Gmail/ Google phishing

[Prints Of Darkness]

Onlymail, sent to my yahoo account....

Return-Path: <ddrc114@onlymail.com>
Received: from (EHLO eggnog.nocdirect.com) (69.73.181.154)
Subject: You have 3 missed emails
From: Gmail <ddrc114@onlymail.com>
Message-ID: <8456.921a.fa85.5a459d8@eggnog.nocdirect.com>
Date: Sat, 27 Jan 2018

Gmail

January 27, 2018

Support Service Reporting:

You have 3 missed emails. http://opaindia.com/sites/all/themes/reflexively.php

Sincerely,
The Google team

You can also unsubscribe from these emails or change your notification settings. Need help? If you received this message in error, click not my account.

 

[Jessica]

From: 184.107.242.114,

Canada Montreal Iweb Technologies Inc.
Return-Path: <free10023@mail2freedom.com>
Subject: 3 broken emails
From: GmailNotify <free10023@mail2freedom.com>
Date: Sat, 24 Feb 2018 12:03:33 +0000

We have sent you a message:

2/24/2018

3 broken emails was found and recovered.

View emails http://www.theladsongroup.marketingwithvic.co.business/interplayge.php

We hope you found this message to be useful. However, if you'd rather not receive future e-mails of this sort, please opt-out here.

 

[Marie]

From: The Google Accounts <fm9ju67a2hsyf8qn@terzweltuntergang.com>
Date: Thu, Mar 15, 2018
Subject: Your account will be deactivated.

Hello

This is to inform you that your request on: 14/03/2018 2:37:40 p.m. to remove your account from gmail.com server has been approved and will initiate in one hour from the exact time you open this message.

Regards.

ignore this message to continue with email removal or

Please confirm if this is genuine as i have not made any such request.

Regards,
Google

NOTE: If You Receive This Message In Your Junk or Spam Its Due to Your Internet Provider

 

[Sphinx]

From: 81.174.33.102,

Italy, Aosta, Ngi S.p.a. Italy
From: GmailSupport <cobb@southmount.com>
Subject: Notification message
Date: Tue, 8 May 2018
Errors-To: newfrpgljeqiqr@southmount.com
Return-Path: cobb@southmount.com

Samantha Butler (Google Support) has sent you a message:

5/08/2018

Returned email message.

More information http://kapa.sums.ac.ir/wp-content/themes/goghzt.html

Don't want occasional updates about Google activity? Change what email Gmail Service sends you.

 

[Hua Mulan]

Message-ID: <4442f7-1b982-af8578@mail2abc.com>
Date: Tue, 15 May 2018
From: Gmail Support <eilleenne68970@mail2abc.com>
Subject: Notification message

Gabrielle Taylor (Google Service) has sent you a message:

5/15/2018
Returned email message.

More information --> http://www.dom-ukazi.pl/depositorype.html

Don't want occasional updates about Google activity? Change what email Google Team sends you

 

[GhanaGeria]

I just got this one. It asks to reply to all 0f the following email addresses. Perhaps these are a whole slew of Phishing domains controlled by one group. Maybe all of them can be taken down in one shot?

contact@linearsedimentation.net
contact@qualifieddriving.net
contact@placepossible.net
contact@blognippy.net
contact@goldtop.online

from: xjs97dhjdbjh@z33w9fp1wi3s.edu.se
reply-to: contact@linearsedimentation.net,
contact@qualifieddriving.net,
contact@placepossible.net,
contact@blognippy.net,
contact@goldtop.online
to: 6V2GQP8UOWP57W7HC615J93X@itlgopk.uk
date: Tue, May 22, 2018 at 5:07 PM
subject: Important Message For You

Google®

Hi,

Your Email Account has sent out spam emails to a list addresses that you don’t recongnize,!!!

You're getting this Email to make sure it was not you.

