UPS phishing

G

Guesting

Guest
Jennifer Watson

Subject: Delivery Status:Case Z81169145136
From: "UPS® Customer Services" <no_reply@upsmail.com>
Date: Sat, March 19, 2011 9:51 pm
To: undisclosed-recipients:;
Priority: Normal

Final Reminder:

Dear Customer,

We regret to inform you that the delivery of your shipment has been suspended for the following reason.

1. In line with new laws, items transiting through the EU are to be fully taxed and are subject to postal inspection by transiting postal authorities.
Concluding the inspection on the package it has been ascertained that adequate duties was not paid on the package.

Your name and email address were on the package for contact details.
Under new laws any package transiting through the EU is liable to full duties
payment. The sender did pay the appropriate courier fee but did not pay adequate
duties on the package .We are therefore requesting you pay full duty for the
coverage of (?) 119 Euros on the package.
To resume delivery, you are obligated to pay the duties on the contents of the package
You should therefore contact your assigned claims Officer, Jennifer Watson to assist
with the duty payment in
Spain , where your package is currently being held
Below is her contact information of your assigned claims
Officer.
Name: Jennifer Watson
Email address:jeewatson@terra.com
Tel: 678 701 8046
Note: Duty coverage fees are payable to authorities through your assigned claims
Officer.UPS® does not accept fees on behalf of foreign authorities.
Your old tracking number has been suspended due to non payment of tax.When making
contact with your assigned claims officer via email or phone please quote reference
Z81169145136
The status of your package can be tracked as soon as payment has been confirmed
Copyright © 1994-2011 UPS Inc. All rights reserved.


X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
maildrop12.localnet.sys
X-Spam-Level: *****
Received: (qmail 16816 invoked from network); 20 Mar 2011 02:58:21 -0000
Received: from unknown (HELO inbound8.hw.buf.ny.localnet.com) ([10.30.204.30])
(envelope-sender <no_reply@upsmail.com>)
by maildrop12.localnet.sys (qmail-ldap-1.03) with SMTP
for <XXXXX>; 20 Mar 2011 02:58:21 -0000
Received: from deepbrain.jp (deepbrain.jp [202.229.58.220])
by inbound8.hw.buf.ny.localnet.com (Postfix) with SMTP id 250AC41600A
for <XXXXX>; Sat, 19 Mar 2011 22:58:20 -0400 (EDT)
Received: (qmail 27955 invoked by SAV 20110319.023 by uid 0); 20 Mar 2011 11:51:40 +0900
X-Authentication: info was authenticated by 202.229.58.220
at 20 Mar 2011 11:51:40 +0900
Received: from unknown (HELO User) (66.255.7.162)
by ps20.suite2.arena.ne.jp (202.229.58.220) with SMTP; 20 Mar 2011 11:51:40 +0900
Reply-To: <jeewatson@terra.com>
From: "UPS® Customer Services"<no_reply@upsmail.com>
Subject: Delivery Status:Case Z81169145136
Date: Sat, 19 Mar 2011 22:51:40 -0400
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20110320025821.250AC41600A@inbound8.hw.buf.ny.localnet.com>
To: undisclosed-recipients:;
X-DSPAM-Result: Innocent
X-DSPAM-Processed: Sat Mar 19 22:58:25 2011
X-DSPAM-Confidence: 0.6000
X-DSPAM-Probability: 0.0000
X-DSPAM-Signature: 2348,4d856d51110226488068943
 

penn

New Member
came up red flag, cant open

Clear flagUnited Parcel Service notificationSunday, March 20, 2011 9:41 PM
From: "United Parcel Service" <infoqy@ups.com>
.. moreMessage contains attachments1 File (5KB)UPS notification.zip No virus threat detectedFile: UPS notification.zipDownload File

Dear customer.

The parcel was sent your home address.
And it will arrive within 7 business day.

More information and the tracking number are attached in document below.

Thank you.
© 1994-2011 United Parcel Service of America, Inc.
 

compaq

New Member
How do I ban these emails

I keep getting supposed emails from UPS, DHL, FEDEX and similar. Just delete them, but how can I ban them from coming into me.

here is one I had just now.

