RSS

Tag Archives: Benin

“Office Customerscare”

ADVANCE FEE FRAUD – LOTTERY SCAM

This post shows 4 different emails from the same scammer. I’ve been scam-baiting this one but stopped over a month ago and I still receive emails daily so it’s hard to keep up. This particular scammer(s) always emails under different IP’s and email-addresses so I have posted each header in order as well.

1st EMAIL –

WESTERN UNION MONEY
HELLO MY DEAR
THIS IS SEVERAL TIMES WE WESTERN UNION BENIN REPUBLIC ARE SENDING YOU THIS THE SAME EMAIL TO START PICKING UP YOUR PAYMENT AS WE TOLD YOU BEFORE THIS INFORMATION REACH US SINCE LAST THREE WEEK AGO FROM OUR CORPORATE HEADQUARTERS ECO BANK WESTERN UNION,
STATES THAT YOU ONLY HAVE 48HOURS TO EFFECT PAYMENT FOR THE ACTIVATION OF YOUR MTCN TO ENABLE YOU CASH UP YOUR FIRST $5,000:00 FROM YOUR TOTAL (FUND) SINCE YOU ARE FINDING IT DIFFICULT TO MAKE THIS PAYMENT WE HAVE DECIDED THAT YOU ARE TO GO AHEAD AND PAY WHATEVER YOU HAVE FOR THE ACTIVATION FEE SINCE YOU ARE NOT ABLE TO COME UP WITH THE REQUIRED SUM $250, TIME IS OF THE ESSENCE HERE,
SINCE YOU DON’T HAVE THE REQUIRE SUM OF$250, SO GO AND SEND ANY AMOUNT OF MONEY THAT YOU HAVE AT HAND STARTED FROM $40 TO UP $250, WE WILL ACTIVATE YOUR MTCN AND SEND TO YOU TODAY, UPON RECEIPT OF THIS PAYMENT,
BELOW IS THE MTCN OF YOUR FIRST PAYMENT, SO YOU ARE TO TIPE WWWW.WESTERNUNION.COM AND PUT THE SENDER FIRST NAME AND SENDER LAST NAME BEFORE THE MONEY TRANSFER CONTROL NUMBER (MTCN): THEN CLICK THE STATUS THEN YOU WILL SEE THE AVAILABILITY OF THE FUND ONLINE BUT IT CAN NOT BE PICKED UP DUE TO THE TRANSFER NEED TO BE ACTIVATED OKAY

1.WWW.WESTERNUNION.COM
2.MTCN 0560139994
3.SENDER EMMANUEL OKOYE
4.AMOUNT $5,000
BE INFORMED THAT YOU WILL HAVE TO PAY THE BALANCE SUM OF YOUR ACTIVATION UPON CASHING UP OF YOUR FIRST 5,000:00 USD, ALSO I AM USING THIS MEDIUM TO INFORM YOU THAT FAILURE TO PAY THE BALANCE SUM WILL LEAVE US WITH NO OPTION BUT TO DEACTIVATE YOUR MTCN OF WHICH YOU WILL AND CAN NEVER CASH UP THE BALANCE SUM. SO I WANT YOU TO SEND THE AMOUNT YOU HAVE AT HAND. WITH THIS INFORMATION BELLOW. AND UPDATE US AMOUNT THAT YOU SEND AND THE MTCN.SEND THE PAYMENT DETAIL TO THIS EMAIL,(officecustomerscare@yahoo.com)
1. RECEIVER NAME… Ikwunne O Anthony
2. COUNTRY… BENIN REPUBLIC.
3. CITY… COTONOU.
4. TEST QUESTION…HONEST
5. ANSWER…TRUST.

THIS LAST NOTICE TO YOU IF YOU FAIL TO SEND THE MONEY TODAY YOUR PAYMENT FILE WILL BE CANCEL FINAL SO RUSH TO WESTERN UNION OR MONEY GRAM NOW AND SEND ANY MONEY THAT YOU HAVE AT HAND NOW START FROM $40 TO UP $250,
CALL ME ON THIS LINE AS SOON AS YOU SEND THE MONEY  +229 68377742
DR.CHINEYE NWACHUKWU
OPRATION MANAGER.
WESTERN UNION DEPARTMENT
PHONE NO.. +229 98677751

2nd EMAIL (RESPONSE) — Hello my dear you can go ahead and the send the one that you have at hand ok waiting for your urgent reply with the payment information, good luck?

3rd EMAIL (RESPONSE) — Hello my dear you can go ahead and the send the one that you have at hand ok waiting for your urgent reply with the payment information, good luck?

(The 3rd email is the same as the second but was sent on a seperate day with seperate header information)

4TH EMAIL — ATTENTION BENEFICIARY; THIS IS TO INFORM YOU THAT WE HAVE CONCLUDED TO EFFECT YOUR PAYMENT VIA WESTERN UNION BY $5000USD DAILY UNTIL THE TOTAL PAYMENT OF$1,500,000,00USD IS COMPLETELY SEND TO YOU.THE DIRECTOR ADMINISTRATOR OF FUND RELEASE HAS ALREADY SIGNED YOUR PAYMENT.NOW CONTACT WESTERN UNION PAYMENT OFFICER WITH YOUR FULL INFORMATION TO START RECEIVING YOUR MONEY AND ALSO FOLLOW THEIR INSTRUCTION.

YOUR FULL NAME :::::::
YOUR PHONE NUMBER:::::
YOUR COUNTRY:::::::::::
YOUR ADDRESS:::::::::::

CONTACT PERSON MR TERRY SAMSON
E MAIL ADDRESS (western_union09@wss-id.org)
PHONE NUMBER +229 98841150

Regard
Mark James.
WESTERN UNION PAYMENT
SECRETARY HEADQUARTER

1ST EMAIL HEADER:

Return-Path: <office_dooog@yahoo.cn>
X-YahooFilteredBulk: 203.188.201.73
Received-SPF: none (domain of yahoo.cn does not designate permitted sender hosts)
X-YMailISG: YTQQLVYWLDtr8GvJiSxswwRjP7wnkQFwbp2etVmaNl0FiaXv WEWUyzcgnOMV_Qxqdh9W6bDVUk0oJ2n4H_.OqH3FVMd.Y5SeQLY8WPB3FzvF PDksuUJsc8jsOTNRuyWFfYR3l5wAZDJgIWuiiGdSmgdTu68C3rqyg3O3KdWs h.EODC.8..TyOEAnTAvAstMaGS8Ncy0SIJObOaOjtoBxXs6HTVJjL2nLqQq. V8jcqhibon.BQ9tsji3ubP5LyOllUnFxk7kElsMu7n0vVWWSlivsKIy_S5n1 TnjjQsj6Z6unrH0LPjxjeSxKbAjjeU63LUw4W.D9he2EEs26JXAWNlSyN_RA mHtPVevectbOeAKgC.m._frVA4tVlBJnUDlnVGkTYGWpICSFxTT9LPW_EEeJ l2XotLG4IwrFUfDfi_oT5YhbAo7jPwjxliFYxO_jm1h_wnaqEAIoQUqbckjp VIOOy.9bM6cUUjn4sXuLElKl.HyFw3R3uBNExQYnmx4RLVovyUrURD0ciS64 y4A8HjS0d8vV45llBD7G.G.oahtQT4gZsScBryrPWxrTQ3pLGp8tSk2zK.n2 eeTHvEQSRnZIbN0eOuFt75vrczEzEp24_Wxy.kkTt24Ghr67RLbx14T8AWJX oN_fjH0I4fLe4bZg9kWJjC5AIUtbrQ2yjsGa8Rqmniy4tDcDdplQBJNCIttH Y6iPtc8dzN6XRG89qgna5ydQU4LybEz.EW03VSf5bIAK7G7wCnLMhQCLLxgk ly1aVYK.aBw2ZGGdBfsnGxEQGmjWgPW9Y8yaS38MKaKk5BlVKjdKTv4Du9tr 7v1Q0Ahg1rbEQYh8bXhTn4R03SCnAeBhjAproiLkSzIk_nlJpbqzYS_tDYFN eublP_kgPayXAilWx.ksYpuHs_SFNkLaI2tWIn4oFvj8Hul6cqhvS1pJwTK2 8xjAkTjf5BRCJ73jx3wjykpTf9CXKVLe4qVn43MdJwIGfeb9p6tuMcY5ae7w c0GAOM3ZK4N_pO93ZKX2sJA.aGW8uNMDRTGyX1W7L7EKmy.ZYJQMjrOnd1Pp 8VcXJpyj7WUoKAXFir41peZR3kuJAGhW1GbparzRRCsM53A5wxeRRRvbeQlP o9SRMR9hJ7G68eklKQlZiNlLHYAN75iIROMHam0GQkoQl658wOksxxV0w1yE mwld8PgOs6.ieT5hfoq6JOm_CZnFaWvDCuNdzu7iw15xSb996aG1QW0ovKDm ivdO.r3OOe2nezrbgWHscU8DcPD0SD__8p7aOAMpHGW.0iovFBMBhXwhAkfD _c5Tjzjt4SpvsBLMK1O5olWM9ZTOgPGebcxgdbmbvX9l8w–
X-Originating-IP: [203.188.201.73]
Authentication-Results: mta1299.mail.sk1.yahoo.com from=yahoo.cn; domainkeys=pass (ok); from=yahoo.cn; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm9-vm7.bullet.mail.tp2.yahoo.com) (203.188.201.73) by mta1299.mail.sk1.yahoo.com with SMTP; Thu, 15 Nov 2012 00:06:47 -0800
Received: from [203.188.200.142] by nm9.bullet.mail.tp2.yahoo.com with NNFMP; 15 Nov 2012 08:06:45 -0000
Received: from [202.165.102.48] by tm4.bullet.mail.tp2.yahoo.com with NNFMP; 15 Nov 2012 08:06:45 -0000
Received: from [127.0.0.1] by omp102.mail.cnb.yahoo.com with NNFMP; 15 Nov 2012 08:06:45 -0000
X-Yahoo-Newman-Id: 597653.91745.bm@omp102.mail.cnb.yahoo.com
Received: (qmail 1033 invoked by uid 60001); 15 Nov 2012 08:06:44 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.cn; s=s1024; t=1352966804; bh=sqgSO8xP/LR+hXQMdA2e6Ah1eNeIaTHiSoq/jXQJhqw=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=Yws8UW5RVEL2oPJjowNq8quCXz9OzL0CxZrfGMUtTLq9P49zyzmh4cHIIaccgUS6cadGW2uanBjRYI1LgN7qnDfXWjIk1fJUorh8XSrtSnhaoUyUmvLuinqV/FZQLQV6ArVs06/OCE6rJG6RrChDzUt4hI5ALQRFiJ3ZkZnKHy8=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.cn; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=Lytcrsw3vUiLafw/lAGi2G0Q0Tb6yrnlT4ruv+ReTjQFhJriBDR+YxFNsAJmBt2mYpnus+zpYYvm4eYTFIsF0fqvBhc21W3x1a+iiSAPgC+CPtqGdn9cWtDgfR5n6UI9cuY9jwzCd+BU5PzXNKOXbca69Rp1IZVW4Uh5V+L0jKc=;
X-YMail-OSG: O7Gnv7UVM1lkD_jTVvQ9yvdVYlFxea2vZYOteXXHXMW9Qko jdT9UCaq6
Received: from [41.216.44.199] by web92416.mail.cnh.yahoo.com via HTTP; Thu, 15 Nov 2012 16:06:43 CST
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.123.460
Message-ID: <1352966803.94317.YahooMailClassic@web92416.mail.cnh.yahoo.com>
Date: Thu, 15 Nov 2012 16:06:43 +0800 (CST)
From: “DR.CHINEYE NWACHUKWU” <office_dooog@yahoo.cn>
Reply-To: officecustomerscare@yahoo.com
Subject: WESTERN UNION MONEY

2ND EMAIL HEADER:

