RSS

Monthly Archives: October 2012

Rev.Mrs.Sandra Morgan sandramorgan3@hotmail.com

Email Scammer AND Possible HACKER

IP:  98.136.216.151 – Project Honey Pot has also detected malicious scam behavior and possible phishing attacks relating to this IP address. ” The Threat Rating is a metric that describes how dangerous an IP is based off its observed suspicious activity. These activities include sending spam messages, performing dictionary attacks, harvesting addresses, posting spam comments to web forms, hosting bad web pages (phish sites, etc), and breaking nofollow or certain robot.txt rules. ”

Name: (Mrs.) Sandra Morgan

Email-Address: sandramorgan3@hotmail.com

Subject: “Rev Mrs. Sandra Morgan” <sandramorgan3@hotmail.com> sandramorgan711@yahoo.es

Email: 

From Rev Mrs Sandra Morgan, Kindly view the memo for more info and get back to me ASAP

(A link/document was also sent a but I wasn’t comfortable clicking it nor posting it.)

____________________

76.164.223.67 ↔ This e-mail address is also a threat and associated with Nigerian Scammers – Below is a list of IP’s and Usernames/EmailAddresses Associated with this IP

Associated Harvesters
61.209.182.171 | H
220.104.111.43 | H
220.209.92.10 | H
61.120.171.99 | H
58.93.60.43 | H
219.66.235.234 | H
124.100.242.218 | H
211.3.203.142 | H
207.58.242.51 | H
216.40.222.50 | H
87.118.98.62 | H
74.86.14.10 | H
61.12.159.10 | H
124.87.239.201 | H
210.197.231.224 | H
221.189.176.140 | H
211.3.202.189 | H
211.3.148.18 | H
58.1.134.137 | H
61.192.206.8 | H
210.159.185.76 | H
211.3.201.184 | H
221.187.26.77 | H
211.3.197.133 | H
58.93.52.120 | H
58.1.137.191 | H
211.3.150.226 | H
61.197.40.208 | H
221.191.123.113 | H
221.191.98.148 | H
211.3.149.19 | H
220.102.212.9 | H
211.3.197.244 | H
222.148.27.140 | H
210.159.185.248 | H
61.12.154.89 | HS
222.149.220.4 | H
203.141.139.66 | H
60.42.120.21 | H
122.16.111.96 | H
220.145.66.254 | H
220.212.121.156 | H
61.192.203.55 | H
60.42.121.62 | H
221.191.100.238 | H
221.187.33.151 | H
60.35.184.189 | H
61.194.3.241 | H
61.197.106.97 | H
211.3.148.38 | H
210.159.162.224 | H
61.209.182.88 | H
210.196.117.232 | H
219.66.233.209 | H
60.238.228.252 | H
60.39.204.165 | H
210.159.162.152 | H
210.159.164.35 | H
219.116.155.150 | H
60.41.42.46 | H
60.236.76.181 | H
58.93.58.112 | H
61.201.27.78 | H
61.192.190.165 | H
61.201.27.187 | H
211.3.202.95 | H
61.192.203.48 | H
211.3.198.197 | H
61.209.182.129 | H
219.66.234.219 | H
220.98.187.188 | H
61.201.27.254 | H
218.43.35.206 | H
211.3.200.161 | H
220.104.131.236 | H
IPs In The Neighborhood
76.164.222.99
76.164.222.104 | D
76.164.222.119 | SC
76.164.222.132
76.164.222.137 | S
76.164.222.138 | S
76.164.222.154 | S
76.164.222.162
76.164.223.54 | SDC
76.164.223.57 | SD
76.164.223.68 | SDC
76.164.223.69 | SC
76.164.223.73 | S
76.164.223.76 | SC
76.164.223.77 | C
76.164.223.80 | SC
76.164.223.81 | SDC
76.164.223.83 | S
76.164.223.89 | SD
76.164.223.92 | S
76.164.223.93 | S
76.164.223.99 | SC
76.164.223.100 | SDC
76.164.223.101 | S
76.164.223.104 | S
76.164.223.107 | S
76.164.223.113 | S
76.164.223.117 | SD
76.164.223.122 | S
76.164.223.124 | S
76.164.223.166 | S
76.164.223.175 | S
76.164.223.180 | SD
76.164.223.198 | D
76.164.223.200 | SD
76.164.223.216 | SC
76.164.223.219 | S
76.164.223.220 | S
Sample Spam URLs & Keywords Posted From 76.164.223.67
Domain: blackscissors.org
URL: http://blackscissors.org/forum/showthread.php?26109-salg-billige-Silagra-piller&p=26140#post26140
Domain: www.narproducerattidaholm.se
URL: http://www.narproducerattidaholm.se/forum/viewtopic.php?f=4&t=89925
Domain: slideweb.fr
URL: http://slideweb.fr/showthread.php?tid=10290
Domain: www.teenmentalillness.org
URL: http://www.teenmentalillness.org/index.php?topic=82103.new#new
Domain: forum.sotkov.cz
URL: http://forum.sotkov.cz/viewtopic.php?f=2&t=158059
Domain: rxdoctoronline.com
URL: http://rxdoctoronline.com/pictname/diflucan.jpg
Domain: rxdoctoronline.com
URL: http://rxdoctoronline.com/buy-diflucan-dk.html
Domain: www.alcatraz0572.be
URL: http://www.alcatraz0572.be/phpBB-3.0.2/phpBB3/viewtopic.php?f=2&t=18519&sid=605025174e220963ca42c615 …
Domain: ifthisismotherhood.com
URL: http://ifthisismotherhood.com/parentadvocate/viewtopic.php?f=1&t=114613
Domain: www.tiempodecriar.com
URL: http://www.tiempodecriar.com/foro/viewtopic.php?f=10&t=9725
Domain: bloodguild.org
URL: http://bloodguild.org/viewtopic.php?f=6&t=109560
Domain: redroid.blogja.net
URL: http://redroid.blogja.net/forum/viewtopic.php?f=23&t=149483
Domain: rxdoctoronline.com
URL: http://rxdoctoronline.com/pictname/zithromax.jpg
Domain: rxdoctoronline.com
URL: http://rxdoctoronline.com/buy-zithromax-dk.html
Domain: www.exponenteducation.com
URL: http://www.exponenteducation.com/node/2883
Keywords: kennel cough and amoxicillin successive
76.164.223.67’s User Agent Strings
Mozilla/0.6 Beta (Windows)
Mozilla/4.0 (compatible; MSIE 4.01; Digital AlphaServer 1000A 4/233; Windows NT; Powered By 64-Bit Alpha Processor)
Mozilla/4.0 (compatible; MSIE 5.0; Windows 2000) Opera 6.0 [en]
Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 4.0; .NET CLR 1.0.2914)
Mozilla/4.0 (compatible; MSIE 6.0; Update a; AOL 6.0; Windows 98)
Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)
Mozilla/4.76 [en] (Windows NT 5.0; U)
Mozilla/4.79 [en] (Windows NT 5.0; U)
Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.165 Safari/535.19 YI
Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.63 Safari/535.7
Mozilla/5.0 (Windows NT 5.1; rv:14.0) Gecko/20100101 Firefox/14.0
Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0
Mozilla/5.0 (Windows NT 5.2; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.1634 Safari/535.19 YE
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.165 Safari/535.19 YI
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.121 Safari/535.2
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.52 Safari/536.5 Comodo_Dragon/19.1.0.0
Opera/7.54 (Windows NT 5.1; U) [pl]
Opera/9.00 (Windows NT 5.1; U; en)
Opera/9.01 (Windows NT 5.1; U; en)
Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.00
Opera/9.80 (Windows NT 6.1; U; ru) Presto/2.10.229 Version/11.61
Example Messages Sent From 76.164.223.67
From:”‹´��û ‚¢‚±‚¢” <op5ifu2nnh@hotmail.com>
Subject: “ダメ男を買う”イ
From:”’‡��c Ž��–ë��T” <tqhr7h83yl@docomo.ne.jp>
Subject: =?ISO-2022-JP?B?GyRCSH49dyRyS=?=
From:”ì��£ —R“ß” <d8oegspfnh@willcom.com>
Subject: 話題の逆援コミュニティ
From:”�ᏼ �g�T” <r5tqjudmcl@willcom.com>
Subject: ■不倫の出会い掲示板(
From:”�㐙 ����” <nqkm6z3wm6@msn.com>
Subject: 貴方にあったセフレを無
From:”•l��è ��ؖȎq” <pkjnbxh9vf@docomo.ne.jp>
Subject: 貴方の時間をお金で買わ
From:”•Ð��ª –¾ˆßŽq” <pso4rdn1pn@docomo.ne.jp>
Subject: 史上初!!先振込みの逆
From:”���� ����” <ii86l9oq47@willcom.com>
Subject: あなたがH目的なら無駄
From:”’r��{ ‘½ˆ��” <ll70xaqbez@livedoor.com>
Subject: 今晩5万円でお相手して
From:”¬��c“‡ Ž” <oalhy9nkgx@yahoo.com>
Subject: あなたの時間を売ってく
From:”¼��ì Žì‹P” <udsewkvuap@docomo.ne.jp>
Subject: 旦那以外の方と…
From:”���X �[��” <orhdnlol1g@ezweb.ne.jp>
Subject: 即愛はいかが?
From:”’ç ˆÇ‹|” <banamwccxd@msn.com>
Subject: 大人気のSTAR-CAS
From:”���� �ԓގq” <hcrmzpijqx@yahoo.com>
Subject: =?ISO-2022-JP?B?GyRCJCpGQCRKGyhCQi1DQVMbJEIlKyE8JU=?
From:”�΋� ���Ƃ�” <ktejbvfxmm@docomo.ne.jp>
Subject: 限定販売!便利なB-C
From:”…��ì Žé”T” <zk360a6l@docomo.ne.jp>
Subject: 夢のカードが、今なら特
From:”•l��û ��ѓތb” <i2b1nyyt@i.softbank.jp>
Subject: =?ISO-2022-JP?B?GyRCOiMhIkJ=?
From:”‘q��{ ¬—t” <zus9qfit@softbank.ne.jp>
Subject: =?ISO-2022-JP?B?GyRCJUYlbCVTJE4lQSVjJXMlTSVrJHIbKE=?
From:”�镔 �x�D” <f9udtjsp@docomo.ne.jp>
Subject: 全てのチャンネルが制限
From:”���� �P��” <q1coqz6p@ezweb.ne.jp>
Subject: スカパー!全有料チャン
From:”‚”¨ t“Þ” <n3foeznnxu@i.softbank.jp>
Subject: 【半永久】半永久的に使
From:”‹àŽR ��mŠG” <7oichpls@mail.goo.ne.jp>
Subject: =?ISO-2022-JP?B?GyRCJDMkbBsoQjEbJEJLZyRHQTQkRiROJU=?
From:”Elva —R��üŽq” <tuotsbbwxrvmrj@goomeil.com>
Subject: avxezrzfae@ezweb.ne.jp
From:”Silas ŒbŽq” <ovlkdazex@goomeil.com>
Subject: qmckkf@yahoo.co.jp
From:”Alexis Œ‹Žq” <iflwflsiimhwdu@yahoo.com>
Subject: zjswekt@goomeil.com
Example User Names Used By 76.164.223.67
User-name: eslie.hubler
User-name: istan_c_cabanela
User-name: archive1_1963
User-name: aratyfus_1964

