PHISHING ALERT! PHISHING scam email from TD Ameritrade postmaster@beachcomberhottubs.com www.scarved.mudasisters.com

DO NOT CLICK ON THE LINK IN THIS EMAIL and DO NOT LOG-IN TO THE WEBSITE THE LINK TAKES YOU TO!  This email IS NOT FROM TD AMERITRADE and the link DOES NOT TAKE YOU TO THE TD AMERITRADE WEBSITE!  The link takes you to https://scarved.mudasisters.com/wp-includes/rest-api/tdam.htm and is PHISHING for your information!

Originating IP: 140.238.182.208
Originating ISP: Oracle Corporation
City: Sao Paulo
Country of Origin: Brazil

from: TD Ameritrade <postmaster@beachcomberhottubs.com> 
to: 
date: Sep 24, 2019, 5:42 AM
subject: Important Information About Your Account
signed-by: beachcomberhottubs.com

TD AmeriTrade
 
SECURITY MESSAGE  

Dear Valued Client,

Some information on your account appears to be outdated or incorrect

 •  We have put a temporary hold on your account activities till you logon and verify your correct contact information.

Kindly logon and verify your personal and account information by clicking on the link below

CLICK HERE TO CONFIRM

Thank you
TD Ameritrade Security Team

TD Ameritrade  | PRIVACY STATEMENT  |  BRANCH LOCATOR  | Follow us:
  
footer bar

This is an automated email and we won't receive your message if you reply. To contact us, please log in to your account and go to the Message Center to write us.

TD Ameritrade understands the importance of protecting your privacy. From time to time we need to send you notifications like this one to inform you of important information regarding your account. If you've elected to opt out of receiving promotional marketing communications from us, containing news about new and valuable services, we will continue to honor your request.

TD Ameritrade, Inc., member FINRA / SIPC. TD Ameritrade is a trademark jointly owned by TD Ameritrade IP Company, Inc. and The Toronto-Dominion Bank. Copyright 2016 TD Ameritrade IP Company, Inc. All rights reserved. Used with permission.

Distributed by: TD Ameritrade, Inc., 200 South 108th Avenue, Omaha, NE 68154-2631.

CNS_MESSAGE_ID = 453800319

From the HTML of the email:

<A href="https://scarved.mudasisters.com/wp-includes/rest-api/tdam.htm">CLICK HERE TO CONFIRM<BR></A>

PHISHING ALERT! PHISHING scam email from Navy Federal Credit Union postmaster@beachcomberhottubs.com www.skipic.net

DO NOT CLICK ON THE LINK IN THIS EMAIL and DO NOT LOG-IN TO THE WEBSITE THE LINK TAKES YOU TO!  This email IS NOT FROM THE NAVY FEDERAL CREDIT UNION and the link DOES NOT TAKE YOU TO THE NAVY FEDERAL CEREDIT UNION WEBSITE!  The link takes you to http://www.skipic.net/wp-content/plugins/grtpvlq/navy.htm and is PHISHING for your information!

Originating IP: 140.238.182.208
Originating ISP: Oracle Corporation
City: Sao Paulo
Country of Origin: Brazil

from: Navy Federal <postmaster@beachcomberhottubs.com> 
to: 
date: Sep 19, 2019, 5:49 PM
subject: Important Information About Your Account
signed-by: beachcomberhottubs.com

Navy Federal Credit Union   Navy Federal Security Zone

Dear Member.

This is to notify you that your Navy Federal account requires a full profile update.

Please log into your Online account immediately to review and verify recent activity on your account.

Upon logging in, you will be asked to verify some of your informations.

Log in to access your account

Get Started


Thank you,
Navy Online Team 

Products & Services • FAQs • Mobile Banking • Contact Us

Please do not reply to this email. For contact information, or if you have any questions about this email, please Contact Us or call us at 1-888-842-6328.
 
iPad and iPhone are trademarks of Apple, Inc., registered in the U.S. and other countries. Android is a trademark of Google, Inc. Kindle is a trademark of Amazon.com, Inc. or its affiliates.
 
  Equal Housing Lender | APY=Annual Percentage Yield | APR=Annual Percentage Rate. © 2019 Navy Federal Credit Union. All rights reserved. Message and data rates may apply. Terms and Conditions are available. NFCU 32766 (1-15) Federally insured by NCUA.