Return-Path: <officecustomerscare@yahoo.com>
X-YahooFilteredBulk: 98.139.212.254
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: VLLNlMkWLDtUbQTbov0porruXohSlGjiyaNfjajWB0Cduvem OEGnfKhhlF4xKrU2tbM7tHSjRtnksOtCmBni7.2lTKxqM.zJc0kyzLSmp0nG i_CbXXHC8eh56HcFkIULD.BdzbjU3UfTNf7R.IJyVWYbK4FdG2DbERiFQ4AL 2W3kyMd2NrGNWVi84alfEJaPHmLcuiCe1dLIUuBMMg3BNKZYFjFuj1Cbr1QS fmYvDQcEL9QkVQFRA1r4HQalx1x.gCGsnuJ2c9o5WMKTqxEw1lfIpbsWdvZb 0oKivkDXKT0HKUzKdomv4xD1rCw13jYJ0yXJK0BLZfjeePYsPyENUOsfKq9Y Nsoj1dG59zkCJKyLFnd4kgct.GcOBFGPoqpevxYvub8VNcT0gOhnFqLdU38G 72Wja4aTwyX2PGzlzRnU6lmTFEBVcSg3lAYandBAzew3G7Yidyq9q1dnArb3 aue0WfEzyULn8QnrFCgUnH0L2oQF5ev9nBRp.V7MwiTHNOL02o3SMhpcTzSL 52bdZyM3GnxXlVmICHIGyw3cjZkp4_5N.3WtCcf84ScjcaJVKOWt4ReEQVXz 1BtjyULP_fiWN1GESbbrTsmE5WwCpijqJaFqFw45b6wli268.1f0LfkNr.4z YlGykrhi5NCIpY_7esUOObjfjns3nvhb2j5mCdx7_hWj9lolzI2w0DcE3rdp sgN2GDBvVZ680RMztbImaCT.cTURBiiCwvdgTcUy0Mu0E.lTCpJPstDT6ZlW Di1Hoob5dN4ln1HGBipY7Z5mrwTFmtlfI1gjFum_SEDYSmuHGh7eTWZ.BoSU ..k.g0Z8apbapJclKdfT1VK5b1PTmnhtp0OwH3TkTAIf_pAo19ji1fUKzKDZ EMdkEFWD_lfFSXaZjN5LQxHHk0l0N6rCojsf0_lY0srKWve2SaahYAwGBjAV tPNotMOJ51vzMiyw9Zlgyn_jFQ6KxZb5_8Jf8wqtd85wZFjSV6QXpmyxDCKT BahVlS5eGljKzuKTRb0dPV1.M9TxnEImZOHOKCzELtPfnvAeYRoQI25sr133 QlJUxK4HOn1WdLoMNCYBk5J9fmNaV4mS4MQtnFmyIz6wEMbpqkh5CYIrF_8a 5wUl2MuedcVKiMKjzJ2tIETeEsnKcOIDytHmAkQDqTOW2ji6B9lvQQmqB4Ad A9EnFyF4tcz6dmhzNuJh.b_dhtlKSZ.m4PC6WeOEvnrqaf5k3Sy5nN11UGqE 6ok1.QuDzlLWvjzFTfU4a4QZxV5a7pd64zvhBsFGvxUQSVvpBL.8YqBW77Wu hit9.w–
X-Originating-IP: [98.139.212.254]
Authentication-Results: mta1227.mail.sk1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm15-vm0.bullet.mail.bf1.yahoo.com) (98.139.212.254) by mta1227.mail.sk1.yahoo.com with SMTP; Sun, 02 Dec 2012 22:55:27 -0800
Received: from [98.139.215.141] by nm15.bullet.mail.bf1.yahoo.com with NNFMP; 03 Dec 2012 06:55:26 -0000
Received: from [98.139.212.223] by tm12.bullet.mail.bf1.yahoo.com with NNFMP; 03 Dec 2012 06:55:23 -0000
Received: from [127.0.0.1] by omp1032.mail.bf1.yahoo.com with NNFMP; 03 Dec 2012 06:55:23 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 790906.43532.bm@omp1032.mail.bf1.yahoo.com
Received: (qmail 63457 invoked by uid 60001); 3 Dec 2012 06:55:23 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1354517723; bh=D22VWzs/hPiPuo7CTSZY9WVrAb3WF520cs1fAxQD+yQ=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=M+WHRGyJ+Obkc6ezHvdZOt7XhENLPL3udu25sOZBN2bEv8bvyklwtQ6DLpmKzRRpBXOT706jn4vx+mPHl7Ss1QRzP9+0Wo6Ei7G3drwBg4JNSK0krATXorvXYUy6GzTqTOR3umwdQ0HSFEkjOZOm/e7lrZzQypAAF2HsfzCs/yE=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-
Received: from [41.216.44.199] by web161601.mail.bf1.yahoo.com via HTTP; Sun, 02 Dec 2012 22:55:23 PST
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.128.478
Message-ID: <1354517723.57854.YahooMailClassic@web161601.mail.bf1.yahoo.com>
Date: Sun, 2 Dec 2012 22:55:23 -0800 (PST)
From: Office Customerscare <officecustomerscare@yahoo.com>
Subject: Re: WESTERN UNION MONEY
In-Reply-To: <1354346435.35920.YahooMailClassic@web161004.mail.bf1.yahoo.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=”-83809723-1967636313-1354517723=:57854″

3RD EMAIL HEADER:

Return-Path: <officecustomerscare@yahoo.com>
X-YahooFilteredBulk: 72.30.239.148
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: 19QBmTwWLDt95EV2ebP6OidYWqd1j1U2Pdisxv.rlfwDDGY5 69ILUE_kjRPOWAe40.wXl4PoTGUhChdXTKcgusQIibh0IPY_D0Ei53Wrj3P2 DDAmqC8G56tWm3H_2xzLI52rgBO8bDRU9eSbv2pm3Azd_QOUM2JKPXkfNgvF tl4uGNQOLg59unuxlWy7GcvTf7k_qoqXCzJmrjoh8hal1wltXqDrPCdnPvy. gFAaiJyTkAU00qxgTiQBoHammaTYZ4ZKrv1Bj7dJ1Ay0unZZGeZ_8m2Gszaf Hwkx24CP1NPhsf3bn1yuJzkA3iUs9lmwihY8jKVEyWkaKzas.DMkI_qi4SpH ZcprZOz7Wo6Ip0Xe7ngKq.DJvGhyKa6y3Mo9rBfkwPSE1QwldTeMrv.HiKNc J7.fdByCHPm9iuieID3uhsZuZxJJIk_dE_HSPw5N3kU3zc7fJYmx.cnjr3Wf 2ypCCkWSg4Xl.J_9t27tMPFXSJSoGwnm1vLC91UKaZD.u1dtZUXXxB5tay_6 GXotgxrPGmqkwvJ1U.b3XhbbjAW7JSmUeiIRB4cduWQUVHj_rnXP_czMPQVD 4N5bIlcCPjZh3eSRW3gf3AEFVFfPfJx8dm3puMNiCNIHEOWM.KXpLJkyXgwj CXCCZTVhjugOJr6sn4MUCKseOTSyKsr9xa8mUcQ7Ob3w7yUH9YsolFteJokZ 791VNvwM.fuDRTa4C7_GNiOQkrjQtbT08_fPhS4e5p8AUbAPtXoVVhGyrysS WNwPxxltk8XRhk_dX67wDsZjyOfXPmDB3HLalZHqy18lbOcSTBFWISoihgww mPfGu3xD9UWTgN63IDe.rcwpwuXNg9AUAD4WI2TC1TkLuaiTIMBHc1hUskD6 YD46YkgYu9COqzPN4SopL_xQJrvUF.PV5BY4NQB5A_ZB2qJd1gRrxiH7F2oM WMR0CXNOYrY9TXM7XVLamxfO0CSlGMEfV72DaaT_VdZEOlfYoPd4lJDJmB_N sx2jYYAEsdbk4xs6H_9732N8KEwn6jyiAlysubWeSNzm_bnMmkZWyun_skUk lz4XKNVqrbYacm35w2StbbyHFWA8Oo1zW2qh9zv_DmYJfZdb6uGfCzwiuoY3 n24tw2e56bUSpjpwHGWyNJG5h17GA.7b0IXQjO.t5i4rXNFLy4dlPo8Ql.KL 7o3hOnvqv8SS3l.1ctFHuH50C0Qb8SFAoSBMFFfAJNxfMjdPOZxRzdCI54Rr wbWeyGdrtM3CPB2GdyVVli6zsFLRpSNohN6nXHYzK_sThaAO.uWlopq9Mi7R 7gMJVHuSRow-
X-Originating-IP: [72.30.239.148]
Authentication-Results: mta1368.mail.mud.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm39-vm4.bullet.mail.bf1.yahoo.com) (72.30.239.148) by mta1368.mail.mud.yahoo.com with SMTP; Mon, 03 Dec 2012 06:21:13 -0800
Received: from [98.139.215.140] by nm39.bullet.mail.bf1.yahoo.com with NNFMP; 03 Dec 2012 14:21:11 -0000
Received: from [98.139.212.194] by tm11.bullet.mail.bf1.yahoo.com with NNFMP; 03 Dec 2012 14:21:11 -0000
Received: from [127.0.0.1] by omp1003.mail.bf1.yahoo.com with NNFMP; 03 Dec 2012 14:21:11 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 750916.31792.bm@omp1003.mail.bf1.yahoo.com
Received: (qmail 15592 invoked by uid 60001); 3 Dec 2012 14:21:11 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1354544471; bh=+YYliwmsShAvNwhPLyzJNYE1MPX34bjAR9RvOUaGZQw=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=T9KwqKkebNxfAW3bEGZimvC7gz9wDwXYuJCHcFJKyIMKz+2fgGWIXJY7hbmEDeCEDL5nkFpao0O8/BJLEktQpgL/Oc8jlwc4lhbKFPAsVSV5XtdqnIgfQv+QUZOwGSNXAEzCLteM/75epq2GVgFNFQgSBnbamPziTry6CjeHtGA=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=o9sVFcOkfqm1EvfSTDuAbchXwIrh1CcZ/q9lVAsMZNG9iKgZzGUjcyCwN6W2BlBR/8N1BCU063PBnoZz65AMfqMww9vx0tKyy44myRUE6CCrpuSb6Q4IvBJvmXmIBv8uMwFHW7T9qQ9GntFtNWZAEBsJEOoiU1w2LqVEwcJ/LaA=;
X-YMail-OSG: 01EGTb8VM1m0Oj0eiFuBd82hpLH5OcmVrv4NLOE.DGTQuBD xtJPpsSc0mVlekI3jqbZq
Received: from [41.216.50.26] by web161604.mail.bf1.yahoo.com via HTTP; Mon, 03 Dec 2012 06:21:11 PST
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.128.478
Message-ID: <1354544471.96769.YahooMailClassic@web161604.mail.bf1.yahoo.com>
Date: Mon, 3 Dec 2012 06:21:11 -0800 (PST)
From: Office Customerscare <officecustomerscare@yahoo.com>
Subject: Re: WESTERN UNION MONEY
In-Reply-To: <1354346435.35920.YahooMailClassic@web161004.mail.bf1.yahoo.com>

4TH HEADER:

Return-Path: <yajie3128198@yahoo.cn>
X-YahooFilteredBulk: 203.188.201.9
Received-SPF: none (domain of yahoo.cn does not designate permitted sender hosts)
X-YMailISG: emIYTZsWLDsWBcwgel.WAdTfmAz7lIDU50.tyqE5VPt1VGpv VeukhIjY1Cn.KU8zhzCD_Pw_36n4JbpBBnAvEduvgl5qSCqKBsweGyX_h2Ds wNqtHkWk84quxCURRbnzMjvGUohntskqKJ9WLPygNjL0APgEgATzpDrLvj8k VuA9FW29oKwfhjurxzDZCcZH2Oo2zAfZnsdooccof.1DHRU8.6up3Noi8BNz 8uT6vrZfuFUPZ8DeDut0XwFw6QVwjr1qEX04NI..JcSraqBEfIQfTaoAwHus vr6Lj_dvPNX5tWGkfcNnjurajknIRROwwtXaASLQ7Cx8Uh3N5NoiCPSRcyUG yKVTej8g1qqyPvMgRR.Xg5HP87.bsB_o_vmswcSNF8KDt9Xkig3exi2o.Llu bLaJLyQxnGQMqS2eBdVt7G9icsk0YsTnLfPjvmsUkuS7kjMMvIL8AvgT8Wld 0y2mIrI71WQLbuCmqFVBhujChu2eWJ200uDJKrDtjv9_yZnFECzHIn02pCyw CDCDxpVA63zdAbSelgfxij7sHg1_jZCnlbyUm2cEPdLk15uFHsM.7nvxrgUY 5LsHbzlOaBg0rJ9x6AjwIurAG9AqXXMS28ewOfH2p.VXst11fH7r9U5jjOcl nrsDfP6NHDykG0m5xL.B6nKv_VGrJFtJ2d7bJ49SJD3fHvm08HTy3IukXkbR _af4nG35A546UhnaBoCPZY2XgqgjyqfjS7wIp_.Xpne8dHrzvdiv2fGZoxNs cdmCT929aSNoBVS7qmf.Vqh4Ba0Cq0iGPC69oPzjoseElXh_w.rLeV3Vhtmh v4w396qlHszg2qTh1ti6kqxrlGBJ5Es5_rFAUpfV_Iyc523_g9gcXSF639qk 5L5ibU_TC20R6g7C8emmS0Xz4A881Mgir2IBDvlQCykLm36iOT7Jt3KtGd0Q 8zo2IoPSQNQeUnRVvOOs_1u4tawNtF3beclZPl1jNKjb13l6FkwaL.Pl0fMr 0zPIZaLlHadKxr2LSmAlVNFkwxzVF.ejbaqH1T4Bf.HF1_4vrPHyGwypU4oT _Rd9trwPjtmiazFmvyW4zVt6P3uo6oNViHQvSKESLhBEb0dp1mJ24JmpYudY 9FOXDLAfJNTHD0OBlfo4j0ZN5tFbVqku8MM2wJkkVdHXcav.NP88edHCmGkG 3hnvwRmaS.xRh57w.78MDdmqgr8JsPvQbi7hbuZbxtyPysPjavf.Mn1dKiU8 MDzL6_L.ARVxcwWXZuD__sEtleqB
X-Originating-IP: [203.188.201.9]
Authentication-Results: mta1048.mail.ac4.yahoo.com from=rediffmail.com; domainkeys=fail (bad syntax); from=yahoo.cn; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm8-vm7.bullet.mail.tp2.yahoo.com) (203.188.201.9) by mta1048.mail.ac4.yahoo.com with SMTP; Fri, 30 Nov 2012 06:06:08 -0800
Received: from [203.188.200.80] by nm8.bullet.mail.tp2.yahoo.com with NNFMP; 30 Nov 2012 14:06:04 -0000
Received: from [203.209.230.76] by tm1.bullet.mail.tp2.yahoo.com with NNFMP; 30 Nov 2012 14:06:03 -0000
Received: from [127.0.0.1] by omp105.mail.cnb.yahoo.com with NNFMP; 30 Nov 2012 14:06:03 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 676497.39980.bm@omp105.mail.cnb.yahoo.com
Received: (qmail 62200 invoked by uid 60001); 30 Nov 2012 14:06:03 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.cn; s=s1024; t=1354284362; bh=y53EsIyh7n71+dZ/04bpw8ev0uIRHfZGOGFr7f2xT6g=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=2YdCEBsGYX6t8lq6v3RHWBeQNjh949+Bf0uHOzdQF4HHzc99e4R1GTkk82F+ACxM92FYk6ciYRMBFJjgw2vTXqxajDQF2mGe9gcYWTzOWlcMZcKOpAlTdfZ0a/Q5L57cgywjlceOUq8CTwQTYdP7c8C7RolTF4JhNYOVKXiweg8=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.cn; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=GvTvbvzMaFegUf3UU+0sN9uBuXGXz9nGn8DJZsM7LuwwyYt/3ZLa/bfYTxLdIOMSKzvNeyVM1QZb+7O0P99zR4/vnljfB45mZ1c63OSyAeHSYzBLiIpy7fSSyVzqdmyGQmITI9SAFiL0VKPGWWc8GDdA8JtUfxELE16aQoEAntI=;
X-YMail-OSG: uMubNSsVM1lY53F0TXaMY83uS7TEq6JQlDsaehAolKSsGNi urJ9D0OkSh22JWyfGoQTj
Received: from [41.216.63.171] by web92205.mail.cnh.yahoo.com via HTTP; Fri, 30 Nov 2012 22:06:01 CST
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.127.475
Message-ID: <1354284361.58719.YahooMailClassic@web92205.mail.cnh.yahoo.com>
Date: Fri, 30 Nov 2012 22:06:01 +0800 (CST)
From: OFFICE <offficialofficee@rediffmail.com>
Reply-To: western_union09@wss-id.org
Subject: REPY TO WESTERN UNION PAYMENT OFFICER