 

 

Header:

Return-Path: <sandramorgan3@hotmail.com>
X-YahooFilteredBulk: 98.136.216.151
Received-SPF: softfail (transitioning domain of hotmail.com does not designate 98.136.216.151 as permitted sender)
X-YMailISG: jJ0QtIEWLDv_WDdKEHNBtLRVf.cuyLK58wwtme64dCer.zJl aQF6QYPEtjfmg9IzTHRPezMFoNle7UyMF.k3hoMT1JqqkWXYk31Ryzq3Olag htLZOkTeYzuJGnskOb5NNGQ.l8h4xOVJUaFlX9bxnK52gOONrBO45P7GfObo LtzfZODJb.ni.0raEZ1S_CLxTVaPRHaCLJ9zeBv2IRk_48eonWDoGM.yZXmD eLQJ5yEdYVZSYGxQuQ7iSRp4W9p_6745FX6rw1L6ss8a.VCt265jnFYTJCgm HsNEVcAva_tfe7gnN8Dy11IZ9Mt3UzFjRRyEIxgJVl8Nz5dGP_yIyV6ZhHnJ HrBn6HBpYOk_T0g_v7ojeTNCLfZyAKQBL09fe6l0WclHbBjqMkGMnRoBrjzq TFRJ.IFKhIQtva3YXMubvzwTKq1Dbv.fnjDbaauFFOvBU2arWr6m76rnJtza h4Yw2xXVttSt79PkZgdkCqZANYKIhre77bsoLMdw6Bdcw3vpitvbCj2c.8vC UpBnP6bbRBQXZXNFzVgqPh2G6xtCd_8AbBx9yGDRzsPziIwGXx_iNgCW6YhS 4PbcuEhWrqa80vMl802UZCfQTxoxxTRsai7rndIwcZ6Lt8h3PwN6Toz5pq.L buQ_hXfucVOmCu.PmE3edojpHkwgMddseoxzITCMxJLlA2guTJplMBvDSfj7 4EKTtaPCxKzLdeFHJdKf1h8X.nWuQZXSWhtY1DsCpHQiKMV3okF0gCRTpZQ9 ONsMoiOgm_OWP1lWKY3EsK_Tl3PaWvW_hCvfeto0MWqy_w.mhLrlSoe6Yj.o chfgP3sy2s1LhpDnFDilmgu4iYWYlXw2r_wgDfLAAt6.SKKnjv1WTeVnc_3p RjfW_lAYfGa.ODOqupEqaXAAzNfByNNLFC.2s3qHC6hiDPl9iyBzDqHkVUqG djDbb2Kh6k8LVyBR.TS8uKv71iiUr1BQ65gfDLXLMZEuOJmq1c7PELdX2rbX ex3KBFEPvfq7G1.kmqIvWZE8wcBsq0MmULPabYQEHFyz8ZTXqL2b_m.qOSer 4NyQW9xcQyYFTCLgJ6ICVX2EtyT1hSxbXYP.2hOxQK92OsaUYT6YQ3.4.4Fl 30AVc0U9AF7Swc4o810pBeMGRMWPubBW391GZvZSK9sHuAhREK3vO7MkdM1j lKnK8PCYEuDzamgGsYImRqn5O1rwwTZ5EnY9TFbhHmGW
X-Originating-IP: [98.136.216.151]
Authentication-Results: mta1243.mail.sk1.yahoo.com from=hotmail.com; domainkeys=neutral (no sig); from=hotmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO nm27-vm8.bullet.mail.gq1.yahoo.com) (98.136.216.151) by mta1243.mail.sk1.yahoo.com with SMTP; Thu, 18 Oct 2012 01:52:11 -0700
Received: from [98.137.12.55] by nm27.bullet.mail.gq1.yahoo.com with NNFMP; 18 Oct 2012 08:52:09 -0000
Received: from [98.136.185.47] by tm15.bullet.mail.gq1.yahoo.com with NNFMP; 18 Oct 2012 08:52:08 -0000
Received: from [127.0.0.1] by smtp108.mail.gq1.yahoo.com with NNFMP; 18 Oct 2012 08:52:08 -0000
X-Yahoo-Newman-Id: 920957.30208.bm@smtp108.mail.gq1.yahoo.com
Message-ID: <920957.30208.bm@smtp108.mail.gq1.yahoo.com>
X-Yahoo-Newman-Property: ymail-3
X-YMail-OSG: RCeCcIQVM1muyrgHf8tFbAK_TyyCFBtb0IJdtseZjnsWyd1 k4f1DlPremX9ocgnXNu1rIc5pccsyZaZSTdynHvW3Qjy6GkDsGjiACqQJq3m ePy_3Q68lIyXqbwRM6FlvnRYkWjr58eWhphr0Fl1KcBbH1fN_a.T7BUlxILc O_dZ09vj1XwYfVCUsYSwO646Tlv6HROuZ8rCQQ.5IgCIGThMZgjLuDhU0Jfn p.ROAkfB4y1wdN3L34OjNvs6OQBaQf_TVeiwOTAZ.iuOFI2cDPoDWo_.idv6 khYgPN7MtLJqtwuSqiR8QhSGmEPqfn886pIKt4M84xk72TbKnygvITRrZHTC l_bJhhXE5kcPXmYw4npOotVo6hOgoo94gQvpjNE4yBFwTRwOX_M43P5V3oTk Fz7yj7vX4mg4Uda.I85WlRlChLKqexP70TNKAymX7zNhf
X-Yahoo-SMTP: rcUwqs.swBCs4f4vwoVy9tuv4a_36owJ2kQYl6t9GG.H0B7U
Received: from User (sandramorgan3@76.164.223.67 with login) by smtp108.mail.gq1.yahoo.com with SMTP; 18 Oct 2012 01:52:08 -0700 PDT
Reply-To: <sandramorgan711@yahoo.es>
From: “Rev.Mrs.Sandra Morgan”<sandramorgan3@hotmail.com>
Subject: From Rev.Mrs.Sandra Morgan,Kindly view the memo for more info and get back to me.ASAP
Date: Thu, 18 Oct 2012 09:52:06 +0100
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary=”—-=_NextPart_000_010C_01C2A9A6.43814626″
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Content-Length: 4220
 

Tags: , , , , , , , , , , , , , , ,

“Mark Wellington”

Employment (Job) Scam – ”Work At Home” Scam

Nigerian Scammers information below:

Name: Mark Wellington Email-Address:  Adminjob@aol.biz <> admnjobj@aol.com (replyto-emailaddress)

168.234.191.26 ↔ IP-Address in this email has been black-listed and Project-Honey-Pot (PHP) has detected malicious behavior as well. To view other usernames and email-addresses associated with this IP/Scammer, then please click: 168.234.191.26

198.12.80.73 ↔ Yahoo (my email server) has warned me that this IP ”might be forged” – I already suspected it was.

Subject: Need a job?

Email: If you have access to a computer, and have up to three hours spare time per-week. you can get paid, would you like to work part or full time online, and get paid weekly? If yes,then please read carefully.

_____________________________________________________________________
ABOUT US
______________________________________________________________________
Asin Europe is a diverse wholesale distributor with operations spanning multiple
business groups. The company is ranked as one of the largest plumbing
wholesalers in North America. Ferguson is also the industry’s second largest
distributor of pipes, valves and fittings, waterworks, and heating and cooling
equipment in North America.
______________________________________________________________________
JOB POSITION
_______________________________________________________________________
We are currently seeking part or full time employees for our ever-growing
accounts receivable department. Through extensive demographic research, we have
discovered a wealth of untapped human resources that, for one reason or another,
need the freedom to work from home. If this sounds like you, please read on,
and consider becoming part of our company family.
As part of our ongoing Multi Level Marketing Network,we seek capable
individuals to work for us as our representative.You can easily make $700-$2000
or more in a week by working for us as a Sub-contractor in your geographical
location, you will be in charge of collecting payment on behalf of our
affiliates and Small business organizations that are registered under us. Does
it sounds like your dream job? Well, it certainly does for 10,000+ current
members who are making $700 – $2,000 weekly online with this system.
Note that no form of investment is needed from you and this job will take only
1-3 hours of your time per week.
______________________________________________________________________
JOB RESPONSIBILITY
_______________________________________________________________________
The position of Accounts Receivable Officer entails the following duties:
1. Co-ordinate payments from our clients.
2. Receive payments which come in form of certified checks or united states
postal money orders, process payments at your local bank, and forward 90% of
funds received to the proper branch office, as instructed. The remaining 10% is
your wage. Since this position is need-based, you will have plenty of free time
while enjoying a good income.
___________________________________________________________
REMUNERATION
___________________________________________________________
For every assignment in form of payment received from our clients, you’re
entitled to 10% which excludes the cost of processing western union to any
regional office accountant
Also you get a monthly salary of $1000 which comes at the end of every month,
plus other incentives and benefits that accrue, which includes tax-free
holidays.
________________________________________________________________________
INTERESTED APPLICANTS (HOW TO APPLY)
Interested applicants should fill out the required details below and send back
so that one of our Human Resources Managers can contact you via email with an
approval letter if the management decides you are a successful candidate.
Please specify the best way to contact you in your reply email.
Details Required:

FIRST NAME:
LAST NAME
ADDRESS LINE 1 (Not P.O Box):
ADDRESS LINE 2:
CITY:
STATE:
COUNTRY:
ZIP/POSTAL CODE:
HOME PHONE:
CELL PHONE:
GENDER:
AGE:
NATION OF ORIGIN:
HAVE YOU RESPONDED TO A SIMILAR OFFER LIKE THIS? IF YES,WHAT WAS THE OUTCOME :
CURRENT JOB :( If Any)
NOTE: A COPY OF YOUR RESUME SHOULD BE INCLUDED IF AVAILABLE.
We appreciate your interest in Aisin Europe Ltd.
Mr Mark Wellington
Human Resources Department,
Aisin Europe ltd,
223 campobello ave
North las vegas,
nv 89081 USA
REPLY TO……………admnjobj@aol.com

Read the rest of this entry »

 
 

Tags: , , , , , , , , , , , , ,

“Red bull”

RED-BULL IMPOSTER – EMPLOYMENT SCAM

Name/Email-Address: Red bull <> admin@redbull.com <> redbull.promousa@att.net

Subject: ***Red Bull Auto Wrap Decal Promo***

Email: RED BULL energy drink is looking to hire candidates for the up coming promo on Auto Wrap Decals. Interested people should please get in touch with us on email atredbullpromousa@att.net to apply and get more information on this job openning. Please note that the position is opened until the amount of people wanted had been choosen.

Header:

Return-Path:   <admin@redbull.com>
X-YahooFilteredBulk:   64.202.189.171
Received-SPF:   none (domain of redbull.com does not designate permitted sender hosts)
X-YMailISG:   T.ylaU0WLDuqGPokP9TNstD18uFUkZjvD5WqnxKQnPI0xm1q fA980gORQJ2G8JWDDiCcR844dxBJI4jiqXeFJe3dOTxengEgCMO.tI.ATUad hTiKe5pQFsiopmN_K5mUTTVTOzQgXU1iGFQIMOgCNhKGTRyd5F8C6byl9lJF z08gXJoypx4XLUdmMePUvBEUoQSJQT2fuUovhnQIiv_WVLn8gb.WcwceRuLB AQ8E0T6AfuLHLYcVGlIwd0KZFUK275fGDWMa2RLsX0Z5PL3EWq_zxRBXCCDa 0Bg9KKrv_x0LLIOU4iUlQ7NJ1t_KaYPTcW714o51N1Sv1TNvrZbCwb.KKOj2 d0I50AaR0Ffuu.fGu41KHXu_He.C.80MNuqA5mxDz4HWFuAkMnPh9JhvNBFe tm9CrvX9MyM6ANk0xj9oFIEvuttXgzQpa5MqMwXTMuKDWVhcYqXx8Fteng20 vemzefR7y4kCLwK32kcvWo1WpCbrTv34N4vlaEsGJn.ndBi90lG.rQlhdQ5w QIcypbeGhWnZ0BULlDr6vNl9jvs4BlTih469CRnhoxv6aaJSA1VXIqVO_VZe p47sFuhD2R3WbonnJNnbCBDZ8qRYSyctY6KfNoW75tsX9Wwh9KDmHMNRl1cd YlosmMC4NHz7WhfqfFyXT87pj07H2F90vKAYR05egjENnCCXFw2hr9CZAlSm KD_nbN9OrJuE1RgSXZtK8UiN2wqG8cwFkUeTo8um6vT6fTOdbyQASuFaPug9 w_Db85shTS0G8MGBQ0N.A4czkKbmsB3nckBNndQJxT6IPRf1e.EB3o3JDMzb w.pmsyOPxeSqoVPAmr.yUCRZdoeY8lkBfomk52HK_p4_w1OJskbQ0rCdCKpv AJOlwFJP_AJUhiRdKkPcqubAhmIF62swKd9Z2JetDPtj4e.YY6TpjjR1eySE 8O7eA9MoaoKfOC5R2cPhXu5iQkJHNoDa6rN_KAU.kjQ1MypsF99tjOPT5fhh oAHWSCHHkofmd5BVrmS6.l1QixYm62qbqIHcvCdADeRihAiT5UxlWGocQU_9 wtLzIGcGhBGG0qKys54YbKvIxSnqh7hh4dq17gFXWu1qRUuVAFEaEE_LNTUj 1EmezQWlyhPHTCstMzLsAfjfjKFfudKYL5MzraLl.a4O9qdrePab_XBDoNd0 n2mPRVgjLBz.AnaL.HGtMwt9uolwOlSIbMerRvNiRNqhjXnephe9S0ver5ZM nf7vFU865QLkvM9NV5Gy8G_xUVM7819bOWEMk.i3lc6dA0VP0rvTckQv8Wlm
X-Originating-IP:   [64.202.189.171]
Authentication-Results:   mta1205.mail.sk1.yahoo.com from=redbull.com; domainkeys=neutral (no sig); from=redbull.com; dkim=neutral (no sig)
Received:   from 127.0.0.1 (HELO k2smtpout03-01.prod.mesa1.secureserver.net) (64.202.189.171) by mta1205.mail.sk1.yahoo.com with SMTP; Thu, 18 Oct 2012 04:05:14 -0700
Received:   (qmail 26171 invoked from network); 18 Oct 2012 11:05:13 -0000
Received:   from unknown (HELO ip-118-139-163-87.ip.secureserver.net) (118.139.163.87) by k2smtpout03-01.prod.mesa1.secureserver.net (64.202.189.171) with ESMTP; 18 Oct 2012 11:05:13 -0000
Received:   (qmail 21631 invoked from network); 18 Oct 2012 10:42:27 +1100
Received:   from 68-116-17-66.static.knwc.wa.charter.com (HELO User) (68.116.17.66) by ip-118-139-167-155.ip.secureserver.net with ESMTPA; 18 Oct 2012 10:42:26 +1100
Reply-To:   <redbull.promousa@att.net>
From:  
“Red bull”<admin@redbull.com>  
Subject:   ***Red Bull Auto Wrap Decal Promo***
Date:   Wed, 17 Oct 2012 16:41:50 -0700
MIME-Version:   1.0
Content-Type:   text/html; charset=”Windows-1251″
Content-Transfer-Encoding:   7bit
X-Priority:   3
X-MSMail-Priority:   Normal
X-Mailer:   Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE:   Produced By Microsoft MimeOLE V6.00.2600.0000
Content-Length:   335
 

Tags: , , , , , , , , ,

Suzana Davis s_davisx0003@yahoo.co.jp s_davisx00001@yahoo.co.jp

FRAUD ALERT: DONATION / CHARITY SCAM – NIGERIAN 419 SCAMMER

Name/Email-Address: Suzana Davis <s_davisx0003@yahoo.co.jp> ReplyTo: s_davisx00001@yahoo.co.jp

Subject: Re: GREETINGS IN THE NAME OF OUR LORD JESUS CHRIST.

Email: BELOVED

GREETINGS IN THE NAME OF OUR LORD JESUS CHRIST

I AM MRS SUZANA DAVIS FROM KUWAIT, A WIDOW TO LATE MR JOHNSON DAVIS NOW A NEW CHRISTAIN CONVERT, SUFFERING FROM LONG TIME CANCER OF THE BREAST, FROM ALL INDICATION MY CONDITIONS IS REALLY DETERIORATING AND IT IS QUITE OBVIOUS THAT I WON\’T LIVE MORE THAN 2 MONTHS, ACCORDING TO MY DOCTOR, THIS IS BECAUSE THE CANCER STAGE HAS GOTTEN TO A VERY BAD STAGE. MY LATE HUSBAND DIED LAST TWO YEARS,AND DURING THE PERIOD OF OUR MARRIAGE WE COULD\’NT PRODUCE ANY CHILD.

MY LATE HUSBAND WAS VERY WEALTHY AND AFTER HIS DEATH, I INHERITED ALL HIS BUSINESS AND WEALTH. THE DOCTOR HAS MADE IT CLEAR TO ME THAT I MAY NOT LIVE FOR MORE THAN 2 MONTHS, SO I NOW DECIDED TO DIVIDE THE PART OF THIS WEALTH, TO CONTRIBUTE TO THE DEVELOPMENT OF THE CHURCHES IN AFRICA, AMERICA ASIA, AND EUROPE. I SELECTED YOU AFTER VISITING THE WEBSITE AND I PRAYED OVER IT. I AM WILLING TO DONATE THE SUM OF $7,800,000,00 USD (SEVEN MILLION UNITED STATES DOLLARS) TO THE LESS PRIVILEGED.