Privacy Policy Follow Us:      

From the HTML of the email:

<A style="FONT-SIZE: 13px; TEXT-DECORATION: none; FONT-FAMILY: sans-serif; WIDTH: 160px; BACKGROUND-IMAGE: url(http://contentz.mkt030.com/lp/480/167728/orange-button.jpg); FONT-WEIGHT: bold; COLOR: #ffffff; TEXT-ALIGN: center; DISPLAY: inline-block; LINE-HEIGHT: 35px; BACKGROUND-COLOR: #f18723; -webkit-text-size-adjust: none; mso-hide: all" href="http://www.skipic.net/wp-content/plugins/grtpvlq/navy.htm" name=aolmail_CTA_getstarted rel="noopener noreferrer" target_blank>Get Started</A>

PHISHING ALERT! PHISHING scam email from Mail Admin Team support@security.com www.000webhostapp.com

DO NOT CLICK ON THE LINK IN THIS EMAIL AND DO NOT ENTER ANY LOG-IN INFORMATION ON THE WEBPAGE IT TAKES YOU TO!  This email is not from your email provider and the link does not take you to your email.  The link takes you to https://unmelted-convulsion.000webhostapp.com/uvbss.php and is PHISHING for your information!

Originating IP: 192.99.175.72
Originating ISP: Ovh Sas
City: Montréal
Country of Origin: Canada

from: gmail.com <support@security.com> 
to: 
date: Aug 18, 2019, 12:03 PM
subject: pending messages

Email Administrator

Error Pending Messages
 
Action Required

Dear ,

You have 7 new pending messages in our email server as of August 18th, 2019 7:46  (UTC).

To retrieve your messages and upgrade your e-mail security simply click here.

Best Regards,

Mail Admin Team
Message is auto-generated from E-mail security server 

PHISHING ALERT! PHISHING scam email from Wells Fargo Online deliverypreference@west.ca www.thuoctiemthammy.com

DO NOT CLICK ON THE LINK IN THIS EMAIL AND DO NOT ENTER YOUR USERNAME AND PASSWORD!  This email IS NOT FROM WELLS FARGO and the link DOES NOT TAKE YOU TO THE WELLS FARGO WEBSITE!  The link takes you to http://thuoctiemthammy.com/cache/wts.php and is PHISHING for your information!

Originating IP: 14.2.110.7
Originating ISP: Tpg Telecom Limited
City: Prospect
Country of Origin: Australia

from: Wells Fargo Online <deliverypreference@west.ca> 
to: 
date: May 14, 2019, 9:26 PM
subject: Wells Fargo changes to your delivery preferences

Wells Fargo wellsfargo.com

Your delivery preferences have changed

Your Wells Fargo delivery preferences were updated for the following accounts:

Account Account number or nickname Document type Updated delivery preference
Account XXXXXXXXXXXXX Notices Mail
Account XXXXXXXXXXXXX Notices Mail

You're receiving this notification for one or more of the following reasons: •You changed your delivery preferences.
•We changed your delivery preferences for selected statements and notices to Online.
•Your account is no longer linked to Online Banking.
•We were unable to deliver your documents or notifications online because your primary email address is invalid. Please update your email address.

You can change your delivery preferences at any time. Sign on to Statements and Documents and select Manage Delivery Preferences.

If you have questions, Wells Fargo Online Customer Service is available 24 hours a day, 7 days a week at 1-800-916-4332 or by secure email.

wellsfargo.com | Fraud Information Center

Please do not reply to this automated email. Sign on to send a secure email.

ONL-CSDO

b85d7cd9-801d-4df1-b683- 1e087b5a5e29

PHISHING ALERT! PHISHING scam email from Outlook Team e-Mail Security support@mail-server.com www.hamblenmachine.com

DO NOT CLICK ON THE LINK IN THIS EMAIL and DO NOT LOG-IN TO THE WEBSITE IT TAKES YOU TO!  This email is not from Outlook and the link does not take you to Outlook.  The link takes you to http://www.hamblenmachine.com/wp-includes/walker/e-Mail/index.html and is PHISHING for your information!

Originating IP: 111.118.178.249
Originating ISP: Cyfuture India Pvt. Ltd.
City: n/a
Country of Origin: India

from: e-Mail Security <support@mail-server.com> via discoverytourindia.com 
to: 
date: Mar 11, 2019, 8:38 AM
subject: e-Mail Notification
signed-by: discoverytourindia.com


Email Security Alert
for - Account User: 

This is to notify you that someone from an unrecognized location tried logging into your email  few minutes ago.

For your account security, we strongly recommend that you verify your account now. Click on your email address below for a quick verification.

After completing verification extra security features will be activated in your email settings and your account will be strongly protected.

