr. Hong Woo" <hongwoo@gmail.com>	INV 3326GHF- from Outriger General Importers Korea for acknowledgment	Malspam	Malware Traffic Analysis
"khusheim" <proc400@khusheim.com>	RFQ#5500177966	Malspam	Malware Traffic Analysis
"Evergreen Group Pte Ltd" <intrebizagency@gmail.com>	Evergreen Group Pte Ltd - Request for Quotation	Malspam	Malware Traffic Analysis
[redacted]	Urgent Request for Quotation #RFQE67Y54	Malspam	Fortinet
"harish" <[redacted]>	FW: [redacted] new order C 21-19	Malspam	Trend Micro
Google <no-reply@accounts.googlemail.com>	Someone has your password	Clone/Spearphishing	Wikileaks
Blizzard Entertainment <a battle.net email account >	has gifted you: World of Warcraft In-Game Pet: Brightpaw!	Bulk	Malware Bytes Blog
HR@berkeley.edu <HR@berkeley.edu>	Message from human resources	Spearphishing	Berkeley Security
Sass, Bradley <sass@tamhsc.edu>	Your Dropbox File	Clonephish	Berkeley Security
App.Support <no_reply@appsupport.com>	Your access has been disabled	Bulk	Berkeley Security

amazon_1

source: Enron Spam Cache

From aw-confirm@ebay.com Mon Jan 8 05:42:31 2007 Return-Path:
X-Original-To: user@login.example.com
Delivered-To: user@login.example.com
Received: from mail.example.org (mail.example.org [192.168.4.9]) by example.com (Postfix) with ESMTP id 3020246A1A; Mon, 8 Jan 2007 05:42:31 -0500 (EST)
Received: from mail.com (adsl-65-67-75-241.dsl.fyvlar.swbell.net [65.67.75.241]) by mail.example.org (Postfix) with SMTP id 1AC28131FD0B; Mon, 8 Jan 2007 05:42:31 -0500 (EST)
Reply-To: From: "Amazon"
Subject: Customer Support Notification
Date: Mon, 8 Jan 2007 04:57:57 -0600 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20070108104231.1AC28131FD0B@mail.example.org> To: undisclosed-recipients:; Status: RO X-Status: X-Keywords: X-UID: 592

Dear Amazon® member,

This is your final warning about the safety of your Amazon account. If you do not update your billing informations your access on Amazon features will be restricted and the user deleted. This might be due to either following reasons:

- A recent change in your personal information (i.e. change of address)
- Submiting invalid information during the initial sign up process.
- An inability to accurately verify your selected option of payment due an internal error within
our processors.

To securely confirm your Amazon information please click on the link bellow:

        http://www.amazon.com/gp/subs/primeclub/account/homepage.html/ref=ya_hp_sub_1/104-4436503-7329515?ie=UTF8&method=GET

We encourage you to log in and perform the steps necessary to restore your account access as soon as possible. Allowing your account access to remain limited for an extended period of time may result in further limitations on the use of your account and possible account closure.

Thank you for using Amazon!
The Amazon Team

Con
        ditions of Use | Pri
        vacy Notice © 1995-2007, Amazon.com,    Inc. or its affiliates.

amazon_2

source: Enron Spam Cache

From support@amazon.com Tue Sep 19 10:18:15 2006
Return-Path:
X-Original-To: user@login.example.com
Delivered-To: user@login.example.com
Received: from mail.example.org (mail.example.org [192.168.6.4])
by example.com (Postfix) with ESMTP id 12D2C469D5
for ; Tue, 19 Sep 2006 10:18:15 -0400 (EDT)
Received: from 192.168.6.4 (unknown [217.52.40.131])
by mail.example.org (Postfix) with SMTP id D49CC6FA755
for ; Tue, 19 Sep 2006 10:18:13 -0400 (EDT)
Received: from 7lvba.lmqp6.com (HELO em5c4) [14.89.67.245]
by 192.168.6.4; Tue, 19 Sep 2006 20:11:51 +0500 Message-ID: <3$97dr5d$985107h2-n$b@bjsz.rp6t8kt>
From: "Amazon" To:
Subject: Amazon Inquiry Date: Tue, 19 Sep 06 20:11:51 GMT X-Mailer: Microsoft Outlook Express 6.00.2462.0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="2F.E__3D8E.79" X-Priority: 3
X-MSMail-Priority: Normal Status: RO X-Status: X-Keywords: X-UID: 283

Dear Amazon.com Member,

Due to concerns we have for the safety and integrity of the Amazon community we have issued this warning.

Per the User Agreement, Section 9, we may immediately issue a warning, temporarily suspend, indefinitely suspend or terminate your membership and refuse to provide our services to you if we believe that your actions may cause financial loss or legal liability for you, our users or us. We may also take these actions if we are unable to verify or authenticate any information you provide to us.

Please follow the link below:

http://www.amazon.com/exec/obidos/sign-in.html

and update your account information.

We appreciate your support and understanding, as we work together to keep Amazon market a safe place.

Thank you for your attention on this serious matter.

Regards,

Amazon Safety Department

Please note: This e-mail message was sent from a notification-only address that cannot accept incoming e-mail. Please do not reply to this message.

Amazon.com
Earth's Biggest Selection

Prefer not to receive HTML mail? Click here

amazon_3

source: Enron Spam Cache

From service101@amazon.com Wed Apr 18 22:14:06 2007
Return-Path: X-Original-To: user@login.example.com
Delivered-To: user@login.example.com
Received: from mail.example.org (mail.example.org [192.168.4.9]) by example.com (Postfix) with ESMTP id 5D614468C9 for ; Wed, 18 Apr 2007 22:14:06 -0400 (EDT)
Received: from mail.example.org (mail.example.org [192.168.6.4]) by mail.example.org (Postfix) with ESMTP id 58991131F9DF for ; Wed, 18 Apr 2007 22:14:06 -0400 (EDT)
Received: from 192.168.1.10 (rrcs-70-61-37-30.central.biz.rr.com [70.61.37.30]) by mail.example.org (Postfix) with SMTP id 4B83A6FA1A4 for ; Wed, 18 Apr 2007 22:14:06 -0400 (EDT)
Received: from 60.4.193.169 by ; Thu, 19 Apr 2007 08:07:48 +0500
Message-ID:
From: "Amazon Service" Reply-To: "Amazon Service"
To: user@example.com
Subject: Please Update Your Profile - Personal Information Error
Date: Thu, 19 Apr 2007 09:09:48 +0600
X-Mailer: AOL 7.0 for Windows US sub 118 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--03371404466094140899" X-Priority: 1 X-MSMail-Priority: High Status: O X-Status: X-Keywords: X-UID: 1143

Dear Amazon Customer,

During our regularly scheduled account maintenance and verification procedures,
we have detected a slight error in your account information.
To securely confirm your personal information please click on the link bellow:

https://amazon.com/account_signin/webscr_/verify/index.html

Confirm Your Amazon Account to enjoy the benefits of
online shopping and to avoid identity theft and fraudulent activities on
your account.

Note: We will be upgrading our yearly SSL EncryptedServer to prevent fraudulent
activity.

2007 Amazon & Co. All rights reserved.

amazon_4

source: Enron Spam Cache

To: marino_holguin@example.com,
oioio6787856@example.com, libevent-users-bounces@example.com, libevent-users@example.com, openbsd-misc@example.com, user@example.com, openbsd-bugs@example.com
From: "Amazon"
Content-Type: multipart/alternative; boundary="------------000501070504030807060107"
Subject: ***Urgent Fraud Prevention Group Notice***
Return-Path:
X-Original-To: user@login.example.com
Delivered-To: user@login.example.com
Received: from mail.example.org (mail.example.org [192.168.4.9]) by example.com (Postfix) with ESMTP id 81806469BC; Fri, 8 Dec 2006 07:23:36 -0500 (EST)
Received: from 192.168.0.102 (static-72-87-159-146.lsanca.dsl-w.verizon.net [72.87.159.146]) by mail.example.org (Postfix) with SMTP id E58A1131FA83; Fri, 8 Dec 2006 07:23:30 -0500 (EST)
Message-ID:
Reply-To: "Amazon"
Date: Fri, 08 Dec 2006 12:03:39 -0100
X-Mailer: Microsoft Outlook Express 5.00.2615.200
MIME-Version: 1.0
X-Priority: 3
X-MSMail-Priority: Normal
Status: RO
X-UID: 496

Dear Customer,

- Due to recent account takeovers and unauthorized listings, Amazon is requesting a new account verification procedure. >From time to time, randomly selected accounts (seller and/or buyer)are placed under an advanced updating process based on merchant accounts/bank relationsand on-file credit cards. Amazon may also request in an email message scanned/faxed copies of one or more photo ID's. Your account confirmation may go wrong if your credit card/bank account has expired, or if you have changed/replaced your credit card without letting us know about the change.

Your account is not suspended, but if in 36 hours after you receive this message your account is not confirmed we reserve the right to terminate your Amazon subscription.

If you received this notice and you are not an authorized Amazon account holder, please be aware that it is in violation of Amazon policy to represent oneself as an Amazon user. Such action may also be in violation of local, national, and/or international law.

To confirm your identity with us click HERE

We apologize in advance for any inconvenience this may cause you and we would like to thank you for your cooperation as we review this matter.

Respectfully,
Amazon.com, Inc.

Amazon sent this e-mail to you because your Notification Preferences indicate that you want to receive information about Special Events & Promotions.Amazon will request personal data (password, credit card/bank numbers) only on our home site, wich is securely incrypted with SLL.

amazon_5

source: Enron Spam Cache

From: "Amazon Customer Service"
Content-Type: multipart/alternative;
boundary="------------060402000003010108040100"
Subject: Important Notice: Your Amazon.com Order (#002-5081318-3276061).
Return-Path:
X-Original-To: user@login.example.com
Delivered-To: user@login.example.com
Received: from mail.example.org (mail.example.org [192.168.4.9]) by example.com (Postfix) with ESMTP id B85B3468EA for ;
Mon, 11 Jun 2007 09:28:15 -0400 (EDT)
Received: from mail.example.org (mail.example.org [192.168.6.4]) by mail.example.org (Postfix) with ESMTP id 12239131FA09 for ;
Mon, 11 Jun 2007 09:28:14 -0400 (EDT)
Received: from deswood.com (mail.deswood.com [64.162.7.226]) by mail.example.org (Postfix) with ESMTP id A13B36FA1C5 for ;
Mon, 11 Jun 2007 09:28:13 -0400 (EDT)
Reply-To: no.replay@amazon.com
Date: Mon, 11 Jun 2007 06:26:41 -0700
MIME-Version: 1.0
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
Message-ID:
X-OriginalArrivalTime: 11 Jun 2007 13:25:35.0421 (UTC) FILETIME=[FE59AED0:01C7AC2B]
Status: RO
X-UID: 1382

Amazon

Greetings from Amazon.com.