PLEASE I WANT YOU TO NOTE THAT THE FUND IS LYING IN ONE OF THE INTERNATIONAL SECURITY FINECE COMPANY IN ABIDJAN COTE D\’IVORIE. ONCE I HEAR FROM YOU, I WILL FORWARD TO YOU ALL THE INFORMATIONS YOU WILL USE TO GET THIS FUND TRANSFERED FROM THE BANK HERE AND TO YOUR ACCOUNT I HONESTLY PRAY THAT MY DEAR PLS I WILL LIKE YOU TO CONTACT ME

MAY THE GRACE OF OUR LORD JESUS THE LOVE OF GOD AND THE FELLOWSHIP OF GOD BE WITH YOU AND YOUR FAMILY PLS FOR THE SAFETY OF THIS FUND LET IT BE BETWEEN YOU AND MY DOCTOR

I AWAIT YOUR URGENT REPLY
YOUR SISTER IN CHRIST

MRS SUZANA DAVIS

Header:

Return-Path: <s_davisx0003@yahoo.co.jp>
X-YahooFilteredBulk: 77.238.189.206
Received-SPF: softfail (transitioning domain of yahoo.co.jp does not designate 77.238.189.206 as permitted sender)
X-YMailISG: qzEvR5UWLDtpRnW6ifr8BGfUpchJ2CozItM51BwSnGroXEhL svjYKgw0h6wkpwJzdyuBt.F48u6oNQihFUDtlLNnWmf4aejyTAOTMhQBCbUK aMJbPoxUrc_Y8jh_Gt_8cGWvQS0dMPdgX8Virgh32U_Zdu6UNrpFXTxEZd8M AvkabKly5ZrJyYowkOQMZ5MOZNmqXSwxxDm.LzbbzD1p3CFQxaijPfluo8ko JjJ9jzkZdznrYDInmuubwP.QHOoV5Ext2D2grvGmuVYjw0k5lMpLM86.RAEr 3U1h5YOavH9XBGFPp4gyHQvi2PbwBP3tJLYptmZZQ8t6XWq4sJqlOaFLP4sB gN7Csq5lEAWnsiGOWx9qgWYa6fX.TRutqp2yhwBD0Qff.9LuyWSasLzBtw6k J9SUPFz_ZtWelvs5ZW4FqB26cbGE8g0.iR4qkmOGi_OR18mU31ZjotAynp4q 4oThggejbuHyeFNfTmdKh0UXlGqRqpkCuNKOokmOX_B3tU2xvqn3vvqLUSiv 5aK1grAQeTZfi53ibFuh9nj5Tt5N9esq.jEZV4rc9BCaUs_mmypXFBqiCszi uN6vkfgQWDTBlOsrrrgdduCHPjseCFwkjAKLCEiUmO0qUeI3zPmbZIek_fRQ XPXWyz9aYE.vCa4Ko3v3N9VqDg_FBgGV3rLobNpE1TXM3vPQ4naZgChJWmDL ey9ai6AfNDBm2Pg3XlErj4ZTdD0ILf6aMs0xyoAY6sIsczMtW3RjivIAVqkU BaB7g1usmIjO1wyENMlrptquDA_BWnV99hU9qnx6chFXCxxYV3PYM37wFK2v kL3RDNSbM0VbYoKCbSG.hUI7P_iAgFB.QyITm5eVaw.s.iqPJtxUG6GkyShB 3zjlgvXTnT2LetLm.VJuiKMmFySCy2lPkTTcbRY6xLJmZLkbWtNtCyIyiqZq BoSPlA2gNOkNG13af3X1gWTyxU5wuqxdIwI2UcbJSlnGcVcAfcLjwvV0eu2Y BusXUJXQhush2xC0Com17i3MzLbOqnL3qXor39V6w_NENKoiU.ev_ta6WKAM QbTsslBNU_UTCCNreFzUPw5khdoxtgnemf_CU5WpWOQVpVCKSZ80zJIn_YRk gcJbBDuiTY7FKDh05fWCVkmuGNanv2JI6Ni8Yrbb.G4Yy.IkcpL6oCrUKSuA .Kk6g2OV4op_tZgRcujiL_ZALBGWKNN4nB0VLglBEN.xdKTKwqiLV.0v48VK e4D5ypDtqzcv2.lkvUNqgz9fGJ0sW_e4TutSk2T1HllR1CykaZURag_WLUbc AvDLzDLhBsTwbMrlEWFh0j2ycEYh6ItnTZiveUbZqGFqxKQ.am_cbQ–
X-Originating-IP: [77.238.189.206]
Authentication-Results: mta1326.mail.gq1.yahoo.com from=yahoo.co.jp; domainkeys=neutral (no sig); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm17-vm1.bullet.mail.ird.yahoo.com) (77.238.189.206) by mta1326.mail.gq1.yahoo.com with SMTP; Wed, 24 Oct 2012 17:56:10 -0700
Received: from [77.238.189.230] by nm17.bullet.mail.ird.yahoo.com with NNFMP; 25 Oct 2012 00:56:08 -0000
Received: from [212.82.108.243] by tm11.bullet.mail.ird.yahoo.com with NNFMP; 25 Oct 2012 00:56:08 -0000
Received: from [127.0.0.1] by omp1008.mail.ird.yahoo.com with NNFMP; 25 Oct 2012 00:56:08 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: 302246.80803.bm@omp1008.mail.ird.yahoo.com
Received: (qmail 31884 invoked by uid 60001); 25 Oct 2012 00:56:08 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1351126568; bh=5nadoiiQqJmkYMDbGKmQ4fjNvZyA3jjeMJ1+qbTcrnc=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=d+ctxqL+SMoIiR72dDHyvQ/LHHeduYKiKV/p3FiCRP7gpBQxtZ9jlKnf6NB+lCR1jLFlqJIvUMK6QI4R8y2GpIbaBH+DNlkDtzWesScQt9YxATBQy6s2U383D6UUQlgll0DUQZL2eBDjiU0JvH2+fi/+d3qTYMowYpK2/bUshss=
X-YMail-OSG: SQkC28YVM1lVL5Qpm3tyC0CIFB_hg34B.wfIcQZ2A8UMTVW vHl5xCbc2in3bVVSnmG7pFO9XrRUskq5Nta2EgrUxpi84XRxDWSvOK4i.pnA ypkNnaqyGKKsbwpR_FONxZmjmRBxZsN_3IDFZxdBv4x8.wNaBRezK7E.gKFK zJXZXVsPbr7CQFb0YSg8.MyjFaqGZsCzOQhGusrF1ZatRq6DOdnVTw.QhZVg ijGlxNz_mw7woi0JcIanUu05RxS.IBqCFqcD5wkRvPuR7q2d63L1sywBBQWJ lLlLjFtxClFdjokskpiVmbFuqaHTwpdw4QJIfyK2ZvQrzjSsBRtE2MN181LI fVFo4W6QhaJjFAFlB3rsVeYfbGMOa0M87MdiTV_KC.BcYZoXzJj5Nfft0U27 VmXInStClvPSnXgsFRn0R8VTGXYSPMQdY51EM1AckEaiqhF.9EmmSqKBmuEW wbKGlyy9K65XLF972TQiD5_6GRdk1T5c_IpQWrzUBXEx5I2Qw_OBi_S.hrUg XQmXccdaL2VkV3HcxeYG7PlcQftgP3EeWBukzScPsDWgpMe6vLUYapMeiHhg byL127QlOiY8bR5WZkdYNrwX7oa.FGZ3l0Ec3lQ–
Received: from [213.136.125.248] by web28805.mail.ir2.yahoo.com via HTTP; Thu, 25 Oct 2012 01:56:08 BST
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.123.450
Message-ID: <1351126568.31448.YahooMailClassic@web28805.mail.ir2.yahoo.com>
Date: Thu, 25 Oct 2012 01:56:08 +0100 (BST)
From:
Suzana Davis <s_davisx0003@yahoo.co.jp>
Reply-To: s_davisx00001@yahoo.co.jp
Subject: GREETINGS IN THE NAME OF OUR LORD JESUS CHRIST.
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=”-779725378-1120749859-1351126568=:31448″
Content-Length: 3833

(FIRST HEADER) RECEIVED IP: 213.136.125.248 X-ORIGINATING-IP/X-YAHOO-FILTERBULK: 77.238.189.206

Below is the header from a second email sent to my spam filter from this scammer. The email addresses are the same but IP’s and other information are different!