Source: Outlook Team 

From the HTML of the email:
<a
href=3D"http://www.hamblenmachine.com/wp-includes/walker/e-Mail/index.html?=
email=3D%0%">
 </a>

PHISHING ALERT! PHISHING scam email from Web mail Support Team andreabussani@tin.it executive5252@gmail.com

DO NOT REPLY TO THIS EMAIL!  This email is not from your email service provider.  The email is from Benin and is PHISHING for your email log-in and password!

Originating IP: 197.234.221.180
Originating ISP: Spacetel
City: Cotonou
Country of Origin: Benin

from: Web mail Support Team <andreabussani@tin.it> 
reply-to: executive5252@gmail.com
to: 
date: Oct 6, 2018, 2:16 AM
subject: Hello Good Friend,
mailed-by: tin.it

Dear E-mail-Account Owner,

This message comes from your (EMAIL SERVICE PROVIDER) messaging admin
center to All E-mail-Account owners. We are currently improving our
Database and E-mail Account Center and creating more certainty for our
Legal Service clients At this moment we are upgrading our data base so
that there will be more space for new customers and increasing the surf
on the Internet. To prevent your Email address not to be DE-activated
and to enable it upgraded, Because we understand that last time that
your email was compromised because it was associated with lack of
upgrade-able in order to secure your email from losing again just
follow the instruction instructed bellow

you need to assist us by sending the information below to enable us
upgrade it, so that your email account status will flect in our
database as a very active, useful and legal email account.

Do send to us the below information to enable us upgrade your Account,
else your email account will lost in a
short time.

Email text question: ________
email text answer: _______
First Name: _____________
Last Name: _____________
Date of Birth: ____________
E-mail Address: ___________
E-mail pass-word: __________
Phone Number:_______________
Alternative Email:
Alternative: pass-word: 
Country or territory:

WARNING!!! E-MAIL OWNERS who refuses to upgrade his or her account
within Five days after notification of this update will permanently be
deleted from our data base and can also lead to malfunctioning of the
client or user's account and we will not be responsible for loosing
our account.

Thanks for your understanding as it is geared towards serving you
better.

Web mail Support Team

Warning Code: ID+

PHISHING ALERT! PHISHING scam email from American Express Online Team 365mc@smith.edu www.breastenhancementnaturally.com

DO NOT CLICK ON THE LINK IN THIS EMAIL!  This email IS NOT FROM AMERICAN EXPRESS and the link DOES NOT TAKE YOU TO THE AMERICAN EXPRESS WEBSITE!  The link takes you to http://breastenhancementnaturally.com//wp-content/themes/gaukingo/amex/redirect.htm and is PHISHING for your information!

Originating IP: 68.99.120.137
Originating ISP: Cox Communications Inc.
City: Santa Barbara
Country of Origin: United States

from: American Express <365mc@smith.edu> 
to: Recipients <365mc@smith.edu>
date: Aug 23, 2018, 1:20 PM
subject: Important Review Required

Dear Customer
We've noticed a sign-in attempt from an usual device
.
This may be due to IP LOCATION or browsers

we strongly recommended to verify your profile immediately to ensure safety of your account
Click Here To Confirm .

Thanks for being a loyal customer
American Express Online Team

From the HTML of the email:

<a href="http://http://breastenhancementnaturally.com//wp-content/themes/gaukingo/amex/redirect.htm"> Click Here To Confirm </a>

PHISHING ALERT! PHISHING scam email from Facebook Team zsantos@aasp.org.br www.123formbuilder.com

DO NOT CLICK ON THE LINK IN THIS EMAIL and DO NOT ENTER ANY LOG-IN IN FORMATION ON THE WEBFORM!  This email is not from Facebook and the link does not take you to your Facebook account.  The link takes you to a form built at http://www.123formbuilder.com/form-3998012/Facebook and is PHISHING for your Facebook log-in and password!

Originating IP: 200.219.212.90
Originating ISP: Equinix Brasil Sp
City: n/a
Country of Origin: Brazil

from: Facebook Team <zsantos@aasp.org.br> 
to: 
date: Sat, Jul 28, 2018 at 1:48 AM
subject: Important Alert :

Dear  Facebook User,

This is to inform you that we are currently updating our  server to provide you with the best, fastest, most secure email service most reliable. We will be closing our previous server and you may not be able to access your email,
to avoid this disconnect you are required to click the link below and log into your account again to enable the newly improved server to identify your account .

Click the link below to update your account;

http://www.123formbuilder.com/form-3998012/Facebook

Failure to do so may result in the loss of your  account and can be permanently disabled.