“Office Customerscare” <officecustomerscare@yahoo.com> <> DR.CHINEYE NWACHUKWU <> westernunion09@wss-id.org <> offficialofficee@rediffmail.com <> +22998841150 –  +22998677751 – +22968377742<office_dooog@yahoo.cn>

_______________________________________________

Associated Email: western2union1money0transfer@live.com
Associated User Account: Mr.Barry Grant
IP: 41.216.63.171

Associated Email: johneric777777@yahoo.com.ph; western_union2011@superposta.com
Associated User Account: Mr. JOHN ERIC.

The ip address 41.216.63.171 has been recorded as a spammers ip. If you have had a member sign up with this address you may want to consider contacting them, and possibly banning them from your site.

Other scammer IP’s in this range:

41.216.50.26
41.216.44.198
41.216.44.37
41.216.50.204
41.216.50.32
41.216.192.148
41.216.133.26
41.216.50.182
41.216.63.171
41.216.44.196
41.216.50.181
41.216.63.171
41.216.50.33
41.216.50.33

________________________________________________

Associated Email: kennethkuye58@yahoo.com.ph; emscompany78@yahoo.com.au
Associated User Account: Kenneth Kuye
IP: 41.216.44.199
The ip address 41.216.44.199 has been recorded as a spammers ip. If you have had a member sign up with this address you may want to consider contacting them, and possibly banning them from your site.

_______________________________________________

Associated Email: office.filemail21@yahoo.com.ph; western_union3852253@yahoo.com.au
Associated User Account: Mr Kenneth Kuye
IP: 41.216.50.26
The ip address 41.216.50.26 has been recorded as a spammers ip. If you have had a member sign up with this address you may want to consider contacting them, and possibly banning them from your site.

_______________________________________________

The additional IP’s have been blacklisted on atleast one anti-spam (scam) website and reported by other internet users.

Spammers Sent From 72.30.239.207
From: Standard Credit International Finance <thomasdavid
Subject: none/blank
From: Nadia kallon mbembe <nadimbem@rambler.ru>
Subject: Hello dear
From: Ibrahim Sanogo <ibrahimsanogo@voila.fr>
Subject: GREAT CONFIDENTIAL BUSINESS
From: “DR. B.S RUMA”<bsruma1@hotmail.com>
Subject: Call for assistance Tel: +44 (702) 401 6959
From: 郑���阳
Subject: 艳君
From: “ypyqv” <zabelvineewm@yahoo.com>
Subject: 何丽壤何丽壤
From: 唐湘祁
Subject: 楊家團
From: “Mrs. Sharon Crawford”<info203932@skymail.mn>
Subject: COMPENSATION ALERT, OPEN ATTACHMENT TO READ ALERT
From: YAHOO MICROSF 2012 <claimagent45@gmail.com>
Subject: Co
From: EURO LOTTERY PROMOTION AWARD <drmartins123@gmail.c
Subject: YOU HAVE WON
From: MATHEW SILVER <mathewsilver1290@gmail.com>
Subject: DETAILS OF THE MONEY IS ATTACHED
From: “AGENT JAMES BURTON”< kjhguigu@hotmail.com>
Subject: FROM FEDERAL BUREAU OF INVESTIGATION {FBI}SOLID PR
From: UNTED NATION PAYOUT <anthonymark.clyd@gmail.com>
Subject: (FIND ATTACHED) TO CONFIRM YOUR PAYMENT INSTRUCTIO
From: dso <obregonhjmou@yahoo.cn>
Subject: 请查收!
From: “Mr.Law Kanu” <lawkanuu@gmail.com>
Subject: AT LAST YOUR PART PAYMENT HAS BEEN APPROVED
From: “MR. SUNNY LUCAS” <sunluccas111222@rediffmail.com>
Subject: SOUTH AFRICAN NETWORK FOR WOMEN
From: “CARD OFFICE”<drgoodluck001@aol.com>
Subject: payment of US$2.182.Million Dollars only via ATM C
From: “Mr.Ibrahim”<lamored.ibrahim8442@live.com>
Subject: VIEW THE ATTACH OF YOUR COMPENSATION FUND
From: “MS GRACE SMALLWOOD”<mr.johnwalker444@hotmail.com>
Subject: HIS IS TO NOTIFY YOU THAT YOUR FUNDS ARE CURRENTLY

From: COMMITTEE ON FOREIGN PAYMENT <web.np@att.net>
Subject: ATTENTION
From: john graig <web66778822@att.net>
Subject: GOOD DAY
From: Nadia kallon mbembe <nadimbem@rambler.ru>
Subject: hello dear
From: “Mr.Steve Gulliver” <stevegulliver001@gmail.com>
Subject: INVESTMENT PROPOSAL
From: “Mr. Donald Wilson”<michealscolls25@att.net>
Subject: Confidential Account information
From: UNITED NATIONS ORGANIZATION <unitednations22010@gm
Subject: PAYMENT ORDER VIA ATM CARD
From: pavel_stuleanic_12@yahoo.com
Subject: Curs Italiana – Invata italiana fara profesor
From: Zana Clement <zanaclement2011@yahoo.com>
Subject: From Miss Zana Clement
From: e_x_t_r_a2000@yahoo.com
Subject: Economizor de energie electrica!
From: emo_love191@yahoo.com
Subject: Economizorul care reduce factura la curent cu cel
From: “United Nations�”<publication@un.org>
Subject: Attn: BENEFICIARY, Notification of Your Unclaimed
From: Oferta zilei <alexandra1975stefan@yahoo.com>
Subject: Tigaia magica Dry Cooker
From: Google Corporation <claims.sector@webname.com>
Subject: Google’s 14th Happy Anniversary
From: POWER-BALL ONLINE PROMOTION <info.pball.promotion1
Subject: CONGRATULATIONS. (VIEW THE ATTACHMENT FILE FOR MOR
From: MICROSOFT AWARD <awardm2012@gmail.com>
Subject: Good News And Congratulations You Are Lucky Winner
From: CANADA UK LOTTERY PROMOTION
Subject: Congratulation,[Kindly Open The Attach File
From: Musa Ahmed <musaahmed20222@gmail.com>
Subject: CAN WE WORK TOGETHER WITH TRUST?
From: William Nii Offori <douglaakana12@gmail.com>
Subject: Dear friend kindly view the attached file and get
From: “tristardamith@yahoo.com” <tristardamith@yahoo.com
Subject: GUESS WHO HAS A CRUSH ON YOU!
From: HEINEKEN PREMIUM PROJECT 2012
Subject: HEINEKEN PREMIUM PROJECT 2012
From: Felix Hachel <felll_hachel@hotmail.com>
Subject: Your transfer is ready
From: “#10090246 _____Get-a,holiday-bonus!_____Last<Hour
Subject: Last Hours to Save! 40% Off! Order #10090246Exp|re
From: MRS GRACE MANDA <gracemanda147@gmail.com>
Subject: I NEED YOUR ASSISTANCE ON THIS TRANSITION

Other Spammers IPs in this Range

41.216.50.33
41.216.133.26
41.216.50.204
41.216.50.182
41.216.44.198
41.216.50.33
41.216.50.26
41.216.50.79
41.216.50.33
41.216.160.135
41.216.44.37
41.216.50.26
41.216.38.164
41.216.40.128

 
Leave a comment

Posted by on 12/05/2012 in Lottery Scam, Other

 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , ,

“HOUSE OF LORD’S ORGANIZATION UK LONDON”

INHERITANCE / LOTTERY SCAM – COUNTERFEIT CHECK

ATTENTION: This scammer had previously sent me a similar email on November 13, 2012 under the same email-address of info@lordsdept.org but the reply-address was managementfile1@gmail.com IP 41.216.50.32 (location: Nigeria) and 213.154.64.102 – For more information click: HOUSE OF LORD’S ORGANIZATION UK LONDON 11/13/12

EMAIL: ATTN PLEASE
The HOUSE OF LORD’S ORGANIZATION UK LONDON Have just concluded the meeting
with the board of Trustees of United Nations Organization and
Representative of all the financial institutions, The meeting that has
been for the past eight months on financial matters, It has been agreed to
release all long terms debt, These are the classes we are looking into:
those whom has been one way or the other denied their Inheritance or
Contract payment/award payment due to corrupt official services,

After our mutual investigation in the recent schedule for payment of
outstanding debts incurred since 1999 to 2012 according to your file
record where we got your email address; your payment is categorized under
section {B}: Contract type: Lottery/inheritance/ unpaid contract funds/
Undelivered Lottery fund, Attn: Beneficiary, We have decided to bring to
your attention, that you were listed as one of the beneficiary, The
executive council Have decided to pay as many they have their file record
on their desk on a direct wired transfer, The total sum of $5.5usd has
been approved under your file according to elect,

Contact the processing/paying manager for your direct payment of US$5.5M
(five Million Five Hundred Thousand United States Dollars), you are
directed to contact the International Remittance Department of Benin
Republic who is In-charge of the payment
via E-mail:
E-mail: olusegunoniwon@ymail.com
E-mail: consultationdept@yahoo.com
Phone: +229 674 067 42.
CONTACT PERSON: MRS. ANDRIANA U. OLUSEG
INTERNATIONAL FUND REMITTING DIRECTOR.
HOUSE OF LORDS BENIN REPUBLIC.
Also provide the following detail to her for immediate release of your fund,
Also it is very necessary and important that you send us an e-mail
containing your vital information?? As requested below so that you will be
given an immediate response and directives on what to do next:

Full Names:
Address:
City:
Zip/Postal Code:
State:
Country:
Present Occupation:
Company Owner:
Company Name:
Gender:
Age:
Reachable Tel#/Mob:…………..*No Voice Mail Service*
Fax:

THIS REQUIREMENT MUST BE PROVIDED TO HER COMPLETELY,
As soon as the International Remittance Department in your file location
receives your information, your US$5.5M will be Transfer to your nominated
Bank account. this payment terms is to keep a clean slate of all debts
owned by the government and company to individuals either by contract or
award fund, we hereby plead for any inconvenient that you might have
received by any of this corrupt officials, The United Nations Organization
will not be interested in your story of not receiving your payment if you
fail to abide to this Instruction.
Yours Faithful,
Mr. Anderson Paul
Public Relation Officer
Strand Bridge House 138-142 Strand,
City of London,
E-mail: com.unit@net.hr
Hot line +44 020 8759 9090
OUR REF: H/L/UNN/APXB/TF/08
IMMEDIATE PAYMENT
#:WB/PC/FMF/MIN/UN/APXB/08.
HOUSE OF LORDS LIAISON HEADQUARTERS UK LONDON OFFICE.

