attempted lloyds-TSB phishing scam from IP 18.104.22.168 (Source Host22.214.171.124.cablelink.rdsar.ro)located in Arad, Romania.
Fraudulent email contains phishing link to http://www.ilam-telecom.ir/public/css/hlloyds.html . (DO NOT CLICK ON LINK!)
ISP: Romania Data Systems
Host Name: 126.96.36.199.cablelink.rdsar.ro
Organization: Romania Data Systems
Location: Arad, Arad 02, Romania
Received: from pokrzywno.pl ([188.8.131.52]) by BAY0-MC2-F11.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Sun, 26 Aug 2012 14:17:25 -0700
Received: from [184.108.40.206] (helo=User)
by pokrzywno.pl with esmtpa (Exim 4.69)
id 1T5lIK-0002oo-Na; Mon, 27 Aug 2012 00:27:00 +0200
From: "Lloyds TSB"
Subject: Unauthorized Access
Date: Mon, 27 Aug 2012 00:17:02 +0300
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-OriginalArrivalTime: 26 Aug 2012 21:17:26.0301 (UTC) FILETIME=[310D64D0:01CD83D0]
We recently have determined that different computers have logged on to your Online Banking account and multiple password failures were present before logons.
We now need to re-confirm your account information with us.
If this is not completed by August 27, 2012 we will be forced to suspend your account indefinitely, as it may have been used for fraudulent purposes.
We thank you for your cooperation in this matter.
click here immediately to verify your identity and automatically reverse the change.
Please do not contact us directly as this issue is mainly processed by our Online Banking System.