Return-Path: <s_davisx0003@yahoo.co.jp>
X-YahooFilteredBulk: 77.238.189.94
Received-SPF: softfail (transitioning domain of yahoo.co.jp does not designate 77.238.189.94 as permitted sender)
X-YMailISG: x7HArFwWLDuJisIkTC5ou37Hm_4sFd3L_JpgK_.PQ2wYRzIJ CJhLqrfLhVBnDgWg3YXxiuahkU0f_Ccui5N6VNSQUoLyGPADSP9tsjp7VDFp Z21a2Z5cGPV3GsbCQG8w4HvZpvcd9r67rs.iK51YR1aaxYaRLIZcRpS0qELi orcNm0EaD5w2GrEUd4Nbu_RgtA.Lp_dNpXSeXfDJGhe4RFqbv6baGYwIsGwb tpCpkrLdQh.s8StC1HOZXiedc4ukxfwfXXOkyJ5n_UYynHxOYDK8tOGTjG5y GmwSLa7oLHQEZf9aikPuBSFN.DFOahZLt9OXYPo6DNAABIEtj_bSP4_PCqsB mNMyV.uQ_VEwuStA2Um3J.BfTg2IP4MagO_A7cAPaB83y6cwn5e1DA2yEvLm Za_dFbTAFmprR8.GSKNzJwBOCdpJ9McAP0lmJB2f91zQLfWXuifHEXKGEE5Z Q6gng2D60hGzPwrLcNknSawKlcDvVM4yReSFxhU8IRRVnU2SWjgt8xsvEEsI tRDi9q5ekcT9tl2u8eIoJNTdTtIAtVjfd4sxRXERZAhdN1T2XI8Urd4gTgrq OkSzoIB2pX6HpIxFeP8LjVIHF_bbCm4lIaRLSl3DhQ8RmF3tYw4riUn7.9Yk 4cRe49K8Tmvvaaly_.KOdS8D8oYVbAqM1MmjTaLbtYjCGVHhLh1f8Aj.RFwH wwKeRttkG50_GklMuPgB0uTbZDSX1_w9uw6XRUuZawNMFtxKVfcxxqMQnyJP _T9C6NZVGNY9at8JrjayCo_UK7.g529o4dekJtjZGH2UrGms.uT8ziom__Dl aOTYx9k5REZggY8hfnvSFu7HE309R3YmxXklXpD79ztC2vQQl4bsyt4jlKYh HbakZrlpNgRPtZqUiLEjnz8eqR_fejBGPtfdxn..UdxBK2enOpM9ruO4TwyI tmkzSr7MY.AaBCCrhdluEvN5i5neVmBLjZY5X6edEmPzW7McPSCf6pEZ148H gra7ev7dGy_wM6cteCLcJqZkDD9U_wm.hISBJL6FUnReA5BqxYjazhD7uCVx d9G333X8Jf5LhnMZBNCJMhRCmDnLF4YVN1mDDRQHBerhLIGLiZ7DUtcp0tkV qjTJoKltJ7846RKOJ5nhj__58JrYjB__99fz8UJbpUNj8jsQNCP7Yp1c68Gv 5sPLlHfN20yNOEO3zToKUqoBIT5dUDEUksocIESYu7lPV8DV2FX3OWXlH6Wx cVjRQvRu3WS8K6dMu_zG6BQP2re7qjFckT7MnY5B34EBvUzO3Xd17qHHYAxV _5I2GOiblV3drkq9LuNPtCfLhVXBgxBWV4V3tifn3lRzpe_EFLWa
X-Originating-IP: [77.238.189.94]
Authentication-Results: mta1125.mail.gq1.yahoo.com from=yahoo.co.jp; domainkeys=neutral (no sig); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm9-vm1.bullet.mail.ird.yahoo.com) (77.238.189.94) by mta1125.mail.gq1.yahoo.com with SMTP; Thu, 18 Oct 2012 08:56:01 -0700
Received: from [77.238.189.57] by nm9.bullet.mail.ird.yahoo.com with NNFMP; 18 Oct 2012 15:55:51 -0000
Received: from [212.82.108.112] by tm10.bullet.mail.ird.yahoo.com with NNFMP; 18 Oct 2012 15:55:51 -0000
Received: from [127.0.0.1] by omp1021.mail.ird.yahoo.com with NNFMP; 18 Oct 2012 15:55:51 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: 530050.80966.bm@omp1021.mail.ird.yahoo.com
Received: (qmail 42559 invoked by uid 60001); 18 Oct 2012 15:55:50 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1350575750; bh=2nMTUGCzPZDWO6gAyIZH4LQ//mdwcq/OZ9+4HN2hx00=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=3PGfkNI0JPpnIH2WmPwCc+mSVNxkEJnniSS660zlTlovkFizoUIh2UavQ4CHr16inDmZP0H7toW4r6h6IMqJTaNfmFkb0fK5PKJ+29UB3kFVRgF9uX9CVkm3OnDklDRpXEFRx+rog6fTXtKVRvwlo2twBgnH15ewiPehrC8sJtQ=
X-YMail-OSG: u1atfa0VM1mKmfJ9jBbW9LY8QhsuT8.Qz7g5Kp1NzBDF1Hj RWrrsKUp_pQnIrTEgUVQJNH_5zPARrQdRbh9GNbh_C.dy274h2.H0Bau60d6 Af1PaH8YkFg9CBe8npbM3C1X8MdAPRaWW9_8ly5XsxEBZEHTltr.eulx1mkz ouZZg1YoFt_iLRcqLcte6lM8ZGZTqzIVHShY_FA6z9UHdrRJB9a9AVw1r_MN WN6ucnvpOp1FaUaM57PAYrw8Gql4m1auQOteUMeqFQg2BPXWBH17mn1Qf8I9 20zLeTw6YZfkywB9CsX7.9LmX87oLdqpHb3Ku8UWt0GfL0fq1twJFfIuuDh4 I90dGAJv4YC_xU4FiZ44o6P67J0HzIAyuHYsVF9K97F8sdNU5oKl9zbycNmx Tj9c0MHx3AX3znMHbTTyeyl78VudBLC57n2v5LkkvTH.lDzfHPeD6NZKlrqB 6VccJV2xcOE8FvJPhklL4VIgavPBkESNBv4xDfu7L4yxhsDLvUSvHGazF9ps npwshPBdMQ5ljgYctjU_FGiAmAZd9kSdNcsXUZc1BLilo6zzP7mu6moFCKE8 ygD8yKLmVvBgtJK674gETCAUIU.If8DS.aSd.Rgw1znARLJaB2yHIcDIYGg- -
Received: from [196.201.84.160] by web28803.mail.ir2.yahoo.com via HTTP; Thu, 18 Oct 2012 16:55:50 BST
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.123.450
Message-ID: <1350575750.36820.YahooMailClassic@web28803.mail.ir2.yahoo.com>
Date: Thu, 18 Oct 2012 16:55:50 +0100 (BST)
From: Suzana Davis <s_davisx0003@yahoo.co.jp>
Reply-To: s_davisx00001@yahoo.co.jp
Subject: GREETINGS IN THE NAME OF OUR LORD JESUS CHRIST

(SECOND HEADER) RECEIVED IP: 196.201.84.160 (SECOND HEADER) X-ORIGINATING-IP: 77.238.189.94]

 

 
 

Tags: , , , , , , , , , , , , , , , , , , ,

“Katie Gary” aka “Gerald Moris”

Job Scam – Nigerian Scammer

animation

Feb 13, 2013 UPDATE – I received five comments for this post. All of the comments were slightly different, had different names but the same email and IP address. The commenter spells worse then a child and, well, let me just post the comments, lol. (btw, this isn’t the first time this post has gotten similar comments, check under these recent comments for more comments that were posted several months ago.

First comment  from Ruth Walter using the IP address 64.141.199.64 -

My name is Ruth Walter i am from UK i want to share my happiness with the general public of what Dr.kefee of Africa has done for me in the last few weeks i was once in love this guy called john we fall in love with each other until traveled out of my state for two year and we promise ourselves to be together forever, but before return from my journey he where now having another lover when i try to come back to he. He told me i should go away i love him so much that i could not let he go just like that then i told a friend about it and she advice me and recommend this man Dr.kefee for me when i visit he at kefeejajaspiritualtemple@gmail.com he only ask me to buy some items for sacrifices to help me get my ex back and he actually did it and it work well and today i am happy with in case any one is out there with same problem or any kind i advice he or she to contact this man today at kefeejajaspiritualtemple@gmail.com and with what he did for me i believe he can also help you thank once again. Ruth Walter.

Second comment from Sarah Kelly using the IP address 64.141.199.64 -

My Name is Mrs. Sarah Kelly, I was married to my husband for 13 years and we were both bless with three children, living together as one love, until 2009 when things was no longer the way the was [when he lost his job]. But when he later gets a new job 6 months after, he stated sleeping outside our matrimonial home. Only for me to find out that he was having an affair with the lady that gave he the job. since that day, when i called him, he don’t longer pick up my calls and he nothing since to come out good. Yet my husbands just still keep on seeing the lady. Until I met a very good friend of my who was also having a similar problem, who introduced me to a very good love spell caster. But i told her that if it has to do with things that i am not interested, but she said that it has nothing to do with pay first. but the only thing he was ask to do was just to go and buy the items to cast the spell, and that was what she did. And she gave me the spell caster e-mail address and phone number. When i contacted him, i was so surprise when he said that if i have the faith that i will get my husband back in the nest three [2] day, and off which it was really so. but i was so shock that i did not pay anything to Dr.kefee , but my husband was on his knells begging me and the children for forgiveness. This testimony is just the price i have to pay. This man dr.kefee his great and powerful spell caster so contact him,, good and he is the author of my happiness. His email address; kefeejajaspiritualtemple@gmail.com

Third comment from Mrs.Heather using the IP 64.141.199.64

hi…i have been a victim of scam spell casters, been scammed several times and i still believed…i have lost a total $2500 on fake and scam spell casters…i met Dr.kefee online and he promised he was gonna help me and i thought he was different but he wasn’t. I have been contacted by a lot of fake spell casters lately and i don’t even know how they got my addresses but i think it is the same people that scammed me.. they are trying to change identities… i was introduced to one by my maid since four months ago but i cant believe all what he(kefeejajaspiritualtemple@gmail.com
) did is actually working because its like am in a dream, everything he told me is happening, this man is real..please beware of these spell casters, they have scaager to help you:so contact the great priest kefee on email: kefeejajaspiritualtemple@gmail.com

The fourth comment from Miss Joy who is using the IP 64.141.199.64

I met a man more than 22yrs ago and fell in love with him. We started a relationship and after a while I had a baby girl for him. We began to have Issues between us because the man was dragging his feet about performing the marriage rites. A few months later, the relationship broke up and we went our separate ways. Last year, friend, directed me to Dr.kefee the spell caster for marriage spell. I went to Dr.kefee temple on the 20th of june, 2013 at the Baba temple After the spell, the great spirit of Dr.kefee temple mysteriously reconnected me with the father of my daughter. Our love was rekindled and he proposed marriage to me. I accepted and by the great power of Dr.kefee spell caster, we just get married on July 16 2013 after 22yrs of separation. I am 51yrs old now and just get married for the first time in my life! thank Dr.kefee the great spell caster!email him via:kefeejajaspiritualtemple@gmail.com

The fourth comment from Chloe who is using the IP 64.141.199.64

My name is Chloe from canada,My husband n I av lived 2gedr 4 10yrs but with no kids, we went 2 different temples and magicians , all 2no avail. This caused frustration and my husband left me alone for another woman. I was so bitter,cried and Even tried to commit suicide, it was by this river bank while trying 2get my self drowned that I met this man.I explained all my problems to him and he laughed and told me to follow him home. At first I taught he was some spiritualist or another scam-er just wanting to take advantage of my helplessness. He prepared certain things for me to eat and bath with, and just 2weeks after my husband came back to me begging and not only that I have my love of 10years back, am also 2months pregnant. And he did all this without collecting a single penny from me. I just want 2thank this prophet, have always believed there are no real prophets again,but this great man showed me there is power 2whom power has been given. His name is Dr.kefee U can contact him on this email address; kefeejajaspiritualtemple@gmail.com . TRY HIM he’s indeed a Life saver

A Nigerian scammer with the IP address of – 41.206.11.37 – commented on this post, I didn’t accept the comment but I will post what he said below. Also, Lagos, Nigeria is where the IP is originating from which already instantly set off the scam detector, however, once I actually read the comment I was pretty confident that this was a scammer.
“ Elias ” – upesaspelltemple65@yahoo.com – okdousplltemple@yahoo.com

“this is a spell caster I contacted 2weeks ago. he is really great. I have been scammed initially by other spell casters of almost a thousand of dollars. I am not rich, I work my ass for this hard earned money. But my sadness was turned to joy when I met Dr.okdou he is really terrific and you will get results for whatever you are seeing he for within very few days. he is so honest and sticks to his promises. His contact is below: okdousplltemple@yahoo.co  ”

11/23/12 UPDATE: okdousplltemple commented again under this post under the name Dores and email dodogodssolution@yahoo.com .. Scammer used the IP address 212.118.232.216 which originates from United Kingdom – Not the commenters actual location but an anonymous proxy. The updated comment from Dores is:

I ordered a spell on a friday night and on Monday the place I applied for a job called for me to come by their office. They gave me the job I applied for and made me an offer of more per hour than I have ever made in my life! I am so happy! The government jobs sometimes are a slow process. You somehow managed to speed up that process, and I start in just a few days! dr,kokotemple i will be forever grateful thank ones again ok you can call on him for help on his email address dr,kokotemple@gmail.com

Name/Email-Address: Katie Gary katiegary@excite.com primus193@yahoo.com 

Subject: Hiring: Quality Agents ~$15.00/hr

Email: Hiring: Quality  Agents ~$15.00/hr

As a Quality Agent, you would listen to recordings
of sales calls to determine if the sale was valid
or if there is evidence of sales fraud
or undue customer confusion. Work from home or office.
Pay: $15-$18/hr

Scammer also sent a link with the email, they wanted me to click (tinyurl link.)

Header:

Return-Path: <katiegary@excite.com>
Received-SPF: pass (domain of excite.com designates 208.89.132.144 as permitted sender) UXVhbGl0eSBBZ2VudCwgeW91IHdvdWxkIGxpc3RlbiB0byByZWNvcmRpbmdz IG9mIHNhbGVzIGNhbGxzIHRvIGRldGVybWluZSBpZiB0aGUgc2FsZSB3YXMg dmFsaWQgb3IgaWYgdGhlcmUgaXMgZXZpZGVuY2Ugb2Ygc2FsZXMgZnJhdWQg b3IgdW5kdWUgY3VzdG9tZXIgY29uZnVzaW9uLiBXb3JrIGZyb20gaG9tZSBv ciBvZmZpY2UuIFBheTogJDE1LSQxOC9ociBodHRwOi8vdGlueQEwAQEBAQN0 ZXh0L3BsYWluAwMwAgN0ZXh0L2h0bWwDAzI-
X-YMailISG: S3pOxB0WLDtOcxGyuoobeOrd7E5g2W07KCt.symmBliIauWt L3M5HS_LBeElVfAQE0gBla6KZn_E7IU3E7ZxJkbiJO.WGI9KAaaaSmQ_ZbCW 3Z8Aljh2nHm4YnmsZK13xwJZYH9Lg3WRU335gcxn7c9IV4ZQIeYBLoljiAEN ntLq53mQWpZl9TBuRQfHuOFuuKIkGo3m9_ooi7GMW6VFDpsK.q34IyrJpwgX bXcumSRiaTFk7GluW2rAGRkKwzlqfnD7Otasn5GxseTVE6gYLXt4cp2dubKr DYjM5.72nZ9eMqOwMwKcmDJ9M.kc_g9UcdViKtT_zcD4Vra0PVAGnNgiPFfF 4b5.vGCbdBECZuLf2Ygeff8RFl9JQueIOqXz8jsb2F7lb2QaIl.6QVVL1pMu wk3oa8H0seEAt0BWnoKHLtaUc76kZGTx8CVFc0KG3eMVmqqijQcGkoVWkUCe elK4L0qmOlRk7ZIWADhsIHfveujpqmgCD3grK_xDD8qkhMb35UbWFXGJSNT5 e3GMQ9OLmoyBoQMsL.MtZkm_JGfoh0LqJQSLFdohJ5Ckk8uZyZ8mjkFImRVD eAgQo9ioLlb.QXdMK9hmO5Nt2VtC9X9l40ZXRVdUJ3d3M_9JqAWo2BEEQt_h Fs4BN3WC0uzqhKTc7zlJFYXFVCn2MxixQ7RFIbgmDIQhDu3UXoO_g1du_HOS syopIiPNdFsNsV7nwaq5CooEjC2NVW.9xnDVT7MxA0ZHZ0gURfv.3nvkJ50k 5DyFRO4xiHzsCXAhDnHJIN.doZIXCUxC_XlsBcuoeu3Q1uDQNiAiO215Icf9 rBf4k59XvffcRH2BBYYJBzqbBS1vavEI3ezwYfznOwdidmX2TeHDCxlhhCc7 cOe8EItaTPcdpGCkqZdp7hP8jWItJYhJbk.HB1KrjZNTBhVVf_NTrOZ2MzjZ 8Oki3PMzxnxA8YaMbHgjFLxAEdbfU4Uh8muIhdKEKLW7yEHSq4.g4RKK3fys oM6Kh6h0SItB.n83On8233JwRnSUOd7gsj2JaLcODV3ImUu1zV7gxzPat3UQ 5f9A_0DjklnkG0zxGR_YRicXf3tFS1g7W0vRg7xNsQzWQl8HTYxVW7u1IccO 7hhOAnQlAbRoIDom0_xfhAEDPs6b3Le7sIE0R55956snULrI2UHgfBckc7l2 5.iEEmdG79iIpgN7ybb92HqjjJZ30sdaSREI8M3R2KFdSus-
X-Originating-IP: [208.89.132.144]
Authentication-Results: mta1123.mail.bf1.yahoo.com from=excite.com; domainkeys=neutral (no sig); from=excite.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO outbound004.roc2.bluetie.com) (208.89.132.144) by mta1123.mail.bf1.yahoo.com with SMTP; Wed, 24 Oct 2012 12:29:23 -0700
Received: from web006.roc2.bluetie.com ([10.200.2.100]) by outbound004.roc2.bluetie.com with outbound004 id F7VN1k00S29U4Qi017VNp8; Wed, 24 Oct 2012 15:29:22 -0400
X-CMAE-OUT-Analysis: v=2.0 cv=XIGyuHdE c=1 sm=1 a=TAZsHk2J_UkA:10 a=i-wQWBNYtOgA:10 a=FmX3VfpdAAAA:8 a=QoHJ8kPOAAAA:8 a=ZP2tlIEgbdMA:10 a=aCq2QwiTAAAA:20 a=Bdwgkd5yssPVd8LNzMIA:9 a=QEXdDO2ut3YA:10 a=KXuLW65_DLEA:10 a=MgLGFTGd5xxFATJC7KcA:9 a=w9Mn5X6xMxnmLyr6:21 a=L9C/gGIz1Vpswtb6eSrjaQ==:117
X-CMAE-OUT-Score: 0.00
Received: from web006.roc2.bluetie.com (localhost.localdomain [127.0.0.1]) by web006.roc2.bluetie.com (Postfix) with ESMTP id A71ACAE01EE for ; Wed, 24 Oct 2012 15:29:22 -0400 (EDT)
Message-ID: <20121024152910.2338@web006.roc2.bluetie.com>
X-HTTP-Received: from katiegary.excite [109.200.31.68] by web006.roc2.bluetie.com (BlueTie WebMail ); Wed, 24 Oct 2012 15:29:10 -0400
X-Mailer: BlueTie MTA
Date: Wed, 24 Oct 2012 15:29:10 -0400
Cc:
To: primus193@yahoo.com
From: “Katie Gary” <katiegary@excite.com>
Importance: normal
Subject: Hiring: Quality Agents ~$15.00/hr
Content-Type: multipart/alternative; boundary=”1095842479-1351106950=:2338″
MIME-Version: 1.0
Content-Length: 2470

“Elias” – upesaspelltemple65@yahoo.com – okdouspIItemple@yahoo.com ← This Nigerian Scammer is scamming under the following names/email address/etc below:

1) Gerald Moris – geraldmoris50@yahoo.com -

Image

Gerald Moris is pretending to be this man posted above. He tries to lure vulnerable lonely woman on dating websites then tries to scam them out of money.

Host of this IP: 41.206.11.37.vgccl.net >< ISP:MTN NIGERIA >< IP-Address: 41.206.11.37 (Lagos Nigeria)

Host IP is: 207.46.202.15 which is listed as Beverly Hills, California >< Not the scammers actual location. Fraudster’s use proxy servers to hide and confuse their (potential) victims because they are cowards. The scammers Real IP is 41.206.11.37 ( Lagos, Nigeria )

Host name for this IP: – 1661882.r.msn.com >< 1654287.r.msn.com

212.118.232.216 – <dodogodssolution@yahoo.com>

http://4sat1.persianblog.ir/  [212.118.232.216]. http://4sat1.persianblog.ir/. 20-, Google  [212.118.232.216]. http://4sat1.persianblog.ir

[2.178.9.96]. http://neveshtehkhatkhati.persianblog.ir/. 25-, Google : نوشته های خط خطی, انگلستان. [212.118.232.216]. http://neveshtehkhatkhati.persianblog.ir/ 

63.141.199.64 trepomjv peregatolikajmot@gmail.com 
 63.141.199.64 trepomjv peregatolikajmot@gmail.com 
63.141.199.64 trepohoj peregatolikajmot@gmail.com 
 63.141.199.64 nircuicky cereever@gmail.com 
63.141.199.64 faulpabbiquix cereever@gmail.com 
63.141.199.64 escossero cereever@gmail.com

 
 

Tags: , , , , , , , , , , , , , , , ,

Man Commits Suicide After Falling For An Online Romance Scam (2009 Article)

Hessle

Pictured; Hessle station in East Yorkshire near where Philip Hunt took his own life on August 13, 2009..

GRIMSBY, UK — A Grimsby man took his own life after he fell victim to an online dating scam that promised him the love of a “beautiful woman” – but instead left him with debts of over £80,000.

An inquest in Hull heard that at around 9.30pm on Thursday, August 13, 2009, 58-year-old Philip Hunt, of St Catherine’s Court, was struck by a train in Hessle. A post mortem examination revealed he had suffered multiple injuries and that his death was “instantaneous”.

The jury took just 15 minutes to return a unanimous verdict of suicide to the coroner Geoffrey Saul.

A spokesman for British Transport Police said Mr Hunt had “insurmountable debts” and was the victim of a common scam known as the Nigeria Letter or 419 Fraud.

The inquest heard he had been targeted by someone posing on an online dating agency as a Nigerian woman called Rose, in December 2008. She convinced him she was young, fabulously rich and if he could help transfer $2.9million from Nigeria to the UK then they could start a new life together, an inquest heard today.

Mr Hunt told his ex-girlfriend Lesley Smith – who gave evidence at the inquest – that “Rose” had promised him a share of her father’s estate if he could help her get 2.9-million US dollars into the country.

Ms Smith tried to warn Mr Hunt against it, telling him it was a ‘scam,’ but he was head over heels and blinded by the love of this impostor and believed the scammer over his former girl-friend of three years. 

The 58-year-old was so hooked on the fantasy of a future with the stunning ‘Rose’ and he willingly paid out tens of thousands of pounds to help her beat malaria and get her funds through customs and into the UK.

The cargo officer remortgaged his house, took out loans, ran up overdrafts and begged for cash from his employers after repeatedly transferring money across to the fraudsters’ account.

Ms Smith said Mr Hunt – who had worked as a cargo officer for DFDS Tor Line, Immingham, for the last 14 years – had sent her a text in January last year, saying: “There are amazing things happening in my life”.

She told the inquest: “He told me that this lady needed to come to England with this case of money to be able to convert it into usable money. “He retrieved a suitcase from City Airport in London and under instruction went to a hotel room and waited there.”

The inquest was told by British Transport Police that he was met by two men, who revealed the case was full of blank paper. They showed Mr Hunt how they could “turn one of them into a 100 dollar bill” with the use of a liquid solution.

Eventually he became so hopelessly mired in debt that he committed suicide by lying down in front of a train.

Mr Hunt appeared to believe in Rose until the very end. His mobile phone was found in a rucksack near his body and a text message to Rose – which was never sent – read: ‘I’m cold, lonely and depressed, I’m so lonely without you tonight. Going to meet my maker..’

 
1 Comment

Posted by on 10/24/2012 in Romance Scam, Uncategorized

 

Tags: , , , , , , , ,

“Susana Yake”

Online Dating Scam a.k.a Romance Scam

HELLO,
my name is Miss susana , i saw your profile on site and became interested, i want us to be  friends i don’t know how you will feel about it, please you can write to me through my email (susanayake386@yahoo.com) i,m sorry if i am embarrassing you, i don’t mean to do that, thank you
for your understanding
please,  send your massage direct to susanayake386@yahoo.com so that i can tell you more about me,
yours in love susana,

Header:

Return-Path: <susanaluv1@gmail.com>
X-YahooFilteredBulk: 209.85.212.193
Received-SPF: pass (domain of gmail.com designates 209.85.212.193 as permitted sender)
X-Originating-IP: [209.85.212.193]
Authentication-Results: mta1450.mail.mud.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO mail-wi0-f193.google.com) (209.85.212.193) by mta1450.mail.mud.yahoo.com with SMTP; Fri, 19 Oct 2012 17:33:36 -0700
Received: by mail-wi0-f193.google.com with SMTP id hm4so307836wib.0
Received: by 10.180.87.230 with SMTP id bb6mr22235957wib.6.1350693215827; Fri, 19 Oct 2012 17:33:35 -0700 (PDT)
Sender: susanaluv1@gmail.com
Received: by 10.223.161.212 with HTTP; Fri, 19 Oct 2012 17:33:35 -0700 (PDT)
X-Google-Sender-Auth: T7-P8yN6ZRIu12BeKIl2R_g4Aa4
Message-ID: <CAJMWhW+cQThdMb6aZOT1UJZ4=65d_W+Fwz=LMbexL4rdMszapQ@mail.gmail.com>
Subject: hello,
From:
susana yake <susanayake386@yahoo.com>
 
1 Comment

Posted by on 10/24/2012 in Romance Scam

 

Tags: , , , , , , , , , , ,

“Mr Tony Anderson” unionwestern66@yahoo.cn western.union45@live.fr

Inheritance Scam – Nigerian (419) Scam

This Nigerian Scammer(s) has sent various other emails (I will post links to my other posts regarding the earlier emails.) At first, he wanted me to send so much money in order to get my ”Funds” but because I’ve continued to not send the money, they lowered the fee. I still didn’t send any money so now they’re trying to get me to cash in a fake check, send them money and then when the check bounces the bank will contact me and order me to pay the balance. Not gonna happen!

Email Addresses: unionwestern66@yahoo.cn <> western.union45@live.fr

Subject: FOREIGN CONTRACT PAYMENT OFFICE

Email: FROM DESK OF MINISTER OF. FREDERAL REPUBLIC OF BENIN.
FOREIGN CONTRACTOR PAYMENT OFFICE.

ATTENTION BENEFICIARY ,

The Board of Federal Ministry of Finance Benin Republic. are here to notify you of your payment inherited funds of ($2.5 M)U.S.D dollars . after the meeting held on 6th of OCT 2012. His Exelence the PRESIDENT OF FEDERAL REPUBLIC OF BENIN DR YAYEE BONI. has Instructed this Department to send your funds through western union money transfer for easier receive of your inherinted funds without any further delay. to avoid paying money to the fraud stars that is going on through the global.

You are required to send your name and address were you want your fund to be send through western union the maximium amount you will be receiving each day starting from tomorrow is the sum of $5000.00. they have also apoint a reliable Western Union Office and has instruct them to cary on with the transfer according as it was aprovad. You are required to contact the Western Union Office after reading this message, send to them your full name and address because they are waiting to hear from you before they start the transaction.

Here is the contact information of the Western Union Office.

(DODJI) WESTERN UNION OFFICE
BENIN REPUBLIC. 01 BP 2020 Cotonou Benin 
EMAIL: western.union45@live.fr
PHONE/FAX +229 68 44 96 76.
CONTACT PERSON, MR. PETER JOHN.
W.U TRANSFER DEPARTMENT.

Call or send an email to the Wester Union Office with the above email address and apply for an urgent transfer of your fund. Please do not hesitate to inform us immediately everything is concluded. We also wish to appologize to you for the delay and all the problem you have encountered in the past because of the fund, plesae do accept our apology.

Meanwhile be inform that the New Administration has been mandated to issue out your payment and to ensure that you receive it as urgent as possible, so you are required to stop your conversation with any Company, Bank or any institution claiming to be the payment Office. Once more, we have also issue a CODE for you which shall enable the Western Union Officer Identify you as the beneficial approved fund owner. HERE IS THE CODE: WTL229. So during your communication with the Western Union or by mail, you are to use the code as subject for proper indentification.

My regards and good luck.

Mr Tony Anderson.
New Administrative
Yours in service Financial Minister Federal republic of Benin WAITING TO HEAR FROM YOU AS SOON AS POSSIBLE

Header:

Return-Path:   <unionwestern66@yahoo.cn>
X-YahooFilteredBulk:   106.10.151.72
Received-SPF:   none (domain of yahoo.cn does not designate permitted sender hosts)
X-YMailISG:   jkLaMJQWLDuI1pfd0.ccYsIP0Ry8ZniBDXTL8c6_.x5v6T1K hMkVgiENYXJ2yuifEdwa7ekSP2sbCKpS_Nj66CsmwxmY8YIMrQzhSyNe5Kej ujbRfE4rdC3z41Ijj6UtxjVkhLaL.2Je_1sbTTCsO5q6fKzcNaV_AXVa4u83 PwOChY1Zo3pT6czSgO3yasyoveGDy4yOWoBySoEoXPFUrloeamMCTaiUZ5Et c8uhn4YdSMqvLiEjJ26YgZY7CygEOX4161SqvEPGeinaAgOunVsBYsmKRshv v2eV.ZEmB4anEI5DIN0FLYRJPJQw5rsmDpQ.5G2f7KuvNYrcbrdH3Zrn9B1l PjXHMmw.b7T7lWLba6eRIvubPQEye9I8LvwYUBbsngwMxIPnke2R8vnfScl2 5dFRqWLYQ.TfXtM7VccenClG4zqDk9kkRx14p8a2LCI2H_I4lYSzPx9zvB_C 0d50AXyUi8v4b8EqSxdUa2Asu_p40dBPGQRA1TxI1orm4IyzTiZ2yMdhftt7 _Qoi.K3jOFM9uE48RywJCHs5bYCdXYibEkNO4F5mPYG_1U8GzMp1r.pwAopX kIr.mqbsMGpMmqE_tb.Y864PavJP8xNXBiqnez8neprECceJXu20Y8fdvqWV DHvff.yXjjy4bk7A6IpaIJbbwdl54N2czCoX1_oeMPVByholTTuu1f.VPLsG P4AKQf9vps2Ts41OvfH7YZOT1pOx27Yd9.z9oPHby4.TYPPfoRViBVvuLVzs OVSSaiyFArWXrPlQ1kBN9IK6ubCByTWfQ4pzJVD0e8xVXmpB9RZJK4TA.Vsj dPXO_yD7gTLpvpAPF.2We54da4GDBnDuYMgNnWHpTVxh8E7dzCSCOGrzWIeh WEVqJUGvmevm11E4Vkjw2kVrySZnOm4Y58nj1oG5ymPejkmIxzM1YWbyHHol lymFctv7zX42eGXAyv9b0yyzEkfSxmbFblTTbYEeTQ0XRh_hkaeiOjP5oGnZ Aqp73Llm_hAuk_c1_D.mZmTVQwwAiAXO01pXmAEXOWCiO_BRHdsDUJcfpqMP yuyFPzeJBVIkT5CehkSf_VUg00vi2SbGWJVmqZm3hTVJwT1FqmLWOqm0k6rW YcWcUMRUoYFgAWdlHEIxvTYwvCYqlOlYAZ.mkkeNIILfjvMlh2ICAL5KNrV_ Zzn04Eg0hO2_goF6kjRxSKuPkEBN7UqNccW_FNUMpItaWss2urX1F3HEDiyi wqr5VGipAhDzpimDovYh17YKnxf_2Gcx_ra6cLgHKMvEOxWA9rPrl.IJUvie Dq4_KNBjM0q.Pk6qhVFysqee1GUrnYYYBlO7lAzwZG4-
X-Originating-IP:   [106.10.151.72]
Authentication-Results:   mta1172.mail.gq1.yahoo.com from=yahoo.cn; domainkeys=pass (ok); from=yahoo.cn; dkim=pass (ok)
Received:   from 127.0.0.1 (EHLO nm23-vm9.bullet.mail.sg3.yahoo.com) (106.10.151.72) by mta1172.mail.gq1.yahoo.com with SMTP; Tue, 23 Oct 2012 04:38:12 -0700
Received:   from [106.10.166.61] by nm23.bullet.mail.sg3.yahoo.com with NNFMP; 23 Oct 2012 11:38:09 -0000
Received:   from [202.43.217.37] by tm18.bullet.mail.sg3.yahoo.com with NNFMP; 23 Oct 2012 11:38:08 -0000
Received:   from [203.209.230.75] by t2.bullet.cnmail.cnb.yahoo.com with NNFMP; 23 Oct 2012 11:38:07 -0000
Received:   from [127.0.0.1] by omp104.mail.cnb.yahoo.com with NNFMP; 23 Oct 2012 11:38:07 -0000
X-Yahoo-Newman-Property:   ymail-5
X-Yahoo-Newman-Id:   313128.88982.bm@omp104.mail.cnb.yahoo.com
Received:   (qmail 49408 invoked by uid 60001); 23 Oct 2012 11:19:13 -0000
DKIM-Signature:   v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.cn; s=s1024; t=1350991153; bh=UpV/vfWFnYCsV+wRBd/2IYp7CCdKY0D7+LNsfQC9Uso=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=TWhqia4ub6u9XOg/X5j+zaeXm0lIL/FH2b/ZXgJJz7DUHMVey6VBEftBfpcciiCVZFxm4pmQTvJy+SpPCQeG9LEYNN18iDultaYOIlsrhQiAFY2y71ClUy9wkRKO0+Ab5G5FkwG/DtaJ2DR/Y2CjsmO8newdEt/O2nq+tgIo894=
DomainKey-Signature:   a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.cn; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=Wc1KXBgfMZocANXsC3v+svYOKI5aPkyFiN4Doa0ycrH9RKZ43el4JzQNslxyj3BnGOvTfUbzqt+UgaGs67r4BQGK1FFF7SvtqWJxsSAqH4KZh4nSxU9MPEK7FNqwhnT33E33FZzuyb3Qmea0akgeNQ4zIosPry253hOixL2irzA=;
X-YMail-OSG:   kdPnf8UVM1m4h.2AgeRCk_0nuFmhJMMXT2RF2qXjoswpDvV I_ik98gFP
Received:   from [41.216.50.90] by web92411.mail.cnh.yahoo.com via HTTP; Tue, 23 Oct 2012 19:19:12 CST
X-Mailer:   YahooMailClassic/15.0.8 YahooMailWebService/0.8.123.450
Message-ID:   <1350991152.47639.YahooMailClassic@web92411.mail.cnh.yahoo.com>
Date:   Tue, 23 Oct 2012 19:19:12 +0800 (CST)
From:  
“Mr Tony Anderson.” <unionwestern66@yahoo.cn>  
Reply-To:   western.union45@live.fr
Subject:   FOREIGN CONTRACTOR PAYMENT OFFICE.
To:   undisclosed recipients: ;
MIME-Version:   1.0
Content-Type:   multipart/alternative; boundary=”1615855314-1603110399-1350991152=:47639″
Content-Length:   19072
 
Leave a comment

Posted by on 10/24/2012 in Inheritance Scam

 

Tags: , , , , , ,

Wilson Coker wilsoncoker50@barid.com wilsoncoker60@barid.com

Business/Investment Scam – Nigerian (419) Scam

Name: Wilson Coker

Email Address(s) - <wilsoncoker60@barid.com> and  <wilsoncoker50@barid.com> 

Subject: PRIVATE INVESTMENT

Email: Attention,

I have a client who is wishing to invest up to $16.5 million in a lucrative joint or fully owned business, project venture and loan offer.

If you are capable and interested…please contact me on wilsoncoker60@barid.com,  Tel: +44-701-2976369

Regards,

Wilson Coker

 

Header:

Return-Path:   <www-data@locutus-test.ehealthglobaltech.com>
X-YahooFilteredBulk:   74.42.7.130
Received-SPF:   none (domain of locutus-test.ehealthglobaltech.com does not designate permitted sender hosts)
X-YMailISG:   UMU3SFQWLDu4LNBp8xc2sgscglAz_dK7Hh6NjLpRcqe4Bbzo nHuMN1WPlKkRlbKq3FmuAxdDEuFU.qyEaFqP5LAwrBuO7fjbLwpz7u6DYUCd a5SI08xzprtOHsliqQRJmg7Zlaz_WV124T6Pv97EZsv7J8iYuW63bz9Q0F3w Og3pTA2PjUD27pKltIijKbNhxdVF_d29ipcNpmc8ZetIzxJ246vjx_vTEKXK D1iJ28jjW2.s76WLOG3vYVcbJqRQqWxVomyB6sBe5bUVFTqbAszi90Rgt1aI HSnLREf8Li9jNQT9VHNNsfluC0WyE.PApICelmERr91NkcT92F0mIM7Rv8pw FJ_fwM3gzfz0zjjkNuY1UV9yy6PkIO9o7lxl5nfefcOo_xt6Bwzr4p7pQ_ez oL67hV1uPiSt5y5zLYfQ.pg5uiPV6g8ODPAbjpDVXcAG72mys_gJy.oHVj0g .fJLHV36_AtK04CNPKM_LuULErbqv8zm4fhWvS5.VrDgiSVCndv.6StefBHV b42LvzVKIKY6.jrTrsyMKha4oniMXjvwe1jNNDRGnxVpFtPbFI3wFSWVGXTc cFJxkPj6rPcyz42.A0CG.X38h753eL1JxZWMc.uxMpIthqg66pWfuWrxfy8l A3Co7SYZkkaj8QaR0aRpnJtkX4hWfMUa4.2lLfWFNewxGcaMI3FwL77F5p0y e6.MH5rB4M7kJmESZgcbHxoz8JYJcAbDEy75xZiMiKlZFw27LF7FptYw_sBg YnO1MTYCPIbWcXgZbNhTXTOkheOvEnwS.WYKEFXMgFejt6q8mG.WosgPuSQd GKtf6W0ulAcWUDmdVPSVfGm6gWzY8dJQtAAW7yyQRNRaPsJizeZ74tqtHj1U rfzh8uUN4PCDPCFGJ99q5M2pJ9w.pmvh3a8OGxQNCSSIXvK6hWlobnfoVBR5 DOIlYoIkDPcgKOhQc2qx3kj0YfGISjY4dacsjD08h7rT9j98WC.5P7hU2C27 5tXWUmE5barah2V5fAFx5K1kDMVgdhzivrhLqMmjYUrjyAlbvcnYU55gAs36 HsjzfZUDyeaBdFe9npL.KDj5hFYaFKvW..NxFPOO3jR1_wUiV6ztjG0zzmEW wjvakGW3ltrgJWvDUYYJXuS5RSkMt3Dgj8_DG8yoiM3k5MyXFIYm470gWZms lnlFlAHS.Towd4JFS128U34n8vg_b6ctVOiM2e5bIdHt15rzNQ–
X-Originating-IP:   [74.42.7.130]
Authentication-Results:   mta1036.mail.bf1.yahoo.com from=barid.com; domainkeys=neutral (no sig); from=barid.com; dkim=neutral (no sig)
Received:   from 127.0.0.1 (EHLO exmail.ehgt.com) (74.42.7.130) by mta1036.mail.bf1.yahoo.com with SMTP; Tue, 23 Oct 2012 14:02:35 -0700
Received:   from locutus-test.ehealthglobaltech.com (192.168.200.175) by exmail.ehgt.com (192.168.50.116) with Microsoft SMTP Server id 14.1.355.2; Tue, 23 Oct 2012 12:49:52 -0400
Received:   from locutus-test.ehealthglobaltech.com (localhost [127.0.0.1]) by locutus-test.ehealthglobaltech.com (8.14.3/8.14.3/Debian-6) with ESMTP id q9NGnmYX032550 for <porkyexposed@yahoo.com>; Tue, 23 Oct 2012 12:49:48 -0400
Received:   (from www-data@localhost) by locutus-test.ehealthglobaltech.com (8.14.3/8.14.3/Submit) id q9NGnmmV032534; Tue, 23 Oct 2012 12:49:48 -0400
Date:   Tue, 23 Oct 2012 12:49:48 -0400
Message-ID:   <201210231649.q9NGnmmV032534@locutus-test.ehealthglobaltech.com>
To:   (deleted for privacy reasons)
Subject:   PRIVATE INVESTMENT
From:  
Wilson Coker <wilsoncoker50@barid.com>  
Reply-To:   <wilsoncoker60@barid.com>
MIME-Version:   1.0
Content-Type:   text/plain
Content-Transfer-Encoding:   8bit
Return-Path:   www-data@locutus-test.ehealthglobaltech.com
Content-Length:   286
 
 

Tags: , , , , , , , , , , , , , ,

 
Follow

Get every new post delivered to your Inbox.

Join 58 other followers

%d bloggers like this: