Fake American Airlines virus spam email Order # 9017937910 - Credit Card Approved

Fake American Airlines virus spam email states that you can download and print a ticket you purchased using the provided link.
Link downloads zip containing executable malware or a trojan horse.
 This email is NOT coming American Airlines or aa.com


Subject: Order # 9017937910 - Credit Card Approved   
 Your payment has been processed and your credit card has been charged.

 Please download and print your ticket from our website :
 https://www.aa.com/flightInformation/viewOrder.do?order_id=9017937910&flight=WA794019

 Below, you can find the order details and e-ticket information.

 FLIGHT NUMBER / WA794019
 DATE & TIME / May 11 2015, 13:30 CDT
 DEPARTING / Washington, DC
 TOTAL PRICE / $ 740.00

 For more information regarding your order, contact our technical support by visiting :
 http://www.aa.com/i18n/contactAA/contact-technical-support.jsp

 Thank you for flying with America Airlines.

Fake McInnis Construction malware spam email CITY OF PORT Arthur - STORM SEWER Project

Fake McInnis Construction malware spam email wants you to see the attachment, then sign and return it.
Attached .zip contains an exe virus or trojan horse.
This email is NOT coming from  McInnis Construction or mcinnisprojects.com
Do NOT call them or email them to tell them they have "been hacked" because even if they have, it has nothing to do with these emails.

Subject: CITY OF PORT Arthur - STORM SEWER Project  
 Please see attachment for contract.  Please sign and return.

 Thanks      

 Fred Stepp - Office Manager
 McInnis Construction, Inc.,
 675 South 4th Street
 Silsbee, Texas 77656
 email: fred @mcinnisprojects.com
 Phone: 409-385-5767
 Fax: 409-385-2483

    ApdtZGLaEfYm.zip (26)

Fake Deluxebase Ltd virus spam emails Invoice #00044105; From Deluxebase Ltd

Fake Deluxebase Ltd virus spam emails thanks you for your order and claims and invoice for the goodsis attached.

Attached .doc has macro to download malware.
These emails are NOT coming from Deluxebase Ltd deluxebase.com

 Subject: Invoice #00044105; From Deluxebase Ltd 
 Hello

 Thank you for your order which has been dispatched, please find an invoice for the goods attached.
 Please contact us immediately if you are unable to detach or download your Invoice.
 As a valued customer we look forward to your continued business.

 Regards
 Accounts Department
 Deluxebase Ltd
 UK Phone:                          01482 880050
 UK Fax:                               01482 883225
 International Phone:        +44 1482 880050
 International Fax:             +44 1482 883225
 accounts @deluxebase.com
 www.deluxebase.com

    ESale.doc (70)

Fake CHS Surety malware spam email claims they would like to meet you in a couple weeks

Fake CHS Surety malware spam email claims they would like to meet you in a couple weeks to get ideas about surety services for your company.
Attached .zip contains an exe virus or trojan horse.


Subject: Surety Bond Alternative 
  Hi:

 It was a pleasure speaking with you today.  We at CHS Surety would welcome the 
 opportunity to represent you.  
 As a brokerage, we represent numerous surety markets that we can approach if needed. 
 In case you aren’t aware of our company, CHS is a Fortune 100 company and has been 
 writing surety since 1938. We represent numerous utility contractors here in Texas 
 (many on the bidders list today).  I’ve personally been in the business for the past 
 25 years and have represent utility contractors so I understand the urgency at times 
 they find themselves when bids come in at the last minute for approval. With all 
 the construction opportunities here in Texas, it makes it even more important to have 
 someone that is close and able to meet at the last minute if needed.

 I would like to see if we can meet sometime in the next couple of weeks just to get 
 an idea of what we can offer in the way of surety services in the future for your 
 company or possibly work in a backup capacity. I’ve attached our “bond kit” much 
 of which you probably have already provided to Gallagher recently.  

 We can use their forms if you’ve just completed say a questionnaire or personal 
 financial statement for them. 
 
 Please feel free to contact me with any questions and hope you have a great week!

 Respectfully,
  
   4SFBsJpZlGFdk.zip (38)

Fake reliancescrapmetal.com virus spam email Self Bill SB026336 Attached.

Fake reliancescrapmetal.com virus spam email claims you will find a bill in the attachment.

Attached .doc has macro to download malware.
These emails are NOT coming from reliancescrapmetal.com

 Subject: Self Bill SB026336 Attached.
 Please Find Enclosed Self Bill Number SB026336 Dated 07/05/2015

 C Phillips
 enquiries @reliancescrapmetal.com

    Attachment.doc (57)


Header Examples:


Spoofs reliancescrapmetal.com in From and Envelope headers.
Received: from localhost [113.165.207.9]
   X-Envelope-From: enquiries @reliancescrapmetal.com
   From: "Reliance Scrap Metal" <enquiries @reliancescrapmetal.com>
   Subject: Self Bill SB026336 Attached.

Received: from [113.23.50.207]
   X-Envelope-From: enquiries @reliancescrapmetal.com
   From: "Reliance Scrap Metal" <enquiries @reliancescrapmetal.com>
   Subject: Self Bill SB026336 Attached.

Received: from abts-ap-dynamic-140.178.169.122.airtelbroadband.in [122.169.178.140]
   X-Envelope-From: enquiries @reliancescrapmetal.com
   From: "Reliance Scrap Metal" <enquiries @reliancescrapmetal.com>
   Subject: Self Bill SB026336 Attached.

Received: from [115.248.241.245]
   X-Envelope-From: enquiries @reliancescrapmetal.com
   From: "Reliance Scrap Metal" <enquiries @reliancescrapmetal.com>
   Subject: Self Bill SB026336 Attached.