SORRY IF YOU RECEIVED THIS MESSAGE IN JUNK BOX IS DUE TO OUR SLOW NETWORK

HEADER:

Return-Path: <info@lordsdept.org>
X-YahooFilteredBulk: 213.154.64.102
Received-SPF: none (domain of lordsdept.org does not designate permitted sender hosts)
X-YMailISG: n17TtrcWLDsdDEuSkY_HSkT51L21bPdZBMwxi6AQhYevQE6n 5AHJGUMCXxFcQWA_8b.NyHFBqZMcO.UjZ8FCertxLymBdRPX5yB160N2TGnm qwaPHWExX39Nk3fcXAu.PafkPhJjSLuBXZu9PORr5C.y390tBzQRaxX_Ajeo 7Hur_RtoMBNsEKEcS1NY_jJ7MVItgwhEdNv6BMjqx_b1MlG92f5bS_CtuAVd .oh_JKiqCucKnJdR_vA8__9UE.1fwuLwZ2jBdATHKGRXWA9jdgOwV3Ib69fT EOd7eaFTWdb_5Z16_.TYe.j7ArE3IJKpEKIk4E3slNCtWmGIRFmTka.H7YVU kHIFWlOe90o2tvuCYr8RvUv71WE0TgPgVl6Khq6RD5q1jIaXuAGNiZL303nP R7TIfXxur5a8ZC_2oHyszcv9WRLQjWFSCzGvGQYUJrk_g_Fa1qrpUjRjeM2i l0G7FO2XeR9HCwaTT2znjIqPkdy2KwzEIIjCz.N4kogQKc2kG9n6xWFpcpLo 74MXi2XlqMqfjw4Cj80wiP3jwE0ktGXxBGMSU_2n3YAQ21o2uVONL1mXGIl5 4bMmhVshiHKswZJfj1BN.SBP2D3c53qVkVjkIDCET06u1nIveivDP4Y_oe4g Gp0bTWt5y_R1RqFMmD.AIwh_MS5N2hQgXY2q7xk1_gsgMw2uKxCqk5wcw1df NMnauhxNQjJs0_tgmkT.nJ.KTOhA_qgdK986CusmuMctpQOH_ihBK.jvNTSK btYCtI0byx3BytVo7snXt8QYK6E5Jx9k3ZzauOFpR59.AeWK_EuKrJxb5kp_ 3EZ1tBGHB.ss6mypa8vfMvhb8TINeip6CZPnWI2wlXwUR.ZEKIJrohmFVHFm KFYVmymAMCOdWOLWh2A.dyJSUrjLje2_aZ.DSuRVGpoAtJLHe0QsBF20RzyD 7dC25DeBhkcO8UHLsvng7wFO2coQ2XMhsp.ayEqCe4X2lpjsh2lah9Xo7V7L pPiABw_yasLUGHztyfOUYJ9OSusCqxN.k2MPixuf1vKCB7pq65Iyc4p2uGVC K6bnKMICrei.rxdj1vvTYbKEmvHVsmn.tfhS5B0nTlah3FmibbEpZKHX7Upe wqrzGbwYMdD9LSIDpmkIqF3bRJMX91BdA08UsLs4_E931bhwDffu1ERuYjIw WyEwbhIfjONgETEO8gEzvb42sZbk90Wsxo5b2y1F4ypAzD7R2VyYuQIFQHpb _kcoyrCgQZolEt10hXFRxy0X5MWOAFCOxnDTvDjoJuR2m5Q4DJk8Ic5xuXp8 QCyFyE5lHJPSNnKZ9A15ErmDah0X_ZcVtz5Ri2C_TQNylkHidCSUd8sG0SJb Mg567n3VzIfX6JYHtqlSY9NbCE.G8GC_kNiS.WMe0oeKI7OGev6vbuV8Hzjf yRICVnPIJjSU56vQ91Rk6elLYGnonbkMLw–
X-Originating-IP: [213.154.64.102]
Authentication-Results: mta1349.mail.mud.yahoo.com from=lordsdept.org; domainkeys=neutral (no sig); from=lordsdept.org; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO smtpgp.orange.sn) (213.154.64.102) by mta1349.mail.mud.yahoo.com with SMTP; Sat, 01 Dec 2012 01:51:12 -0800
Received: from sunumail.sn (HELO srv1-smtfree-msg.orange.sn) ([213.154.64.61]) by smtpgp.orange.sn with ESMTP; 01 Dec 2012 09:17:34 +0000
Received: from [213.154.64.43] (helo=www.sunumail.sn) by srv-smtfree.orange.sn with smtp (Exim 4.43) id 1Tejj5-000827-EM; Sat, 01 Dec 2012 09:51:11 +0000
Received: from 41.203.79.249 (SquirrelMail authenticated user fletcherdavid) by http://www.sunumail.sn with HTTP; Sat, 1 Dec 2012 09:51:11 -0000 (GMT)
Message-ID: <55073.41.203.79.249.1354355471.sunumail@www.sunumail.sn>
Date: Sat, 1 Dec 2012 09:51:11 -0000 (GMT)
Subject: NOW CONTACT THE GLOBAL FUND REMITTING OFFICE FOR YOUR APPROVED CHEQUE.
From: HOUSE OF =?iso-8859-1?Q?LORD=92S_ORGANIZATION_UK_LONDON?= <info@lordsdept.org>
Reply-To: consultationdept@yahoo.com
User-Agent: SUNUMAIL/1.4.2
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3
Importance: Normal
X-SA-Exim-Connect-IP: 213.154.64.43
X-SA-Exim-Mail-From: info@lordsdept.org
X-SA-Exim-Scanned: No (on srv-smtfree.orange.sn); SAEximRunCond expanded to false
Content-Length: 3749

HOUSE OF LORD’S ORGANIZATION UK LONDON

Some other email addresses and IP’s used by HOUSE OF LORD’S ORGANIZATION UK LONDON SCAM – info@lordsdept.org <> com.unit@net.hr <> managementfile1@gmail.com <>  olusegunoniwon@ymail.com <>  freshtools@wanadoo.fr <> hackk@smtp.com <> 213.154.64.102 <> 213.154.64.43 <> from 41.216.50.32 (SquirrelMail authenticated user david_fletcher) by http://www.sunumail.sn <>

RECEIVED: from 41.203.79.249 (SquirrelMail authenticated user fletcherdavid) by http://www.sunumail.sn with HTTP; Sat, 1 Dec 2012 09:51:11 -0000 (GMT)

MESSAGE-ID: <55073.41.203.79.249.1354355471.sunumail@www.sunumail.sn>

More scammers who’ve sent out email spam under 41.203.79.249 are:

From: <sales1@home.fanwrestling.com>
Subject: Fwd: Re: Wire Transfer Confirmation
From: Tagged<Tagged@taggedmail.com>
Subject: Re: Fwd: Wire Transfer Confirmation (FED REFERENCE
From: <hien_u_spine@hhp.sugarmotor.net>
Subject: hien_u_spine@hhp.sugarmotor.net � ROLEX Inc � Disc
From: <kathytessendorf@mailfront.cbulock.com>
Subject: kathytessendorf@mailfront.cbulock.com � ROLEX Inc
From: LinkedIn Password <password@linkedin.com>
Subject: Reset Your LinkedIn Password
From: <Harrietjeancy@gmail.com>
Subject: Fwd: Re: Your Flight US 66-56833
From: “Purchase Vigara” <EAF01C7@tennlandforsale.com>
Subject: Weekend sale

western_uniontransfer121@hotmail.com — Received: from col0-omc4-s16.col0.hotmail.com ([unknown] [65.55.34.218]) by vms172065.mailsrvcs.net

From: Western Union Payment Center western_uniontransfer121@hotmail.com
Subject: FROM WESTERN UNION AGENT MR.PAUL EZE
X-Originating-IP: [65.55.34.218]
X-Originating-IP: [41.203.79.249]

From: Office Ups Courier
Subject: Urgent Delivery of your ATM Card Payment Through UPS Company Delivery.
X-Originating-IP: [77.238.189.61]
To: undisclosed recipients: ;
Reply-to: upsofficecourier@yahoo.com.hk

Received: from [41.203.79.249] by web29301.mail.ird.yahoo.com

From: Money Gram
Subject: Dear Customer.
X-Originating-IP: [77.238.189.216]

Received: from [41.203.79.249] by web132219.mail.ird.yahoo.com

Received: from nm25-vm8.bullet.mail.ukl.yahoo.com ([unknown] [217.146.177.154])
by vms169119.mailsrvcs.net
(Sun Java(tm) System Messaging Server
Received: from [127.0.0.1] by omp1016.mail.ukl.yahoo.com with NNFMP; Tue,
29 Nov 2011 19:54:16 +0000
Received: (qmail 69819 invoked by uid 60001); Tue, 29 Nov 2011 19:54:16 +0000
Received: from [41.203.79.249] by web26303.mail.ukl.yahoo.com
Date: Tue, 29 Nov 2011 19:54:15 +0000 (GMT)
From: “Mr.Edwin Aja”
Subject: CONTACT DIPLOMATIC AGENT IMMEDIATELY
X-Originating-IP: [217.146.177.154]
Reply-to: adamsvictor14@yahoo.fr

IP 209.239.47.191 as relay: IP: 41.203.79.249

YOUR BANK DRAFT DELIVERY NOTIFICATION!!!
Contact Person: REV.TEDDY HARRIS
UPS Courier Company.
E-mail: upscompainy1133@hotmail.com

419 from above IP, using 3 Yahoo IP addresses, including 98.138.91.34, as relays:

YOUR WESTERN UNION PAYMENT CALL TO CONFIRM @ +229-98679197
Vital Finance Bank Western Union Department.
Location Address; Plot 1261, Adeola Hopewell Street CO/B/REP,
Contact Person: Mr Chris Mike.
Tele phone Number: +229-98679197
Email Address: ( westernuniontransfe6@globomail.com )

“Western Union” Spam from above IP (Lagos, Nigeria), using IP 196.1.218.76 as relay:

Call Mr Kevin Anthony For Your Mtcn.
webmail address:( western_union001@qatar.io)
tele phone.+229-984-168-39
Contact person Mr Kevin Anthony.
November 17 2010 03:11 PM
H.User7043 commented…
“Western Union” SpamScam from above IP (Lagos, Nigeria), using IP 211.55.29.156 as relay:

MESSAGE FROM WESTERN UNION
Director; Tuker Hans
E-Mail :(cbbj@ymail.co)
Direct line: +229-66-614-055
October 09 2010 09:39 AM
H.User7043 commented…
From “Tony Chris,” purporting to be a poatmaster in Ghana, as a follow-up to an email from a “Barrister Paule Eze,” offering me an ATM card worth 2.4 million Euros.

“Attention Beneficiary,
From: TONY CHRIS “

 

 
 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

“DR.CHINEYE NWACHUKWU”

INHERITANCE SCAM – NIGERIAN 419 SCAMMER

UPDATE: LOTTERY SCAM – SAME SCAMMER – CLICK PAUL JOHNSON FOR MORE INFORMATION Paul Johnson under <westernu749@gmail.com> officepost466@yahoo.fr IP 212.82.109.207 and the same receiving IP 41.216.44.199 (I’ve been baiting this scammer but stopped over a month ago and still receive emails daily. Each day the scammer emails me under a new proxy/fake IP, email-address and name.)

RESPONSE EMAIL FROM: DR.CHINEYE NWACHUKWU <office_dooog@yahoo.cn> reply-address: <officecustomerscare@yahoo.com> is now going by “Office Customerscare” <officecustomerscare@yahoo.com> and sent this follow up email:

Hello my dear you can go ahead and the send the one that you have at hand ok waiting for your urgent reply with the payment information, good luck?

His response email is under a new (fake proxy) IP address of 98.139.212.160 with the same receiving IP of 41.216.44.199 IP-Location: Nigeria (the rest of the header is below the original email/header.)

EMAIL: WESTERN UNION MONEY HELLO MY DEAR

THIS IS SEVERAL TIMES WE WESTERN UNION BENIN REPUBLIC ARE SENDING YOU THIS THE SAME EMAIL TO START PICKING UP YOUR PAYMENT AS WE TOLD YOU BEFORE THIS INFORMATION REACH US SINCE LAST THREE WEEK AGO FROM OUR CORPORATE HEADQUARTERS ECO BANK WESTERN UNION,
STATES THAT YOU ONLY HAVE 48HOURS TO EFFECT PAYMENT FOR THE ACTIVATION OF YOUR MTCN TO ENABLE YOU CASH UP YOUR FIRST $5,000:00 FROM YOUR TOTAL (FUND) SINCE YOU ARE FINDING IT DIFFICULT TO MAKE THIS PAYMENT WE HAVE DECIDED THAT YOU ARE TO GO AHEAD AND PAY WHATEVER YOU HAVE FOR THE ACTIVATION FEE SINCE YOU ARE NOT ABLE TO COME UP WITH THE REQUIRED SUM $250, TIME IS OF THE ESSENCE HERE,
SINCE YOU DON’T HAVE THE REQUIRE SUM OF$250, SO GO AND SEND ANY AMOUNT OF MONEY THAT YOU HAVE AT HAND STARTED FROM $40 TO UP $250, WE WILL ACTIVATE YOUR MTCN AND SEND TO YOU TODAY, UPON RECEIPT OF THIS PAYMENT,
BELOW IS THE MTCN OF YOUR FIRST PAYMENT, SO YOU ARE TO TIPE WWWW.WESTERNUNION.COM AND PUT THE SENDER FIRST NAME AND SENDER LAST NAME BEFORE THE MONEY TRANSFER CONTROL NUMBER (MTCN): THEN CLICK THE STATUS THEN YOU WILL SEE THE AVAILABILITY OF THE FUND ONLINE BUT IT CAN NOT BE PICKED UP DUE TO THE TRANSFER NEED TO BE ACTIVATED OKAY

1. WWW.WESTERNUNION.COM
2. MTCN 0560139994
3. SENDER EMMANUEL OKOYE
4. AMOUNT $5,000
BE INFORMED THAT YOU WILL HAVE TO PAY THE BALANCE SUM OF YOUR ACTIVATION UPON CASHING UP OF YOUR FIRST 5,000:00 USD, ALSO I AM USING THIS MEDIUM TO INFORM YOU THAT FAILURE TO PAY THE BALANCE SUM WILL LEAVE US WITH NO OPTION BUT TO DEACTIVATE YOUR MTCN OF WHICH YOU WILL AND CAN NEVER CASH UP THE BALANCE SUM. SO I WANT YOU TO SEND THE AMOUNT YOU HAVE AT HAND. WITH THIS INFORMATION BELLOW. AND UPDATE US AMOUNT THAT YOU SEND AND THE MTCN.SEND THE PAYMENT DETAIL TO THIS EMAIL,(officecustomerscare@yahoo.com)
1. RECEIVER NAME… Ikwunne O Anthony
2. COUNTRY… BENIN REPUBLIC.
3. CITY… COTONOU.
4. TEST QUESTION…HONEST
5. ANSWER…TRUST.