Return-Path: <joiner2@ups.com>
Received: from triband-mum-120.63.18.216.mtnl.net.in (triband-mum-120.63.18.216.mtnl.net.in [120.63.18.216])
by viper.bpweb.net (8.13.1/8.13.1) with SMTP id p2NH0s98021846
for <aaaaaaaaaaaaaaaa>; Wed, 23 Mar 2011
Reply-To: "United Parcel Service" <joiner2@ups.com>
From: "United Parcel Service" <joiner2@ups.com>
Subject: United Parcel Service notification
Date: Tue, 22 Mar 2011

Content:

Dear customer.

The parcel was sent your home address. And it will arrive within 7 business day.

More information and the tracking number are attached in document below.

Thank you.
© 1994-2011 United Parcel Service of America, Inc.

It also had a zipped attachment, that I never open.

After putting through the IP tracker;

Originating IP: 120.63.18.216Originating ISP: Mahanagar Telephone Nigam Ltd. City: MumbaiCountry of Origin: India

But it is possible UPS to be using Indian outsourcing??? How can I know if real or not??

Seems I have lots to learn still.

Any advice appreciated.
 

Mister X

Super Moderator
Staff member
I keep getting supposed emails from UPS, DHL, FEDEX and similar...
What sort off email provider do you use?

Personal i use Gmail and this below is my own solution on the same problem..

A sugestion / option can be to just make a filter for words like.. UPS, DHL, FEDEX or other uniq text in a email message...
And then you setup the filter so that it delete that email that fits the filter search info.
Or you just move it to a folder, so that you can see later if some email are put in it incorrectly..

But this is just one solution to your problem..
 

Ben

Member
Hi folks :)
As the header is here for discussion here's lets try and answer some questions.

First I took the header to > http://www.iptrackeronline.com/header.php
Then opened another browser window and googled joiner2@ups.com which is a an Invalid domain name address to say the least ., you will see your post at AFI in the google search plus many others relating to this scam address and perhaps someone opened the zip file shedding more light.
the real Ups page by law has to have a 'contact us' which would not be 'joiner2' < joiner is nonsense and the numerals relate to a list of address the scammer uses 1 2 3 etc. This fake domain of ups.com which people here can and do report .
Including the header, to webmaster@ups.com or customer.service@ups.com

Now how did a scammer mail from what appears to be the domain name of ups.com?
and how does a header tell that this mail is not from ups without having a real header from the real ups.com to compare it with?… bearing in mind ups is global concern and could be mailing from India as you suggested.
A header is basically a list of stop off points on the way to your machine, this one has surprisingly few IP's relating to stop offs for a sock proxy so perhaps notice should be taken of Reply to: & Received form : in this case the line in brackets (triband-mum-120.63.18.216.mtnl.net.in [120.63.18.216]) why is it in brackets ? possibly because it is accepted but not recognised . search revealed > http://www.bizimbal.com/odb/details.html?id=890872
giving an IP range 59.176.0.0 - 59.185.255.255 again India but again this mail says it is from ups so perhaps when googling @triband-mum.com or triband-mum it is in the header to take us off the trail .
 

Sphinx

Administrator
Staff member
From United Parcel Service
Return-Path: <info51@ups.com>
Received: from 84.40.118.72, Bulgaria, NET1 Ltd.
Date: Thu, 24 Mar 2011
Reply-To: "United Parcel Service" <info51@ups.com>
From: "United Parcel Service" <info51@ups.com>
Subject: United Parcel Service notification #1573313
Message contains attachments
1 File (6KB)

* United Parcel Service document.zip United Parcel Service document.zip

Dear customer.

The parcel was sent your home address. And it will arrive within 7 business day.

More information and the tracking number are attached in document below.

Thank you.
© 1994-2011 United Parcel Service of America, Inc.
 

Garreg Ddu

Gweinyddwr
Staff member
And yet another!