It's required that you reply within the next 24 hours,

We will suspend access to your account
If we don't recieve your reply within the given time frame,

We would appreciate your immediate attention to this matter



I also received the same above mail with a different group of reply to email addresses:

contact@extremelogg.science,
mail@pacificland.online,
contact@watersrise.net,
contact@thanenough.net,
contact@allsportmania.club

 

[Mark Herdford]

From: Notification <dinoceratidae@ fdgfg. com> (217.16.4.76 - CYPRUS - NO SCAMMER RANGE)
Subject: XXXX, Critical security alert for your profile ID 1314

Your profile is listed as the recovery email for xxxxxxx@xxxxx Don't recognize this profile? click here (http :// tradesinfo .com /tragicph .html) be carefull, possible malware!

Sign-in attempt was blocked for your linked profile
xxxxxxx@xxxxx

Someone just used your password to try to sign in to your account.
CHECK ACTIVITY (http :// tradesinfo .com /tragicph .html), be carefull, possible malware!

You received this email to let you know about important changes to your profile and services.
© 2018 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
__

Website Address Tradesinfo.com
Last Analysis3 seconds ago
Blacklist Status 1/35

SCUMWARE Detected View More Details

 

[Mark Herdford]

From: FX-48837 - DocuDrive™ <ceoeric@ bricorllc .com> (40.107.72.129 - US)
Subject: Completed: DocuDrive #Ref.INV8837

One new encrypted document is attached via a secured link.
One new document sent to you by a contact from your directory, click "Access File" below.

<<< Access File >>>

Please consider the environment before printing this e-mail

Message protected by MailGuard: e-mail anti-virus, anti-spam and content filtering.
http:// www. mailguard.com. au/mg

Note: The link are pointing to the url: https:// tinyurl. com/y7chpkmc (and the short link are poitinng to the url: https:// karagamachis .com/tps/one/)

BitDefender Detected View More Details

 

[Mark Herdford]

Subject: XXX, Critical alert for your account #16727
From: Reminder <dtrebycu@pbcare.com> (192.163.228.72 - US)
To: XXX
__

Your profile is listed as the recovery email for XXXX. Don't recognize this profile? click here.

Sign-in attempt was blocked for your account
XXXX
Someone just used your password to try to sign in to your account.
CHECK ACTIVITY
You received this email to let you know about important changes to your profile and services.
© 2018 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Note: The links are pointing to the url: http://www. votepiranhas. com/wp-content/seasoningqu. html

SCUMWARE Detected View More Details

BitDefender Detected View More Details

GoogleSafeBrowsing Detected View More Details

ZeroCERT Detected View More Details

From: Support <ghammond23@unga.com> (74.208.78.129 - US)
To: XXX
Subject: XXX, Critical security alert for your account #23975
__

Your account is listed as the recovery email for XXX. Don't recognize this account? click here.
Sign-in attempt was blocked for your account
XXXX
Someone just used your password to try to sign in to your profile.
CHECK ACTIVITY

You received this email to let you know about important changes to your profile and services.
© 2018 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Note: The links are pointing to the url: http:// andromeda-technologies. com/wordpress/wp-content/themes/protestationsd.html

From: GmailSupport <edyeeaicapblg@activeware.com> (145.14.169.83 - NETHERLANDS)
To: XXX
Subject: Message notification XXX
__

Google
Bailey Phillips (Google Service) has sent you a message:

10/14/2018
Message status: undeliverable.

Get more information
Don't want occasional updates about Google activity? Change what email Gmail Service sends you.

Note: The links are pointing to the url: http:// www. cldehradun .com/wp-content/uploads/2018/unguidede .html

From: Google Support <curt@tui-uk.co.uk> (46.102.232.18 - POLAND)
To: XXX
Subject: Undeliverable messages XXX
__

Google
Nicole Watson (Google Team) has sent you a message:

10/13/2018
Undeliverable messages.

More information
Don't want occasional updates about Google activity? Change what email Google Service sends you.