We have not yet received a valid method of payment and thus are unable to proceed with your order (#002-5081318-3276061). Your order remains open.

Your credit card payment for the above transaction could not be completed. An issuing bank will often decline an attempt to charge a credit card if the name, expiration date, or ZIP Code you entered at Amazon.com does not exactly match the bank's information.

To verify and/or update payment information for this order, please visit the following page:

https://www.amazon.com/gp/css/account/payment-update

Please note that if we do not receive payment from you within the next 3 days, your order will be canceled.

If you would like to cancel the above order (#002-5081318-3276061) now, please visit the following page:
https://www.amazon.com/gp/css/homepage/order-summary

This e-mail contains information directly related to your account with us, other services to which you have subscribed, and/or any application you may have submitted. Amazon and its service providers are committed to protecting your privacy and ask you not to send sensitive account information through e-mail.

You can view our privacy policy and contact information at:
http://www.amazon.com/gp/help/customer/policy_privacy

Thank you for shopping at Amazon.com.
Sincerely,
Amazon.com Customer Service

Please do not reply to this email. This mailbox is not monitored and you will not receive a response. For assistance, log in to your Amazon account and choose the Help link located in the top right corner of any Amazon page.

To receive email notifications in plain text instead of HTML, update your preferences here.

chase_1

source: Enron Spam Cache

From security@chase.com Wed Feb 28 18:31:37 2007
Return-Path:
X-Original-To: user@login.example.com
Delivered-To: user@login.example.com
Received: from mail.example.org (mail.example.org [192.168.4.9]) by example.com (Postfix) with ESMTP id 08E75468DF for ; Wed, 28 Feb 2007 18:31:37 -0500 (EST)
Received: from mail.example.org (mail.example.org [192.168.6.4]) by mail.example.org (Postfix) with ESMTP id 2A539131FC6A; Wed, 28 Feb 2007 18:31:37 -0500 (EST)
Received: from 192.168.1.100 (unknown [166.70.49.22]) by mail.example.org (Postfix) with SMTP id 815E86FA1A4; Wed, 28 Feb 2007 18:31:36 -0500 (EST)
Received: from 181.116.183.136 by ; Wed, 28 Feb 2007 19:33:40 -0400
Message-ID:
From: "Chase Bank Inc."
Reply-To: "Chase Bank Inc."
To: ceremony@example.com, user@example.com, geeks-owner@example.com
Subject: Security Update Notification Date: Wed, 28 Feb 2007 22:35:40 -0100
X-Mailer: Microsoft Outlook, Build 10.0.2616 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--7246074569122406" X-Priority: 1 X-MSMail-Priority: High Status: O X-Status: X-Keywords: X-UID: 906

Dear Online Account Holder,

As of a Days ago, our online banking security team observed Invalid logons
on your account, because the number of attempts to sigon in exceeded
the number allowed, you are required to Re-Confirm your online access.
Please note that entering invalid answers to your login details will lead to
Online banking Account block down For security reasons.

We have issued this warning.We ask you to take 5-10 mins to Re-Confirm your online access.
An extra verification process has been placed to ensure your identity and your account data, also enable our numerous customers to upgrade to 2007 Chase Bank SSL Servers.
Please login to your online access to continue to the verification process.

Failure to verify your account details may lead to account disconnection

Thank you.

Customer Service
Chase Bank Online Customer Service
1999-2007 Chase Bank Bank, N.A. All rights reserved. Member FDIC

chase_2

source: Enron Spam Cache

From: "Chase.com"
Content-Type: multipart/alternative;
boundary="------------000501070504030807060107"
Subject: Please restore your account
Return-Path:
X-Original-To: user@login.example.com
Delivered-To: user@login.example.com
Received: from mail.example.org (mail.example.org [192.168.4.9]) by example.com (Postfix) with ESMTP id 9F1304695C for ;
Mon, 15 Jan 2007 02:57:30 -0500 (EST)
Received: from Human-Media.net (human-media.net [216.40.201.206]) by mail.example.org (Postfix) with ESMTP id 7114B131FDCC for ;
Mon, 15 Jan 2007 02:57:30 -0500 (EST)
Received: (qmail 13800 invoked from network);
15 Jan 2007 07:37:31 +0000
X-Greylist: delayed 1054 seconds by postgrey-1.27 at mail.example.org;
Mon, 15 Jan 2007 02:57:30 EST
Reply-To: service@chaseonline.com
Date: Mon, 15 Jan 2007 01:38:18 -0600
MIME-Version: 1.0
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20070115075730.7114B131FDCC@mail.example.org>
Status: RO
X-UID: 617

Dear Chase valued customer,

We recently noticed one or more attempts to log in your Chase account from a foreign IP address and we have reasons to believe that your account was hijacked by a third party without your authorization. If you recently accessed your account while traveling, the log in attempts may have initiated by you.

However if you are the rightful holder of the account, click on the link below and submit, as we try to verify your account.

https://chaseonline.chase.com/

The log in attempt was made from:

IP address: 89.30.50.107
ISP host: 89.30.50.107.drmnet.org

If you choose to ignore our request, you leave us no choice but to temporally suspend your account.
We ask that you allow at least 48hrs for the case to be investigated and we strongly recommend not making any changes to your account in that time.

* Please do not respond to this email as your reply will not be received.

Thank you for your patience as we work together to protect your account.

chase_3

source: Enron Spam Cache

To: owner-ceremony-digest@example.com,
openbsd-mobile-request@example.com,
user@example.com, staff@example.com
From: "JPMorgan Chase & Co"
Content-Type: multipart/alternative;
boundary="------------060402000003010108040100"
Subject: Account Authentication Required
X-Original-To: user@login.example.com
Return-Path:
Delivered-To: user@login.example.com
Received: from mail.example.org (mail.example.org [192.168.4.9]) by example.com (Postfix) with ESMTP id 77A3E4692B for ;
Mon, 22 Jan 2007 11:18:39 -0500 (EST)
Received: from mail.example.org (mail.example.org [192.168.6.4]) by mail.example.org (Postfix) with ESMTP id A376B131FC17;
Mon, 22 Jan 2007 11:18:39 -0500 (EST)
Received: from 72.52.153.158 (unknown [72.52.153.158]) by mail.example.org (Postfix) with SMTP id 389626FA1A8;
Mon, 22 Jan 2007 11:18:39 -0500 (EST)
Message-ID:
Reply-To: "JPMorgan Chase & Co"
Date: Mon, 22 Jan 2007 11:13:08 -0600
X-Mailer: Microsoft Outlook Express 5.00.2919.6700
MIME-Version: 1.0
X-Priority: 3
X-MSMail-Priority: Normal
Status: O
X-UID: 660


		> Dear Chase Bank Customer, > The Chase Bank Online department kindly asks you to take part in our quick and easy 5 questions survey. In return we will credit $20.00 to your account - Just for your time! > With the information collected we can decide to direct a number of changes to improve and expand our services. The information you provide us is all non-sensitive and anonymous - No part of it is handed down to any third party. > It will be stored in our secure database for maximum 7 days while we process the results of this nationwide survey. We kindly ask you to spare two minutes of your time and take part in our online survey. > To continue please click here.
		EQUAL HOUSING LENDER Member FDIC
s

chase_4

source: Enron Spam Cache

Content-Type: multipart/mixed;
boundary="------------000501070504030807060107"
To: user@example.com
From: "Trashcan G. Straitjacket"
Subject: Chase Security Measures
Return-Path:
Delivered-To: user@example.com
Received: from mail.example.com (mail.example.com [192.168.6.4]) by example.com (Postfix) with ESMTP id D377C2A893 for ;
Mon, 2 Apr 2007 01:46:43 -0400 (EDT)
Received: by mail.example.com (Example mail relay) id C6ABD621F06;
Mon, 2 Apr 2007 01:46:43 -0400 (EDT)
Received: from -1210287440 (unknown [211.143.13.123]) by mail.example.com (Example mail relay) with SMTP id 1FDE1621EDE for ;
Mon, 2 Apr 2007 01:46:31 -0400 (EDT)
Date: Mon, 02 Apr 2007 05:46:35 +0000
X-Mailer: The Bat! (v2.00.1) Personal
X-Priority: 3
Message-ID: <3495496348.20070402054635@chase.com>
MIME-Version: 1.0
X-Virus-Scanned: by Ameriserv.net Anti-Virus E-Gateway
Status: RO
Content-Length: 5712
Lines: 130

Chase Bank is constantly working to ensure security by regularly screening the accounts in our system. We recently reviewed your account, and we need more information to help us provide you with secure service. Until we can collect this information, your access to sensitive account features will be limited. We would like to restore your access as soon as possible, and we apologize for the inconvenience.

Why is my account access limited?

Your account access has been limited for the following reason(s):

March 20, 2007: We would like to ensure that your account was not accessed by an unauthorized third party. Because protecting the security of your account is our primary concern, we have limited access to sensitive Chase Bank account features. We understand that this may be an inconvenience but please understand that this temporary limitation is for your protection.

(Your case ID for this reason is CHSE04-410-320-3334.)

At Chase Bank, one of our most important responsibilities to you, our customer, is the safekeeping of the nonpublic personal ("confidential") information you have entrusted to us and using this information in a responsible manner. Appropriate use of the confidential information you provide us is also at the heart of our ability to provide you with exceptional personal service whenever you contact us.

How can I restore my account access?

Please confirm your identity here: Restore My Online Banking Account and complete the "Steps to Remove Limitations."

Completing all of the checklist items will automatically restore your account access.

chase_5

source: Enron Spam Cache

MIME-Version: 1.0
X-Priority: 3 (Normal)
To: user@example.com
From: "Chase Online"
Content-Type: multipart/alternative;
boundary="------------070107070808050302020700"
Subject: Alert: Account Locked!
Return-Path:
X-Original-To: user@login.example.com
Delivered-To: user@login.example.com
Received: from mail.example.org (mail.example.org [192.168.6.4]) by example.com (Postfix) with ESMTP id 63AD146BF9 for ;
Sun, 10 Sep 2006 22:38:14 -0400 (EDT)
Received: from shelby.mywebworx.biz (shelby.mywebworx.biz [69.61.24.130]) by mail.example.org (Postfix) with ESMTP id 133046FA4EC for ;
Sun, 10 Sep 2006 22:38:14 -0400 (EDT)
Message-ID: <1157942293.18618.qmail@jpmorgan.com>
Date: Mon, 11 Sep 2006 02:38:13 +0000
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - shelby.mywebworx.biz
X-AntiAbuse: Original Domain - monkey.org
X-AntiAbuse: Originator/Caller UID/GID - [65534 65534] / [26 6]
Status: O
X-UID: 219

Account Locked !

Dear Chase Member,

Due to the number of incorrect login attempts, your Chase Account has been locked for your security. This has been done to secure your accounts and to protect your private information in case the login attempts were not done by you..
At Chase Bank we care about your security so, for your protection we are proactively notifying you of this activity.