Thank you,
The Facebook Team.

PHISHING ALERT! PHISHING scam email from Facebook Team claudiocardoso@aasp.org.br www.123formbuilder.com

DO NOT CLICK ON THE LINK IN THIS EMAIL and DO NOT ENTER ANY LOG-IN IN FORMATION ON THE WEBFORM!  This email is not from Facebook and the link does not take you to your Facebook account.  The link takes you to a form built at http://www.123formbuilder.com/form-3995742/Facebook-Developers and is PHISHING for your Facebook log-in and password!

Originating IP: 200.219.212.90
Originating ISP: Equinix Brasil Sp
City: n/a
Country of Origin: Brazil

from: Facebook Team <claudiocardoso@aasp.org.br> 
to: 
date: Fri, Jul 27, 2018 at 10:26 AM
subject: Critical Alert :

Dear  Facebook User,

It looks like someone tried to make a change to your account on July 27 at 06:13 using Chrome for Windows 7 . Your account is secure; we just wanted to make sure it was really you who was connecting from a new place.

If you think it was not you, click on the below link to secure ur account

http://www.123formbuilder.com/form-3995742/Facebook-Developers

so we can walk you through a few steps to keep your account secure.

Thank you,
The Facebook Team

PHISHING ALERT! PHISHING scam email from Apple support+noreply-65665+hey@email.info.chatwomens.online.com www.mumineenapp.com

DO NOT CLICK ON THE LINK IN THIS EMAIL!  This email is not from Apple and the link does not take you to the Apple website.  The link takes you to http://mumineenapp.com/static/js/APL_HF/ and is PHISHING for your information!

Originating IP: 46.16.60.19
Originating ISP: 10dencehispahard, S.l.
City: n/a
Country of Origin: Spain

from: ApplelD <support+noreply-65665+hey@email.info.chatwomens.online.com> via mohajournan.es 
to: 
date: Sat, May 12, 2018 at 11:55 AM
subject: Please Review Your Recent Activity !
mailed-by: mohajournan.es

Dear Client

We've noticed that some of your account informations appears to be missing or incorrect We need to verify your account informations in order to continue using your Apple ID, Please Verify your account informations by clicking on the link below

Confirm My Account

Thanks for choosing Apple,
Apple Team

© 2018 Apple. All rights reserved.

From the HTML of the email:

<a href="http://mumineenapp.com/static/js/APL_HF/" target="_blank"><span style="text-align:center;font-size:11px;font-family:arial,sans-serif;color:white;font-weight:bold;border-color:#CCCCCC;background-color:#333333;text-decoration:none;display:inline-block;min-height:27px;padding-left:8px;padding-right:8px;line-height:27px;border-radius:2px;border-width:1px;"> <span style="color:white;"> Confirm My Account</span></span></a>

PHISHING ALERT! PHISHING scam email from Match emailteam@match.com www.guceoague.ga

DO NOT CLICK ON THE LINK IN THIS EMAIL!  This email is not from Match.com and the link does not take you to the Match.com website!  The link takes you to http://guceoague.ga/match/ and is PHISHING for your information!

Originating IP: 219.232.51.216
Originating ISP: China Networks Inter-exchange
City: Beijing
Country of Origin: China

from: Match.com <emailteam@match.com> 
reply-to: no-reply@match.com
to: 
date: Thu, May 3, 2018 at 7:04 PM
subject: Someone Just Emialed You

someone just emailed you

You caught thier attention and now they expressed interest in you... Could he be the one?

You have 2 unread messages. Connect Today!

From the HTML of the email:
<A href="http://guceoague.ga/match/">Connect Today!</A>

PHISHING ALERT! PHISHING scam email from USPS pknight@montana.net www.kaerlen.ga

DO NOT CLICK ON THE LINK IN THIS EMAIL!  This email is not from USPS and the link does not take you to the USPS website.  The link takes you to https://kaerlen.ga/index.php and is PHISHING for your information!

Originating IP: 195.201.133.30
Originating ISP: Hetzner Online Gmbh
City: n/a
Country of Origin: Germany

from: USPS <pknight@montana.net> 
to: 
date: Fri, Apr 27, 2018 at 5:44 PM
subject: Your Package!!!
mailed-by: montana.net

Friday, April 27, 2018

HI, We have updated status of your USPS Delivery
USPS8112457776529 as signature could not be collected at
time of delivery. View attached Shipping label for more
information. Details can also be viewed by logging in your
USPS Delivery Manager profile.
Shipment can also be picked up at your nearest USPS
location between 8:00AM - 6:00PM (CAT) a printed copy of
shipping label and a valid government issued identification
card will be required.