Note: The links are pointing to the url: http:// www. urgentcargonw. com/plugins/content/assistantsw .html

From: Support <hager@katrillion.com> (62.173.163.188 - ITALY)
To: XXX
Subject: XXX, Critical alert for your linked profile ID 69973

__
Your account is listed as the recovery email for XXXX. Don't recognize this profile? click here.

Sign-in attempt was blocked for your linked account
XXXX
Someone just used your password to try to sign in to your account.
CHECK ACTIVITY

You received this email to let you know about important changes to your account and services.
© 2018 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Note: The link are pointing to the url: http:// islandmarble. com. sg/immediacyr. html

From: GoogleService <firmeninterne-seminare@coachingbuero.de> (5.39.79.75 - UK - SCAMMER RANGE)
To: XXX
Subject: Message you sent blocked by our bulk email filter XXX
__

Google
Lauren Bennett (Gmail Service) sent you a message:

10/12/2018
Returned email message.

Learn more
Don't want occasional updates about Google activity? Change what email Google Service sends you.

Note: The links are pointing to the url: http:// www. syhlove. com/deallocatedce. html

 

[Mark Herdford]

From: GmailReminder <domie-salitopu@mcdowellknight.com> (193.0.61.97 - UKRANIE)
To: XXXX
Subject: Notification message XXX

_

Allison Palmer (Google Support) has sent you a message:

10/16/2018
Message status: undeliverable.

Learn more
Don't want occasional updates about Google activity? Change what email Google Support sends you.

Note: The links are pointing to the url: http:// guildfordislamiccommunity. com/images/celsiusyv. html

SCUMWARE Detected View More Details

YandexSafeBrowsing Detected View More Details

From: Support <diamonddd@nortel.ca> (188.165.238.215 - IRELAND - SCAMMER RANGE)
To: XXXX
Subject: XXX, Critical security alert for your profile #13747

_

Your profile is listed as the recovery email for XXX. Don't recognize this profile? click here.

Sign-in attempt was blocked for your linked profile
XXXX
Someone just used your password to try to sign in to your profile.
CHECK ACTIVITY
You received this email to let you know about important changes to your profile and services.
© 2018 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Note: The link are poiting to the url: http:// fundacionelfortin. org/wp-content/uploads/summonerie. html

SCUMWARE Detected View More Details

From: Support <debbie@cityofclemson.org> (212.166.68.10 - SPAIN)
To: XXX
Subject: XXX, Critical alert for your profile ID 35752

_

Your profile is listed as the recovery email for XXX. Don't recognize this account? click here.

Sign-in attempt was blocked for your profile
XXX
Someone just used your password to try to sign in to your account.
CHECK ACTIVITY
You received this email to let you know about important changes to your profile and services.
© 2018 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Note: The link are pointing to the url: http:// art-culture. uru. ac. th/complicatorso. html

MyWOT Detected View More Details

SCUMWARE Detected View More Details

Fortinet Detected View More Details

ZeroCERT Detected View More Details

From: GoogleReminder <etqbnncvy@mail2panama.com> (101.0.86.66 - AUSTRALIA)
To: XXX
Subject: Incoming messages XXX
_

Kaitlyn Parker (Google Team) just sent you a message:
10/17/2018
Returned email message.

More information
Don't want occasional updates about Gmail activity? Change what email Google Team sends you.
Note: The link are pointing to the url: http:// kvision. vn/wp-content/raoulb. html

SCUMWARE Detected View More Details

From: Support <dat5@buyproperties.com> (62.212.150.75 - NETHERLANDS)
To: XXX
Subject: XXX, Critical alert for your linked profile ID 35187
__

Sign-in attempt was blocked for your profile
XXXX
Someone just used your password to try to sign in to your account.
CHECK ACTIVITY
You received this email to let you know about important changes to your profile and services.
© 2018 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Note: The link are pointing to the url: http:// saskatoonfieldlacrosse. ca/plugins/smuggleda .html

From: Support <gaskino@mail2freedom.com> (89.252.165.14 - UKRANIE)
To: XXX
Subject: XXX, Critical security alert for your linked profile ID 8959

__

Your profile is listed as the recovery email for XXX. Don't recognize this account? click here.

