14Oct2011 – scam email supposedly from the Co-Op bank

Just had another phishing email, this time for the Co-Operative bank. They don’t stop do they? The email address to send scam or phishing emails that are ‘supposedly’ from the Co-Op Bank is ihaveseenascam@co-operativebank.co.uk. The headers are included after the email. The link to click on leads to http://anahaberler.xx/xxxxxxx.php. The email comes from spant@ptd.net. I have seen a few coming from ptd.net in the last few days. Maybe someone will shut them down quickly.

Surely the banks out there should send emails to their customers giving them info on this sort of thing and how to avoid them. And don’t click on links in emails. It is just as easy to type the address in if it is one you know to be safe, like http://www.co-operativebank.co.uk.

Email :

We are receiving complaints from our customers for unauthorised use of the Cooperative Online banking accounts. As a result we are making an extra security check on all of our Customers account in order to protect their information from theft and fraud. Due to this, you are requested to follow the provided steps and confirm your Online Banking Details

At Co-operative Bank, we take the job of protecting our customers very seriously, so for your protection we are proactively notifying you of this activity.

To restore access to your online banking please click on the link below.


Kind regards
Jayashree C
Co-operative Internet Banking Customer Support
Because email is not a secure form of communication, this email box is not equipped to handle replies.
If you have any questions about your account or need assistance, please call the phone number on your statement or go to Contact Us at http://www.Co-operative.co.uk

Headers :

——– Original Message ——–
From: – Fri Oct 14 01:31:37 2011
X-Account-Key: account4
X-Mozilla-Status: 1001
X-Mozilla-Status2: 00000000
X-Apparently-To: xxxxxxx@xxxxx via; Thu, 13 Oct 2011 09:49:02 +0000
Received-SPF: pass (domain of ptd.net designates as permitted sender)
X-YMailISG: karg6QQWLDv4FIfjyZm9qld_zjzLBijj_KLI_kNi14f6UJ8e RVSf_T6zGSIjuHvJk4d56aGVz6I5iV.x5CsgWBPAXbMhyI4BJM1mi2QzgZo. 9LhEgwBC_kyks068SD2TcxVnczm1ZkLMq3XjH4jRBycHsesf_OlvH8KI4hEP oUrQgxeCNldq2.mSRPoBJQNAkiS7VQBR5hHc8tZqXoFseZU7dhvdyGGPqBZL jE_TMY1dOEvxy61XL_E0sT6oT1vw3EuzBRT2D6QXT2F7Ab1szRVF6GGmgYgS ekSLy6C3.LMz8CcpPUmxktfFDPhTTAGcjUZCHOe8qkOTMlVlYm4ncTRD7b0w QQYeGg_Qqez5GwDkqc.7jUuOPrz1fG6HlU9XZT2teQG_Elw7SSLyzoitHm2L Hc2IaBRRXv5zrx_Xn.p7AuJ6D8BQSED1CRWmMtguTumwgN9XH75t8X9WH7iB FIErJf6l5cVv.aE65odZpgVX2jIqZ22_tzNZJvMeQdNGo8Lgn0P.bfIommQp RCPikEtdQ5V999ys8qvxylSME0kZ2tx8ANOtdMpeHARVLR73QfeFmYH0GnCV VFo3_6PrPrnrLrg7BkfgXHQw81JcoJnYCDcaYj2Gsjf6.SS7Kx1DB4qNyK4n ncm2OhrLQrgV7HJ_lWwJFAYLl9kp9X3i7qaUSqlfY94y8v1lcFMpNeUwAXB8 BjIso0hSBAXDw_vNlmrVEq9Y31rEdJeqjSAjWr6ib8GRUv3HJqKmmPNm0RUZ jRaJHMjL7smXPBEAPqMFcV48c3cRdDcel7etS43MFsfVIsGB54I6RoaHz9vf IQyHKxASZkSgflT2hmYNMZgRxtfdoEfaNL.lLDpz0ptMqDFfr2VYxXil8dRM DVdEm5P0NajaBc3ZyRDv4l_93UsMd141G0e4i9U6cFEn7OIzUyOhopSNv7tJ 4oQPleeUxjNKZbXLa3TSOfu.KHwbhyYJWdAC6f4yb466PaoOdLGbK6SO6Es5 DUnoTpytzHgY06ZDVyOpfV4rxEjFMXKDtdfB_DwTptMaFnnWeKqYnVVOfPDK 4L6YCgbPvDmZgltF9CvGff.uQDA7OkpVnaPmh5isSA3ODvlQb0FQt28WMFg1 QkzmWSKRmBeV7tXBZBr9BBJT2Sp1A9ce8XFxQqAZG0FYQuTsTAInZnUcjblP otyxwZhHFqHNj6YxuZNx0npDdZBRa4M3oyKlTUv.XgVJMIQQy0zspDdttHJm n6jUbcckikKEafU-
X-Originating-IP: []
Authentication-Results: mta1063.mail.ukl.yahoo.com from=ptd.net; domainkeys=neutral (no sig); from=ptd.net; dkim=neutral (no sig)
Received: from (EHLO proxyz14.mailnet.ptd.net) ( by mta1063.mail.ukl.yahoo.com with SMTP; Thu, 13 Oct 2011 09:49:00 +0000
Received: from localhost (localhost.localdomain []) by proxyz14.mailnet.ptd.net (Postfix) with ESMTP id 5741D1108F33; Thu, 13 Oct 2011 05:48:58 -0400 (EDT)
X-Virus-Scanned: amavisd-new at
Received: from proxyz14.mailnet.ptd.net ([]) by localhost (proxyz14.mailnet.ptd.net []) (amavisd-new, port 10024) with ESMTP id bnavupgvx3wx; Thu, 13 Oct 2011 05:48:57 -0400 (EDT)
Received: from User (unknown []) (Authenticated sender: tjhe) by proxyz14.mailnet.ptd.net (Postfix) with ESMTPA id 68E8D1108F42; Thu, 13 Oct 2011 05:48:20 -0400 (EDT)
From: The Co-operative
Subject: [Bulk] Important Message From Co-operative Internet Banking
Date: Thu, 13 Oct 2011 10:48:43 +0100
MIME-Version: 1.0
Content-Type: text/html; charset=”Windows-1251″
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
To: undisclosed-recipients:;

2 responses to “14Oct2011 – scam email supposedly from the Co-Op bank

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s