Delivery Shipping Label (e-copy): USPS8112457776529

From the HTML of the email:

<a href="https://kaerlen.ga/index.php">Delivery Shipping Label (e-copy): USPS8112457776529</a>

PHISHING ALERT! PHISHING scam email from Paypal support-inc@help.com www.vindemar-gadgets.ch

DO NOT CLICK ON THE LINK IN THIS EMAIL AND DO NOT LOG-IN TO PAYPAL USING THIS LINK!  This email IS NOT FROM PAYPAL and the link DOES NOT TAKE YOU TO THE PAYPAL WEBSITE!  The link takes you to http://www.vindemar-gadgets.ch/images/banners/shop.html and is PHISHING for your Paypal information!

Originating IP: 37.59.145.28
Originating ISP: Ovh Sas
City: n/a
Country of Origin: France

from: Service Support <support-inc@help.com> via www114.masbytes.es 
reply-to: support-inc@help.com
to: 
date: Sat, Apr 14, 2018 at 12:55 PM
subject: [PayPal] : Your Account Limited - Update Your Information Account !!
mailed-by: www114.masbytes.es

This message is from a trusted sender.

ID: #R56L6D9R406MH

PayPal

Your account has been limited.

Dear customer.

We"ve limited your access and the reason is the last login attemp,we"ve limited your account for security reasons .

To fix this problem you have to login and update your personal informations by following this link .

Update Account

Copyrights Reserved 1999 - 2018

Help & Contact - Fees - Security -Features

From the HTML of the email:

<a class="mcnButton " href="http://www.vindemar-gadgets.ch/images/banners/shop.html" style="font-weight: bold; line-height: 100%; text-decoration: none; color: rgb(255, 255, 255);" target="_blank" title=" Confirm your Account">Update Account</a>

PHISHING ALERT! PHISHING scam email from Mail Service mailing@bt7.at www.mr-labor.com

DO NOT CLICK ON THE LINK IN THIS EMAIL AND DO NOT ENTER YOUR EMAIL LOG-IN AND PASSWORD! This email is not from your email service provider and the link does not take you to your email service provider.  The link takes you to http://mr-labor.com/modules/erroreng/erroreng/erroreng/erroreng/start.php and is PHISHING for your email log-in!

Originating IP: 13.210.246.32
Originating ISP: Amazon.com, Inc.
City: Sydney
Country of Origin: Australia

from: Mail Service <mailing@bt7.at> 
to: 
date: Mon, Mar 5, 2018 at 10:33 AM
subject: Verify Your Emails

You have (5) incoming e-mails pending
Verify your infomation to deliver your e-mails.

Click Here To Verify Your Emails

Sincerely,
Mail Service Team.

All Rights Reserved.

From the HTML of the email:
<A href="http://mr-labor.com/modules/erroreng/erroreng/erroreng/erroreng/start.php" target=_blank data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=http://saec.by/language/erroreng/erroreng/erroreng/erroreng/start.php&amp;source=gmail&amp;ust=1520253647032000&amp;usg=AFQjCNFykmnpDvWDLdnRV7bjOH6VG6jpSw">Click Here To Verify Your Emails</A>

PHISHING ALERT! PHISHING scam email from NSW Trade Portal team do-not-reply@ncs.gov.ng www.verify.kentuckybiz.us

DO NOT OPEN THE ATTACHMENT TO THIS EMAIL AND DO NOT ENTER YOUR EMAIL ADDRESS OR PASSWORD!  The attachment in this email is PHISHING for your email log-in and is posting it to https://verify.kentuckybiz.us/doc.php

Originating IP: 70.39.115.201
Originating ISP: Sharktech
City: Las Vegas
Country of Origin: United States

from: do-not-reply@ncs.gov.ngm <do-not-reply@ncs.gov.ng> 
reply-to: do-not-reply@ncs.gov
to: Recipients <do-not-reply@ncs.gov.ng>
date: Thu, Feb 15, 2018 at 10:06 AM
subject: PAAR CN201708194/001 with Consignment number 89839 is issued

Dear User,

PAAR CN20170819482/001 with Consignment number 898399 (Form number: BA21420170011805, ADB: 214) has been issued
Kindly download the attached Pre-Arrival Assessment report (PAAR)

Should you experience issues with the NCS electronic PAAR Forms, please contact the support at supportnow@trade.gov

