Wells Fargo Phishing Email

From WELLS FARGO Mon Nov 11 13:59:58 2013
X-Apparently-To: scamFRAUDalert via 98.138.213.179; Mon, 11 Nov 2013 wells fargo222:00:00 +0000
Return-Path: info@bankvrn.ru
X-YahooFilteredBulk: 120.151.242.178
Received-SPF: fail (domain of bankvrn.ru does not designate 120.151.242.178 as permitted sender)
X-YMailISG: 1Yep.lEWLDsXgrOpSEKUf5OEnWDJEFSDrmEsJ09aBSDZnGMd
sMABUzaicqE0asp.MQL1KH78J2ySaSVU31._sTn9ijwxl3uQco_bgVIP.oGY
3neQ7FUtHr4ZkNEX64FOIsb2oVDYpF4N9L4cBIcIzqh_zSyShbjXTqzgxIsQ
wTxhHfy2V9O5AYJS4wh0fjoflJ5a0ue57FB9IMJCLKxbRT2KOJrum3GrQcTO
QeZoWTeXceZC1jSd3h_hB5tkekUMa7G3b5Jfxlrez9E6gCHl1MGpQFkeQvHe
Zk8oBK0ru5ac7ySDIGRDhtqLWXyrUvOUF4h5ct3Wtn9mR9Z1mZicypYgJxrB
i_yoz53CQxeAZ235sAZ2jaWwX9euRo6Q2FpPvTyqa72JxErtnnwDw8uXY.ao
c4wyEWNYDw36R08OugbQLt6wx7DBx1wYrCeTS.bGWbm4lXUCYqQRnTDENOut
r00pewFTZLoeL1_MfzNxOIga6_nUDMd8vM9mqLo9__aH8esKw8r6oCQcF4SX
ro56umVscC1IhMeYVOlxO2h0m6IepKU5ni6Tl3pGFiKUUmOiS6lEGhnm.sfr
cch1NhGKU8LZcAW9fJn7JoiZwzA.XEi5GTMppVoC6NPEBj__EYJ_b0v5MtOS
EnG2KdotDqaKGw2OUVCasyHzAKj_9vN4wqB3eU1FJL4yk0YrgS_qM33WUuur
35PCUvmxm5wxA_ymix5CFZkTj0yob885JJyfmsAcHsZEJNm_1MShxMg.ImqL
ObrxBZpgbkj1NUoMgRsn7ydD5UAjaoMfmLhCz92_8ZHL72OtdAYXIt0WMIec
2UWhgaLvJvgyEPAHM4ZRbvUox.NuIbrmWTgKFOkj7wxRlZLkL_iYiQGLYOXL
i.XxV.porBI8pCPQTs4GJFZuNFLhMRyMXVH1OKZ47lC2loY3O6sbQ4aPahVD
K1LiRZX3MfZT3rGvTciMxQPZUOZIT5JNbnowgrO5yO1htfAAwM1tf6LThF5d
9tElzcGg0WLWN6UqN1WSXAeLqpKJlgukusBJnhD0YQ5fwYWYyIMmuqk3CubZ
qJiTegdLNEPs0kaUplcIE6tB_GjgCfUIbsn9clcJrIlr3c.BS10OiK2Gto5j
KoPDFhjup61yTVp6KtmU3Yp5IChmICG89EQ8r9fg6vIBqtLtIzBagPxNzOYA
zM11EJaQ8t6nFqqZrghOQC1LSctVsudvxCND69SEzWsml0tlLBWE.A6W_EEB
n3oNAVGCJYX63t1y.OWWKGYmlMjz_Lqps.4iUb8o3uOS.qFl6p6S2vSoKSnh
.qaQzI3k3lajbbC4pDJcIm6GXd3A
X-Originating-IP: [120.151.242.178]
Authentication-Results: mta1079.sbc.mail.ne1.yahoo.com from=; domainkeys=neutral (no sig); from=bankvrn.ru; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO velvet3.lnk.telstra.net) (120.151.242.178)
by mta1079.sbc.mail.ne1.yahoo.com with SMTP; Mon, 11 Nov 2013 22:00:00 +0000
Received: from [94.33.186.5] (account autokredit@gmail.com HELO rqpagecng.xxwjecxmscvirdr.biz)
by velvet3.lnk.telstra.net (CommuniGate Pro SMTP 5.2.3)
with ESMTPA id 382842493 for xxxxxxx; Tue, 12 Nov 2013 07:59:58 +1000
Date: Tue, 12 Nov 2013 07:59:58 +1000
From: “WELLS FARGO” info@bankvrn.ru
X-Mailer: The Bat! (v3.0.1.33) Educational
X-Priority: 3 (Normal)
Message-ID:8583197384.NL7UZE5A940258@vebnr.cdxzpwl.tv
To: scamFRAUDalert
Subject: Wells Fargo Advisors
MIME-Version: 1.0
Content-Type: multipart/mixed;boundary=”———-A09F4B5FBB5ED1A”
Content-Length: 25084

Email header analysis report
All valid IP Addresses found in the header.
Ip Address 3rd Party Info Provider City Flag Country
* 3.0.1.33 Check 3.0.1.33 at Senderbase.org Check 3.0.1.33 at Reputationauthority.org General Electric Company Fairfield United States
94.33.186.5 Check 94.33.186.5 at Senderbase.org Check 94.33.186.5 at Reputationauthority.org Tiscali Spa n/a Italy
120.151.242.178 Check 120.151.242.178 at Senderbase.org Check 120.151.242.178 at Reputationauthority.org Telstra Internet Brisbane Australia
98.138.213.179 Check 98.138.213.179 at Senderbase.org Check 98.138.213.179 at Reputationauthority.org Yahoo Sunnyvale United States

*Probable originating IP address

Please review attached documents.

Chloe_Milson
Wells Fargo Advisors
817-559-4662 office
817-358-9011 cell Chloe_Milson@wellsfargo.com

Investments in securities and insurance products are:
NOT FDIC-INSURED/NO BANK-GUARANTEES/MAY LOSE VALUE Wells Fargo Advisors, LLC is a nonbank affiliate of Wells Fargo & Company, Member FINRA/SIPC.
1 North Jefferson, St. Louis, MO 63103

CONFIDENTIAL NOTICE: The contents of this message, including any attachments, are confidential and are intended solely for the use of the person or entity to whom the message was addressed. If you are not the intended recipient of this message, please be advised that any dissemination, distribution, or use of the contents of this message is strictly prohibited. If you received this message in error, please notify the sender. Please also permanently delete all copies of the original message and any attached documentation. Thank you.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s