1. "Phishing" Email IMPORTANT SECURITY NOTICE
! Importance: High
BancorpSouth Inview
IMPORTANT SECURITY NOTICE
All Users - Must Accept New Digital Security Certificate 2007 (Security
ISO Certification Consulting)
Customers of numerous banks have been victims of ACH and wire transfer fraud in recent weeks, resulting in the origination of unauthorized ACH entries and wire transfers from customers' computer systems.
BancorpSouth Enhanced Security Authentication
We have enhanced the BancorpSouth security access to further safeguard access to your account information.
IT IS VITALLY IMPORTANT THAT YOU REMEMBER AT ALL TIMES THAT THE SECURITY AND INTEGRITY OF YOUR CONFIDENTIAL INFORMATION AND CASH MANAGEMENT APPLICATIONS DEPEND UPON YOUR OWN COMPUTER SYSTEM BEING ADEQUATELY PROTECTED FROM OUTSIDE THREATS.
BancorpSouth now requires all InView users to enroll in our 2-way authentication security system, Passmark
You will be able to provide your Passmark information quickly and easily using our secure server web form.
Please understand that without promptly providing your Passmark information, your BancorpSouth Corporate Cash Management Online service may be discontinued.
To update your Passmark at this time, please visit our secure server web form by clicking the hyperlink below:
Login by clicking here:
2007 BancorpSouth Corporate Cash Management Online Passmark Services

2. Expanded Headers Return-Path: <Ivan.Watson@sarahcookdesign.com>
Received: from mail.ee.gatech.edu (mail.ee.gatech.edu [ ])
by imap.ece.gatech.edu (Cyrus v2.3.7) with LMTPA;
Tue, 23 Oct :12:
Received: from deliverator6.gatech.edu (localhost [ ])
by mail.ee.gatech.edu (8.14.0/8.13.7) with ESMTP id l9NHBmr ;
Tue, 23 Oct :11: (EDT)
Received: from home-d979407c2a ( broadband.corbina.ru [ ])
by deliverator6.gatech.edu (Postfix) with ESMTP id 8E592186F
for Tue, 23 Oct :57: (EDT)
(envelope-from
Date: Tue, 23 Oct :14:
From: "BancorpSouth support"
Reply-To:
Message-ID:
To:
Subject: BancorpSouth Corporate Management Privacy and Security Notice
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=" BF674444B821A0"

3. Expanded Body - Actual URL in Red, Domain Bold
IMPORTANT SECURITY NOTICE</b></font></strong></p> <p><b><font face="Arial" color="#FF0000">
All Users - Must Accept New Digital Security Certificate 2007 (Security ISO Certification Consulting)</font></b></p> <p><font face="Arial">
Customers of numerous banks have been victims of ACH and wire transfer fraud in recent weeks, resulting in the origination of unauthorized ACH entries and wire transfers from customers' computer systems.</font></p> <p><font face="Arial">
BancorpSouth<strong style="font-weight: 400"> Enhanced Security Authentication<br>
We have enhanced the </strong>BancorpSouth<strong style="font-weight: 400"> security access to further safeguard access to your account information.</strong></font></p>
<p><strong style="font-weight: 400"><font face="Arial">IT IS VITALLY
IMPORTANT THAT YOU REMEMBER AT ALL TIMES THAT THE SECURITY AND INTEGRITY OF
YOUR CONFIDENTIAL INFORMATION AND CASH MANAGEMENT APPLICATIONS DEPEND UPON
YOUR OWN COMPUTER SYSTEM BEING ADEQUATELY PROTECTED FROM OUTSIDE THREATS.</font></strong></p> <p><strong style="font-weight: 400"><font face="Arial">
BancorpSouth now requires all InView users to enroll in our 2-way authentication security system, Passmark.<br>
You will be able to provide your Passmark information quickly and easily using our secure server web form.<br>
Please understand that without promptly providing your Passmark information,<br>
your BancorpSouth Corporate Cash Management Online service may be discontinued. <br><br>
To update your Passmark at this time, please visit our secure server web form by clicking the hyperlink below:</font></strong></p> <p><font face="Arial" size="4" color="#FF0000">
Login by clicking here: </font>< strong> <a href="
<font size="4">
</font></a></strong><strong style="font-weight: 400"><br><br>
2007 BancorpSouth Corporate Cash Management Online Passmark Services

4. To access the form for your tax refund, please click here * Regards,
From:
Subject: Tax Refund
Date: Wed, 24 Oct :29:
After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $ Please submit the tax refund request and allow us 6-9 days in order to process it.
A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.
To access the form for your tax refund, please click here *
Regards,
Internal Revenue Service
© Copyright 2007, Internal Revenue Service U.S.A..
* <

5. Return-Path: <refund.-acc@irs.gov>
Received: from mail.ece.gatech.edu (mail.ece.gatech.edu [ ])
by imap.ece.gatech.edu (Cyrus v2.3.7) with LMTPA;
Wed, 24 Oct :39:
X-Sieve: CMU Sieve 2.3
Received: from mail1.wiworks.com (91408-mail1.wiworks.com [ ])
by mail.ece.gatech.edu (8.14.0/8.13.7) with ESMTP id l9OKd9eR014125
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT)
for Wed, 24 Oct :39: (EDT)
Message-Id:
Received: (qmail invoked from network); 24 Oct :29:
Received: from unknown (HELO User) ( )
by with SMTP; 24 Oct :29:
From:
Subject: Tax Refund
Date: Wed, 24 Oct :29:
#whois (nslookup -> no known DNS name)
person: Chingaru Silviu Ionut
address: Link2U
address: Str. Calea Bucuresti, Bl. H2D, Parter
address: Targoviste, Dambovita,
address: RO
phone:

6. Install "dig" for MS Windows (better than "nslookup")
This will also install "whois" for Windows.
"Command Prompt" (like UNIX Terminal) is run as:
Start .. Run .. then type "CMD"
or find the file and double click
%systemroot%\system32\cmd.exe