NSW Trade Portal team
Information in this email is intended solely for the use of the individual(s) to whom it is addressed or otherwise directed.
The recipient should check this email for the presence of viruses.
The Government accepts no liability for any damage caused by any virus transmitted by this email.
If you are not the addressee or have received this message in error, please delete it as well as all copies from your system

attachment; filename="PAAR.html"

<form name="myForm" action="https://verify.kentuckybiz.us/doc.php" onsubmit="return validateForm()" method="post">

PHISHING ALERT! PHISHING scam email from UPS Quantum View upshippinginfo@vps.com www.upshipmentlabel.faqserv.com

DO NOT CLICK ON THE LINK IN THIS EMAIL, DO NOT DOWNLOAND THE FILE and DO NOT ENTER ANY LOG-IN INFORMATION!  This email IS NOT FROM UPS! The link takes you to http://upshipmentlabel.faqserv.com/ups.htm and is PHISHING for your information!

Originating IP: 78.130.176.186
Originating ISP: Cooolbox Ad
City: Plovdiv
Country of Origin: Bulgaria

from: UPS Quantum View <upshippinginfo@vps.com> 
to: 
date: Wed, Feb 7, 2018 at 9:45 AM
subject: UPS DELIVERY UPDATE

Hi, This message is sent to you at the request of your shipper, To notify you that a package has been shipped to you. The physical package was tendered to UPS and has been shipped. To verify the actual transit status of your shipment, Click below to view your shipping label and tracking link for delivery time

Shipped:  Monday 2/5/2018

Shipping Label

UPS 
Change Delivery
Manage Preferences
View Delivery Planner

This message was sent to you at the request of the shipper to notify you that the shipment information below has been transmitted to UPS. The physical package may or may not have actually been tendered to UPS for shipment. To verify the actual transit status of your shipment, click on the tracking link below.

Shipment Details

Tracking Number:
1Z099555M45346543

UPS Service: UPS 2nd Day Air®
Number of Packages: 1
Package Weight: 6.5 LBS
Scheduled Delivery: Wednesday 2/7/2018
Reference Number 1: 4321372

Download the UPS mobile app

© 2017 United Parcel Service of Australia, Inc. UPS, the UPS brandmark, and the color brown are trademarks of United Parcel Service of Amercia, Inc. All rights reserved.

All trademarks, trade names, or service marks that appear in connection with UPS's services are the property of their respective owners.

Please do not reply directly to this e-mail. UPS will not receive any reply message.
For more information on UPS's privacy practices, refer to the UPS Privacy Notice.
For questions or comments, visit Contact UPS.

This communication contains proprietary information and may be confidential. If you are not the intended recipient, the reading, copying, disclosure or other use of the contents of this e-mail is strictly prohibited and you are instructed to please delete this e-mail immediately.

UPS Privacy Notice
Contact UPS 

CONFIDENTIALITY NOTICE: This e-mail and any attachments are confidential and may also be privileged. No waiver of any legal privilege or proprietary right is intended or shall be deemed to have occurred by the transmission of this e-mail or its contents or attachments to any person other than the originally intended recipient. If you are not an intended recipient of this e-mail, you are hereby notified that any unauthorized use, dissemination, storage or copying of this e-mail or the information contained in it or attached to it is strictly prohibited. If you have received this e-mail in error, please delete it and immediately notify the sender by telephone. Thank you.

From the HTML of the email:

<A class=m_-9198355861251395329fontLink style="FONT-SIZE: 15px; TEXT-DECORATION: none; COLOR: #363636; TEXT-ALIGN: center; DISPLAY: block; LETTER-SPACING: 0px; LINE-HEIGHT: 100%" href="http://upshipmentlabel.faqserv.com/ups.htm" target=_blank data-saferedirecturl="http://upshipmentlabel.faqserv.com">Shipping Label</A>

PHISHING scam email with possible MALWARE from Bank of America admin@nowmarketingglobal.co.uk 77.89.52.2

DO NOT CLICK ON THE LINK IN THIS EMAIL!This email IS NOT FROM BANK OF AMERICA!The link takes you to ftp://77.89.52.2/GRAFICA/signOnV2Screen.htm and is PHISHING for your banking information and could possibly infect your computer with MALWARE!

Originating IP: 202.147.252.7
Originating ISP: Bitnet Isp As
City: Jakarta
Country of Origin: Indonesia

from: Bank of America <admin@nowmarketingglobal.co.uk>
to:
date: Tue, Feb 6, 2018 at 4:21 AM
subject: Bank of America Alert: Your Online Access is Temporarily Locked


Please do not reply to this email. This email has been sent from an auto-notification system that cannot accept incoming email.