THIS LAST NOTICE TO YOU IF YOU FAIL TO SEND THE MONEY TODAY YOUR PAYMENT FILE WILL BE CANCEL FINAL SO RUSH TO WESTERN UNION OR MONEY GRAM NOW AND SEND ANY MONEY THAT YOU HAVE AT HAND NOW START FROM $40 TO UP $250,
CALL ME ON THIS LINE AS SOON AS YOU SEND THE MONEY +22968377742
DR.CHINEYE NWACHUKWU
OPRATION MANAGER.
WESTERN UNION DEPARTMENT
PHONE NO.. +229-98677751

HEADER:

Return-Path: <office_dooog@yahoo.cn>
X-YahooFilteredBulk: 203.188.201.73
Received-SPF: none (domain of yahoo.cn does not designate permitted sender hosts)
X-YMailISG: YTQQLVYWLDtr8GvJiSxswwRjP7wnkQFwbp2etVmaNl0FiaXv WEWUyzcgnOMV_Qxqdh9W6bDVUk0oJ2n4H_.OqH3FVMd.Y5SeQLY8WPB3FzvF PDksuUJsc8jsOTNRuyWFfYR3l5wAZDJgIWuiiGdSmgdTu68C3rqyg3O3KdWs h.EODC.8..TyOEAnTAvAstMaGS8Ncy0SIJObOaOjtoBxXs6HTVJjL2nLqQq. V8jcqhibon.BQ9tsji3ubP5LyOllUnFxk7kElsMu7n0vVWWSlivsKIy_S5n1 TnjjQsj6Z6unrH0LPjxjeSxKbAjjeU63LUw4W.D9he2EEs26JXAWNlSyN_RA mHtPVevectbOeAKgC.m._frVA4tVlBJnUDlnVGkTYGWpICSFxTT9LPW_EEeJ l2XotLG4IwrFUfDfi_oT5YhbAo7jPwjxliFYxO_jm1h_wnaqEAIoQUqbckjp VIOOy.9bM6cUUjn4sXuLElKl.HyFw3R3uBNExQYnmx4RLVovyUrURD0ciS64 y4A8HjS0d8vV45llBD7G.G.oahtQT4gZsScBryrPWxrTQ3pLGp8tSk2zK.n2 eeTHvEQSRnZIbN0eOuFt75vrczEzEp24_Wxy.kkTt24Ghr67RLbx14T8AWJX oN_fjH0I4fLe4bZg9kWJjC5AIUtbrQ2yjsGa8Rqmniy4tDcDdplQBJNCIttH Y6iPtc8dzN6XRG89qgna5ydQU4LybEz.EW03VSf5bIAK7G7wCnLMhQCLLxgk ly1aVYK.aBw2ZGGdBfsnGxEQGmjWgPW9Y8yaS38MKaKk5BlVKjdKTv4Du9tr 7v1Q0Ahg1rbEQYh8bXhTn4R03SCnAeBhjAproiLkSzIk_nlJpbqzYS_tDYFN eublP_kgPayXAilWx.ksYpuHs_SFNkLaI2tWIn4oFvj8Hul6cqhvS1pJwTK2 8xjAkTjf5BRCJ73jx3wjykpTf9CXKVLe4qVn43MdJwIGfeb9p6tuMcY5ae7w c0GAOM3ZK4N_pO93ZKX2sJA.aGW8uNMDRTGyX1W7L7EKmy.ZYJQMjrOnd1Pp 8VcXJpyj7WUoKAXFir41peZR3kuJAGhW1GbparzRRCsM53A5wxeRRRvbeQlP o9SRMR9hJ7G68eklKQlZiNlLHYAN75iIROMHam0GQkoQl658wOksxxV0w1yE mwld8PgOs6.ieT5hfoq6JOm_CZnFaWvDCuNdzu7iw15xSb996aG1QW0ovKDm ivdO.r3OOe2nezrbgWHscU8DcPD0SD__8p7aOAMpHGW.0iovFBMBhXwhAkfD _c5Tjzjt4SpvsBLMK1O5olWM9ZTOgPGebcxgdbmbvX9l8w–
X-Originating-IP: [203.188.201.73]
Authentication-Results: mta1299.mail.sk1.yahoo.com from=yahoo.cn; domainkeys=pass (ok); from=yahoo.cn; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm9-vm7.bullet.mail.tp2.yahoo.com) (203.188.201.73) by mta1299.mail.sk1.yahoo.com with SMTP; Thu, 15 Nov 2012 00:06:47 -0800
Received: from [203.188.200.142] by nm9.bullet.mail.tp2.yahoo.com with NNFMP; 15 Nov 2012 08:06:45 -0000
Received: from [202.165.102.48] by tm4.bullet.mail.tp2.yahoo.com with NNFMP; 15 Nov 2012 08:06:45 -0000
Received: from [127.0.0.1] by omp102.mail.cnb.yahoo.com with NNFMP; 15 Nov 2012 08:06:45 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 597653.91745.bm@omp102.mail.cnb.yahoo.com
Received: (qmail 1033 invoked by uid 60001); 15 Nov 2012 08:06:44 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.cn; s=s1024; t=1352966804; bh=sqgSO8xP/LR+hXQMdA2e6Ah1eNeIaTHiSoq/jXQJhqw=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=Yws8UW5RVEL2oPJjowNq8quCXz9OzL0CxZrfGMUtTLq9P49zyzmh4cHIIaccgUS6cadGW2uanBjRYI1LgN7qnDfXWjIk1fJUorh8XSrtSnhaoUyUmvLuinqV/FZQLQV6ArVs06/OCE6rJG6RrChDzUt4hI5ALQRFiJ3ZkZnKHy8=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.cn; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=Lytcrsw3vUiLafw/lAGi2G0Q0Tb6yrnlT4ruv+ReTjQFhJriBDR+YxFNsAJmBt2mYpnus+zpYYvm4eYTFIsF0fqvBhc21W3x1a+iiSAPgC+CPtqGdn9cWtDgfR5n6UI9cuY9jwzCd+BU5PzXNKOXbca69Rp1IZVW4Uh5V+L0jKc=;
X-YMail-OSG: O7Gnv7UVM1lkD_jTVvQ9yvdVYlFxea2vZYOteXXHXMW9Qko jdT9UCaq6
Received: from [41.216.44.199] by web92416.mail.cnh.yahoo.com via HTTP; Thu, 15 Nov 2012 16:06:43 CST
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.123.460
Message-ID: <1352966803.94317.YahooMailClassic@web92416.mail.cnh.yahoo.com>
Date: Thu, 15 Nov 2012 16:06:43 +0800 (CST)
From: “DR.CHINEYE NWACHUKWU” <office_dooog@yahoo.cn>
Reply-To: officecustomerscare@yahoo.com
Subject: WESTERN UNION MONEY
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=”1574124242-396125434-1352966803=:94317″
Content-Length: 14282

HEADER NUMBER TWO:

Return-Path: <officecustomerscare@yahoo.com>
X-YahooFilteredBulk: 98.139.212.160
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: A6td62IWLDuBmelQKJEhijgTEL0P5R2xOPPy_._RsvsdzBaH yiBrnQT0925psK.s7SNHcBYe49AU0Ul3ICxEk7jQrKYkMrnITllaNYEqTeoQ pszSKc.CXds6vyKRGay5HbkIm5xdJL06qMYJeuDndMfXhl.KtXNDPBcZw0BO e7rSU1yq9Tq0AIKYLibJS5Ji7cCOJbYxKoA4yfOsJcdoBZHzSv6nABQ1E6Zn uABQykHao.NClcwPP.1B0.6GNP31WL93qUf8JoRj3B6BR75xwrIFYRdUy4G5 262Inle71_i99iHg0IqLKmQNy_9XV4J2klJ79za74Jts7ST_TwEjurl5e8Jf _PAY8p3MdVI4fsKogQpHgxR1s5wZIhK1pQhdQaLszisflXZsORhhjrtlapUr A73MhrwdcfdcXSqVSmfpwdzxBXkcV.4BTYIqHGTGZqh2qwsUty8igYWrIIoh sDVyJCRsLDsvD1rqVdGkrQYLcRjGVehq2_k3u0KTIr1aNYkrfLPSdcEY1Bwq _gBGoox6wsKZPkPuqCx89Hzc4hLvUbS8W9BFJLxlj2Ey4nLAmaKnIpqZdMjl 4hcVV8tlsvsuT4tYNW0lHggMDR0Z8qztWv3TT5X17FkNatwLR9Z3cgkoLfCe h1gP7PEELa47jNfNMRIofd8zaQNS9kVxpKl_mOEUV16Q5hPPsaEiL6jrdBvJ K6WVdOmRxYs9LETX5HhMZI.tT1kO_.t.VDGWOxQqI5bwTuY_si3Nmyg1gMMm T8G5YTa4tuftY3yPi.IVm50h7zhHPJYz43C4ze0iES8nuHCXpgcdO8QkvWJB rul3g18dawtTywGuPNr8L3z3YwhxzwgJcvrBnnqbT5tMGKriaFsDtUb7QCVT 2w59IxZtgg9QIbZbCwx.wO.AS6EIIO3Rg5h442qemVR0NnhI_i7tXeZ5Z8Xk aQNqbSBI0ZdY3J98pAMrUI4GfLJlT4aKyCWKpbXobriv6gfG7HkyNwKTik71 7D9lycclsvAe_RoyDEcUHh7NIQjBllyIJ0dBWYAMIc8k6dp2QTcItskcss36 r0H0FyF1YAuULXqdMRUTwafuLsHIAlqmvCKb33f8Lto0_eqFpy7rblQ1lMkc BJH0Jy_MYFo8JsxlaV6gIJJv30.DknRRqr0e79ga9ucQfYVgmaU4DApKHtwd c_AgySu.BPiKcidO0VJeW8osusxFm4T7JiwASuwuzGclt9WW7DJbihfcQK7u ThBXA0In8NnC0stWZn8vKuG1.rxwVgaK0RBVZrsxG_Z_Bz4ilkET7YqZ
X-Originating-IP: [98.139.212.160]
Authentication-Results: mta1187.mail.bf1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm1.bullet.mail.bf1.yahoo.com) (98.139.212.160) by mta1187.mail.bf1.yahoo.com with SMTP; Sun, 02 Dec 2012 22:54:20 -0800
Received: from [98.139.215.141] by nm1.bullet.mail.bf1.yahoo.com with NNFMP; 03 Dec 2012 06:54:17 -0000
Received: from [98.139.212.195] by tm12.bullet.mail.bf1.yahoo.com with NNFMP; 03 Dec 2012 06:54:17 -0000
Received: from [127.0.0.1] by omp1004.mail.bf1.yahoo.com with NNFMP; 03 Dec 2012 06:54:17 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 296448.58568.bm@omp1004.mail.bf1.yahoo.com
Received: (qmail 29676 invoked by uid 60001); 3 Dec 2012 06:54:17 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1354517657; bh=kJDT5cjpbLJ82eNurct1MB2GVVciWeGexi7i426BwJ0=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=LDRcgojsiWMlx1x+zCJeK8Ij7oJzAHg3xJYyco2XPFGssWdcTEnSoZAGjixPokWJ+LDm55PhuiuBXjOJfsPy6T+9cBwGl1tr3c9YMIZqEDPJDTN71V1pLXxI0Z53oNGyvQGAKmgnZ5zLuqERI3krJzVxqA2tm5oktP+RePDjv4k=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=xzEPklSUYsGtcFrb03xI5tsNxxPpLgFzq18y0B3ZDo3LD8wtm6LVTwMrowI1STv1RL9L457GvMEljRaUkoVhdbBdV1STmPOxSQd+Y8Y9sci9kKl6bsG0WmAeJyC/t7sWZj6W6k9zb8aPt0VG1++MsK/OPLrVlDdO4+4nkufIhXQ=;
X-YMail-OSG: 6N4vh_4VM1mbdEGhvO_RyhbLAeLnsPGi6s8aQaiHe8YX6W. rhuE7fSBvQ_ftU4Al5JgYAo2Z.5DOZ2i59WMXv.THlBBKjJP6NpUUvxYnjKu _Ch_mo433YiqyQ6hPEZDCdVAvfc0zg8.lue8uGl07GOkw4dCa5oKTjUTAm99 HV.Cu01qyMkmDo6cO.4ZIVBnQuvfS2kXm5CUxG73z6a.usxaxPwQIaHHCnVc 62hrAx3MizJn6OKWk_tno8l8aN0E0q3ZqZ3MgL0J.ELjO3LM2OUOTDQq4UMV MpGkfD_TVZ1Ub0D_mAZviZbdEGcjVPrLPP1P0gwmgc.4VNHtsoc.NbzI9dst 1CY1zoGFzHD8VBdTiapnjUaBLRd_gzJW9wxO7UJN1lbkYeEooyqEUO2rlTP3 8EnxRxTJVq8ufB2a4HIoWYk58FVBQOYBUQt2qeofOJ.yCB5WMpCTnSWAou1R FB2YGoeDoR6EwEM1VjresV0AXyzncUORA7KxmI2VazxlIWw8OaIyI2lJ46Ev IMBLQGb8.z8msK0PntWCMe8q4VFGbHEBTrE7_MCCcFlF5jOQHaBkH3kSIXcz 3dLNSl5INWPJkgb86z9ep0VZjC7REgroyqPtENcY2HOfwvv7Nj5AKPnpGSHE fnttfWkSDsb6azL8mMX7.USb5gpo4YndcGUMR4q6eVNJPT9rlyq8ikAX_y9H MGakiGkTmX61IKpy6Eh2DB3b5KyvGe2L.8Xsk43UqPmgIRxV2.XWcPjfS3A3 dbjDPDVukFI_K4XlNP35lyHjDvUqqQW76TSNEwIcgvDqMDlHGqZtu1udDwiW bKKBOPlKfuwA0ybkhD_qMkcjmbfdLaefAP9tBMLq.C.inNz4Mc2psagyYQ8L 9Rd11ST_9FoHaHhMaAfw7LZxBv_BKfhwrcYm3z47ua41oaexPi2rM.gi7_jr eErSGcegHPgGDu4k9QdQZnlef4vyJh6qVVgSyNM7kREotHk4q_4YDUNLnv_y ytY9frrXOKDuQlQuL27qL0OzDNT06xLZF5qQxDX27vpxRQIk3ogG6Zj0E0yU QeJjwWRUQ.f9vkaGHImfB2lSmXDVeiOPggMIa4ca8vI70ulU8nUbo7H0Iqkh QAK_UHRHySczm54TBpHFMXJ.PYL9i6g0XZn355ZS0hBg9sUF0pSnH4dRkFzo z0OdBlmbq6eh_Ccnkb3lFuyiG2hg0DYRmCAnHRgxrbJRwldN67jL1q29hBYv 5sPP7P.l868cM05.1wYpA.IyWxGZ9jQzOsv.rNCo0h3KlCWKq12K.n2q.ums NfL7jWHpgFzd4prV2IJXj3annZG8eJjh.WR_t1d6Lb7YaRgnrhpjBGsGJEGY tl7E.ZLgdGnoNsGyPl5uMX0KzXx7xgZUDNwcfPLM8f46kK7PnkLygDDck4RH kMeoO6C6wundts4OTXJNTVtYa_RsHIag6Pnz9gpJMIbDACbdlLkx0dIJCrO9 hPNqyxguptR9A5dSXr18lS8XXCSCK5gOKJLnO.9KZOuiEClvtS0N6WwAWZrl X2TMtwuPI4GWk6uZsLjYkjnhzjK4Mue.pkkyAYOsx0nBrF0SqClph.mLP2gg RhYqCqcizaYXnSMxyfaoTk_mXOGVwkQwT.0pebeMajeWZPdbnj6zDFyB_RtG H7CuPDxc5pWFpmx1bkgcxV7u1OUAD86cTP5eaMSMPAqAxvGh4TowZNhdna7q slJu5uK3vme8zDsu7tZsILoCZMYQaTeofrr11QpU10u_m3CHKahxlTmDZkNO 7p992wagF0rF7Bdi4y7GzQieBnbT3KxvtE_iqPB.CxU97R34AhS54EMNyoP3 SiSQHLkKl2d2j0KpBNsM2HSxrAEU.kNZELw6bddzBXAauVDntm09i0JGANED G2xgGt5pEO2Alp1qtPBXd_99vBqB5HT7apOhQaBTsv0XAjNF6Li6F1RmvD50 j0JV3aj8sI_1BsYTUE2yC.ZgDSB7SZZ.Pwb9geGqA_0sX6hekZx4pkDG3sdP DBP..MfaKKmAM5w0DCD4o8BWgmTmrR26Kk4xKbIrxjGAgMqUl_waE.ECw_pY Y_Y1SJQ6cfGYqnA5yzOun8Eo143DJeS5s9IGCcTObOllEy3eUFK6nnRbOJs3 lULboYK_jjrkdKgvmp094UDGXja3TAzBSgYRF80h9bxhA3KZcdbDgpohqyHu m6bU3Q_nLyZJI9SQM64_gK7qBC00VeEEk49nJmvqiWCkZ5Uy3AGJus92STx_ WAVnfiNnIYWk3ZzJApHqt8AiIVXkyaFeBWp_Fh3qoLl92IP0_HFJUWrxIv3L aSTEBDdjcpzTmABNgDMx7K8m_FfJ0jQIvVXCrlyTd6rUzr3uBBotATWAWYAj oZDlW5yfOI3JL77KWHti.eweN2ChJM2PjUEFOf.bV5kOFMWLXAcDRs4wbXLd yrml46PWmL6DFLXgiAxgukFjqtngKvuLYspZZA8Wckti7qbw1IiRShAGeFrh OAGrEkrAuQP7QuAqq3GzL_k2gv40JNwF0c07nBYWRnmV9I9tCMbVQ44uePKv LQTVW8QKtVms0JkSuETtylaRgpYVTI7kg_t47zo33UKUBUi1iuCFhiPnX_Yu wbOaPugLirBbc45fE_ioAVdMCBb4FcWvaZsGIlP47X4NjQzagetkLuf9JvSq RHJlD.eVSXsO55Eo7kpxOR7eMZACKC1xI7c1XJ5fJguDWlIusVuFgCLNO4cA t7A–
Received: from [41.216.44.199] by web161602.mail.bf1.yahoo.com via HTTP; Sun, 02 Dec 2012 22:54:16 PST
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.128.478
Message-ID: <1354517656.28058.YahooMailClassic@web161602.mail.bf1.yahoo.com>
Date: Sun, 2 Dec 2012 22:54:16 -0800 (PST)
From: This sender is DomainKeys verified Office Customerscare <officecustomerscare@yahoo.com> Add sender to Contacts
Subject: Re: WESTERN UNION MONEY
To: Porky Pig <porkyexposed@yahoo.com>
In-Reply-To: <1354346435.35920.YahooMailClassic@web161004.mail.bf1.yahoo.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=”406169123-855337282-1354517656=:28058″

DR CHINEYE NWACHUKWU – office_dooog@yahoo.cn – officecustomerscare@yahoo.com

41.216.44.199

Associated Email: kennethkuye58@yahoo.com.ph; emscompany78@yahoo.com.au
Associated Name: Kenneth Kuye
IP: 41.216.44.199

chukwuemma57@yahoo.com.ph – 82.57.200.117 alberto.tonietti1@alice.it

Received: from (41.216.44.199) by alicemail.rossoalice.alice.it; Thu, 28 Jun 2012 03:10:18 +0200
Message-ID: <13830a382f0.alberto.tonietti1@alice.it>
Date: Thu, 28 Jun 2012 03:10:18 +0200 (CEST)
From: CLERIOT PRUNE STELLA <alberto.tonietti1@alice.it>
Reply-To: cleriotprunestella@yahoo.com

Received: from (41.216.44.199) by alicemail.rossoalice.alice.it

Same IP – (phishing attempt) – Mr Eng David Kalu – chukwuemma57@yahoo.com.ph – REPLY-TO: ww.ups.com@superposta.com – Received: from [41.216.44.199] by web190206.mail.sg3.yahoo.com via HTTP 98.139.91.244 Phone # +229-98344889

Mr PAUL JOHNSON <westernu749@gmail.com>

 
Leave a comment

Posted by on 12/01/2012 in Lottery Scam

 

Tags: , , , , , , , , , , , , , , , , , , ,

“Mr Jude Anoma”

WARNING: BUSINESS PROPOSAL SCAMMER – 419 SCAM

EMAIL: From: Mr Jude Anoma 

Address: Abidjan, Cote d’Ivoire.

Hello Dear,
My name is Mr Jude Anoma the principal treasury officer with one of the prime banks in Cote d’Ivoire. I have decided to contact you through this medium based on a business proposal, which will be of mutual benefit to both of us. I discovered your email through comprehensive web email search on directory so I decided to contact you. I know this might sound like scam to you because of a lot of activities going on in the internet today. But I assure you that this is real.

I am the personal accounts manager to one of our late client a national of your country, who used to work with an oil servicing company here in Cote d’Ivoire, the late client made a numbered time (fixed) deposited for twelve calendar months, valued at €8,200,000.00 (Eight Million Two Hundred Thousand European Euros) in my branch. Upon maturity, we sent a routine notification to his forwarding address but got no reply.

After a month, we sent a reminder and finally we discovered from his contract employers, PETRO-CI Corporation that my client died from an automobile accident. On further investigation, I found out that he did not leave a will and all attempts to trace his next of kin were fruitless. I therefore made further investigation and discovered that the deceased person did not declare any next of kin in all his official documents, including his bank deposit paperwork.

This sum of (€8,200,000.00) is still sitting in the bank and the interest is rolled over with the principal sum at the end of each year. No one will come forward to claim it. According to the law of Cote d’Ivoire, at the expiration of 5{five} years, the money will l revert to the ownership of the Cote d’Ivoire government if nobody claims the funds.

Consequently, my proposal is that I will like you as a foreigner to stand in as the next of kin to deceased person for the fact that you have same last name with him so that this money will not be reverted by the government. If this request matches with your inward intention for success and greatness, then you are urged to make a quick response indicating your interest and readiness to participate and work with me to make this successful.

Please observe utmost confidentiality, and be rest assured that this transaction would be most profitable for both of us because I shall require your assistance to invest my share in your country. In your return mail, please do forward your information as listed below if you are willing to complete this deal with me, to enable me put the total fund in your name for claim as the next of kin to the deceased person:

Your full name:
Your contact address:
Occupation;
Your phone number:
Date of Birth:

I wait for your urgent reply.

Best Regards,

Mr Jude Anoma

Rue 18 Avenue 11 Angre
Cocody-BP 982 Abidjan 01
Abidjan-Ivory Coast.

HEADER:

Return-Path: <jonascalcario@terra.com.br>
X-YahooFilteredBulk: 208.84.243.152
Received-SPF: pass (domain of terra.com.br designates 208.84.243.152 as permitted sender)
X-YMailISG: jti0k3AWLDtAdhHtJ8DBla5B6hhhFN9uNDQ2xLXFYHSDgkJi 7091ufrq_TjZrOiPrIOKj63_2IGN54yIjV6tPOKOaA6MQSboGMb3.VLa4ihD VnHZP15ln0etwMeg7Ci.AHtAcejrAaHkHsdimXH6nHUCToobObG6Y1nFpvhN YzhroWrqXo6MKSYtliiA0U9V6A2I1Kwwqwpv0Pj3cCTUHsUk5g3HncHSDXIs AJZnh.AnBpeOUzENdbp17DqRO.VAnev620wLyUqzo6nzBcDmyDQ9ge0XC51x 6Gk464rg8soUZ5CW7qmTGxtjySpOcyF_kXDJNgyVvVD89kfj_3W5s6rW3VNJ 1jbYOfSGg8wCLFkEpz4173rLvHHCEneC1V0DZOZ7rq3jq1qEXJGlFMjbnnWU 3LXOf5slQOrXlGFbhVqo6iIqbl5AB8GlX_ZlFoC.lKuGmoXrBjqtXKpDvMlk MklDV6TNAagWg4jWScFYCvIKbXv5GgpmGOs4NKE1n035dYZH0vFYE7Q4CO8p nLA5_rWWFq2Itdi1rOajDMEmtAJaHSTH_wwiW.uppyXVfQIm9_Lb6wyIqZky M9t4Flaeo8BgTmjv1UIdzzcFdW9peAlD3_Cs5iGh8PoUh52WBmxGzRjpZi7D JSKQWws3v53dJ7_9utqZ_O1GZbTKsOv29zxXQvkYl.KQVv30tAhTD6wdO17Q OSPkTBFG_jjquu.H0ptd03O_fcZKY2BXtNMUEQE1GuC2UNX9rCzmH52aGKBw USxd1kGEfDq5AyAG3k51CDMLqzgo9rO2cQlIEKqlnUHa_dKUT0tnLxTcNchV bUXZ8oj4RFOWrDoiWQj5GlzXdpdKuMkkdpk8tBDWgUXEoPsysImLLUoCy9qL ttxZg8T0hp_3_zj4xV8i.u5bGHRCOv90scNgBI0L0JKcnBKIByE6kC6iCycR eFLx73Arn1lYN5j7s02rDk6qtyRm.3PTa5PGnB3rZL7rhz.8TcdTWS2j76Be TKxKJsLdB1874.e8Bu2pwoO.eF7ZqgBrAo9E4AGT7Gd5CF9nT0SOZkyZHgw. wncFODEu_b99Il0M3745JzjWwtoOu63qJOh5mn5IUtX1I7yBiZfB70mcTMYn BZo6c9nguq3T66pAkJzFOjfGWujBAeLEULJy7gawozWyGNHLYJjHY3cVnVfm S2BoiAgKFV0qj0l6jHpd1MyuVFJU7UChSQW5hUW92gu8k1GtYJhABJLzxL2u PEQEKTnyNGtCaOs6Nxx0KFqfIjOZWwzcH3r6xogufNcVBtXPVYGTs3G_kTZg Rlsq1UtVgUXiduwFfZYJt3_9H7416xVCC1o3WMOLOqd.qg56fXXcL7_iQH2t 0ZqeV5XmohxjsTtR1p6F
X-Originating-IP: [208.84.243.152]
Authentication-Results: mta1333.mail.mud.yahoo.com from=terra.com.br; domainkeys=neutral (no sig); from=terra.com.br; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO if01-mail-fb08-mia.mta.terra.com) (208.84.243.152) by mta1333.mail.mud.yahoo.com with SMTP; Thu, 29 Nov 2012 08:33:18 -0800
Received: from if02-mail-sr08-mia.mta.terra.com (unknown [208.84.243.35]) by mail-fb08-mia.tpn.terra.com (Postfix) with ESMTP id 31F5018002998; Thu, 29 Nov 2012 16:32:59 +0000 (UTC)
Received: from 1gr.tpn.terra.com (unknown [10.235.200.44]) by mail-sr08-mia.tpn.terra.com (Postfix) with ESMTP id 6EC5B40104A1; Thu, 29 Nov 2012 16:32:20 +0000 (UTC)
X-Terra-Karma: -2%
X-Terra-Hash: 18156cd98356fb6c44cc10b60c2b8ee4
Received-SPF: pass (1gr.tpn.terra.com: domain of terra.com.br designates 208.84.242.62 as permitted sender) client-ip=208.84.242.62; envelope-from=jonascalcario@terra.com.br; helo=terra.com.br;
Received: from terra.com.br (18h.terra.com [208.84.242.165]) (authenticated user jonascalcario!terra) by 1gr.tpn.terra.com (Postfix) with ESMTPA id E7F104000014D; Thu, 29 Nov 2012 16:32:19 +0000 (UTC)
MIME-Version: 1.0
X-Mailer: TerraMail PHP 5.2
Message-ID: <4236.1354206739@terra.com.br>
To:
Reply-To: jude_anoma41@yahoo.com
Content-Type: multipart/alternative; boundary=”=_1e3c6d7761ec54535f40b301bdebe3a6″
X-Origin: 41.202.90.93
Date: Thu, 29 Nov 2012 16:32:19 +0000
Subject: Hello Dear,
From:
Mr Jude Anoma <jonascalcario@terra.com.br>
X-Milter-Version: master.39-g1fd3ecd+
X-CLX-Rate-Response: fh=1gr; fi=10.235.200.247:2001;
X-CLX-ID: a123GLF8i43m0VH-AT1632K6
X-Abaca-Score-Saida: -7
Content-Length: 6555

