Phishers impersonating LinkedIn

Dylan Ferguson via LinkedIn <lyde@shapieron.tkb.pl>

Email:

LinkedIn
Dylan Ferguson just sent you a message
Date: 3/25/2013
http:/ /www.linkedin.com/?action=viewProfile&uy=profile&message=bdab
View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings .
This email was intended for xxx.
2013, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA

Link: http:/ /hexaestudio.com.ar/recombination.html

Header:

Return-Path: <lyde@shapieron.tkb.pl>
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of lyde@shapieron.tkb.pl designates 89.161.65.231 as permitted sender) smtp.mail=lyde@shapieron.tkb.pl
Date: Mon, 25 Mar 2013 07:50:16 -0700
From: "Dylan Ferguson via LinkedIn" <lyde@shapieron.tkb.pl>
To: xxx
Subject: Dylan Ferguson sent you a direct message

Originating IP: 89.161.65.231
Originating ISP: As Telekomunikacja Podlasie Sp. Z O.o.
City: Bialystok
Country of Origin: Poland

Email:

LinkedIn
Blodwen Wallace sent you a message
Date: 3/26/2013
http:/ /www.linkedin.com/?action=viewProfile&ll=member&message=7644ec
View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings .
This email was intended for xxx.
2013, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA

Link: http:/ /dvsurvivorsjusticeact.org/stink.html

Header:

Return-Path: <djcasola@ip36.131.adsl.wplus.ru>
Authentication-Results: mx.google.com;
spf=pass (google.com: best guess record for domain of djcasola@ip36.131.adsl.wplus.ru designates 195.131.131.36 as permitted sender) smtp.mail=djcasola@ip36.131.adsl.wplus.ru
Date: Tue, 26 Mar 2013 08:17:12 -0500
From: "Blodwen Wallace via LinkedIn" <djcasola@ip36.131.adsl.wplus.ru>
To: xxx
Subject: Blodwen Wallace sent you a personal message

Originating IP: 195.131.131.36
Originating ISP: Webplus
City: Saint Petersburg
Country of Origin: Russian Federation

Email:

LinkedIn
Morwen Campbel sent you a message
Date: 3/31/2013
http:/ /www.linkedin.com/?action=viewMessage&qk=message&member=848e3f6
View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings .
This email was intended for xxx.
2013, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA

Link: http:/ /210.245.122.38/~donexco/commendation.html

Header:

Return-Path: <chaneytkru@cpanel24.uk2.net>
Received: from cpanel24.uk2.net (cpanel24.uk2.net. [77.92.82.201])
by mx.google.com with SMTP id w10si3883991qct.63.2013.03.31.06.21.53;
Sun, 31 Mar 2013 06:21:54 -0700 (PDT)
spf=pass (google.com: best guess record for domain of chaneytkru@cpanel24.uk2.net designates 77.92.82.201 as permitted sender) smtp.mail=chaneytkru@cpanel24.uk2.net
Date: Sun, 31 Mar 2013 14:21:54 -0300
From: "Morwen Campbel via LinkedIn" <chaneytkru@cpanel24.uk2.net>
To: xxx
Subject: Morwen Campbel just sent you a personal message

Originating IP: 77.92.82.201
Originating ISP: Uk2 Infrastructure
City: London
Country of Origin: United Kingdom

Dylan Lee sent you a personal message

Email:

LinkedIn
Dylan Lee has sent you a message
Date: 3/31/2013
http:/ /www.linkedin.com/?action=viewProfile&rx=member&member=95d7d
View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings .
This email was intended for xxx.
2013, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA

Link: http:/ /vegasaug.org/shylockian.html

Header:

Return-Path: <claude.richard@gic-web-bsd-021.genotec.ch>
Authentication-Results: mx.google.com;
spf=pass (google.com: best guess record for domain of claude.richard@gic-web-bsd-021.genotec.ch designates 82.195.224.121 as permitted sender) smtp.mail=claude.richard@gic-web-bsd-021.genotec.ch
Date: Sun, 31 Mar 2013 23:22:18 -0700
From: "Dylan Lee via LinkedIn" <claude.richard@gic-web-bsd-021.genotec.ch>