Bank of America(R)

Review and Verify your Account Details

Online ID Confirmation

We're letting you know that we detected several failed attempts to sign in to your Bank of America account on 06/02/2018. For your protection, we need you to review and verify your account details. Follow the link below to unlock your Online ID.

Click on this link to unlock your Online ID

Date and time:Feb. 06 / 04:00 AM-04:30 AM ET
Language preference:English

Note: After verifying your account details, we will take the necessary steps to protect your account from fraud.

1Mobile Banking requires enrollment through the Mobile Banking app, mobile website or Online Banking. View the Online Banking Service Agreement for more information. Data connection required. Wireless carrier fees may apply. The Mobile Banking app is available on iPad, iPhone, and Android devices.

If your appointment is with a Merrill Edge Financial Solutions Advisor, you should be aware that a Merrill Edge Financial Solutions Advisor can provide solutions that include FDIC insured deposit products with Bank of America and non-FDIC insured investment products from Merrill Lynch.

Investment products:

Are Not FDIC Insured Are Not Bank Guaranteed May Lose Value

Merrill Edge is the marketing name for two businesses: Merrill Edge Advisory Center, which offers team-based advice and guidance brokerage services; and a self-directed online investing platform. Both are made available through Merrill Lynch, Pierce, Fenner & Smith Incorporated (MLPF&S).

MLPF&S is a registered broker-dealer, Member SIPC and a wholly owned subsidiary of Bank of America Corporation.

Banking products are provided by Bank of America, N.A., member FDIC and a wholly owned subsidiary of Bank of America Corporation. Equal Housing Lender

Email Preferences
This is a service email from Bank of America. Please note that you may receive service email in accordance with your Bank of America service agreements, whether or not you elect to receive promotional email.

Privacy and Security
Keeping your financial information secure is one of our most important responsibilities. For an explanation of how we manage customer information, please read our Privacy Policy. You can also learn how Bank of America keeps your personal information secure and how you can help protect yourself.

Bank of America Email, 8th Floor-NC1-002-08-25, 101 South Tryon St., Charlotte, NC 28255-0001

© 2017 Bank of America Corporation. All rights reserved.

ARD4M5F1/6N9ACU

From the HTML of the email:

<a rel="nofollow" target="_blank" href="ftp://77.89.52.2/GRAFICA/signOnV2Screen.htm">unlock your Online ID</a>

PHISHING ALERT! PHISHING scam email from PayPal no-reply@server5.floathosting1.com www.bksvm.in

DO NOT CLICK ON THE LINK IN THIS EMAIL AND DO NOT ENTER YOUR PAYPAL LOG-IN AND PASSWORD ON THE WEBPAGE THE LINK TAKES YOU TO!  This email IS NOT FROM PAYPAL and the link DOES NOT TAKE YOU TO THE PAYPAL WEBSITE!  The link takes you to http://bksvm.in/includes/.international/Login-account/ and is PHISHING for your Paypal log-in!

Originating IP: 197.26.144.200
Originating ISP: Tunisia Backbone As
City: Ariana
Country of Origin: Tunisia

from: Account Support <no-reply@server5.floathosting1.com> 
to: 
date: Tue, Jan 2, 2018 at 11:51 PM
subject: Account Notification
mailed-by: server5.floathosting1.com

PayPal

Notification : janvier 02, 2018

Beloved , Costumer(s)
Your account acces will be denied because we've noticed significant changes in your activity. As your last payment method, we need to understand these update sbetter.

This account Iimitation will affect your ability to:
•Send or receive money
•Withdraw money


Also, you won't be able to:
•Remove any accounts
•Remove credit cards
•Close your account

What to do next ?

Please log in to your account and provide the requested information through the Resolution Center. If we don't receive the information before this deadline or we notice additional significant changes in your account activity, your account access may be further Iimited.

Reload my account

Thank you for your understanding and cooperation. If you need further assistance, please check our support case ID

Copyright © 2017 PayPol, Inc. All rights reserved. PayPol is located at 2211 N. First St., San Jose, CA 95131.I'm a new Text block ready for your content.