X-SID-PRA: United Parcel Service <infosec2@ups.com>

Received: from smtp.fvluxuj.net ([175.57.132.110]) by relay-x.ddeyxg.com with SMTP; Mon, 28 Mar 2011 03:55:44 GMT

Origin IP Address = 175.57.132.110 = North Star Information Hi.tech Ltd. Co., No.18, Beifengwo Road, Haidian District, Beijing, China, 100038

From: "United Parcel Service" <infosec2@ups.com>
To: <**********@******.***>
Subject: United Parcel Service notification 95359
Date: Mon, 28 Mar 2011 03:53:06 GMT
Return-Path: <infosec2@ups.com>


Dear customer.



The parcel was sent your home address.

And it will arrive within 3 business day.



More information and the tracking number are attached in document below.



Thank you.

© 1994-2011 United Parcel Service of America, Inc.

4efl26ZAK6y70abCeI6Ol6EOi1n2k82uvJrE7B5oiNIK520W4u3I3IXuiJ


In this case the attachments were an HTML copy of the email text above, and a ZIP file of 2 bytes length, which has no contents.

I think this idiot failed Scamming 101.
 

xmanhere

Ninja
United Parcel Service notification #715624713

United Parcel Service notification #715624713Monday, March 28, 2011
From United Parcel Service Mon Mar 28 2011
X-YahooFilteredBulk: 170.170.59.133
Date: Tue, 29 Mar 2011 0638 +0900
From: "United Parcel Service" <info4vaxyu@ups.com> Add sender to Contacts
Subject: United Parcel Service notification #715624713
Message contains attachments1 File (6KB)
173.251.113.220 Cablevision Systems Corp. Bethpage United States
101.29.154.60 n/a n/a China
170.170.59.133 FedEx Office Carrollton United States

Dear customer.

The parcel was sent your home address.
And it will arrive within 3 business day.

More information and the tracking number are attached in document below.

Thank you.
© 1994-2011 United Parcel Service of America, Inc.
 

Violet

New Member
FEDEX PHISHING

ANOTHER ONE!!!!:mad:

FedEx system notification
Monday, 4 April, 2011 19:49
From: "FedEx" <66infojauu@fedex.com>
Add sender to Contacts
Message contains attachments1 File (7KB)FedEx.zip
Dear customer

The parcel was sent your home adress
And it will arrive within 10 business days

More information and the tracking number
are attached in document below.

