Odd phishy

[MrLinus]

Interesting phish. Apparently the phisher read the article where we seem ok with minor spelling errors. But I guess the term minor seems to be missing. It sources from Brazil and the link is interesting.

X-Apparently-To: msmittens@msmittens.com via xx.yy.zz.aa; Fri, 22 Apr 2005 11:28:36 -0700
Authentication-Results: msmittens@msmittens.com from=xx.yy.zz.aa; domainkeys=pass (ok)
X-Originating-IP: [xx.yy.zz.aa]
Return-Path: <hiqjlpzjzj@yahoo.com>
Received: from xx.yy.zz.aa (EHLO xx.yy.zz.aa) (xx.yy.zz.aa) by xx.yy.zz.aa with SMTP; Fri, 22 Apr 2005 11:28:36 -0700
Received: from web54705.mail.yahoo.com (web54705.mail.yahoo.com [68.142.225.203]) by mailhub.xx.yy.zz.aa (Postfix) with SMTP id 9A8052B6DCB for <msmittens@msmittens.com>; Fri, 22 Apr 2005 14:02:47 -0400 (EDT)
Received: (qmail 42518 invoked by uid 60001); 22 Apr 2005 17:37:58 -0000
Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; b=aa+yGzWS9Fr3QuTShDXjOKTMpyceh8m8so8gguel1VegNlQ2Lo4gaPrHgsQod7H9ne7p0FiVzH9AhZWrlS9Q/DMgJrtpUfn7jZe7AKtSE2VMoFUkgAwOUdSRNrYS7V9ZnAPPEoZH2UxzE+PtiJ9bY8ctwxq23i4hlWiPkjg6kzw= ;
Message-ID: <20050422173758.42516.qmail@web54705.mail.yahoo.com>
Received: from [200.204.170.119] by web54705.mail.yahoo.com via HTTP; Fri, 22 Apr 2005 10:37:58 PDT
Date: Fri, 22 Apr 2005 10:37:58 -0700 (PDT)
From: Send an Instant Message "Ba޴rcla޸ys" <hiqjlpzjzj@yahoo.com> Add to Address BookAdd to Address Book
Subject: B*alcra‬ys E*iam‬l Verific*noita‬
To: rogerl@msmisp.com
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-278744306-1114191478=:41382"
Content-Length: 1237
De*ra‬ B*lcra‬ays M*me‬ber,

T*sih‬ em*lia‬ was s*tne‬ by the B*cra‬lays se*vr‬er to ve*yfir‬ y*ruo‬ ema*li‬ add*sser‬. You m*tsu‬ com*etelp‬ t*ih‬s p*secor‬s by clic*ik‬ng
on the li*kn‬ bel*wo‬ and enter*gni‬ in the s*am‬ll wi*wodn‬ y*ruo‬ Barcl*sya‬ Mem*ihsreb‬p n*bmu‬er, pas*ocs‬de and me*om‬rable word.
T*sih‬ is d*eno‬ for y*uo‬r p*itcetor‬on - b*ace‬use s*emo‬ of our memb*re‬s no lon*reg‬ h*eva‬ a*secc‬s to the*ri‬ e*am‬il add*sser‬es and
we m*tsu‬ veri*yf‬ it. To veri*yf‬ y*ruo‬ em*lia‬ a*serdd‬s and ac*ssec‬ y*ruo‬ b*na‬k accou*tn‬ , c*il‬ck on the li*kn‬ b*ole‬w:

hxxp://www.barclays.com/?wiXBkrgZ0j5jPIpKc8Ndmdm9zs9SiPxltDviRbNgWADyu5A2im5jRyyMLp5T4C06n4p1x

This link is actually:

hxxp://go.msn.com/HML/1/4.asp?target=http://www.google.sc/url%3fq%3dhttp://%76i%09%7301b%09%35%%%.%%%%2544%09%%%2541%%%09.%%%2572%09%2555/

I haven't been able to find a unicode to ascii converter and I suspect that the version that was done was done incorrectly (no site is found).

