LOTTERY SCAM – ADVANCE FEE FRAUD
ATTENTION: This fraudster has been very persistent, spamming my inbox for months under various names, addresses and IPs including Barrister Nector FBI OFFICE Scam as well as (MR) Paul Johnson Lottery Scam – Below is a list of several emails sent by this scammer.
Subject: HELLO ,
From: Mr. John F. Williams firstname.lastname@example.org
I have contacted you because I’ve sent you the first payment of $5,000 today from your winning funds total amount of $1.5Million USD,Therefore you need to contact western union agent Mr. John Mark for him to give you the transfer payment information and MTCN.
Agent: Mr. John Mark
Email: ( email@example.com )
Phone: +229 68433916 firstname.lastname@example.org
Please try to contact him today for him to forward the payment information to you, Remember to Indicate the registration code of EB-2520 to him when e-mailing or calling him, Also he will be sending you $5,000.00 daily as per my discussion with him, this is what he needed from you to send you the first payment.
You’re full Name…………
You’re Telephone Number……..
You’re Copy of Your ID………..
Your Sex …………………….
Do get in touch with me once you have got the transfer.
Mr. John F. Williams.
Received: from 127.0.0.1 (EHLO nm23-vm2.bullet.mail.sg3.yahoo.com) (22.214.171.124) by mta1575.mail.ne1.yahoo.com with SMTP; Tue, 09 Apr 2013 13:53:54 +0000
Received: from [126.96.36.199] by nm23.bullet.mail.sg3.yahoo.com with NNFMP; 09 Apr 2013 13:53:51 -0000
Received: from [188.8.131.52] by tm9.bullet.mail.sg3.yahoo.com with NNFMP; 09 Apr 2013 13:53:51 -0000
Received: from [127.0.0.1] by omp1006.mail.sg3.yahoo.com with NNFMP; 09 Apr 2013 13:53:51 -0000
Received: from [184.108.40.206] by web15303.mail.cnb.yahoo.com via HTTP; Tue, 09 Apr 2013 21:53:46 CST
From: “Mr. John F. Williams” <email@example.com>
Subject: HELLO ,
+22968433916 firstname.lastname@example.org Mr. John F. Williams
FBI OFFICE INHERITANCE LOTTERY SCAM
Subject: TRANSFER MTCN
I am contacting you because I have sent you the first payment of Euro 5, 000 today from your winning funds total amount of Euro1.5Million , Therefore you need to contact the western union agent Rev. Jerry Young for him to give you the transfer payment information and MTCN to pick up the money at WU Branch over there.
W.U Agent: Rev. Jerry Young
Phone: +229 98644349
Please try to contact him today and ask him to forward the payment information to you, remember to indicate the funds registration code of EB-2520 to him when e-mailing or calling him, Also he will be sending you Euro5,000.00 daily as per our board discussion with him.
Do get in touch with me once you have received the transfer.
Dr. Robert Williams
IMF Managing Director Benin.
Authentication-Results: mta1285.mail.ac4.yahoo.com from=superposta.com; domainkeys=fail (bad syntax); from=yahoo.cn; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm15-vm3.bullet.mail.tp2.yahoo.com) (220.127.116.11) by mta1285.mail.ac4.yahoo.com with SMTP; Wed, 12 Dec 2012 02:55:25 -0800
Received: from [18.104.22.168] by nm15.bullet.mail.tp2.yahoo.com with NNFMP; 12 Dec 2012 10:55:20 -0000
Received: from [22.214.171.124] by tm3.bullet.mail.tp2.yahoo.com with NNFMP; 12 Dec 2012 10:55:20 -0000
Received: from [127.0.0.1] by omp103.mail.cnb.yahoo.com with NNFMP; 12 Dec 2012 10:55:20 -0000
Received: (qmail 16962 invoked by uid 60001); 12 Dec 2012 10:55:19 -0000
Date: Wed, 12 Dec 2012 18:55:19 +0800 (CST)
From: “Dr. Robert Williams” <email@example.com>
Reply-To: firstname.lastname@example.org Western Union Money Transfer
Subject: TRANSFER MTCN
FROM: Dr. Robert Williams <email@example.com> REPLY-TO: firstname.lastname@example.org RETURN-PATH: email@example.com
ANOTHER ADDRESS GIVEN BY SCAMMER – firstname.lastname@example.org
RECEIVED IP: 126.96.36.199 LOCATION: Benin, Nigeria
Below is a phishing scam email / header sent by the same received IP as the scammer above. The originating (fake) IP are different but if you receive a unknown email with any IP’s shown on this post, you’re more than likely dealing with a scammer.
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
Authentication-Results: mta1031.sbc.mail.sp1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 188.8.131.52 (EHLO fgateway15.isp.att.net) (184.108.40.206)
by mta1031.sbc.mail.sp1.yahoo.com with SMTP; Sun, 23 Sep 2012 07:26:25 -0700
Received: from nm10.bullet.mail.sp2.yahoo.com ([220.127.116.11])
by att.net (frfwmxc15) with SMTP
id <20120923141959f01008dmffe>; Sun, 23 Sep 2012 14:19:59 +0000
Received: from [18.104.22.168] by nm10.bullet.mail.sp2.yahoo.com with NNFMP; 23 Sep 2012 14:19:59 -0000
Received: from [22.214.171.124] by tm11.bullet.mail.sp2.yahoo.com with NNFMP; 23 Sep 2012 14:19:59 -0000
Received: from [127.0.0.1] by omp1016.access.mail.mud.yahoo.com with NNFMP; 23 Sep 2012 14:19:59 -0000
Date: Sun, 23 Sep 2012 07:19:58 -0700 (PDT)
From: Yahoo Member Services <email@example.com>
Subject: Yahoo Warning
EMAIL: Dear Subscriber,
Your E-mail account has exceeded its limit and needs to be verified, if not verified within 24 hours,
we shall suspend your account.Click to verify your email account.
Please note: You serve the risk of losing your account permanently if it is not verified.
Thank you for your usual co-operation.
We apologize for the inconvenience
Yahoo! Mail Product Management.
Copyright Â© 2012 Mail! Inc. (Co. Reg. No. 2344507D)All Rights
Reserved. Intellectual Property Rights Policy