Sign-in attempt was blocked for your account
XXX
Someone just used your password to try to sign in to your account.
CHECK ACTIVITY
You received this email to let you know about important changes to your profile and services.
© 2018 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Note: The links are pointing to the url: http:// buffalocreekglencoe. org/hierarchicallyov. html

SCUMWARE Detected View More Details

From: Google Service <digitekcnxu@carefreewebsitesolutions.com> (74.63.240.162 - US)
To: XXX
Subject: Undeliverable messages XXX
_

Lillian Davis (Google Service) has sent you a message:

10/19/2018
Message status: undeliverable.

Get more information
Don't want occasional updates about Gmail activity? Change what email Google Support sends you.
Note: The links are pointing to the url: http:// coalyardcafe. com/wp-content/uploads/2016/frederickou. html

MyWOT Detected View More Details

SCUMWARE Detected View More Details

From: Accounts <dsaf@vui.com> (87.106.67.75 - GERMANY - SCAMMER RANGE)
To: XXX
Subject: XXX, Critical alert for your account ID 9438

_

Your account is listed as the recovery email for XXX. Don't recognize this profile? click here.

Sign-in attempt was blocked for your account
XXX
Someone just used your password to try to sign in to your profile.
CHECK ACTIVITY
You received this email to let you know about important changes to your account and services.
© 2018 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Note: The links are pointing to the url: http:// jenco. skoshesites. com/mauritiuscw. html

MyWOT Detected View More Details

From: Notification <francisco.oliveira@excite.co.uk>(202.161.188.108 - BANGLADESH)
To: XXX
Subject: XXX, Critical alert for your account ID 8623

__

Your account is listed as the recovery email for XXX. Don't recognize this account? click here.

Sign-in attempt was blocked for your linked account
XXX
Someone just used your password to try to sign in to your account.
CHECK ACTIVITY
You received this email to let you know about important changes to your account and services.
© 2018 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Note: The links are pointing to the url: http:// 4008808055. com/plugins/app/pay_alipay/agglomeratesb. html

From: Reminder <editcashnow@bewell.net>(72.52.228.176 - US)
To: XXX
Subject: Sliona has sent you message
_

Sliona has sent you direct message
CHECK ACTIVITY
You received this email to let you know about important changes to your profile and services.
© 2018 hotmail.com., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Note: THe link are pointing to the url: http:// atentobahiaseg .com. br/wp-content/themes/quadrangleqv. html

SCUMWARE Detected View More Details

BitDefender Detected View More Details

Fortinet Detected View More Details

From: Notification <cosjh@laporte.com>(95.143.172.176 - UKRANIE)
To: XXXX
Subject: Ghislaine just sent you private message

_

Ghislaine just sent you personal message
VIEW MESSAGE
You received this email to let you know about important changes to your account and services.
© 2018 hotmail.com., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Note: The link are pointing to the url: http:// www. stpolice. com/fckeditor/editor/aurigar. html

MyWOT Detected View More Details

 

[GhanaGeria]

from: gmail.com <desari@indovision.tv>
date: Nov 27, 2018, 7:09 PM
subject: gmail.com Failure Delivery Notification.
mailed-by: indovision.tv

This mail is from a trusted sender.
gmail.com

Dear,

gmail.com has prevented the delivery of 3 new emails to your inbox (@gmail.com) as of Monday, November 26 , 2018 2:81 PM (UTC) because it identified these messages as spam. You can review these here and choose what happens to them

Review Message >>> https://gadmaew.com/mine/redirect.php/?

© 2018 gmail.com Corporation. All rights reserved. |Acceptable Use Policy | Privacy Notice



from: gmail.com <desari@indovision.tv>
date: Nov 28, 2018, 2:30 PM
subject: gmail.com Failure Delivery Notification.
mailed-by: indovision.tv

This mail is from a trusted sender.
gmail.com

Dear,

gmail.com has prevented the delivery of 3 new emails to your inbox (@gmail.com) as of Monday, November 26 , 2018 2:81 PM (UTC) because it identified these messages as spam. You can review these here and choose what happens to them

Review Message >>> https://conact-221.ga/mine/redirect.php?

© 2018 gmail.com Corporation. All rights reserved. |Acceptable Use Policy | Privacy Notice

 

[GhanaGeria]

from: gmail.com <noreply@mail.com> via banner-uk.com
date: Dec 11, 2018, 2:56 PM
subject: Mail Session Expiration Warning
mailed-by: banner-uk.com

gmail.com
Dea,
Your Account Session will Expire ,monday 31 December 2018 if you would like to continue using your Email Address
Click Here >>> https://dinikoeceramics.com/wp-includes/Text/Diff/Renderer/_cache/session/leva To Re-Validate Your Mail Session
YOU WILL LOSE YOUR MAIL ADDRESS IF YOU DO NOT VALIDATE YOUR ACCOUNT.

Thanks
Mail Term! ©2018 All Rights Reserved

 

[GhanaGeria]

from: GOOGLE CUSTOMER SERVICE <dr.meenajackson@yahoo.com>
reply-to: GOOGLE CUSTOMER SERVICE <customerservicesc704@gmail.com>
to:
date: Jan 3, 2019, 6:50 PM
subject: Dear Google User,
mailed-by: yahoo.com
signed-by: yahoo.com

Dear Google User,

We are currently upgrading our database and e-mail account center i. e homepage view, enhance security installations of new 2019 anti-spam and anti-virus software, large mailbox space. Kindly verify your e-mail within 24 hours or your e-mail will be temporarily suspended. Kindly Click "Go-Direct Update" .... https://googlecustomerse.weebly.com/ to verify your e-mail. We apologize if you have experienced any difficulties due to this situation

Thanks for your co-operation,

IT HelpDesk,
AOL Support Help Desk

 

[Mark Herdford]

From: Google <gabrielarmontesxm@fnbbemidji com> (185.66.141.119 - FINLAND)
To: XXXX
Subject: Files has been successfully published
__

Files has been successfully published
3 ways to get more space
More information

(all urls pointing to the url: http: // askwhy. pl /wp-content/uploads/stuffyu. html)

You received this email to let you know about important changes to your Google Account and services.
© 2019 Google Inc.,1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

 

[Prints Of Darkness]

Return-Path: <eiyhaves@diamondpharmacy.com>
Received: from ps601909.dreamhost.com (ps601909.dreamhost.com [208.97.170.25])
Subject: Urgent notification
Date: Thu, 18 Jul 2019
Message-ID: <76c3be.4d42.7de45e@ps601909.dreamhost.com>
From: Google Notification Service <eiyhaves@diamondpharmacy.com>

Google Notification Service
Cadence Wood, Google Service:

7/18/2019
Too many emails in your mailbox <http://unachem.ru/reticulatesw.html>

________________________________

We hope you found this message to be useful. However, if you'd rather not receive future e-mails of this sort from Google, please opt-out here <http://unachem.ru/reticulatesw.html> .

 

[Miyuki]

Return-Path: <bounce@ablesales.com.au>
Received: from ablesales.com.au (ec2-54-200-168-104.
Received: from efianalytics.com (efianalytics.com. 216.244.76.116)
From: Security Alert <ivhdyRcNK@hstepielyczrwkuppr.com>
Date: Sat, 25 Jan 2020 09:50:30 +0100
Subject: ?? unusual activity
Message-ID: <-YCxx20Ox43qGyiy.sunset.stroulaea.com@cisco.com>

Someone recently used wrong passwords to try to sign in to your Google account

we prevented the sign-in attempt, in this case please review the details of the sign-in attempt:
Monday at 08:38:12 AM UTC.
IP Address : 21.236.21.8 (GB)

NOTE : if you do not reply to this message to explain us about this unusual activity. Our records indicate that your account will suspended , try to reply us asap.
Best
Google team Account.