[Tiger Shark]

T*sih‬ em*lia‬ was s*tne‬ by the B*cra‬lays se*vr‬er to ve*yfir‬ y*ruo‬ ema*li‬ add*sser‬. You m*tsu‬ com*etelp‬ t*ih‬s p*secor‬s by clic*ik‬ng
on the li*kn‬ bel*wo‬ and enter*gni‬ in the s*am‬ll wi*wodn‬ y*ruo‬ Barcl*sya‬ Mem*ihsreb‬p n*bmu‬er, pas*ocs‬de and me*om‬rable word.
T*sih‬ is d*eno‬ for y*uo‬r p*itcetor‬on - b*ace‬use s*emo‬ of our memb*re‬s no lon*reg‬ h*eva‬ a*secc‬s to the*ri‬ e*am‬il add*sser‬es and
we m*tsu‬ veri*yf‬ it. To veri*yf‬ y*ruo‬ em*lia‬ a*serdd‬s and acssec‬ y*ruo‬ b*n/a‬k accou*tn‬ , c*/il

OMG... New geekspeak... It'll get past all the spam filters..... ;)

[white_pawn]

They Just Keep Getting Better and Better.!

[karmine]

its kind of like porn bots on yahoo chat saying "hgewkrjhqw" thinking theyll get clicks to their gay fake webcams. theyd prolly have even better luck saying "this is spam, i want to steal your CC info and personal info so i can card me a new laptop so i can wardial. please click this link:)"

people these days

[Galdron]

Same old story, if you are stupid enough to give personal info, then you should not even have a bank acct.

Much like real (PH)fishing, for every cast, 100 trout will swim on by, yet once in a while one bites. Is this scam not apparant to everyone with an internet connection by now?

As far as I am concerned identity theft is a problem that is very well documented, the primary responsability lies with the "Cardholder",common sense.

Something that can not be taught.

:p

[M3mph15]

I got some thing like that too
Here it is

Sat, 9 Apr 2005 04:37:00 -0700 (PDT)
From: Send an Instant Message "Bar޿cl޼ays" <fysjlc9xhf@yahoo.com> Add to Address BookAdd to Address Book
Subject: B*alcra‬ys E*am‬il V*oitacifire‬n
To: Send an Instant Message matt_white71@yahoo.com
D*rae‬ Ba*lcr‬ays Me*bm‬er,

Th*si‬ em*lia‬ was s*tne‬ by the Barcla*sy‬ s*evre‬r to v*yfire‬ y*ruo‬ e*am‬il ad*erd‬ss. You m*tsu‬ compl*ete‬ t*sih‬ pr*eco‬ss by cli*kc‬ing
on the li*kn‬ b*le‬ow and en*gniret‬ in the sm*lla‬ wind*wo‬ y*ruo‬ B*ra‬clays M*srebme‬hip n*mu‬ber, p*ssa‬code and m*arome‬ble wo*dr‬.
T*ih‬s is do*en‬ for y*ruo‬ protecti*no‬ - b*ace‬use s*emo‬ of our me*rebm‬s no l*regno‬ h*va‬e a*secc‬s to t*rieh‬ e*iam‬l addr*sse‬es and
we m*tsu‬ veri*yf‬ it. To v*re‬*** y*ruo‬ e*iam‬l a*sserdd‬ and ac*sec‬s y*uo‬r b*kna‬ acco*nu‬t , cli*kc‬ on the l*ni‬k be*wol‬:

http://www.barclays.com/?cAU93wfP3iHWRbhCHkUoZUjEojN0cYlSNRnFpi8FtwPz3mbQiKfbLOlXYeaelUvzw6mQPbVXhmcXuu

[M3mph15]

And there are some other email's that i recieved here's two of them exactly in the same format
but i think it is odd that the from and to address are the same


"Barrister sundayudom udom" <sundayudom22@eresmas.com> Add to Address BookAdd to Address Book
To: sundayudom22@eresmas.com
Date: Tue, 19 Apr 2005 03:29:21 GMT
Subject: URGENT REPLY

ATTN Sir/Ma

It is obvious that this proposal will come to you as a suprise.
This is because we have not met before but i am inspired to sending you
this email by the huge fund transfer opportunity that will be of mutual
benefit to the two of us.

However, I am ,the sunday personal Attorney to the late Engr.Steve Moore
a national of Isle of Man in UK, who used to work with Shell Petroleum Development
Company(SPDC) in Nigeria. On the 21st of April 1996,my client,his wife And
their three children were involved in a car accident along Sagamu/Lagos
Express Road. Unfortunately they all lost their lives in the event of the
accident, Since then I have made several enquiries to several Embassies
to locate any of my clients extended relatives, this has also proved unsuccessful.

After these several unsuccessful attempts, I decided to tracehisrelatives
over the Internet to locate any member of his family but of no avail, hence
I contacted you.

I contacted you to assist in repartrating the money and property left behind
by my client,I can easily convince the bank with my legal practice that
you are the only surviving relation of my client. Otherwise the Estate he
left behind will be confiscated or declared unserviceable by the bank where
this huge deposits were lodged.Particularly, the Bank where the deceased
had an account valued at about $27million U.S dollars(twenty seven million
U.S.America dollars).Conseqently,The bank issued me a notice to provide
the next of kin or have the account confiscated within the next ten official
working days.

since i have been unsuccesfull in locating the the relatives for over
several years now.I seek your consent to present you as the next of kin
of the deceased,so that the proceeds of this account valued at $27million
U.Sdollarscan be paid to your account and then you and me can share the
money. 55%to me and 40% to you,while 5% should be for expenses or tax as
your government may require.

I have all necessary legal documents that can be used to back up any claim
we may make. All I require is your honest cooperation to enable us see this
deal through.

I guarantee that this will be executed under alegitimate arrangement that
will protect you from any breach of the law.Please get in touch with me
by my email to enable usdiscuss further.

Yours Faithfully,
Barrister Sunday ,


Here's the other one



Tue, 26 Apr 2005 15:17:29 +0100
From: "FEMI WILLIAM" <femi1@tiscali.dk> Add to Address BookAdd to Address Book
Subject: GET BACK TO ME
To: femi1@tiscali.dk


From:Femi William
E-mail:barristerfemi_090@yahoo.co.uk

I am Barr. Femi William, a personal lawyer to Mr. Herve Garboudes who
operate an account with a finance company who perished in a plane crash

[Swissair Flight 111] with his wife and two children and the whole
passengers
aboard on september 2nd 1998. See link below for more details.

http://cnnstudentnews.cnn.com/WORLD/9809/swissair.victims.list/

http://cnnstudentnews.cnn.com/WORLD/americas/9809/08/swissair.02/

http://cnnstudentnews.cnn.com/WORLD/americas/9809/05/swissair.transcripts/

Since the demise of this my client, I personally has watched with keen
interest
to see the next of kin but all has proved abortive as no one has come
to
claim his funds deposit of US$30m, [THIRTY MILLION UNITED STATES
DOLLARS]
which has been with (ECOBANK PLC) for a very long time.
On this note, I decided to seek for whom his name shall be used as the
Next
of kin as no one has come up to be the next of kin. And the banking
ethics
here does not allow such money to stay more than eight years, because
money
will be recalled to the bank treasury as unclaimed after this period.

In view of this I got your contact through a trade journal after
realizing
that you might stand as next of kin to the deceased.

And with respect to your personality, I will give you 40% of the total
sum
while 60% will be mine. Upon the receipt of your response, I will send
you
email on the next step we shall follow for us to actualize the transfer
of the funds to you for
our mutual benefit.

I will not Fail to bring to your notice that this business is hitch
free
and that you should not entertain any fear as all modalities for fund
transfer
can be finalized within 10 banking days.

When you receive this letter. Kindly send me an e-mail through
barristerfemi_090@yahoo.co.uk

signifying your Decission. You can contact me on my private Telephone
numbers +234-8032260442 for quick communication and adequate briefing.

Respectfully,

Femi William