If you did not trigger this lockout, follow this link to Log on to your Chase Online Account :

Click here to unlock your account

Thank you for your prompt attention to this matter.

We apologize for any inconvenience.

Thank you for using Chase!

Please do not reply to this e-mail. Mail sent to this address cannot be answered.

eBay_1

source: Enron Spam Cache

From: "moreinfo@ebay.com"
Content-Type: multipart/alternative;
boundary="------------060402000003010108040100"
Subject: Question about item - Respond now !
Return-Path:
Delivered-To: user@example.com
Received: from mail.example.com (mail.example.com [192.168.6.4]) by example.com (Postfix) with ESMTP id 7748B2A894 for ;
Thu, 19 Jul 2007 10:06:58 -0400 (EDT)
Received: from mail.example.com (mail.example.com [192.168.1.2]) by mail.example.com (Example mail relay) with ESMTP id 2FE91621D05 for ;
Thu, 19 Jul 2007 10:06:58 -0400 (EDT)
Received: by mail.example.com (Example mail relay) id A7B09162B0;
Thu, 19 Jul 2007 10:10:41 -0400 (EDT)
Received: from kkcsc.co.jp (kkcsc.co.jp [222.146.60.2]) by mail.example.com (Example mail relay) with ESMTP id A41C91628F for ;
Thu, 19 Jul 2007 10:10:40 -0400 (EDT)
Message-Id: <200707191406.l6JE6MDC076090@kkcsc.co.jp>
Reply-To: no-reply@ebay.com
Date: Thu, 19 Jul 2007 10:06:22 -0400
MIME-Version: 1.0
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-VSS-HEADER: SID:006; PID:26000;
Thu, 19 Jul 2007 23:06:52 +0900 (JST)
Status: RO
Content-Length: 14681
Lines: 353

eBay sent this message .
Your registered name is included to show this message originated from eBay. Learn more.

Question about item - Respond now !

eBay sent this message on behalf of an eBay member via My Messages. Responses sent using email will go to the eBay member directly and will include your email address. Click the Respond Now button below to send your response via My Messages.

Question from pichivelez

	pichivelez(20)
	Positive Feedback:	100%
	Member Since:	Aug-01-03
	Location:	FL, United States
	Registered On:	www.ebay.com

Item: (199209428112)

This message was sent after the listing closed.

hello , please tell me if the item it`s still available for sale ? .

Respond to this question in My Messages.


	Item Details


Item number:	199209428112
End date:	July -20-07 10:20 PDT

Thank you for using eBay!

http://www.ebay.com/

Marketplace Safety Tip

Always remember to complete your transactions on eBay - it's the safer way to trade.

Is this message an offer to buy your item directly through email without winning the item on eBay? If so, please help make the eBay marketplace safer by reporting it to us. These "outside of eBay" transactions may be unsafe and are against eBay policy. Learn more about trading safely.

This eBay notice was sent to you on behalf of another eBay member through the eBay platform and in accordance with our Privacy Policy. If you would like to receive this email in text format, change your notification preferences.

See our Privacy Policy and User Agreement if you have questions about eBay's communication policies.
Privacy Policy: http://pages.ebay.com/help/policies/privacy-policy.html
User Agreement: http://pages.ebay.com/help/policies/user-agreement.html

Copyright © 2007 eBay, Inc. All Rights Reserved.
Designated trademarks and brands are the property of their respective owners.
eBay and the eBay logo are registered trademarks or trademarks of eBay, Inc.
eBay is located at 2145 Hamilton Avenue, San Jose, CA 95125.

eBay_2

source: Enron Spam Cache

Return-Path:
X-Original-To: user@login.example.com
Delivered-To: user@login.example.com
Received: from mail.example.org (mail.example.org [192.168.6.4]) by example.com (Postfix) with ESMTP id B78324683F for ;
Wed, 4 Oct 2006 18:52:57 -0400 (EDT)
Received: from ylpvm29.prodigy.net (ylpvm29-ext.prodigy.net [207.115.57.60]) by mail.example.org (Postfix) with ESMTP id AABE36FA49D for ;
Wed, 4 Oct 2006 18:52:57 -0400 (EDT)
X-ORBL: [69.182.61.18]
Received: from User (vnaeast.org [69.182.61.18]) by ylpvm29.prodigy.net (8.13.7 out spool5000 dk/8.13.7) with SMTP id k94MoXQn008920;
Wed, 4 Oct 2006 18:50:35 -0400
Message-Id: <200610042250.k94MoXQn008920@ylpvm29.prodigy.net>
From: "ebay"
Subject: Question from member
Date: Wed, 4 Oct 2006 18:48:48 -0400
MIME-Version: 1.0
Content-Type: text/html; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
To: undisclosed-recipients:,
Status: O
X-Status:
X-Keywords:
X-UID: 380

eBay sent this message from Michael Douglan (rivernick).
Sender registered name is included to show this message originated from eBay. Learn more.

Question from eBay Member -- Respond Now

eBay sent this message on behalf of an eBay member via My Messages. Responses sent using email will not reach the eBay member. Use the Respond Now button below to respond to this message.

Question from bravofan03

I'm still waiting payment for my item for about 1 week. What happened? Please mail me ASAP or I will report you to ebay.

Respond to this question in My Messages.

Thank you for using eBay!

http://www.ebay.com/

Marketplace Safety Tip

If this message is an offer to sell an item without winning it on the eBay Web site (including Second Chance Offers sent through My Messages) please do not respond to the sender. These "outside of eBay" transactions are unsafe and not covered by eBay purchase protection programs.

Never pay for your eBay item through instant wire transfer services such as Western Union or MoneyGram. These payment methods are unsafe when paying someone you do not know.

Is this email inappropriate? Does it violate eBay policy? Help protect the community by reporting it..

This email appears in the language of the eBay site where you are registered.

Learn how you can protect yourself from spoof (fake) emails at:
http://pages.ebay.com/education/spooftutorial

This eBay notice was sent to ispqri@yahoo.com on behalf of another eBay member through the eBay platform and in accordance with our Privacy Policy. If you would like to receive this email in text format, change your notification preferences.

Copyright © 2005 eBay, Inc. All Rights Reserved.
Designated trademarks and brands are the property of their respective owners.
eBay and the eBay logo are registered trademarks or trademarks of eBay, Inc.
eBay is located at 2145 Hamilton Avenue, San Jose, CA 95125.

eBay_3

source: Enron Spam Cache

From: "eBay France"
Content-Type: multipart/alternative;
boundary="------------000304050505010504030005"
Subject: Question for item #250026510836 - Respond Now
Return-Path:
X-Original-To: user@login.example.com
Delivered-To: user@login.example.com
Received: from mail.example.org (mail.example.org [192.168.4.9]) by example.com (Postfix) with ESMTP id 7719B4692A for ;
Sat, 3 Feb 2007 21:54:41 -0500 (EST)
Received: from mail.example.org (mail.example.org [192.168.6.4]) by mail.example.org (Postfix) with ESMTP id 7175D131FD5E for ;
Sat, 3 Feb 2007 21:54:41 -0500 (EST)
Received: from d565.asilefx.com (unknown [66.49.213.45]) by mail.example.org (Postfix) with ESMTP id 5D95C6FA1C1 for ;
Sat, 3 Feb 2007 21:54:41 -0500 (EST)
Message-Id: <200702040252.l142q0BI002465@d565.asilefx.com>
Reply-To: aw-service@maiI.ebay.fr.asilefx.com
Date: Sat, 3 Feb 2007 21:45:17 -0500
MIME-Version: 1.0
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Status: O
X-UID: 745

eBay sent this message.
Your registered name is included to show this message originated from eBay. Learn more.

	Question about Item - Respond Now

eBay sent this message on behalf of an eBay member through My Messages. Responses sent using email will go to the eBay member directly and will include your email address.

Question from bluebellvue

	bluebellvue( 146)
	Positive feedback:	100%
	Member since:	May-25-05
	Location:	NC, United States
	Registered on:	www.ebay.com

Item: (250026510836)

This message was sent while the listing was active.

bluebellvue is a potential buyer.

I don't understand why you are not answering back.I have made the payment and you said you will provide a tracking number after the payment is done.If you don't replay I am assuring you I will report you at eBay.I am sorry for that but you gave me no choice.Waiting for your answer asap. Thank you!

Mark Barett.

Respond to this question

Responses in My Messages will not include your email address.

Thank you,
eBay

Details for item number: 250026510638
Item URL:	http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=200023943812&sspagename=ADME:B:AAQ:US:1
End date:	Sep-11-06 16:36:44 PDT

Marketplace Safety Tip

Is this email inappropriate? Does it violate eBay policy? Help protect the Community by reporting it.

Learn how you can protect yourself from spoof (fake) emails at:
http://pages.ebay.com/education/spooftutorial

This eBay notice was sent to you on behalf of another eBay member through the eBay platform and in accordance with our Privacy Policy. If you would like to receive this email in text format, change your notification preferences.

See our Privacy Policy and User Agreement if you have questions about eBay's communication policies.
Privacy Policy: http://pages.ebay.com/help/policies/privacy-policy.html
User Agreement: http://pages.ebay.com/help/policies/user-agreement.html

Copyright © 2006 eBay, Inc. All Rights Reserved.
Designated trademarks and brands are the property of their respective owners.
eBay and the eBay logo are registered trademarks or trademarks of eBay, Inc.
eBay is located at 2145 Hamilton Avenue, San Jose, CA 95125.

eBay_4

source: Enron Spam Cache

To: user@example.com
From: "eBay"
Content-Type: multipart/alternative;
boundary="------------000304050505010504030005"
Subject: Account Authentication Required
Return-Path:
X-Original-To: user@login.example.com
Delivered-To: user@login.example.com
Received: from mail.example.org (mail.example.org [192.168.4.9]) by example.com (Postfix) with ESMTP id 1212346968 for ;
Mon, 18 Jun 2007 08:40:40 -0400 (EDT)
Received: from mail.example.org (mail.example.org [192.168.6.4]) by mail.example.org (Postfix) with ESMTP id 1990F131FCFA for ;
Mon, 18 Jun 2007 08:40:40 -0400 (EDT)
Received: from 72.52.202.79 (unknown [72.52.202.79]) by mail.example.org (Postfix) with SMTP id 0923B6FA1C4 for ;
Mon, 18 Jun 2007 08:40:39 -0400 (EDT)
Message-ID:
Reply-To: "eBay"
Date: Mon, 18 Jun 2007 07:35:28 -0600
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
MIME-Version: 1.0
X-Priority: 3
X-MSMail-Priority: Normal
Status: O
X-UID: 1412

Dear eBay Community Member,

I'm writing to let you know that your account have been indefinitely suspended from eBay because our records indicate your account was involved in activities that violate our policy governing seller non-performance.

If you feel you have been suspended in error or want to appeal this decision by providing additional information, please click here .

An email regarding this was sent to your email address on file with eBay.