Originating IP: 82.195.224.121
Originating ISP: Genotec Ag
City: Basel
Country of Origin: Switzerland

Email:

LinkedIn
Connor Sullivan just sent you a message
Date: 4/01/2013
http:/ /www.linkedin.com/?action=viewProfile&pb=member&member=93b2e4b3
View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings .
This email was intended for xxx.
2013, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA

Link: http: //prccs.net/censure.html

Header:

Return-Path: <hed76n@server44.configcenter.info>
Received: from server44.configcenter.info (server44.configcenter.info. [109.75.111.134])
by mx.google.com with SMTP id i8si12896948pao.159.2013.04.01.01.05.48;
Mon, 01 Apr 2013 01:05:48 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of hed76n@server44.configcenter.info designates 109.75.111.134 as permitted sender) client-ip=109.75.111.134;
Authentication-Results: mx.google.com;
spf=pass (google.com: best guess record for domain of hed76n@server44.configcenter.info designates 109.75.111.134 as permitted sender) smtp.mail=hed76n@server44.configcenter.info
Date: Mon, 1 Apr 2013 10:05:48 -0300
From: "Connor Sullivan via LinkedIn" <hed76n@server44.configcenter.info>
To: xxx
Subject: Connor Sullivan just sent you a personal message

Originating IP: 109.75.111.134
Originating ISP: Kingstaff-hosting
City: Berlin
Country of Origin: Germany

Email:

LinkedIn
From: LinkedIn Support
Date: 5/13/2013
Subject: We've got a new message for you
http:/ /www.fahrschule-schirle.de/outstrip.html - phishing link
View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings .

This email was intended for xxx. Learn why we included this . © 2013, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA

Header:

Return-Path: <nejlup_1953@duathlondeselestat.com>
Received: from fw-n01.wc2.dfw1.stabletransit.com (fw-n01.wc2.dfw1.stabletransit.com. [174.143.11.196])
Mon, 13 May 2013 12:17:04 -0700 (PDT)
Received-SPF: neutral (google.com: 174.143.11.196 is neither permitted nor denied by best guess record for domain of nejlup_1953@duathlondeselestat.com) client-ip=174.143.11.196;

Originating IP: 174.143.11.196
Originating ISP: Mosso
City: San Antonio
Country of Origin: United States

The phising attempt is reported.

Email:

There is a new message for you

LinkedIn
From: LinkedIn Updates
Date: 5/12/2013
Subject: There is a new message for you

Phishing link: http:/ /tourselect.com.tr/crickets.html

View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings.

This email was intended for xxx. © 2013, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA

Header:

Return-Path: <abo@entlebucher-anzeiger.ch>
Received: from 127.0.0.1 (HELO localhost) (119.110.108.41)
by mta1102.mail.ne1.yahoo.com with SMTP; Sun, 12 May 2013 04:40:24 +0000
From: LinkedIn Updates <abo@entlebucher-anzeiger.ch>
Subject: There is a new message for you

Originating IP: 119.110.108.41
Originating ISP: Tm-vads Dc Hosting
Country of Origin: Malaysia

They uses a spoofed email address, belongs to a real company.