From the HTML of the email:

<a href="http://bksvm.in/includes/.international/Login-account/" target="_blank" style="display: block;text-decoration: none;-webkit-text-size-adjust: none;text-align: center;color: #ffffff; background-color: #3AAEE0; border-radius: 4px; -webkit-border-radius: 4px; -moz-border-radius: 4px; max-width: 298px; width: 178px;width: auto; border-top: 0px solid transparent; border-right: 0px solid transparent; border-bottom: 0px solid transparent; border-left: 0px solid transparent; padding-top: 5px; padding-right: 60px; padding-bottom: 5px; padding-left: 60px; font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif;mso-border-alt: none">
<span style="font-size:16px;line-height:32px;">Reload my account</span>
</a>

PHISHING ALERT! PHISHING scam email from contact@istaus.com www.santosa-hospital.com

DO NOT CLICK ON THE LINK IN THIS EMAIL!  This email is not from your email provider and the link does not take you to your email!  The link takes you to http://shbk.santosa-hospital.com/media/editors/tinymce/templates/.xrt/ and is PHISHING for your email log-in!

Originating IP: 222.180.210.250
Originating ISP: No.31,jin-rong Street
City: Chongqing
Country of Origin: China

from: Email Server <<contact@istaus.com> 
to: 
date: Sat, Dec 23, 2017 at 4:12 PM
subject: Warning: Urgent Alert!
mailed-by: istaus.com

Email Server

We received your instruction few hours ago to terminate your email account on our server! If you didn't request, please click below to stop action.

Click To Stop Now

NOTICE:

Failure to stop this action, your email account will be permanently disabled.
Thanks,
Account Service

Secure Email Server | Account settings for:

From the HTML of the email:
<A title="http://trafficcables.com/traff/hot.php Ctrl + Click or tap to Follow the Link" style="PADDING-RIGHT: 10px; DISPLAY: block; PADDING-LEFT: 10px; PADDING-BOTTOM: 0px; COLOR: rgb(255,255,255); LINE-HEIGHT: 25px; PADDING-TOP: 0px; FONT-FAMILY: Arial, Helvetica, sans-serif; text-decoration-line: none" href="http://shbk.santosa-hospital.com/media/editors/tinymce/templates/.xrt/" target=_blank><SPAN style="LINE-HEIGHT: normal"><SPAN style=3D"FONT-SIZE: small; LINE-HEIGHT: 18px"><FONT style="LINE-HEIGHT: normal"><B>Click To Stop Now</B></FONT></SPAN></SPAN></A>

PHISHING ALERT! PHISHING scam email from Paypal supportpaypel@live.net www.ourshopee.com

DO NOT CLICK ON THE LINK IN THIS EMAIL AND DO NOT ENTER YOUR PAYPAL LOG-IN ON THE WEBSITE THE LINK TAKES YOU TO!  This email IS NOT FROM PAYPAL and the link DOES NOT TAKE YOU TO THE PAYPAL WEBSITE!  The link takes you to http://ourshopee.com/payment/.assets/Login-account/ and is PHISHING for your PayPal log-in!

Originating IP: 197.1.172.74
Originating ISP: Topnet
City: n/a
Country of Origin: Tunisia

from: Live support <Supportpaypel@live.net> 
to: 
date: Sun, Dec 17, 2017 at 5:50 PM
subject: Attention: Your account status change !

PayPal

Notification : November 24, 2017

Beloved , Costumer(s)
Your account acces will be denied because we've noticed significant changes in your activity. As your last payment method, we need to understand these update sbetter.

This account Iimitation will affect your ability to:
•Send or receive money
•Withdraw money

Also, you won't be able to:
•Remove any accounts
•Remove credit cards
•Close your account

What to do next ?

Please log in to your account and provide the requested information through the Resolution Center. If we don't receive the information before this deadline or we notice additional significant changes in your account activity, your account access may be further Iimited.

Reload my account

Thank you for your understanding and cooperation. If you need further assistance, please check our support case ID

Copyright © 2017 PayPol, Inc. All rights reserved. PayPol is located at 2211 N. First St., San Jose, CA 95131.I'm a new Text block ready for your content.

From the HTML of the email:

<a href="http://ourshopee.com/payment/.assets/Login-account/" target="_blank" style="display: block;text-decoration: none;-webkit-text-size-adjust: none;text-align: center;color: #ffffff; background-color: #3AAEE0; border-radius: 4px; -webkit-border-radius: 4px; -moz-border-radius: 4px; max-width: 298px; width: 178px;width: auto; border-top: 0px solid transparent; border-right: 0px solid transparent; border-bottom: 0px solid transparent; border-left: 0px solid transparent; padding-top: 5px; padding-right: 60px; padding-bottom: 5px; padding-left: 60px; font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif;mso-border-alt: none">
<span style="font-size:16px;line-height:32px;">Reload my account</span>
</a>