Thank You

© FedEx 1995-2011
 

xmanhere

Ninja
Tracking system notification

Tracking system notificationTuesday, April 12, 2011 7:52 PM
From Trcking system Wed Apr 13 02:52:26 2011
X-Apparently-To: via 66.94.238.172; Tue, 12 Apr 2011 20:29:06 -0700
Return-Path: <infoxmni@tracking-system.com>
X-YahooFilteredBulk: 68.153.178.230
Received-SPF: softfail (mta1269.mail.sk1.yahoo.com: domain of transitioning infoxmni@tracking-system.com does not designate 68.153.178.230 as permitted sender)
X-YMailISG: lBXSkdEcZAp9iGXykXxPXjSGxlcKDqYYPzwhX8v8o_vBcgHt PTQnlvvcESb_toeJZbCJ9vix_LF5uWdOE3cue0SX4NokI9vlG95XflQZsQEr RcRNBtxNweWNjCnvBMmAkgnmbxsHQCvWZbnydDVQ3ZqSbFuaU9wXO_t795gx 4wFEjuaKkJHOiw45XQzJ2rIb.IMS8Esc12LD2dOEWk7TFBdP2OfcaDlfR98n Szkd.DxVcutXRYu.W8Ou_KnPqMLak5uZrpbL77NgIrUN0vvKScy9IURXmxmr Mek4PAHVnOXCRdByKYmqJUQhIb4a1UGPB5pR6eveHCYPPLaOnkl.a9iCOP_X 0jvQK_Vd0UQrs6kBH3bPo7Bs5NnS5WMSaNGvnTqjuvzbWMPxAjzoS.ZkfIMA .2_41lqNcLgdudDMdrHtjOUAHCPfvZjwGfXfdovRbdhefp1SgruXhC98Aj4H lKe5YpMlCRCvYVOzIfuqvC1VS5g5cOVk2_xtIFoVzk_biY4BYP1BhcS1az_U DdQMBnfYSMpw8K1WEtIkELwiXyF1Fry8OahcOnkfQycwMxVP9MgaWtvIYeSC EU8cKR5XrNCatHjauLW7N3xElfEa6ONNo8Sv803xzcoOv5jpps2PTbhYPlVk GEJNb44yMruH.HSgdKiAV1DsyBMRmw0RsbCFpIzCrDnMAOe9Tk0iXqz74z2e b3DzE900Li.RiBn_ZKCnDR7AsBzZh54n8oS7mt5P2MnAwTz_3CDjBEiKNkgz SAlCjq704.fW0HbwOUL6Hg9ToiZc9po8LuA9_zhSNs4oNIRRve5gznxnayoD Kk2tWQ7kAGnMjZbQL3dsBBccAlZow3NS1cvJ.6.MR6kqYCzWhG4SH3dp8PBH 9SJxIIVznKP2BVaUyoYQ0sZbiuSKzp0J5K9e88Nufm4aLJyGNiarYC3hrk9X nmfY4G8cpDPgiqr1Ej7vTCqDE2FX_y5G22S6QGdpgHD27UmlX_6fznpJ2IL9 1Q1f6tAzqKUwLbpUGZKUzkC0TevNI7dIQemXcl2cSFLPmI9_esUro77JpDcF 3BBFu4TXgsUfGXudMG9dotd1noZme9xSKTv.3Q3wJbWxyw60FD.tnNO0EXNw YenV4bk1R7eTNEninhv.pCw.uBSmPsTpAMiF7Pg7ZSi0KJm2XBNq2G2yMc.w NX.F_2MMwWesTLHnZWx93CeYaX4zhGGaApQ5LR8s4THVuvZXn7Giki53jB2U pIQXqQ2Bwna9KfjK.HY0mPA9uQyiOIxOXebonzR4pGeqNPzpAILmt3Zvqei_ qSX.16Kz_x0jtz8FZF3e18w1aVsr.diC64dC4qLJwGAu5fWPGewurYfYYAd9 fogpKiMv_XAwZ6Q4xX3mlpek86E1SGUeXyY3PfI5UZFEbH_xZYRgJfL4ZR1_ CcYGtVhFvVF.9PUfX3GoCYPthFqYtuMoarlWPF7a4cRoKnMwLEZk2O..QRVH hVs7MtIr_2EgWr7htYbw6mEQa4934SIwyIkFeb0MiSLshqr2EDtsr09h6uwK JtA0zCwrh0sz.iWIEhhZL6AU60Yz.lsspNrtxli2wxElZ5jecVPD0.EN5FjY j5WGfJ8uZiiOSAViE0ulrQg8boZft2BEX4fSHwBz8Xn5VlE.eiP3QsGNWQTT cWrJeCnWF1uYzLXLaPVqhENziloq7wV0bQ9EFTPqQvJlD19fdJUdaV1LdAPI aXq0KTLEdryIbCjz
X-Originating-IP: [68.153.178.230]
Authentication-Results: mta1269.mail.sk1.yahoo.com from=tracking-system.com; domainkeys=neutral (no sig); from=tracking-system.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO tracking-system.com) (68.153.178.230) by mta1269.mail.sk1.yahoo.com with SMTP; Tue, 12 Apr 2011 20:28:58 -0700
Received: from public.micromail.com.au ([Wed, 13 Apr 2011 10:18:31 +0700]) by mail.gimmicc.net with SMTP; Wed, 13 Apr 2011 10:18:31 +0700
Received: from snmp.otwaloow.com ([90.229.55.205]) by public.micromail.com.au with ASMTP; Wed, 13 Apr 2011 10:15:32 +0700
Received: from smtp.endend.nl [118.202.11.55] by relay-x.misswldrs.com with ASMTP; Wed, 13 Apr 2011 10:08:42 +0700
Message-ID: <557E087B.F1B21CD9@tracking-system.com>
Date: Wed, 13 Apr 2011 09:52:26 +0700
Reply-To: "Trcking system" <infoxmni@tracking-system.com>
From: "Trcking system" <infoxmni@tracking-system.com> Add sender to Contacts
User-Agent: Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:0.9.1) Gecko/20010607
MIME-Version: 1.0
Subject: Tracking system notification
Content-Type: multipart/mixed; boundary="------------018106711460007162463770"
Content-Length: 7035
118.202.11.55 Northeatern University Shenyang China
90.229.55.205 TeliaSonera AB Brämhult Sweden
68.153.178.230 BellSouth.net Hollywood United States
66.94.238.172 Yahoo! Sunnyvale United States

Dear customer,

The parcel was sent your home adress
And it will arrive within 3 business days

All information and the tracking number
are attached in file below.