* 85.214.197.244 Strato Rechenzentrum, Berlin Oranienburg Germany

Return-Path: <mariamoser@t-online.de>
Received: from mailout12.t-online.de (mailout12.t-online.de. [194.25.134.22])
by mx.google.com with ESMTPS id gk10si2945656wjb.110.2015.08.25.21.46.50
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Tue, 25 Aug 2015 21:46:51 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of mariamoser@t-online.de
designates 194.25.134.22 as permitted sender) client-ip=194.25.134.22;
Authentication-Results: mx.google.com;
spf=pass (google.com: best guess record for domain of mariamoser@t-online.de d
esignates 194.25.134.22 as permitted sender) smtp.mailfrom=mariamoser@t-online.de
Received: from fwd03.aul.t-online.de (fwd03.aul.t-online.de [172.20.27.148])
by mailout12.t-online.de (Postfix) with SMTP id A5C883B73A0;
Wed, 26 Aug 2015 06:46:50 +0200 (CEST)
Received: from h2358992.stratoserver.net (S8rvLEZF8hxhYzl226UQ6st3cKKgYMXvEv7RfLAI39rvY-3gHMtLQfVJD8qh00fZlk@[85.214.197.244]) by fwd03.t-online.de
with (TLSv1:DHE-RSA-AES256-SHA encrypted)
esmtp id 1ZUSbp-0SyjZU0; Wed, 26 Aug 2015 06:46:49 +0200
Content-Type: multipart/mixed; boundary="===============1080013775=="
MIME-Version: 1.0
Subject: Security Notice Updates
To: Recipients <accountrev@rug.nl>
From: "LinkedIn" <mariamoser@t-online.de>
Date: Wed, 26 Aug 2015 06:46:50 +0200
Message-ID: <1ZUSbp-0SyjZU0@fwd03.t-online.de>
X-ID: S8rvLEZF8hxhYzl226UQ6st3cKKgYMXvEv7RfLAI39rvY-3gHMtLQfVJD8qh00fZlk
X-TOI-MSGID: e4a48c7f-733a-4693-b43a-e105d4e9d0de



LinkedIn


Security

Notice Updates




On the 23rd of August 2015, An Attempt into your account has been detected
from an unknown location,
For your security, access to your LinkedIn Account has been temporarily suspended.
To regain access,you must complete REGISTRATION BY DOWNLOAD & FILL ATTACHED FORM


PLEASE NOTE: This is a compulsory measure. Failure to update your
information will lead to service termination
Linkedin security team.


VIEW ATTACHED TO UPDATE

You received an invitation to connect. LinkedIn will use your email address to make suggestions to our members in features like People You May Know. Unsubscribe
Learn why we included this.
If you need assistance or have questions, please contact LinkedIn Customer Service.

© 2015, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA

Email:

LinkedIn
Justine Brown sent you personal message
http:/ /www. linkedin.com/do?action=viewMessage&q=member&id=27425168
View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings.

Phishing link in the content of the email: http:/ /brutalsc. com/pilots.php


Return-Path: <dixfxin@miffcrffodf.com>
Received: from u16378879.onlinehome-server.com (u16378879.onlinehome-server.com. [50.21.183.116])
Latest-Euphrates: 2C38F232452DD95C
Message-ID: <676884.31461.110087322@miffcrffodf.com>
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=UTF-8
X-Priority: 2
Substances-Castro: authenticator
Tyler-Naked: e4759d8c36863
MIME-Version: 1.0
Subject: Justine Brown sent you personal message
From: Justine Brown <dixfxin@miffcrffodf.com>

Originating IP: 50.21.183.116
Originating ISP: 1&1 Internet Inc
City: Temple
Country of Origin: United States

Email:

LinkedIn
Rebecca Bailey sent you personal message
http:/ /www. linkedin. com/do?action=viewMessage&q=member&id=5654417
View/reply to this message
Don't want to receive e-mail notifications? Adjust your message settings.

© 2016, LinkedIn Corporation

Phishing link hidden in the content of the email: http:/ /www. myvegidea.it/airmail.php

Header:

Return-Path: <csobuenosaires@loftusomeara.com>
Received: from mail.hightechware.it (mail.hightechware.it. [95.110.169.102])
Received-SPF: fail (google.com: domain of csobuenosaires@loftusomeara.com does not designate 95.110.169.102 as permitted sender) client-ip=95.110.169.102;
Authentication-Results: mx.google.com;
spf=fail (google.com: domain of csobuenosaires@loftusomeara.com does not designate 95.110.169.102 as permitted sender) smtp.mailfrom=csobuenosaires@loftusomeara.com
X-Priority: 1
Resoluteness-Scrapings: briefs
Content-Transfer-Encoding: 7bit
Graciousness-Ceded-Fractures: 36eaa14d375
MIME-Version: 1.0
Subject: You have 1 unread personal message from Rebecca Bailey
From: Rebecca Bailey <csobuenosaires@loftusomeara.com>

Originating IP: 95.110.169.102
Originating ISP: Aruba S.p.a. - Cloud Services Farm
City: Arezzo
Country of Origin: Italy