Mr Jude Anoma – jonascalcario@terra.com.br – jude_anoma41@yahoo.com – 

 

Example Messages Sent From 41.202.90.93
From: “Replica Pens” <tandyb@austin.rr.com>
Subject: Replica watches 25% price off 
From: “Hiram Swanson” <loses36@sanchitech.net>
Subject: Attention from beautiful women is guaranteed to yo 
From: “Internal Revenue Service” <no-reply@irs.gov>
Subject: Notice of Underreported Income 
From: pamelia.n.schilawski@yubaba.ggpsystems.co.uk
Subject: pamelia.n.schilawski@yubaba.ggpsystems.co.uk Rolex 
From: “ANASTACIA AUDRIE” <margaritamelina@bv.com>
Subject: Best Buy Viagra Generic Online – Viagra 100mg x 60 
208.84.243.152 – This IP is also known for sending scam
 

Tags: , , , , , , , , , , , , , , , , , , , ,

“Bonjour”

419 SCAM – FRAUD – NIGERIAN SCAMMER

 

Bonjour , 

Je vous contacte de la sorte car je souhaite communiquer avec le monde et fais une chose que je devrais peut être pas dû. Je souffre d’une maladie très grave que je n’arrive presque pas à trouver le sommeil. J’envisage de vous mettre en possession de mes biens.J’avais travaillé dans le secteur pétrolier au Koweït. Ensuite j’avais décidé de mettre en place plusieurs centres. J’ai une mallette remplir et cerlé,soit 2.500.000 d’Euros qui sont jusqu’à ce jour dans une banque étrangère en AFRIQUE . Je sais qu’on se connait pas, mais ce que je demande à DIEU c’est de rendre votre cœur saint afin de réaliser mes projets avec ce don c’est à dire, construire des centres d’aide sociale. Je veux que vous rentriez en contacte avec mon notaire puisque Je l’ai acquise toute ma vie et la seule chose que je pourrai faire de bien sur cette terre avant de m’en aller c’est de savoir que ce don servira à rendre heureux la personne a qui je le ferai. En effet je suis gravement malade et je suis à l’approche de ma mort c’est ce que mon docteur me la confirmer ce qui me laisse un peu perplexe, pour avoir vous contacter a été une grande réflexion. Malheureusement nous n’avons pas eu la chance d’avoir des enfants mon marie et moi. Après Cinq années de vie commune, mon époux est mort dans un accident. Si Vous êtes d’accord j’attends alors votre réponse à ma lettre. Veuillez prier pour moi car je suis dans une situation critique.

 

Return-Path:   <blackweardesign@moov.mg>
X-YahooFilteredBulk:   196.192.32.61
Received-SPF:   pass (domain of moov.mg designates 196.192.32.61 as permitted sender)
X-YMailISG:   bwx8weMWLDsQQjWKBr4l3K0Yd4C43qxN3b20kfCMcGiIqGuk 0gY3_xmQAxfrzOtgq5RR_ZHnJrfYGkXVam1pZ.qmn41GVoggO7hqYAgq82.I qgcjt6DkUaIlzZXQ7rFc4AWCdFB2R69fuLNVrBCdy3ud1WIJq477k_4nj1K7 MKn2.p2l5Y7BD7qRoGZGYBnwYq1kWDZeCLoh8pCoFpZyjll58BFUG5GQYtF5 OZd4KPWPkbhvqU_7c.rUINpXGzadiVuyVBYKGofNZjrbT24_yWJuRPOu2V6Y U6uPYiidl0E5biW21rQViDH1e1u_cCqrZ1.HKIb6b2HWV3yfqdGznzFRGWso s_hmrGBS.VtxYRPxzLJHg8Z_gzdJ4jsWAoOirJf46dxz38t2mGlyJUZf9t0w DCvbGIdrK6UTLqR8VIwIRn4bQyuIMxN7DJXaRHVlHaK7_1friBmBmc.rh9xo AxsbPaT5GGS3bUPa97zmEmxt01o.DEKms.qpi3lUQ_uoAZhvitVcXIzm3VFc 3szSbmehvZ._y_R59TV2mXwtu9t6CHTYlsNsxTGqrs2NRMP8eBB343DwmxMh Mt.JL8jXgsgjaI0HMHQ3E3vLaQdYW0aFIGO4u02o8IdM5YzoAl9itSHMUkmL AruASq.PsnK9JEZOTrfcxicBHE3N1V9xqfsObfl73czGxL_OXUZ4rYZ9lQAU osqZFKjGj6SkGUjBPfo87SqrZ5jhRYxogex3D922HcqO.RJMN0ONh_MULrPh iyPk.asB35xgmxXiXsmvqvMLaWdO2JBT6sxeL0QeGO1xwnyFTHyFL5xhUjxC SGCj_MGa0TReEEgWjR__N_tOhOH_iWP2hzKHCIJX5ZdyKjV1zkqWd_.PLiRs I.Kx4zw1e9dLwholt.bUglOjupabBLEvNHt0tN6F.mptefUFMeqi0wZ1i.Dw hDU.FcQQjfhK1mB6KQYNr8TfCZbIMbEjga_QSIouuAaHuEYGzPdbSjAtyfnt hc7ybPX7c7XMgOPK4nhPBDnzke9RP9E2aaVZ5A4tcBt3GgkwKShjeuDOTF_h JwUlOE3GBER5r0we9ikY8uGQAmvu17w2t_f7UrnZyKzzH6qRm_uRWy3R15J3 VMGhQkTXyylzEWXLG586Z8tlYbFSG7Saq1nC8VDb5U3kAy_ntU6wZfj694t5 DeSrL21XdJiP55VWzyc7OF3wBC92kfaQspQRt9XQ.MHBKTfmlqgYxIfwcZHn MstkNPPAsjivDR9iBbzANn.lRnu1NBVlHK87P5Frr5XXkXLXaSxSBWUnIfM5 E7j_84Cjx9RGRenRcKZCC70fBwXZuzSbyw6Wu6cZYhkA6A.Q2k.0rJa.
X-Originating-IP:   [196.192.32.61]
Authentication-Results:   mta1005.mail.ac4.yahoo.com from=unknown; domainkeys=neutral (unknown); from=unknown; dkim=neutral (unknown)
Received:   from 127.0.0.1 (EHLO mx-out.dts.mg) (196.192.32.61) by mta1005.mail.ac4.yahoo.com with SMTP; Tue, 27 Nov 2012 11:25:30 -0800
Received:   from localhost (localhost [127.0.0.1]) by mx-out.dts.mg (Postfix) with ESMTP id C7B96803876; Tue, 27 Nov 2012 15:17:21 +0300 (EAT)
X-Virus-Scanned:   Debian amavisd-new at mx-out.dts.mg
Received:   from mx-out.dts.mg ([127.0.0.1]) by localhost (mx-out.dts.mg [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v5mcG8rOEEAS; Tue, 27 Nov 2012 15:17:21 +0300 (EAT)
Received:   from smtp.dts.mg (smtp.dts.mg [196.192.32.27]) by mx-out.dts.mg (Postfix) with ESMTP id A5EB8803871; Tue, 27 Nov 2012 15:17:15 +0300 (EAT)
Received:   from z01.dts.mg (z01.dts.mg [196.192.32.50]) by smtp.dts.mg (Postfix) with ESMTP id A6A521D99093; Tue, 27 Nov 2012 15:19:01 +0300 (EAT)
Date:   Tue, 27 Nov 2012 15:18:55 +0300 (EAT)
From:  
MARIE <blackweardesign@moov.mg>
Reply-To:   “marieb.pouvost@yahoo.ca” <marieb.pouvost@yahoo.ca>
Message-ID:   <1595992550.635399.1354018735157.JavaMail.root@moov.mg>
Subject:   Bonjour ,
MIME-Version:   1.0
Content-Type:   multipart/alternative; boundary=”—-=_Part_635398_1213173424.1354018735148″
X-Originating-IP:   [41.79.217.122]
X-Mailer:   Zimbra 7.2.0_GA_2669 (ZimbraWebClient – GC16 (Win)/7.2.0_GA_2669)
To:   undisclosed-recipients:;
X-SpamTest-Envelope-From:   blackweardesign@moov.mg
X-SpamTest-Group-ID:   00000000
X-SpamTest-Info:   Profiles 24807 [Sep 11 2011]
X-SpamTest-Info:   {TO: undisclosed}
X-SpamTest-Method:   none
X-SpamTest-Rate:   20
X-SpamTest-Status:   detected
X-SpamTest-Status-Extended:   detected
X-SpamTest-Version:   SMTP-Filter Version 3.0.0 [0284], KAS30/Release
Content-Length:   4529

SAME SCAMMER – DIFFERENT EMAIL INFORMATION –

Yolaine Provot (sonema@moov.mg) Bonjour,

 
Bonjour,
Je suis une veuve d’origine française née le 24 Février 1946 à CHENOVE (21) pour la raison de mon état de santé qui ne cesse pas de se dégradé de jour en jour. Je vous écris parce que je recherche une personne à qui faire confiance pour la bonne réalisation de mon projet de donation. Je veux vraiment donner de moi ma fortune d’argent actuellement disponible sous section de gardiennage auprès d’une Banque en République du BÉNIN B.O.A . Mon état de santé si vraiment critique ne me permet plus de sortir de l’hôpital où cette ma maladie me confine, je souffre de CANCER du cerveau qui se traite depuis plus de 1 An pour aujourd’hui. Je ne comprends plus rien de ma vie, c’est des raisons qui me poussent à vous contacter et de savoir si je peux bien sûr vous faire confiance et vous faire part de cette donation. Si oui, écrivez moi directement à mon adresse e_mail que voici ( yolaineprovot@yahoo.fr  )

Veuillez beaucoup m’excuser quant à ma façon de prendre ce contact avec vous. Je m’en vais bien vous faire savoir que je parle couramment le français.
Je suis Yolaine Provot, née le 24 Février 1946 à CHENOVE (21).