Thank You
Copyright © 1994-2011 United Parcel Service of America, Inc. All rights
reserved.
 

Central Scrutinizer

Administrator
Staff member
Don't open a zip file like this!

From United Parcel Service
Return-Path: <infoxoes@ups.com>
Received: from 74.12.210.53, Montreal, Canada, Bell Canada, [abuse@bellnexxia.net]
Date: Wed, 20 Apr 2011
From: "United Parcel Service" <infoxoes@ups.com>
Message contains attachments
1 File (6KB)

* UPS_Document.zip UPS_Document.zip

Compact Headers
Dear customer,

The parcel was sent your home adress It will arrive within 10 business days

All information and the parcel number are attached in file below.

Thank You
Copyright © 1994-2011 United Parcel Service of America, Inc. All rights
reserved.
 

The Doctor

Administrator
Staff member
Return-Path: <baptisteriesqkz57@gmail.com>
Received: from 216.96.234.200, Knoxville, University Of Tennessee
Date: Mon, 2 May 2011
X-AOL-ORIG-From: "UPS Shipping Center" <UPS Customer Department>
Subject: United Parcel Service notification #60567

Dear

The parcel was sent your home adress It will arrive within 2 business days from this moment Mon, 2 May 2011

All information and the parcel number are attached in file below.
(the file is called parcel.mim)

Thank You
© Copyright 2004-2011 United Parcel Service of America, Inc. UPS, the UPS brandmark, and the color brown are trademarks of United Parcel Service of America, Inc. All rights reserved.

Please do not reply directly to this e-mail. UPS will not receive any reply message. For questions or comments, visit Contact UPS.

We understand the importance of privacy to our customers. For more information, please consult the UPS Privacy Policy.

This communication contains proprietary information and may be confidential. If you are not the intended recipient, the reading, copying, discloswure or other use of the contents of this e-mail is strictly prohuibited and you are instructed to please delete this e-mail immediately.
 

Nanook

Administrator
Staff member
From UPS system
Return-Path: <info277875@ups.com>
Received: from 112.145.123.218, Korea, LG Powercomm
Date: Sun, 08 May 2011
From: "UPS system" <info277875@ups.com>
Message contains attachments
1 File (8KB)

* parcel information.zip parcel information.zip

May 2011
UPS Express Delivery
tracking number # 8142573
Good morning
Parcel notification

The parcel was sent your home adress. And it will arrive within 5 buisness days.

More information and the parcel tracking number are attached in document below.

Thank you
UPS Express Delivery system (c)
Copyright © 1994-2011 United Parcel Service of America, Inc. All rights reserved.
 

xmanhere

Ninja
UPS Express Delivery system

From UPS
Return-Path: <adminluzxu@ups.com>
Date: Sun, 08 May 2011
From: "UPS" <adminluzxu@ups.com>
Subject: United Parcel Service notification
75.77.33.204 ULYSSES FOUNDATION - - ROSEMARY AVE - STATIC Fort Lauderdale United States

May 2011
UPS Express Delivery
tracking number # 7428528
Good morning
Parcel notification

The parcel was sent your home adress! And it will arrive within 5 buisness days.

More information and the parcel tracking number are attached in document below.

Thank you
UPS Express Delivery system (c)
Copyright © 1994-2011 United Parcel Service of America, Inc! All rights reserved.

document.zip is virus attached
 
J

jae

Guest
I'm glad ppl are reporting the fake UPS e-mails. I really hate these scammers. I buy items from around the world and don't have time to deal with liars and thieves. It's hard enough to sort through real corrospondence.
j
 

Dick H Box

Samurai
UPS viral phish from <notifyneeob@ups.com>

UPS have confirmed that <notifyneeob@ups.com> is a fraudulent email. DO NOT open any attachments that come from this address. It's packaged as a .zip file, & contains a .exe file, which is VIRAL

UPS parcel information #203686
Thursday, 9 June, 2011 13:23
From UPS inc. Thu Jun 9 13:23:38 2011
X-Apparently-To: via 217.12.10.215; Thu, 09 Jun 2011 12:40:15 +0000
Return-Path: <notifyneeob@ups.com>
X-YahooFilteredBulk: 213.137.110.62
Received-SPF: none (mta1061.mail.ird.yahoo.com: domain of notifyneeob@ups.com does not designate permitted sender hosts)
X-YMailISG: 7X_7.ikcZApQLC0q.ol1Ks.p1IWx64QMk_sibJzXDg5hB10k HBrpobAyzsn_YRpdwk3FHgDY0dU47etURCOnV8QJDUU4ysQo2vKVkQjXypNf 2iy.QeVg6NbgD3kLzKt5.2X14qOk6ITMnNOBNYXFcS4cOEq_v0luTwUGuOWR 3yyMsy_Egs.XOm5Iu.6a1ak1aYlt4e1rxAbzspdnc1UxLGPIR.Fn5HsRP4EE 04HevdAp5H1MzUs91.4laY9swjB3NmOZEJvB5pjigC90Uxv34B_lNWWb78zn gQ_035ENYcES6ouvzcQnedip1CsCdVS02CME.myz.0AxDSFtYgL.kWzfawgd Ig4rzeVvD_ri5H.IjDAppnNc7MGjpowab.TaIhDAEwN63veDXfmG4dDPVkS7 b5r1E78VDi1mgz1g4MLV6pKzsVFPFvM3oyLEoePA9BRM8t7SZsHwZoqlmoeo 5tcTWfz119itwJejyqXj6yT2Rq8.vTcSd8cewOFw9KVskHhwfln3Xzt8.YRS 2SsgkDXXWPWQX1bUDX9iSaCt68sdoqgw7p.jzrJ2L_JB233nTYPm4a9dXjjz BnSHW4iusLxbbnsSdjfrYNuiGUaYeS2RkISsRHyVO08xf4s45lN3pNJLn.XF x0Xh0QQ_hN5oszfattB0ARfKXqFgNGShOQ60nedm5HFfWMIwV.SwNAIjSYj4 UIEaowEGSefblM0pFyTMoy.zVsl0yeCRSVqgsApLimv_etYs3sEm_u9zLo9r IVgdGRSJVg1fTwoSRZQyYWqPWsN5uRXWIbB4MEEgeEgPWQhIxabmAtHdL3da QkXzVeXnXvgAMp.sbbuHf3xmqdxPsbDAxYY6J0wg7eNZ0EBSzQqyXnRU6J8v Q2kIuNmE6bXlKF0VKIv9qTXNBgjD22mbutYiGiY.fPWdHNKGj8xib.CMoryY Rj0O455GhgakTdNSsy6yQbZlAu9WUxlCUUoSt28PMdORB66EkyinEKC57m3y B9RhaAZqUcTcnBdttQUXRfVR8BOvDB5juuq2h1OIHhyOup3P8Ieg4dF.qNLN H8eSGdfOOB5RSIqlTsKZNGT0m.PyJlXakaBBXlKZt7DBq0DYOMLV9LZ6xF1a DSMcNi30GGkMSenhmlz8q9B4WFbaRZpp15PI3ShHIWrlao3DQJgHMifnL0HQ v00rm7s_GRVbmjouniTAVqWYH7SKqzCzfHxfLJ6B0I4BfKcl2VtkugJgYU8p 347hLH2Kv1Y-
X-Originating-IP: [213.137.110.62]
Authentication-Results: mta1061.mail.ird.yahoo.com from=ups.com; domainkeys=neutral (no sig); from=ups.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO ups.com) (213.137.110.62) by mta1061.mail.ird.yahoo.com with SMTP; Thu, 09 Jun 2011 12:40:15 +0000
Received: from [146.210.74.22] by group21.345mail.com with QMQP; Thu, 09 Jun 2011 13:24:37 +0100
Received: from unknown (HELO mts.locks.grgtween.net) (Thu, 09 Jun 2011 13:23:38 +0100) by relay.2yahoo.com with QMQP; Thu, 09 Jun 2011 13:23:38 +0100
Message-ID: <69023A3A.8E011CA2@ups.com>
Date: Thu, 09 Jun 2011 13:23:38 +0100
From:
"UPS inc." <notifyneeob@ups.com>
Add sender to Contacts
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.0.2) Gecko/20030208 Netscape/7.02
X-Accept-Language: en-us
MIME-Version: 1.0
To: <archofdaniel@yahoo.co.uk>
Subject: UPS parcel information #203686
Content-Type: multipart/mixed; boundary="------------668443473377007766530464"
Content-Length: 54392
Message contains attachments
1 File (8KB)

* UPS mail.zipUPS mail.zip << UPS have confirmed a viral payload.
Advise from UPS:
Spam and Phishing E-mails Fraudulently Using the UPS Name or Brand
Fraudulent e-mails adopt many different forms and are the unauthorised actions of third parties not associated with UPS. These e-mail messages referred to as "phishing" or "spoofing" are becoming more common and may appear legitimate by incorporating company brands, colours, or other legal disclaimers. Help protect yourself by becoming familiar with these methods of fraud:


* Spam: Often referred to as "junk mail," spam consists of e-mail messages that are unsolicited by the recipient and that target the recipient with direct mail messages.
* Phishing: The term "phishing," as in fishing for confidential information, refers to a scam in which the sender attempts to fraudulently obtain and use personal or financial information.


Please be advised that UPS does not request payments, personal information, financial information, account numbers, IDs, passwords, or copies of invoices in an unsolicited manner through e-mail, mail, phone, or fax or specifically in exchange for the transportation of goods or services. UPS accepts no responsibility for any costs or charges incurred as a result of fraudulent activity.

Awareness and recognition of fraudulent letters, e-mails and phishing attempts is vital to protecting yourself against theft and other related crimes. Common indicators that an e-mail might be fraudulent include the following:


* Design Flaws: An e-mail containing distorted or irregularly sized logos
* Poor Grammar: Grammatical errors and excessive use of exclamation points
* Misspellings: Incorrectly spelled words or links to altered websites (For example, modifications or variations of the legitimate www.ups.com website address, such as www.unitedparcelservices.com.)
Note: UPS sends legitimate e-mail from several URLs, including ups.com and upsemail.com.
* Sense of Urgency: Alarming messages requesting immediate action, such as "Your account will be suspended within 24 hours." or "Contact us immediately to claim your parcel or prize."
* Unexpected Requests: A request attempting to obtain money, financial information (e.g. bank account or payment card numbers), or personal information in exchange for the delivery of a package or other article
* Communication Gaps: An e-mail that does not provide an alternative method for communicating the requested information (i.e. telephone, mail, or physical locations)
* Deceptive Link: A link contained within an e-mail that appears to direct your browser to a known, safe site but actually directs your browser to another location, potentially to an unsafe or fraudulent site. You can detect this by hovering over the link with your cursor. This causes the actual destination of the link to display in a pop-up, the lower left of your status bar, or other location depending on your e-mail client. It is suspicious if the actual destination does not match the address in the link. Also be suspicious of links containing numbers in place of letters, abbreviations, and slight misspellings in the link.


Some legitimate UPS communications may come in the form of an e-mail with an "epackage" link contained within the e-mail. These messages are designed to increase the protection around sensitive information, and the associated link will always start with https://epackage1.ups.com.
A legitimate UPS email will look something like this:
From: "UPS Quantum View" <auto-notify@ups.com>
To: you@your. email
Subject: UPS Delivery Notification, Tracking Number 1Z081Y0E0390634567
Note the "From" addy, & the length of the tracking number.
UPS will tell you in the body what's happening, & will not ask you to open an attachment.
 
Top