Thank you for using eBay and we look forward to many more successful transactions!

Sincerely,

Scott R. Shipman, CIPP
Senior Counsel, Global Privacy Practices
eBay Inc.

eBay_5

source: Enron Spam Cache

Return-Path:
X-Original-To: user@login.example.com
Delivered-To: user@login.example.com
Received: from mail.example.org (mail.example.org [192.168.4.9]) by example.com (Postfix) with ESMTP id B3A514691D for ;
Fri, 19 Jan 2007 21:10:21 -0500 (EST)
Received: from mail.example.org (mail.example.org [192.168.6.4]) by mail.example.org (Postfix) with ESMTP id 5D65A131FCC9 for ;
Fri, 19 Jan 2007 21:10:21 -0500 (EST)
Received: from ns.vcash.com (vcash.com [66.132.162.76]) by mail.example.org (Postfix) with ESMTP id 55FE76FA1C4 for ;
Fri, 19 Jan 2007 21:10:21 -0500 (EST)
Received: from ns.vcash.com by ns.vcash.com (8.12.8/8.12.8) with ESMTP id l0KEsnuV028960 for ;
Sat, 20 Jan 2007 09:54:49 -0500
Received: (from root@localhost) by ns.vcash.com (8.12.8/8.12.8/Submit) id l0KEsn38028958 for user@example.com;
Sat, 20 Jan 2007 09:54:49 -0500
Date: Sat, 20 Jan 2007 09:54:49 -0500
To: user@example.com
Subject: Your opinion counts
Message-ID: <1169304889.23738.qmail@eBay.com>
From: "eBay"
Content-Type: text/html
Status: RO
X-Status:
X-Keywords:
X-UID: 643

January 19, 2007

Dear eBay Community:

We have decided to close eBay on 27 February 2007 due to the repeatedly abuses on our company. We ask your opinion on this matter and we want to know if you agree with us or disagree .Below you can make your choice.

If you want eBay to stay open click YES otherwise click NO .Your opinion is very important to us. If 50% of the eBay members vote positive eBay stays open otherwise it will be closed.

Regards,
eBay Team

YES NO

eBay sent this message to you based on your good account standing.
Your registered name is included to show this message originated from eBay.

paypal_1

source: Enron Spam Cache

From: "service@paypal.com"
Content-Type: multipart/alternative;
boundary="------------060402000003010108040100"
Subject: Unauthorized access to your PayPal account !
Return-Path:
X-Original-To: user@login.example.com
Delivered-To: user@login.example.com
Received: from mail.example.org (mail.example.org [192.168.4.9]) by example.com (Postfix) with ESMTP id C185946904 for ;
Sun, 11 Feb 2007 16:49:35 -0500 (EST)
Received: from mail.example.org (mail.example.org [192.168.6.4]) by mail.example.org (Postfix) with ESMTP id B5136131FE6A for ;
Sun, 11 Feb 2007 16:49:35 -0500 (EST)
Received: from tedsconstruction.com (mail.tedsconstruction.com [68.15.39.45]) by mail.example.org (Postfix) with ESMTP id A2A3D6FA1C1 for ;
Sun, 11 Feb 2007 16:49:35 -0500 (EST)
Date: Sun, 11 Feb 2007 16:46:25 -0500
MIME-Version: 1.0
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID:
X-OriginalArrivalTime: 11 Feb 2007 21:39:33.0156 (UTC) FILETIME=[1E3F2640:01C74E25]
Status: O
X-UID: 798

Unauthorized access to your PayPal account!

We recently noticed more attempts to log in to your PayPal account from a foreign IP address.

If you accessed your account while traveling, the unusual log in attempts may have been initiated by you. However, if you are the rightfull holder of the account, please visit Paypal as soon as possible to verify your identity:

Click here to verify your account

You can also verify your account by logging into your PayPal account at https://www.paypal.com/us/.

If you choose to ignore our request, you leave us no choise but to temporaly suspend your account.

We ask that you allow at least 72 hours for the case to be investigated and we strongly recommend to verify your account in that time.

Thank you for using PayPal!
The PayPal Team

Please do not reply to this email. This mailbox is not monitored and you will not receive a response. For assistance, log in to your PayPal account and choose the Help link located in the top right corner of any PayPal page.

To receive email notifications in plain text instead of HTML, update your preferences here.

PayPal Email ID PP468

paypal_2

source: Enron Spam Cache

Return-Path:
X-Original-To: user@login.example.com
Delivered-To: user@login.example.com
Received: from mail.example.org (mail.example.org [192.168.4.9])
by example.com (Postfix) with ESMTP id 527864692A for ;
Fri, 22 Jun 2007 06:36:01 -0400 (EDT)
Received: from mail.example.org (mail.example.org [192.168.6.4])
by mail.example.org (Postfix) with ESMTP id 6552A131FC82 for
; Fri, 22 Jun 2007 06:36:01 -0400 (EDT)
Received: from rrcs-70-63-194-81.midsouth.biz.rr.com (rrcs-70-63-194-81.midsouth.biz.rr.com
[70.63.194.81]) by mail.example.org (Postfix) with ESMTP id 47FCA6FA1C5
for ;
Fri, 22 Jun 2007 06:36:01 -0400 (EDT)
Received: from pattie (pattie [70.63.194.81]) by pattie (8.12.8p1/8.12.8)
with ESMTP id i47B3E907F1B6D for ;
Fri, 22 Jun 2007 02:35:57 -0400 (envelope-from accounts@paypal.com)
Date: Fri, 22 Jun 2007 02:35:57 -0400
From: "PayPal"
Reply-To: "PayPal"
X-Priority: 3 (Normal)
Message-ID: <00470876.20070622063557@paypal.com>
To: user@example.com
Subject: Confirm Your Account
MIME-Version: 1.0
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
Status: O
X-Status:
X-Keywords:
X-UID: 1432

Dear PayPal ® customer,

We recently reviewed your account, and we suspect an unauthorized transaction on your account.
Protecting your account is our primary concern. As a preventive measure we have temporary limited your access to sensitive information.
Paypal features.To ensure that your account is not compromised, simply hit "Resolution Center" to confirm your identity as member of Paypal.

Login to your Paypal with your Paypal username and password.
Confirm your identity as a card memeber of Paypal.

Please confirm account information by clicking here Resolution Center and complete the "Steps to Remove Limitations."

*Please do not reply to this message. Mail sent to this address cannot be answered.

paypal_3

source: Enron Spam Cache

From: "PayPal"
Content-Type: multipart/alternative;
boundary="------------060402000003010108040100"
Subject: Limited account access
Return-Path:
X-Original-To: user@login.example.com
Delivered-To: user@login.example.com
Received: from mail.example.org (mail.example.org [192.168.4.9]) by example.com (Postfix) with ESMTP id CC4184687E for ;
Thu, 5 Apr 2007 09:47:56 -0400 (EDT)
Received: from mail.example.org (mail.example.org [192.168.6.4]) by mail.example.org (Postfix) with ESMTP id E0D26131FCA8 for ;
Thu, 5 Apr 2007 09:47:56 -0400 (EDT)
Received: from pv-lunch (unknown [209.94.106.18]) by mail.example.org (Postfix) with ESMTP id D77786FA1C1 for ;
Thu, 5 Apr 2007 09:47:56 -0400 (EDT)
Reply-To: No-Reply@Thank.You
Date: Thu, 5 Apr 2007 09:46:38 -0400
MIME-Version: 1.0
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID:
X-OriginalArrivalTime: 05 Apr 2007 13:41:09.0514 (UTC) FILETIME=[116FB6A0:01C77788]
Status: O
X-UID: 1083

As part of our security measures, we regularly screen activity in the PayPal system

During a recent screening, we noticed an issue regarding your account

For your protection, we have limited access to your account until additional security measures can be completed
We apologize for any inconvenience this may cause. To review your account and some or all of the information that PayPal used to make its decision to limit your account access, please visit the Resolution Center here

https://www.paypal.com/webscreen=?res_center/value=cookie?review

Thank you for using PayPal!

If, after reviewing your account information, you seek further clarification regarding your account access, please contact PayPal by visiting the Help Center and clicking "Contact Us".

We thank you for your prompt attention to this matter. Please understand that this is a security measure intended to help protect you and your account. We apologize for any inconvenience. Sincerely, PayPal Account Review Department PayPal page.

PayPal Email ID PP00245

paypal_4

source: Enron Spam Cache

Return-Path:
X-Original-To: user@login.example.com
Delivered-To: user@login.example.com
Received: from mail.example.org (mail.example.org [192.168.6.4]) by example.com (Postfix) with ESMTP id 57FE146978 for ;
Thu, 17 Aug 2006 13:35:00 -0400 (EDT)
Received: from webbermail.local (pool-72-70-6-251.bstnma.east.verizon.net [72.70.6.251]) by mail.example.org (Postfix) with ESMTP id 909E56FA5F7 for ;
Thu, 17 Aug 2006 13:35:00 -0400 (EDT)
Received: from User ([86.34.8.16]) by webbermail.local with Microsoft SMTPSVC(6.0.3790.1830);
Thu, 17 Aug 2006 12:32:00 -0400
From: "message"
Subject: Your payment has been sent to sales@configure.us.dell.com
Date: Thu, 17 Aug 2006 19:31:39 +0300
MIME-Version: 1.0
Content-Type: text/html; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID:
X-OriginalArrivalTime: 17 Aug 2006 16:32:01.0103 (UTC) FILETIME=[AA6FCDF0:01C6C21A]
To: undisclosed-recipients:,
Status: RO
X-Status:
X-Keywords:
X-UID: 65

Dear PayPal Member,

This email confirms that you have paid DELL INSPERION E1505 (sales@configure.us.dell.com) $449.99 USD using PayPal.

This credit card transaction will appear on your bill as "PAYPAL DELL INSPERION E1505 Notebook Computer ".

PayPal Shopping Cart Contents

Item Name:		Dell Inspiron 1300 Notebook Computer for Business 400 MHz - Celeron - 1 MB RAM - 40 GB Hard Drive 15.4" Display - Windows XP Home
Quantity:		1

Total:		$499.99

Cart Subtotal:		$484.99 USD
Sales Tax:		$15.00 USD
Cart Total:		$499.99

Shipping Information

Shipping Info:		Brandi Lee Skiles 2700 Cross Point circle Matthews, North Carolina 28105 United States
Address Status:		Unconfirmed

If you haven't authorized this charge, click the link below to cancel the payment and get a full refund.

Dispute Transaction

Thank you for using PayPal!
The PayPal Team

Please do not reply to this e-mail. Mail sent to this address cannot be answered. For assistance, log in to your PayPal account and choose the "Help" link in the footer of any page.