Je souhaite vous lire très bientôt,

Yolaine Provot, ( yolaineprovot@yahoo.fr  ) Pour avoir plus d’info sur mon etat de santé  contacté moi (+44 703 5944 846 )

(sender IP is 196.192.32.61) header.from=sonema@moov.mg
 
Received: from mx-out.dts.mg ([196.192.32.61]) 
Received: from localhost (localhost [127.0.0.1])
 by mx-out.dts.mg (Postfix) with ESMTP id 6DB97800E6B;
 Mon, 29 Oct 2012 15:13:27 +0300 (EAT)
X-Virus-Scanned: Debian amavisd-new at mx-out.dts.mg
Received: from mx-out.dts.mg ([127.0.0.1])
 by localhost (mx-out.dts.mg [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id nkYxWdxBvbJa; Mon, 29 Oct 2012 15:13:27 +0300 (EAT)
Received: from smtp.dts.mg (smtp.dts.mg [196.192.32.27])
 by mx-out.dts.mg (Postfix) with ESMTP id E0910800E7B;
 Mon, 29 Oct 2012 15:10:36 +0300 (EAT)
Received: from z04.dts.mg (z04.dts.mg [196.192.32.54])
 by smtp.dts.mg (Postfix) with ESMTP id 606B21D98E16;
 Mon, 29 Oct 2012 15:00:36 +0300 (EAT)
Date: Mon, 29 Oct 2012 15:10:33 +0300 (EAT)
From: Yolaine Provot <sonema@moov.mg>
Reply-To: Yolaine Provot <yolaineprovot@yahoo.fr> 

Email Scam Scammers Scamming

MARIE <blackweardesign@moov.mg>  blackweardesign@moov.mg — “marieb.pouvost@yahoo.ca” <marieb.pouvost@yahoo.ca> Financialbank130@ymail.com << TONY OSITA << bocononfa@yahoo.fr << mail@cervicalcancer-symptoms.info << sonema@moov.mg <<

41.79.217.122 – NIGERIA

TONY OSITA – Nigerian 419 (same IP)

From FINANCIAL BANK INTERNATIONAL PLC Tue Nov 13 06:20:03 2012
X-Apparently-To: via 72.30.239.49 – Scam Warners – > 77.238.189.90 << Received: from [41.79.217.122] by web133106.mail.ir2.yahoo.com via HTTP; Tue, 13 Nov 2012 14:20:03 GMT 
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.123.460 — Bonjour

The above scammers are also attempting to fraud others in an Inheritance Scam (41.79.217.122) for more details on this scammer, please click: Mr. Mark Brown

 
1 Comment

Posted by on 11/28/2012 in Inheritance Scam, Other

 

Tags: , , , , , , , , , , , , , , , , , , , , , ,

Mr. Mark Brown <> Western Union Office

Inheritance “Beneficiary” Scam – 419 Nigerian Scammer

This IP is being used by more than one scammer and if you received an idenical IP from an unknown online user then it’s a scammer. For some other emails, email-addresses, names, etc under the same Nigerian IP, please click: Bonjour 41.79.217.122

From: mr.dango.dangi1@gmail.com
IP: 41.79.217.122
Subject: WESTERN UNION BENIN REPUBLIC hr1-8nw24
Tel: Not found

Western Union Administrative Office®
Porto Novo , Benin Republic

Attention Beneficiary:
This is to officially inform you that, We are still waiting for the details of the western union payment information as soon as you send the charge of US$200 only.

You are hereby ask to remit the fees US$200 to the following information below:

Receiver Name::: Victoria Nnamdi
Receiving Country::: Benin Republic
City:::::  Porto Novo
Question::::: Payment?
Answer::::: Completed
Amount:::: $200.USD (Only)

On the receipt of the US$200 ,your payment shall be release to you within 24 hours. I wait to hear from you as soon as possible, send me the payment
information via E-mail.

Best Regards.
Mr. Mark Brown
Chief Managing Director
Western Union Head Office,
Benin Republic

 
2 Comments

Posted by on 11/28/2012 in Other

 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , ,

“FedEx Online®”

NIGERIAN SCAM – 419 – FRAUD

EMAIL: We have been waiting for you to contact us for your confirm package that
is registered with us for shipping to your residential location. We had
thought that your sender gave you our contact details. It may interest you
to know that a letter is also added to your package. We understand that
the content of your package itself is a Bank Draft. The package is
registered with us for mailing by your colleague, and your colleague
explained that he is from the U.S.A but he is currently in Africa for a
three (3) months Surveying Project as he works with a consultant firm in
Nigeria, We are sending you this email because your package is been
registered on a Special Order. For your information, the VAT & Shipping
Charges as well as Insurance fees have been paid by your colleague before
your package was registered. Note that the payment that is made on the
Insurance, Premium & Clearance Certificates, are to certify that the Bank
Draft is not a Drug Affiliated Fund (DAF) neither is it funds to sponsor
Terrorism in your country. This will help you avoid any form of query from
the Monetary Authority of your country. However, you will only have to pay
a sum of $125 USD to the FedEx Delivery Department being full payment for
the Security Keeping Fee of the FedEx Company as stated in our privacy
terms & condition page. Please note that packages are not shipped nor
delivered on Saturdays, Sundays and on holidays. If your order has been
placed on any of these days, then it may be shipped the following business
day.

Kindly complete the below form and send it to the FedEx Online team. This
is mandatory to reconfirm your Postal address and telephone numbers.

1: FULL NAMES:
2: TELEPHONE:
3: POSTAL ADDRESS:
4: COUNTRY/STATE:

Contact Us between:

Mondays-Fridays: 9:00am – 9:00pm EST
Saturdays: 10:00am – 5:00pm EST
Sundays: 10:00am – 4:00pm EST

Have a great day!

Mr. Thompson Williams.
Direct Tel: +2347033356828
fedexonline_01@yahoo.com.hk

FedEx Online®
©Copy Right Reserved 1994-2012.

HEADER:

Return-Path: <karuiz@fices.unsl.edu.ar>
X-YahooFilteredBulk: 200.41.60.169
Received-SPF: none (domain of fices.unsl.edu.ar does not designate permitted sender hosts)
X-YMailISG: o5TE0VcWLDs6A2iGWRrKiXjvpJ9iJzbVh0d6tg62Wj0icTj9 vmZMCQOukMdUDCGoZuIRp9z0IxNUHMgxvIvYYj2aIPbsDGNdoASLbiisEdUj QBEi1ddHF1qDGdoXfPO5fGq3r96t6.3EMAlu.gZYrqage8higRm6BtMly.rw mIfRU6DCgMO6xe2wenEds3y7f6jkHz8PujZvzVXG06KZXqLfUgswmKyLgCBr XoMranvoL1UpF2zrp9IkEggsDk.stcAvIzVsHemNO52EoccEi9gmti7.KoIW FADXVh5rt92uodAMmY0yUyx5SH8xuTnS8HVA1jqbABSY05OsZuiqD2tnbAyL bLlh4CNm20SRui2X4Xy8KYvHstQSJ2JED57ifWlUyjgIAc0kmiT8UPezvxUv IWwuGwuz0cdnaBz9yWtkze4VsD7mfNV5e55TkF1PnlOQV80xSuZBMTspTRHI Rt3llF72gAFNpNhgBjq1mr36YDryiv6cVF80QRdJY_AvV0JqeMTxkYepk7Zo ZibOOHy5tUxHe1RaLqqXs0WImOyiFBDXjq7mpvYjAYsdHOQOyqNLUN6Hg6u1 tVFo3zVplBVnDXYMSRMyggTOWeOwUWkEw0lYPrWCvkmgmSLj_PXFULib.MPx K7S5XbZpInbFirVmMyQMMjCReCffKzB5eKrZIIbECa1FeVd9PHa6ZIj_LsD0 Yq1pZsf06cF3tpdiRlgAzGrJolauz8y8xqW1iCEc8cvOJudahvuRDsb09YaP DEdo6Nd8twXlDmXqNqVY77QtOAFP6Z6QZzgxq5yu9O6Mv1mI4NhapzzH1k3. afEn6fF4JN4HxcuOEp2Rr_U3ikODeO8VSsJ.qEVvjRitKUHx_V6pncw6HkWN tB7_Lr2JJDj37KsTC9ntsBwAVvF26zHppnpw5jw8jYccPfUnUtzPoWlp6Bi9 o6ZrjPB.DXes_i1kpLdprNB8ehDnWXVLwqQqH31W4qYFuFnyZuj3rhLaUUx3 3J3Vqm2tYLv7DmSdzbfkolSriSZ4yVm_POZLOrsbax7kfm6oXgbPLD2cKab3 ObsRlQiaLIEsfxk7nsR8nxE4NzateWWVNkdKO1n40_7N80WGh_yoBa692ABI HHJO2MTarJriQnZz7soxNKn8AuVrxZVZRo_ebnck6pA4Rfh_0R1sUQIjroJI Pw6gJD2qGOTgx1edsoeYVA6oBf_5ab34B9EC0w80NN8JA8nOVBzVJMhtm.8z 6LOwSdTnFg0X3pOkrEr51x.Gto.BuQNSGp6tYNIzckUKiL24O3dxUNaf4_gX k28hY3hB2zgdLlorQVCWrA5.YESR7.ZspdMBR0exRen9wmIK48IOaFt5H.DR dA–
X-Originating-IP: [200.41.60.169]
Authentication-Results: mta1183.mail.mud.yahoo.com from=fices.unsl.edu.ar; domainkeys=neutral (no sig); from=fices.unsl.edu.ar; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO scooby.fices.unsl.edu.ar) (200.41.60.169) by mta1183.mail.mud.yahoo.com with SMTP; Tue, 27 Nov 2012 02:01:25 -0800
Received: (qmail 24449 invoked by uid 33); 26 Nov 2012 15:51:22 -0300
Cc: recipient list not shown: ;
Received: from 41.71.190.77 (SquirrelMail authenticated user karuiz) by correo.fices.unsl.edu.ar with HTTP; Mon, 26 Nov 2012 15:51:22 -0300 (ARGSL-ST)
Message-ID: <2322.41.71.190.77.1353955882.squirrel@correo.fices.unsl.edu.ar>
Date: Mon, 26 Nov 2012 15:51:22 -0300 (ARGSL-ST)
Subject:
From:
FedEx =?iso-8859-1?Q?Online=AE?= <karuiz@fices.unsl.edu.ar>
Reply-To: fedexonline_01@yahoo.com.hk
User-Agent: SquirrelMail/1.4.9a
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
Content-Length: 2014

41.71.190.77+ << 2347033356828 << FedEx Online®  << karuiz@fices.unsl.edu.ar << fedexonline_01@yahoo.com.hk <<
A scammer(s) under the email-address <mcmunoz@fices.unsl.eu.ar> and graniteloans1010@xnmsn.com sent scam mail out under the same Originating-IP as the above sender. The receiving IP’s location was Nigeria (just like the above senders receiving IP) as well. 200.41.60.169 and 41.203.64.132

Other spam/scam sent under the same IP address are:

 “Sampaio” <SharofSampaio@acupunctureinfo.net>
Subjectnone/blank
From: “Lynnette Grover” <AmparoloreleiVick@centraloregon
Subject: Enlarge At Home Today
From: postmaster@sagemuller.com.ar
Subject: Notificaci=?unicode-1-1-utf-7?Q?+APM-n de es
From: Sewell <inwglae@bluegrassjunction.com>
Subject: Software discounts
From: Pill <lrshipley@instuttgart.de>
Subject: When you need it
From: <caesargq6@clickfoc.us>
Subject: More games, more chances, bigger jackpots 1500 eur
From: <limitlessi2@pip.com.au>
Subject: Best casino games 1500 euro bonus!
From: <politicizingwwk86@fiemg.com.br>
Subject: Best casino games 1500 euro bonus!
From: <misspends@biolconseils.ch>
Subject: Biggest casino online 1500 euro bonus!
From: <thule107@buhrmann.com>
Subject: Biggest casino online 1500 euro bonus!
From: <venousuu@pacunion.com>
Subject: Euro casino online 1500 euro bonus!
From: Валентин ��
Subject: мы тoльko делaеm рekлaмy
From: До��на Павл��ва
Subject: Прoдaжa бaзы в Кoлoмнe. Цeнa
From: Артемий В��но��ра��ов
Subject: КАЧЕСТВЕНН
From: <mainmastsu20@cochamber.com>
Subject: Best erect pills
From: <tunnelingh@mc2school.org>
Subject: Best erect pills
From: <stileskp1161@barronheating.com>
Subject: Get some penis pills
From: <loftwp@blomnet.com>
Subject: Get some penis pills
From: <josiea8@alumni.insead.edu>
Subject: Find pills for cheap prices
From: “Sarahi LAMBERT” <MaciPetet@online.no>
Subject: Re: 62735418449971656

Some previous names and email-addresses under the IP 41.203.64.132 – Location: Nigeria

5-Jul-12 11:36 41.203.64.132 mcoxman gsterling123@gmail.com Nigeria
22-Jun-12 21:56 41.203.64.132 Mike001 phonesmartltd8@gmail.com Nigeria Evidence
17-May-12 03:08 41.203.64.132 pemmy pemmy004@yahoo.com Nigeria
10-May-12 16:57 41.203.64.132 kingcxt cxtblade2@hotmail.co.uk Nigeria
10-May-12 16:53 41.203.64.132 king cxtblade2@hotmail.co.uk Nigeria
5-May-12 03:52 41.203.64.132 ohison ohiluckyson@yahoo.com Nigeria
2-May-12 16:41 41.203.64.132 Frank Richards frankimobiletech98orders@gmail.com Nigeria
23-Apr-12 08:07 41.203.64.132 infotech shecool174@yahoo.com

FYI, the REAL FedEX doesn’t sign up with free Yahoo email-addresses. They have their own domain. And they don’t send out email’s like the one above. Only scammers get into irrelevant details.

 
 

Tags: , , , , , , , , , , , , , , , , , , , , , ,

 
Follow

Get every new post delivered to your Inbox.

Join 61 other followers

%d bloggers like this: