by Terminator5
Sat Sep 24, 2011 1:00 pm
The source IP address is 92.46.161.116
Citizens Bank Phishing Email
Geo-Location Information
Country Kazakhstan
State/Region 05
City Astana
Begin Phishing Email:
Account Locked !
Dear Customer,
Due to the number of incorrect login attempts, your Citizens Bank Account has been locked for your security. This has been done to secure your accounts and to protect your private information in case the login attempts were not done by you..
At Citizens Bank we care about your security so, for your protection we are proactively notifying you of this activity.
If you did not trigger this lockout, follow this link to Log on to your Citizens Online Account :
Click here to unlock your account
Thank you for your prompt attention to this matter.
We apologize for any inconvenience.
Thank you for using Citizens Bank!
End Phishing Email
Link to phishing site http://meadowbrookautosales.com/citizen/index.htm
Full Header Info:
Received: from mailrelay.embarq.synacor.com (mailrelay.embarq.synacor.com [208.47.184.3])
by mtain-mh02.r1000.mx.aol.com (Internet Inbound) with ESMTP id 22122380001B9
for <xxxxxx>; Fri, 23 Sep 2011 05:19:31 -0400 (EDT)
X-BINDING:
X-Spam-Rating: None
X_CMAE_Category: 0,0 Undefined,Undefined
X-CNFS-Analysis: v=1.1 cv=Gy8KO/TIm49fW8xYQdWKCB9/VVgcuY2YFMKhDs4I7p4= c=1 sm=0 a=Dyoqhi_TatcA:10 a=GFB2hxj5TzIA:10 a=sj3mHPa0P_QA:10 a=Cfj4BQAnxiAA:10 a=jRKBoXw36PfSnbciXF2Itg==:17 a=oQTaqCz6AAAA:8 a=prYfrBgAAAAA:8 a=qI-sqkvjAAAA:8 a=coyT3-H3uFHmJXifXaoA:9 a=1v2rL_a-qhsLpf_WKr0A:7 a=Ft8UYL4EG9YA:10 a=tXsnliwV7b4A:10 a=NXw4npNCcOFFIaGm:21 a=lnBozPPh38rWKkAb:21 a=jRKBoXw36PfSnbciXF2Itg==:117
X-CM-Score: 0
X-Scanned-by: Cloudmark Authority Engine
Authentication-Results: smtp02.embarq.synacor.com smtp.user=jchrist961; auth=pass (LOGIN)
Received: from [92.46.161.116] ([92.46.161.116:1513] helo=User)
by mailrelay.embarq.synacor.com (envelope-from <[email protected]>)
(ecelerity 2.2.2.40 r(29895/29896)) with ESMTPA
id 09/6F-22662-00E4C7E4; Fri, 23 Sep 2011 05:19:28 -0400
From: "Citizens Online Banking ©"<[email protected]>
Message-ID: <[email protected]>
Subject: Your Citizens Bank Account Has Been Closed
Date: Fri, 23 Sep 2011 10:19:27 +0100
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
x-aol-global-disposition: S
X-AOL-REROUTE: YES
x-aol-sid: 3039ac1d60d64e7c4f235bf5
X-AOL-IP: 208.47.184.3
X-AOL-SPF: domain : citizensbankonline.com SPF : fail
Citizens Bank Phishing Email
Geo-Location Information
Country Kazakhstan
State/Region 05
City Astana
Begin Phishing Email:
Account Locked !
Dear Customer,
Due to the number of incorrect login attempts, your Citizens Bank Account has been locked for your security. This has been done to secure your accounts and to protect your private information in case the login attempts were not done by you..
At Citizens Bank we care about your security so, for your protection we are proactively notifying you of this activity.
If you did not trigger this lockout, follow this link to Log on to your Citizens Online Account :
Click here to unlock your account
Thank you for your prompt attention to this matter.
We apologize for any inconvenience.
Thank you for using Citizens Bank!
End Phishing Email
Link to phishing site http://meadowbrookautosales.com/citizen/index.htm
Full Header Info:
Received: from mailrelay.embarq.synacor.com (mailrelay.embarq.synacor.com [208.47.184.3])
by mtain-mh02.r1000.mx.aol.com (Internet Inbound) with ESMTP id 22122380001B9
for <xxxxxx>; Fri, 23 Sep 2011 05:19:31 -0400 (EDT)
X-BINDING:
X-Spam-Rating: None
X_CMAE_Category: 0,0 Undefined,Undefined
X-CNFS-Analysis: v=1.1 cv=Gy8KO/TIm49fW8xYQdWKCB9/VVgcuY2YFMKhDs4I7p4= c=1 sm=0 a=Dyoqhi_TatcA:10 a=GFB2hxj5TzIA:10 a=sj3mHPa0P_QA:10 a=Cfj4BQAnxiAA:10 a=jRKBoXw36PfSnbciXF2Itg==:17 a=oQTaqCz6AAAA:8 a=prYfrBgAAAAA:8 a=qI-sqkvjAAAA:8 a=coyT3-H3uFHmJXifXaoA:9 a=1v2rL_a-qhsLpf_WKr0A:7 a=Ft8UYL4EG9YA:10 a=tXsnliwV7b4A:10 a=NXw4npNCcOFFIaGm:21 a=lnBozPPh38rWKkAb:21 a=jRKBoXw36PfSnbciXF2Itg==:117
X-CM-Score: 0
X-Scanned-by: Cloudmark Authority Engine
Authentication-Results: smtp02.embarq.synacor.com smtp.user=jchrist961; auth=pass (LOGIN)
Received: from [92.46.161.116] ([92.46.161.116:1513] helo=User)
by mailrelay.embarq.synacor.com (envelope-from <[email protected]>)
(ecelerity 2.2.2.40 r(29895/29896)) with ESMTPA
id 09/6F-22662-00E4C7E4; Fri, 23 Sep 2011 05:19:28 -0400
From: "Citizens Online Banking ©"<[email protected]>
Message-ID: <[email protected]>
Subject: Your Citizens Bank Account Has Been Closed
Date: Fri, 23 Sep 2011 10:19:27 +0100
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
x-aol-global-disposition: S
X-AOL-REROUTE: YES
x-aol-sid: 3039ac1d60d64e7c4f235bf5
X-AOL-IP: 208.47.184.3
X-AOL-SPF: domain : citizensbankonline.com SPF : fail
Daniel 8 :25