PayPal Email ID PP133320

paypal_5

source: Enron Spam Cache

Return-Path:
Delivered-To: user@example.com
Received: from example.com (example.com [192.168.2.0]) by example.com (Postfix) with ESMTP id 031F82A88C for ;
Mon, 4 Jul 2005 23:39:08 -0400 (EDT)
Received: by example.com (Example mail relay) id E48E463BF3;
Mon, 4 Jul 2005 23:39:07 -0400 (EDT)
Delivered-To: user@example.com
Received: from mail.example.com (mail.example.com [192.168.3.6]) by example.com (Example mail relay) with ESMTP id ABD5363BF2 for ;
Tue, 5 Jul 2005 03:39:07 +0000 (GMT)
Received: (from user@localhost) by mail.example.com id XAA25178 for user@example.com;
Mon, 4 Jul 2005 23:39:07 -0400
Received: from baracus.dreamhost.com (baracus.dreamhost.com [66.33.205.11]) by mail.example.com with ESMTP id XAA25170 for ;
Mon, 4 Jul 2005 23:39:06 -0400
Received: from User (wpc2079.amenworld.com [62.193.238.120]) by baracus.dreamhost.com (Postfix) with ESMTP id 092C617521D;
Mon, 4 Jul 2005 20:35:11 -0700 (PDT)
Reply-To:
From: "service@paypal.com"
Subject: Your PayPal Billing Information records are out of date. Please
update them immediately to restore your account.
Date: Tue, 5 Jul 2005 05:39:04 +0200
MIME-Version: 1.0
Content-Type: text/html; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20050705033511.092C617521D@baracus.dreamhost.com>
To: undisclosed-recipients: ,
Status: O
X-Status:
X-Keywords:
X-UID: 13

Dear PayPal ® valued member,

Is has come to our attention that your PayPal Billing Information records are out of date. That requires you to update the Billing Information.
Failure to update your records will result in account termination. Please update your records in maximum 72 hours. Once you have updated them, your PayPal session will not be interrupted and will continue as normal. Failure to update them will result in cancellation of service, Terms of Service (TOS) violations or future billing problems. Please follow the link below and update your account information:

https://www.paypal.com/cgi-bin/webscr?cmd=_login-run

....................................................................................................................................................................................................

Thank you for using PayPal!
The PayPal Team

Your monthly account statement is available anytime; just log in into your account at https://www.paypal.com/us/HISTORY. To correct any errors, please contact us through our Help Center at https://www.paypal.com/us/HELP.

-------------------------------------------------------------------------------------------------------------------------------------------------------------------
FOR INTERNATIONAL PAYMENTS ONLY:
Commissions and Fees incurred by sender: $0.00

Rate of exchange: If and when the Receipt chooses to withdraw these funds from the PayPal System, and if the withdrawal involves a currency conversion, the Recipient will convert the funds at the aplicable currency exchange rate at the time of the withdrawal, and the Recipient may incur a transaction fee.

RIGHT TO REFUND
You, the customer, are entitled to a refund of the money to be transmitted as a result of this agreement if PayPal does not forward the money received from you in 10 days of the date of its receipt, or does not give instructions commiting an equivalent amount of money to the person designated by you within 10 days of the date of the receipt of the funds from you unless otherwise instructed by you.

If you want a refund, you must mail or deliver your written request to PayPal at P.O. Box 45950, Omaha, NE 68145-0950. If you do not receive your refund, you may be entitled to your money back plus penalty of up to $1.000,00 USD and attorney's fee pursuant to Section 1810.5 of the California Financial Code.
-------------------------------------------------------------------------------------------------------------------------------------------------------------------
Please do not reply to this email. This mailbox is not monitored and you will not receive a response. For assistance, log in to your PayPal account and choose the Help link located in the top right corner of any PayPal page.

To receive email notifications in plain text instead of HTML, update your preferences here.

PayPal Email ID PP120

krebs_1

source: https://krebsonsecurity.com/2019/05/legal-threats-make-powerful-phishing-lures/

Unavailable. See website for details.

{Pullman & Assoc. | Wiseman & Assoc.| Steinburg & Assoc. | Swartz & Assoc. | Quartermain & Assoc.}

Hi,

The following {e-mail | mail} is to advise you that you are being charged by the city.

Our {legal team | legal council | legal departement} has prepared a document explaining the {litigation | legal dispute | legal contset}.

Please download and read the attached encrypted document carefully.

You have 7 days to reply to this e-mail or we will be forced to step forward with this action.

Note: The password for the document is 123456

personal_1

source: personal email (forwarded to me)

X-Priority: 3 (Normal)
To: example@gmail.com
From: "someone sent an example"
Content-Type: multipart/alternative; boundary="------------000501070504030807060107"
Subject: Fwd: FOR MUTUAL BENEFIT
Delivered-To:
Received: Tue, 24 Sep 2019 11:17:29 -0700 (PDT)
References: <5d6bc5c2.1c69fb81.b43d.0b01SMTPIN_ADDED_MISSING@mx.google.com>
In-Reply-To: <5d6bc5c2.1c69fb81.b43d.0b01SMTPIN_ADDED_MISSING@mx.google.com>
From: Forest Mead
Date: Tue, 24 Sep 2019 14:17:17 -0400
Message-ID:
Subject: Fwd: FOR MUTUAL BENEFIT
To: Jenny Lynn Popernack

Hello,

I am Antonio Capilla, a financial and investment management lawyer and an investment consultant law firm based in Spain. I need your partnership/assistance to invest (US$10 Million Dollars) in any good yielding business investment in your country on behalf of my client, and you shall get 30% out of the funds for your assistance.

Due to the sensitivity of my client’s position, the funds shall be invested in your company or personal name to make the fund release process easier. If interested, kindly write me back urgently for more details and to enable us proceed.

I await your reply.

Regards

Antonio Capilla

personal_2

source: personal email

Delivered-To: example@gmail.com
Date: Wed, 8 May 2019 19:06:54 -0300 (BRT)
From: "Givanildo S. "
Reply-To: Maria Elisa
Message-ID: <326036269.440369.1557353214209.JavaMail.zimbra@csemil.com.br>
Subject: =?utf-8?Q?_Grant_Donation_of_=E2=82=AC1,700,000?=
MIME-Version: 1.0

You were chosen to receive a Cash Grant Donation of €1,700,000 from Maria-Elisabeth, Respond back for more details email me at: patriciachandler0@gmail.com

personal_3

source: personal email

My response in an atgtempt to engage:
Date: Sat, 7 Sep 2019 18:55:35 -0400
References: <20190824222105.0306E929B53@zimbra141.bcc.gov.bd>
In-Reply-To: <20190824222105.0306E929B53@zimbra141.bcc.gov.bd>
Message-ID:
Subject: Re: Grants Donations.
From: Jenny Lynn Mead
To: elisabethmaria600@gmail.com
Cc: Recipients Initial Phishing Email
X-Priority: 3 (Normal)
To: ufpomodhupur@dgfp.gov.bd
From: "Maria"
Content-Type: multipart/alternative; boundary="------------040208020605010607030408"
Subject: Grants Donations.
Delivered-To: example@gmail.com
Received: Sat, 24 Aug 2019 17:06:51 -0700 (PDT)
Received: from zimbra141.bcc.gov.bd (zimbra141.bcc.gov.bd. [103.48.16.141]) by mx.google.com with ESMTPS id m6si5320686pgp.423.2019.08.24.17.06.45 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sat, 24 Aug 2019 17:06:51 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by zimbra141.bcc.gov.bd (Postfix) with ESMTP id 29296929B99;
Sun, 25 Aug 2019 04:21:49 +0600 (BDT)
Received: from zimbra141.bcc.gov.bd ([127.0.0.1]) by localhost (zimbra141.bcc.gov.bd [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id WZTi7Av1H9O0;
Sun, 25 Aug 2019 04:21:48 +0600 (BDT)
Received: from localhost (localhost [127.0.0.1]) by zimbra141.bcc.gov.bd (Postfix) with ESMTP id 2B71A929B96;
Sun, 25 Aug 2019 04:21:44 +0600 (BDT)
Received: from zimbra141.bcc.gov.bd ([127.0.0.1]) by localhost (zimbra141.bcc.gov.bd [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 8fptp66jOzkU;
Sun, 25 Aug 2019 04:21:43 +0600 (BDT)
X-Virus-Scanned: amavisd-new at zimbra141.bcc.gov.bd
Received: from zimbra141.bcc.gov.bd ([127.0.0.1]) by localhost (zimbra141.bcc.gov.bd [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 8fptp66jOzkU;
Sun, 25 Aug 2019 04:21:43 +0600 (BDT)
Received: from [10.23.153.30] (unknown [103.14.116.57]) by zimbra141.bcc.gov.bd (Postfix) with ESMTPSA id 0306E929B53;
Sun, 25 Aug 2019 04:21:04 +0600 (BDT)
MIME-Version: 1.0
Subject: Grants Donations.
To: Recipients
From: "Maria"
Date: Sat, 24 Aug 2019 15:15:28 -0700
Reply-To: elisabethmaria600@gmail.com
Message-Id: <20190824222105.0306E929B53@zimbra141.bcc.gov.bd>

Hello,

I received an email regarding a charity donation. Could you give me more information?

Thank you

On Sat, Aug 24, 2019 at 8:06 PM Maria <ufpomodhupur@dgfp.gov.bd> wrote:

You have a Charity Donation of €1,700,000 from Maria Elisabeth. For full details,Contact her now via: elisabethmaria600@gmail.com

personal_4

source: personal email

X-Priority: 3 (Normal)
To: example@gmail.com
From: "Maria Elisabeth"
Content-Type: multipart/alternative;
boundary="------------040106040408060005030605"
Subject: Re: Grants Donations..
Delivered-To: example@gmail.com
X-Received: Mon, 09 Sep 2019 10:32:45 -0700 (PDT)

Kindly provide your details if you are serious and i will refer you to my bank for the transfer okay.

On Mon, 9 Sep 2019 at 10:28, Jenny Lynn Mead <example@gmail.com> wrote:

Oh no Maria I am so serious, but I want to make sure this is real. I know you asked me not to question it, but I'm just scared...I hope you can understand.

On Mon, Sep 9, 2019 at 5:12 AM Maria Elisabeth <elisabethmaria600@gmail.com> wrote:
If you are serious to receive the donations kindly provide us with your details in other to refer you to my bank okay.

On Sun, 8 Sep 2019 at 14:04, Jenny Lynn Mead <example@gmail.com> wrote:
Hi Maria,

Thank you for your consideration of me. I truly feel blessed to receive your email! Obviously the money would help immensely for me. I repair appliances for a living, and the money's not exactly great. I'm happy to answer your questions, but how do I know you're not one of those scammers?

Jenny

On Sun, Sep 8, 2019 at 8:56 AM Maria Elisabeth <elisabethmaria600@gmail.com> wrote:
Good Day Jenny Lynn,

Thank you for the prompt response, please don't be bothered as to why you have been contacted for this and its genuineness as I have done so from a pure motive, I am Maria Elisabeth, a German citizen, wife of late Georg W Schaeffler,73 years old, you can see here:forbes.com/profile/maria-elisabeth-schaeffler.

The intention of this email is to be of immense blessing to people, with my age, I can't continue to amass wealth without giving out,I am indulging myself with such act that will be considered a blessing to others, it is my hope that as you receive this money and that it would be of great use to you and also that you can also assist others from it. I crave your indulgence to keep this offer discreet as I don't want to make this a public affair, so if you are willing to accept the gift, I will make you a beneficiary, As I send this message to you, I have also sent to churches, orphanages, and charitable organization. now with all this being said, if you are ready to receive your part of €1,700,000 {one Million, Seven Hundred Thousand Euro}from my cede of €50Million, kindly introduce yourself in full details,

Full Name,
Telephone Number,
Address,
Occupation
Country:
Age:

Thereafter I shall grant you a letter to authorize the money to you from the bank, please my dear ,this is my personal wealth as it doesn't need any formal procedures, and for the sake that it might seem too easy for you to receive this gift don't justify that life is easy, I would crave your indulgence not to refer any person whatsoever to me so that I can have my peace. I am doing this as a free-spirit gift and I made the contact myself to you, therefore, don’t refer any person and don’t make a public/media show of this as I would not like any publicity of any sort.

I will wait for your email to do further. Stay bless.

Maria-Elisabeth
SCHAEFFLER AG,
HERZOGENAURACH

personal_5

source: personal email

From: Reverend Joseph Cameron King
To: Jenny Lynn Popernack
Subject: Re: $730 / 3br - 1200ft2 on Craigslist
Thread-Topic: $730 / 3br - 1200ft2 on Craigslist
Thread-Index: AQHUxWPn3AMJ7SJZ2Uy/9eNV3abaRKXiw7CZ
Date: Sat, 16 Feb 2019 18:41:36 +0000
Message-ID:
References:
In-Reply-To:

Hello Tenant

Thanks for your email, I personally own the house, I want my property to be well taken good care of, and there are some rules and regulation in which I do give out to tenant willing to rent my house so please don't disrespect my order But if you are still capable of renting my house the rules and regulation goes this way. You must keep my house clean including the surrounding, you must know the way in which you use the stove so as to avoid fire outbreak,you must not disturb the neighbor.I decided to rent out the property due to our transfer to (Topeka, Kansas) on a Missionary Work in a church here named World Mission, so we are renting it out since we need someone to take good care of the property on our absent.

Don't be surprise if you find the home with another site and deference price, I have plan to rent it through Real estate before, but they are not serious simply because they have a lot of house to lease out And they added some money to the rent while there commission is not fair. Have this in mind you must know the kind of person that I'm nevertheless I am giving you this rules because of what corresponded between me and my last tenant. the keys and documents are with us here in (Topeka, Kansas)... So I will need to ship them to you before you can occupy the house But you can drive by the house anytime to take a look at the area and surrounding, You can also peek through the windows if you don't mind.For now we are looking for 3 or 4 years lease or rather lets us know how long you wish to stay.

Attn : The rent are including the Utilities are intact such as Dishwasher,Dryer, Electric Stove, Fridge, Washer,Air Condition,Sewage,Trash, Other amenities include ; large eat-in kitchen with refrigerator, gas stove/oven, and microwave oven; spacious living room with fireplace; deck; laundry room off kitchen with washer & dryer; and cable/internet ready.Hi-efficiency gas heat & electric hot water, city water.all included in the monthly rent,as i am in a governmental programmer that sponsors my utilities on monthly basis etc.

Please note that, we are a kind and honest family,that spent a lot on property that is available for rent, so in one accord,we are soliciting for your absolute maintenance of this house and want you to treat it as your own.We want you to keep it tidy all the time so that we shall be glad to see it whenever we are around on a visit.

SO IF YOU ARE REALLY INTERESTED I WILL WANT YOU TO FILL THE RENTAL APPLICATION FORMS BELOW

RENT APPLICATION FORM AND TELL US MORE ABOUT YOU .

1) Your Full Name

2A) Home Phone ?

2B) Cell Phone Number ?

3) Your Full Address :

4) How old are you?

5a) Are you married?

5b) How many people will be living in the house?

6a) Do you have a pet?

6b) What type

7a) Do you have a car?

7b) What type?

8) Occupation?

9) Do you smoke?

10) Do you Drink ?

11) Do you work at Night ?

12) What is your monthly income?

13) Reference Contact Name and Address?

14) When do you intend Moving in?

15) Private email :

16 ) Picture of you and your family?

17) When can you pay for your deposit to

secure or move in?

Notice : Text me immediately you fill out the application

Looking forward to hear from you with all this details so that we can have it our file in case of issuing the receipt for you and contacting you..

Await your prompt reply so that we can discuss on the rental terms and agreement, please we are renting the house to you base on trust and again i will want you to stick to your words.So please do not let us down in maintaining this our property and God bless you more as you do this.

PROPERTY DESCRIPTION...........

Number of Bedrooms:3

Number of baths:1.5

Square footage:1,200

Pets are welcome!!!

Rent:$730

Refundable security Deposit:$730

House Address: 161 W California Ave Columbus, OH 43202

My Cell Phone Number: (213) 340-7895

Thanks and God bless you.

Reverend Joseph Cameron King & Family

Sent from Outlook

From: Jenny Lynn Popernack <example@gmail.com>
Sent: Friday, February 15, 2019 11:23 AM
To: Landlord1453@outlook.com; Forest Mead
Subject: $730 / 3br - 1200ft2 on Craigslist

Hello,

My fiance and I are moving into the area from Minnesota within the next few weeks for a new job. We came across this posting on craigslist and are very interested in renting. My fiance contacted you yesterday but we haven't heard anything, so I figured I'd send an email too. We've got the deposit and everything ready to go, we're just hoping the unit is still available!

Please contact one of us:

Forest Mead: [redacted] or [example@gmail.com

]

Jenny Popernack: [redacted] or example@gmail.com

Thank you so much, looking forward to hearing from you!

Jenny

personal_6

source: personal email

Return-Path:
Received: from www683.sakura.ne.jp (www683.sakura.ne.jp. [59.106.19.133]) by mx.google.com with ESMTPS id s66si1868342pgs.592.2019.07.12.11.21.33 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Fri, 12 Jul 2019 11:21:34 -0700 (PDT)
Received-SPF: fail (google.com: domain of naoko@koinonia.or.jp does not designate 59.106.19.133 as permitted sender) client-ip=59.106.19.133;
Authentication-Results: mx.google.com;
spf="fail (google.com: domain of naoko@koinonia.or.jp does not designate 59.106.19.133 as permitted sender) smtp.mailfrom=naoko@koinonia.or.jp"
Received: from User (202-152-98-98.flets.freadway.ne.jp [202.152.98.98]) (authenticated bits=0) by www683.sakura.ne.jp (8.15.2/8.15.2) with ESMTPA id x6CIKk3b096503;
Sat, 13 Jul 2019 03:20:50 +0900 (JST) (envelope-from naoko@koinonia.or.jp)
Message-Id: <201907121820.x6CIKk3b096503@www683.sakura.ne.jp>
Reply-To:
From: "Elizabeth Lyonsfield"
Subject: BEEN TRYING TO REACH YOU
Date: Fri, 12 Jul 2019 18:21:17 -0700
MIME-Version: 1.0
Content-Type: text/plain; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
To: undisclosed-recipients:,

Dear

Hello, how are you doing today? I have been trying to reach you but all efforts proved abortive. This email is a reminder that i am still expecting to hear from you as regards our previous conversation

I hope to hear back from you soonest.

Thank you.
Sincerely yours,
Elizabeth Lyonsfield

personal_7

source: personal email

Forwarded message from school account. Unavailable due to organization removing phishing email from server.

Greetings,

I have a Private proposal of 58 Million EUR for your consideration.

DT
DBS Singapore

personal_8

source: personal email

Return-Path:
Received: from mbl-82-59-90.dsl.net.pk (mbl-82-59-90.dsl.net.pk. [203.82.59.90]) by mx.google.com with ESMTP id j30si4164416eda.52.2019.06.26.06.48.53 for ;
Wed, 26 Jun 2019 06:48:54 -0700 (PDT)
Received-SPF: neutral (google.com: 203.82.59.90 is neither permitted nor denied by best guess record for domain of nfrancisou@mail2sal.com) client-ip=203.82.59.90;
Authentication-Results: mx.google.com;
spf="neutral (google.com: 203.82.59.90 is neither permitted nor denied by best guess record for domain of nfrancisou@mail2sal.com) smtp.mailfrom=nfrancisou@mail2sal.com"
Message-ID: <9D984C43E54997EAEF3B34923EE09D98@OI048QUP>
From:
To: "[redacted]"
Subject: Frauders known your old passwords. Access data must be changed.
Date: 26 Jun 2019 22:16:51 +0400

Hi, dear user of gmail.com
We have installed one RAT(trojan) software into you device.
For this moment your email account is hacked.
I know your password for this account [example@gmail.com]: [redacted]

Changed your password? You're doing great!
But my software recognizes every such action. I'm updating passwords!
I'm always one step ahead....

So... I have downloaded all confidential information from your system and I got some more evidence.
The most interesting moment that I have discovered are videos records where you masturbating.

I posted my virus on porn site, and then you installed it on your operation system.
When you clicked the button Play on porn video, at that moment my trojan was downloaded to your device.
After installation, your front camera shoots video every time you masturbate, in addition, the software is synchronized with the video you choose.

For the moment, the software has harvrested all your contact information from social networks and email addresses.
If you need to erase all of your collected data, send me $600 in BTC (crypto currency).
This is my Bitcoin wallet: [redacted]
You have 48 hours after reading this letter.

After your transaction I will erase all your data.
Otherwise, I will send video with your pranks to all your colleagues and friends!!!

P.S. I'm asking you not to answer this letter because the sender's address is fake, just to keep me incognito.

And henceforth be more careful!
Please visit only secure sites!
Bye!

personal_9

source: private message on DeviantArt account

None available.

personal_10

source: private e-mail

From:
Date: Nov 2, 2017 5:26 AM
Subject: Re: House for rent: 12th Ave N, Saint Cloud, MN
To: [redacted]@gmail.com
Cc:


        Thanks for your interest and inquiries about Our house. am sorry for the lateness in my response and as am

        very busy at work lately and yes the house is much available for move in and we are looking for a good and

        responsible tenant that is God fearing and a good christian ready to maintain and keep the house in pristine

        condition now that we are out of the state my reasons for leaving with my family is that i love my family

        and i go everywhere with them now that we are not around,we like to know if you are ready to move in am

        currently transferred to (Atlanta,GA) due my work,i work with people who rely on the power of intelligence

        to innovate, expand their horizons and sustain the hope of a new humanism. UNESCO http://whc.unesco.org/

        exists to bring this creative intelligence to life; for it is in the minds of men and women that the

        defenses of peace and the conditions for sustainable development must be built.i also work as researcher

        under Education for All (EFA). It aims to foster partnerships to strengthen countries’ capacity to offer

        quality education for all.

        My lovely wife is a member of Joyce Meyer ministries i spent less time in the States so I could not get a

        hold on any Realtor to handle this rent issue, although it was when I knew we are going to stay in

        (Atlanta,GA)for 4 to 5 years that is why i decided to rent out the house. However, the initial plan was to

        sell out the house. which I tried, but the agents inflates the prize and it takes longer to sell i am

        telling you this in-case if you find the house on another website, that is the old advert.

         so kindly get back to us so we can proceed on how you could get the application filled and we will also

        like you to know that is not the money that really matters because we believe both the rich and poor

        deserve a better home (734) 508-2612

                      Below is the rental property address:
                      House Address
                      614 12th Ave N,
                      Saint Cloud, MN 56303

                      Monthly Fee:$580
                      Security Deposit:$500
                      Pets Allowed: YES
                      Available: Available Now for move in.

                      Best Regard

                     Hebrews 13:2 - Do not forget to show hospitality to strangers, for by so doing some people have

        shown hospitality to angels without knowing it.



        -----Original Message-----
        From: Jenny Lynn <[redacted]@gmail.com>
        To: gok_wed 
        Sent: Wed, Nov 1, 2017 8:59 pm
        Subject: House for rent: 12th Ave N, Saint Cloud, MN

        Hello,

        My name Is Jennifer and I'm a graduate student/instructor at St. Cloud State, and my boyfriend Forest is an information security specialist at Stearns Bank.  We're looking to move into a place by December 1st.  We were wondering if this time frame works, and if so when we could set up a time to view the house.  It looks perfect for us!   Feel free to contact us either at this email, my phone [redcted], or Forest at [redacted]. Thank you very much, and we look forward to hearing back from you soon.

        Jen

indy

source: https://kb.iu.edu/d/arsf#example

From: "INDIANA.EDU SUPPORT TEAM"
Reply-To: "INDIANA.EDU SUPPORT TEAM"
Date: Sat, 12 Jul 2008 17:42:05 -0400
To: <"Undisclosed-Recipient:;"@iocaine.uits.indiana.edu>
Subject: CONFIRM YOUR ACCOUNT

Dear INDIANA.EDU email Subscriber

This mail is to inform all our {INDIANA.EDU} users that we will be maintaining and upgrading our website in a couple of days from now.As a Subscriber you are required to send us your Email account details to enable us know if you are still making use of your mailbox. Be informed that we will be deleting all mail account that is not functioning to enable us create more space for new students and staffs of the school, You are to send your mail account details which are as follows:

*User Name:
*Password:
*Date of birth:

Failure to do this will immediately render your email address deactivated from our database.

Thank you for using INDIANA.EDU
FROM THE INDIANA.EDU SUPPORT TEAM

netsecops

source: http://netsecops.info/bought-a-drone-from-apple-really/

boeing 737 max

source: https://securityaffairs.co/wordpress/82500/cyber-crime/spam-boeing-737-max.html

additional source: https://mp.weixin.qq.com/s/CpASyR0lYBKFtjRAFumM1g

X-RC-FROM:
X-RC-RCPT:
From: "Forensic"
To: joseph@bing.co.kr
Subject: Fwd:Airlines plane crash Boeing 737 Max 8
Date: 14 Mar 2019 03:32:07 -0400
Message-ID: <20190314011242.F874E0DCCCFF48C5@isgec.com>
MIME-Version: 1.0
Attachment: MP4_142019.jar

Greetings

I believe you have heard about the latest crash Boeing 737 MAX 8 which happen on sunday 10 march 2019, All passengers and crew were killed in the accident

Ethiopian Airlines Flight ET302 from Addis Ababa, Ethiopia, to Nairobi, Kenya, crashed shortly after takeoff

The dead were of 35 different nationalities, including eight Americans.

On 29 October 2018, the Boeing 737 MAX 8 operating the route crashed into the Java Sea 12 minutes after takeoff.

All 189 passengers and crew were killed in the accident.

note: there was a leak information from Darkweb which listed all the airline companies that will go down soon.

kindly notify your love ones about the informations on these file.

Regards

Joshua Berlinger
private inteligent analyst

sextortion_1

source: https://pastebin.com/raw/LQWeA6j1

emotet_malspam1

source: https://pastebin.com/raw/7GbVYu9q

emotet_2

source: https://pastebin.com/raw/TWdxY2Kq

emotet_3

source: https://pastebin.com/raw/Xec3Ap5d

hancitor_1

source: https://pastebin.com/raw/a8Qr2nY4

hancitor_2

source: https://www.malware-traffic-analysis.net/2019/04/02/index.html

Received: from milaromanoff.com ([64.56.218.98]) by [removed] for [removed];
Tue, 02 Apr 2019 16:36:58 +0000 (UTC)
Date: Tue, 02 Apr 2019 11:35:04 -0500
MIME-Version: 1.0
X-Mailer: iPhone Mail (11A501)
Content-Transfer-Encoding: 7bit
Subject: You got invoice from DocuSign Electronic Service
Message-ID: <364EB70F.BFED560B@milaromanoff.com>
From: "DocuSign Signature "
Content-Type: text/html;
charset="utf-8"
To: [removed]

Please review and sign this document.

REVIEW DOCUMENT

Dear Recipient,

Please sign this invoice
It is an electronically created notice.

This message keeps a secure link to DocuSign. Do not share this link with other people.

Alternative Signing Method
Please visit DocuSign.com, click on 'Access Documents', enter the security code: 080E7ACAF4

About Our Service
Sign invoice electronically in just few clicks. It's risk-free. Whether you are at work, home or even across the globe -- Our service gives a professional solution for Digital Operations .

Questions concerning an Invoice?
In case you need to edit an invoice or have questions , please contact the sender directly.

If you cannot see an invoice, see the Help page on our support .

This message was sent to you by DocuSign Electronic Signature Service.

lokibot_1

source: http://malware-traffic-analysis.net/2019/05/23/index.html

Please do not go to this page and download the email/files unless you have a proper forensics setup. They contain active malware. The code I have put here from this email is safe.

Return-Path: bilgi@hidrohan.com
From: "hidrohan otomotiv"
Content-Type: multipart/mixed;
boundary="------------000501070504030807060107"
Subject: New Purchase & Catalogue Requisition
X-Originating-Ip: [94.102.13.111]
Authentication-Results: [removed];
iprev="pass policy.iprev="94.102.13.111";
spf="neutral smtp.mailfrom="bilgi@hidrohan.com" smtp.helo="ns1.linedc.org";
dkim="none (message not signed) header.d=none";
dmarc="none (p=nil"; dis="none) header.from=hidrohan.com"
Received: from [94.102.13.111] ([94.102.13.111:61814] helo=ns1.linedc.org) by [removed] (envelope-from ) [removed];
Thu, 23 May 2019 03:40:48 -0400
MIME-Version: 1.0
Message-ID: <1F3BECA9BB9D4E9F9432E5BA9FB87ADC.MAI@linedc.org>
Date: Thu, 23 May 2019 08:37:20 +0100
X-Priority: 3
X-MSMail-Priority: Medium

Dear,

Good Morning and thank you very much for your time during the Fair

According to our previous discussion, would you please send me quotes and your possible lead time for the below item :

I think your code was ( PBCk0017-1 )

The QTY : 150.000 pcs Each

On the other hand , I would be pleased if you send me your latest catalogue, If any

Awaiting your feedback to proceed.

Best Regards

Shaif Rashama

Managing Director

Mobile no: +91-9880166113

Affiliated to Govt Of India.

Untitled design (4)-min cid:image004.jpg@01D500E4.2E6F0970

HYDROHAN GLOBAL

Head Office:

2nd, 3rd & 4th Floor, Raghavendra Complex

417/418, 10th Main Rd, Geetha Colony,

4th Block - Jayanagar,

Bengaluru - 560041

Above Canara Bank NRI Branch
Email: bilgi@hydrohan.com

www.hydrohan.com

India - Middle East - Africa Operation

cid:image008.png@01D189F4.6A424AD0 cid:image007.jpg@01D189F4.6A424AD0

****** Diverse technology Seamless integrity********

Think Green. Please consider environment before printing this mail/document. Use recycled paper for printing. Every 3000 sheets of paper cost us a tree. Together we can help preserve the environment.

************************************ IMPORTANT MESSAGE ******************************
This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you.

lokibot_2

source: http://malware-traffic-analysis.net/2019/03/15/index2.html

Please do not go to this page and download the email/files unless you have a proper forensics setup. They contain active malware. The code I have put here from this email is safe.

Content-Type: multipart/mixed;
boundary="------------000501070504030807060107"
Return-Path: hongwoo@gmail.com
From: "Mr. Hong Woo"
Subject: INV 3326GHF- from Outriger General Importers Korea for acknowledgment
Received: from [165.227.181.253] ([165.227.181.253:41356] helo=centos-s-2vcpu-4gb-nyc3-03) by [removed] (envelope-from ) [removed];
Thu, 14 Mar 2019 21:42:49 -0400
Reply-To: allen.youfasteelpipe@gmail.com
Date: Thu, 14 Mar 2019 18:34:59 -0700
MIME-Version: 1.0
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id:

Dearsir/Madam,

I hope this email finds you well.

Please findattachedproforma for your acknowledgement and kindly send thefinal PI in order to proceed with the request foradvance payment.

Awaiting your reply.

Thank you.

Regards.

Mr. Hong Woo

Overseas Sales/Purchase

General importers-Outriger Corporation

COMPANY: Outrigger OWNER: Kim Sung Hae

ADDRESS: Outrigger 375-87 1st floor, Gyeongno-ro, Ilsan, Goyang-si, Gyeonggi-do

TEL: 031-901-7092 FAX: 031-905-0444

E-MAIL: Overseas Sales Team - sales@outriger.biz

Import Domestic Team - gift@outriger.co.kr

http://www.outriger.biz

Business Registration No.: 130-28-55800

All images and content used in this mail are prohibited from unauthorized use.

The information contained in this electronic transmission message and any of its attachments is intended for addressee(s) only and may contain confidential information. If you are not the addressee(s), please notify the sender and delete this message completely. Any views expressed herein are those of the individual sender except where the sender specifically states it to be the views of Unilever.
Unileveris neither liable for incomplete transmission of this electronic message nor for any delay in its receipt. If you are not the intended recipient you are hereby notified that any disclosure, reproduction, distribution or taking any action in reliance on the contents of this electronic message is strictly prohibited.

lokibot_3

source: http://malware-traffic-analysis.net/2019/01/03/index.html

Please do not go to this page and download the email/files unless you have a proper forensics setup. They contain active malware. The code I have put here from this email is safe.

by-[removed];-Thu,-20-Dec-2018-16: 13:53 +0100 (envelope-from ) Received: from webmail.ngfsl.com (vl23445.dns-privadas.es [IPv6:::1]) by vl23445.dns-privadas.es (Postfix) with ESMTPA id 307DDD0A14BD; Thu, 3 Jan 2019 02:34:50 +0100 (CET) Authentication-Results: vl23445; spf="pass (sender IP is ::1) smtp.mailfrom=proc400@khusheim.com smtp.helo=webmail.ngfsl.com" Received-SPF: pass (vl23445: connection is authenticated) MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="=_908c3a0142246c9184cbaa1f9a7ceda7" Date: Thu, 03 Jan 2019 03:34:50 +0200 From: khusheim To: [removed] Subject: RFQ#5500177966 In-Reply-To: References: Message-ID: X-Sender: proc400@khusheim.com User-Agent: Roundcube Webmail/1.2.7 X-PPP-Message-ID: <20190103013450.8963.7962@vl23445.dns-privadas.es> X-PPP-Vhost: ngfsl.com

Dear Sir,

Greetings!!!!

We have a requirement for the products which belong to your portfolio.

Please review the attached inquiry and send us your offer at the earliest possible.

OFFER SUBMISSION DATE 05-01-2019

Please do not hesitate to contact us for any clarification.

Looking forward to receive your favorable reply.

Thanks & Regards:

Puneeth.M | Global Sourcing Specialist

Khusheim Industrial Equipment Company

Office number: 304, 3rd Floor, Al Dana Tower (Delta Tower) | Near Eddy Electrical Shop | Jubail | Saudi Arabia - 31961 | Phone: +966 13 361 9282 Ext: 5009

E-mail: proc400@khusheim.com | Web: www.khusheim.com |

lokibot_4

source: https://pastebin.com/3t2GicWX

X-Originating-Ip: [159.203.88.253]
Authentication-Results: [removed]; iprev=pass policy.iprev="159.203.88.253"; spf=softfail smtp.mailfrom="evergreen@gmail.com" smtp.helo="centos-s-2vcpu-4gb-nyc3-04"; dkim=none (message not signed) header.d=none; dmarc=fail (p=none; dis=none) header.from=gmail.com
Received: from [159.203.88.253] ([159.203.88.253:50852] helo=centos-s-2vcpu-4gb-nyc3-04)
by [removed] (envelope-from ) [removed];
Mon, 15 Apr 2019 06:58:20 -0400
Received: from [102.165.37.46] (helo=User)
by centos-s-2vcpu-4gb-nyc3-04 with esmtpa (Exim 4.91)
(envelope-from )
id 1hFzHL-0006EX-L6; Mon, 15 Apr 2019 10:56:00 +0000
Reply-To:
From: "Evergreen Group Pte Ltd"
Subject: Evergreen Group Pte Ltd - Request For Quotation.
Date: Mon, 15 Apr 2019 03:55:59 -0700
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_003D_01C2A9A6.406AEC34"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id:

Dear Sir,

We are writing you from Evergreen Group Pte Ltd.
Recently We have gone through your company profile and we are interested in doing business with your company on your products because it fall in line with therange of products with supplies and distribute.

Kindly see attachment to View the list of products that we wish to have a full briefing on.

You are to provide us with the following about the products

1. Prices FOB
2. Payment terms
3. Delivery Period
4. Specified delivery date assuming from the Date of Order.

Please your quick reply is highly appreciated, we need this concluded before chinese new year.

On receipt of your response, we shall forward you the order quantity and delivery details to enable your company issue us a proper quotation.

Thank you for your cooperation.

With best regards,

Lim Phek Jin

RETAIL, Head

Evergreen Group

8 New Industrial Road, LHK 3, #01-02/03

Singapore 536200

Tel: (65) 6336-4455

Fax:(65) 6448 4110

lokibot_5

source: https://www.fortinet.com/blog/threat-research/new-infostealer-attack-uses-lokibot.html

No information available. Please see source.

lokibot_6

source: https://blog.trendmicro.com/trendlabs-security-intelligence/lokibot-gains-new-persistence-mechanism-uses-steganography-to-hide-its-tracks/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Anti-MalwareBlog+%28Trendlabs+Security+Intelligence+Blog%29

Podesta Email

source: https://wikileaks.org/podesta-emails/

To: slatham@hillaryclinton.com
From: "Milia Fisher"
Content-Type: multipart/alternative; boundary="------------050800070502000402020804"
Subject: =?utf-8?Q?Re:_S=D0=BEme=D0=BEne_has_your_passw=D0=BErd?=
Delivered-To: john.podesta@gmail.com
Received: by 10.25.88.78 with SMTP id m75csp425571lfb;
Sat, 19 Mar 2016 07:14:33 -0700 (PDT)
Received: from mail-oi0-x232.google.com (mail-oi0-x232.google.com. [2607:f8b0:4003:c06::232]) by mx.google.com with ESMTPS id jp4si11178783oeb.93.2016.03.19.07.14.33 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sat, 19 Mar 2016 07:14:33 -0700 (PDT)
X-Received: by 10.202.217.136 with SMTP id q130mr12544902oig.127.1458396873300;
Sat, 19 Mar 2016 07:14:33 -0700 (PDT)
Return-Path:
References: <5210233602194770680@unknownmsgid>
In-Reply-To: <5210233602194770680@unknownmsgid>
Date: Sat, 19 Mar 2016 10:14:31 -0400
Message-ID: <474637145924208579@unknownmsgid>
CC: John Podesta

Hi- yes I will call John right away and work on new passwords. He will need to use my two step verification codes to sign in.

Milia Fisher

(858) 395-1741

On Mar 19, 2016, at 10:07 AM, Sara Latham <slatham@hillaryclinton.com> wrote:

The gmail one is REAL

Milia, can you change - does JDP have the 2 step verification or do we need to do with him on the phone? Don't want to lock him out of his in box!

Sent from my iPhone

Begin forwarded message:

From: Charles Delavan <cdelavan@hillaryclinton.com>
Date: March 19, 2016 at 9:54:05 AM EDT
To: Sara Latham <slatham@hillaryclinton.com>, Shane Hable <shable@hillaryclinton.com>
Subject: Re: Sоmeоne has your passwоrd

Sara,

This is a legitimate email. John needs to change his password immediately, and ensure that two-factor authentication is turned on his account.

He can go to this link: https://myaccount.google.com/security to do both. It is absolutely imperative that this is done ASAP.

If you or he has any questions, please reach out to me at 410.562.9762

On Sat, Mar 19, 2016 at 9:29 AM, Sara Latham <slatham@hillaryclinton.com> wrote:

Sent from my iPhone

Begin forwarded message:

From: Google <no-reply@accounts.googlemail.com>
Date: March 19, 2016 at 4:34:30 AM EDT
To: john.podesta@gmail.com
Subject: Sоmeоne has your passwоrd

Sоmeоne has your passwоrd

Hi John

Someone just used your password to try to sign in to your Google Account john.podesta@gmail.com.

Details:

Saturday, 19 March, 8:34:30 UTC
IP Address: 134.249.139.239
Location: Ukraine

Google stopped this sign-in attempt. You should change your password immediately.

CHANGE PASSWORD

Best,
The Gmail Team
You received this mandatory email service announcement to update you about important changes to your Google product or account.

--
-Charles Delavan
HFA Help Desk

The HFA Operations Team is here to support you. Let us know how we’re doing by filling out a brief survey.

warcraft_1

source: https://blog.malwarebytes.com/cybercrime/2017/03/world-of-warcraft-phish-lures-victims-with-free-pet/

Unavailable, see source.

berkeley_1

source: https://security.berkeley.edu/news/phishing-example-message-human-resources

From: "HR@berkeley.edu(link sends e-mail)"
Subject: Message from human resources
Date: April 13, 2017 at 9:29:54 PM PDT
To: XXXXX@berkeley.edu

Dear XXXXX@berkeley.edu

An information document has been sent to you by the Human Resources Department.

Click here to Login to view the document. Thank you!

Berkeley University Of California HR Department
© 2017 The Regents of the University of California. All rights reserved.
-----------------------------------------------------------------------------------------------------------------------------------------------------------
CONFIDENTIALITY NOTICE: This email and any attachments may contain confidential information that is protected by law and is for the sole use of the individuals or entities to which it is addressed. If you are not the intended recipient, please destroying all copies of the communication and attachments. Further use, disclosure, copying, distribution of, or reliance upon the contents of this email and attachments is strictly prohibited.

berkeley_2

source: https://security.berkeley.edu/news/phishing-example-your-dropbox-file

From: "Sass, Bradley"
Subject: Your Dropbox File
Date: Mon, 30 Jan 2017

Dropbox logo

Hello,

You just received a file through Dropbox Share Application.

Please click below and log in to view file.

View file

Every time a friend installs Dropbox, we'll give both of you 1 GB of

space for free! Need even more space? Upgrade your Dropbox and get 1 TB

(1,000 GB) of space.

Happy Dropboxing.

- The Dropbox Team

berkeley_3

source: https://security.berkeley.edu/news/phishing-example-itunes-access-disabled

Subject: Your access has been disabled
From: "App.Support"
Date: 2/21/2016 4:33 PM
To: removed@berkeley.edu

Dear User

Your Itunes-ID has been disabled .
You've place your account under the risk of termination by not keeping the correct informations .
Please verify your account as soon as possible.
Ready to check ?
Click here to get back your account.

Sincerely,
Inc.AppIe

phishing email corpus

amazon_1

source: Enron Spam Cache

Email Header Information

amazon_2

source: Enron Spam Cache

Email Header Information

amazon_3

source: Enron Spam Cache

Email Header Information

amazon_4

source: Enron Spam Cache

Email Header Information

amazon_5

source: Enron Spam Cache

Email Header Information

Amazon

chase_1

source: Enron Spam Cache

Email Header Information

chase_2

source: Enron Spam Cache

Email Header Information

chase_3

source: Enron Spam Cache

Email Header Information

chase_4

source: Enron Spam Cache

Email Header Information

chase_5

source: Enron Spam Cache

Email Header Information

eBay_1

source: Enron Spam Cache

Email Header Information

eBay_2

source: Enron Spam Cache

Email Header Information

eBay_3

source: Enron Spam Cache

Email Header Information

Question about Item - Respond Now

eBay_4

source: Enron Spam Cache

Email Header Information

eBay_5

source: Enron Spam Cache

Email Header Information

paypal_1

source: Enron Spam Cache

Email Header Information

paypal_2

source: Enron Spam Cache

Email Header Information

paypal_3

source: Enron Spam Cache

Email Header Information

paypal_4

source: Enron Spam Cache

Email Header Information

paypal_5

source: Enron Spam Cache

Email Header Information

krebs_1

source: https://krebsonsecurity.com/2019/05/legal-threats-make-powerful-phishing-lures/

Email Header Information

personal_1

source: personal email (forwarded to me)

Email Header Information

personal_2

source: personal email

Email Header Information

personal_3

source: personal email

Email Header Information

personal_4

source: personal email

Email Header Information

personal_5

source: personal email