WARNING: Nigerian (419) Scam
Subject – deareat one
First Email – I need your help.
Permit me to inform you of my desire to go into business relationship with you after going through your profile and I prayed over it and selected your name among other names due to the nature of my proposal, which requires a reputable and trustworthy person. Someone who will be kind and sincere to me.
l am Mercy Kings the only daughter of late Mr. and Mrs. Joseph kings. My father was a very wealthy cocoa merchant in Abidjan here, the economic capital of Ivory Coast, he was poisoned to death by his only brother (My Uncle) and his business associates on one of their business meeting. My mother died on the 15th June 1991 and my father took me so special because l am motherless.
Before the death of my father on 21st December 2008 in a private hospital here in Abidjan, he secretly called me on his bedside, when I sat down to listen to him, he started crying, when I asked him why?
(1) He complained that I am too young to be managing my life with no one to take care of me,(2)That I have not finished my university education as he planned for me, he revealed to me that he has a sum of US$5.5 ,000,000.00(Five Million Five Hundred Thousand United State Dollars) left in a security company here in Abidjan, that he used my name as the only daughter for his next of kin in deposit of the funds in the box.
He also explained to me that it was because of this wealth that he was poisoned by his only brother (My Uncle) and his business associates , that l should stay away from them as they are evil he warned me seriously not associate with his brother that is my uncle, that I should seek for a God fearing foreign partner in a country of my choice where l will transfer this money and use it for proper investment purpose ,that I must finish my university education by the help of a business partner abroad, that he or she should help me obtain a resident permit in his or her country.
He also gave a standing instruction to the company that the deposit must be transferred outside this country. According to my father, the money was deposited as art works to avoid attracting attention to the deposit.
I am now ready to do all these since my father my bread winner is no more. l am honorable seeking your assistance in the following ways.
(1) To serve as my guardian in your country while I will depend on your expert advice since l am a girl of 22 years.
(2) To make arrangement for me to come over to your country in order to further my university education and to secure a residential permit for me in your country.
Moreover, l am willing to offer you 10% of the total sum as compensation for your assistance in the transfer of this deposit to your country.
Furthermore, you can indicate your option towards assisting me as l believed that this project would be concluded within seven days you signify interest to assist me by contacting the security company.
Hoping to hearing from you soon. May God bless you as you extend your helping hand to the needy.
I wait your reply.
Thanks for the mail, pls dear I want you to open up your mind and help me out, nomatter what it will take you, I meant your time and every other things, just do it as if you are helping your own blood sister or Daughter, I know I will pay you back. The place am hiding now is in a Church the situation here is too bad for me, I hardly eat because sometimes before I could finish what I was doing to come back to the Church the food is served and I will go in empty stomach. My Uncle’s want me to submmit the deposite certificate of this said fund to them so that they will go for the claim, as I told you ealier that I am in the Church that is where am still in, pls I will be waiting for your urgent action, just do what ever your mind tells you in me don’t listen to any advice so should I.
Now below this mail you will see the full contact of the Security Company where the money is, just get intouch with the contact person Mr Edward Clifford and explain to him your purpose of contacting him. I dont know any other person than you, pls I want you to help me to any level, i am sure of paying you back as soon as am there in your Country.
I have gotten little informations on how to proceed, all you have to do is to contact him and tell him that you are Miss Mercy’s partner abroad that you will like him to give you in details what it will take to get the money release and transfer into your own personal care over there in your Country. What everthing he said just let me know so that I will guard you the more, pls dear my situation is too bad I cant even feed well. I will be glad hearing from you soon.
The Security Company contact information
ECKO SECURITY AND FINANCIAL HOME ABIDJAN COTE D’IVOIRE
ADDRESS; 12 BP 2020 ABIDJAN BP 12
EMAIL ; info.ecko.sec.cotedivoire1@Safe-mail.net
DIECTOR MR EDWARD CLIFFORD
I will be glad hearing from you soon. I will soon send you some important documents, pls am beging you to keep those document strictly confidential. I shouldn’t have release it to you but I will do it because of trust, those documents are all I have and they are the very point while my Uncles are hostile to me, pls keep my future secured by keeping it top secret between you and myself.
First email header:
|Received-SPF:||softfail (transitioning domain of rediffmail.com does not designate 22.214.171.124 as permitted sender)|
|X-YMailISG:||Ev.TQnQWLDteh2R2pOEtAq5ZGk2tDSZiijp1X.vCmM.P8uPq gobcHA2cWD8brJR4S7iN50T3ZqpJRD3_NKwmfcRl7lDKVCqFS32A3HxmpRkQ RhSNJCNoIzmAaiYWEaFE3ajQdhxPjlY_aPk8il_OkDj5Bvin6koXF6Nh72pV 77899kBwgxR78Ju42RdDtNgJ2HJEBo5zSmjqMNUNePJiOwPoLPJKMauKj2Pu EqySGkZ3V0mDKBThaHVNFB7PD4_4UxAvj4fwX8PlNvKs4jUd8BKBDLNRDgKl gFosQzT9cURxfIln4aq_grfwWmeGm2xXcAY8BvLF_1rz045ghCxTcqwxrsuB wkH08YWMO.IKBJ2Nj2ERBxzr.yxGVXbYyW4upXBwgrWVWGbmQx3IYb0SE9GG 8HflD_Fb5lYM63EZHhIOFhmdyCF820oTnxm6jq5c3IS1yum63AHDFt0fZ0V8 IuR6FUeKUGxDcz0P7NyjGfVNMCfEj5sXnitxE03OHOHVOIUUmCn8HtA_7bOE .1ZMotKWCUw7.3971ZM21rXOh29hlH8H9X4m2LG8mP5K3I8G8Ovqx__El2zw vB3lQR1UnSsxvI3rKTd0EY1kav6BDNnIavnlwlPYzkg3Jm2yyANTGQTXrBM4 uCIgMYMyMhBVke1YVcubmixSi.oXJj8DIQr.RlAzm7jIME6RXlppeabHe0UJ fHSDd3uWBYHkXKM1bMMQTgT79Jsv.KJsRyMoBkODvOEAOQlxLRxrRTmT7w2F NXDkJcub5NLO1K8Bd1MN4ZKOhwSVErdkWwPJViIosJM84qFlwUqjnFjyJLmV zuPloiA5RzXzI4XWVsLl1C71ER8RT6Iv4pMlfcOKgB5n5WX_i4slvfjT17gr qc5tp2vwAVdzskoVGic4x3BrqA5N2.VwYZR3Y1Ni_cF2LV4p7wqewATBuuH1 QS57JvJcDckynLAxbEg_MKrO_i.yPOjgWEdXClHa4.JjRn8L.4tsxXnzGXOV cmkAOGcdJy8SZTVll0MiBXXvb1wUsgn80Bo5hr3E5fl0jknspDPaeciD0XhC sEu9CdtLLRql4EdocMGjg.wBx.AL.LuC.uImg1b1aAi1cLehKmqPRgOFGne6 eBfcy87ZjUttQ7c7Evx.2_B6KiAERwyPBsliFy0vF5c238XG4l2Q1xbw9VfU fkcu7UeX6ovKH92c5piIqUTepkNg4MpEjqU6C4o7ECZ78WGvI5ijsQ4ui77F IAm5p0hthBIZ7KH4HPRPhAJdOHkChYlJKJzKJKSNQPAnQGJPBInDRkPs0qkG 3AOK7Mg6G1SPGPzD8RAEfWhMAD0OMMo02QhyKLBO93VPvh9N.EF1h4KKKA–|
|Authentication-Results:||mta1154.mail.gq1.yahoo.com from=rediffmail.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=pass (ok)|
|Received:||from 127.0.0.1 (EHLO nm9-vm10.bullet.mail.sg3.yahoo.com) (126.96.36.199) by mta1154.mail.gq1.yahoo.com with SMTP; Thu, 01 Nov 2012 03:03:30 -0700|
|Received:||from [188.8.131.52] by nm9.bullet.mail.sg3.yahoo.com with NNFMP; 01 Nov 2012 10:03:28 -0000|
|Received:||from [184.108.40.206] by tm1.bullet.mail.sg3.yahoo.com with NNFMP; 01 Nov 2012 10:03:28 -0000|
|Received:||from [127.0.0.1] by omp1030.mail.sg3.yahoo.com with NNFMP; 01 Nov 2012 10:03:28 -0000|
|Received:||(qmail 4936 invoked by uid 60001); 1 Nov 2012 10:03:28 -0000|
|DKIM-Signature:||v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1351764208; bh=QTWyhDYSPTUxPD3wHjAyPAE4wjYhGjys7UEwhnhzk4A=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=zfwGO7+wDeRVvpd0+1Fnp1irhFc9AcFA/v2PTaQpV2zdrOm+ggJYPQAkRuB+MSpAWfUH/m4peRaDwiPSczHTYM98mZW+QQMdE6wwgl5HWvyaqq7mazkCyP0+47XEt7rfM9LBUzidtQbpfIHJfSMfpDSz7tNfj230ge/0yvSAd2k=|
|X-YMail-OSG:||6mB3Ys8VM1l40gA4FDEi__88RuPRNw22NbXALyOqGUEB6VS M4RWokmjnlsKwEpV23M_mPmhgl383tpnhSzpHYYOiNGWxWtj0LeNiO5Vt1gS X1m.xEHDM7lypqV_y0ok1j5yZxMOn01YZ.08wOC5KqVrRPNJHiaW7sZAiv.8 Ol2JNvubyMGG27bR4GJkR6tJUdefyyzFWYNvqyyVnKW8vm4a7yXmYZbbGO6d G2.CvFqxqH8RfoKGSwxRDu6qk.H4O5anaxbE6F1khX6Eqr10raQ1gqORWxhq 7RRI2_xLLglvGjn7l9IxjZiSPpw9M4gLdXC1lZAsa0OQFj7KnN8wcOJt1QrD 1M4aBHMH8obshvEG_0z4bGL6cr3t6.KUDlhsuBqAbWDyKDFvrSAX0Y.Kq5ho kSEoR5JKlROKhBGX1rxgPbehP2uKMz_cyYO9ZyLwARBkvdRmV..n5YzT9SVt 0AgXMOnuDG9OSFat1n_uy0_vhdjFoDA2vuylD4_4vEd0OkUrI3r_jKo2ZiOG TSBwh.si8g0fIh.w.FC0dMCdliCMalD8srKmh9tNxv4y9Hre.uFaEYEJE5VQ RwKrMPGiY3ygb4XWz99kHBDYJ9oNDMMZFBdBCT.AA|
|Received:||from [220.127.116.11] by web190803.mail.sg3.yahoo.com via HTTP; Thu, 01 Nov 2012 18:03:27 SGT|
|Date:||Thu, 1 Nov 2012 18:03:27 +0800 (SGT)|
Mercy Kings <firstname.lastname@example.org>
|To:||undisclosed recipients: ;|
PHP has detected malicious behavior from IP-address → 18.104.22.168 (below is a list of IP’s and other spam mail sent from the same IP
Geographic location – COTE D
|Example Messages Sent From 22.214.171.124|
|From:”Curt Clark” <email@example.com>
Subject: Разошлем вше предложен
Subject: Получите вашу СК
|IP’s Associated With 126.96.36.199|
Second Email HEADER:
|Received-SPF:||none (domain of yahoo.com does not designate permitted sender hosts) YXIgSSB3YW50IHlvdSB0byBvcGVuIHVwIHlvdXIgbWluZCBhbmQgaGVscCBt ZSBvdXQsIG5vbWF0dGVyIHdoYXQgaXQgd2lsbCB0YWtlIHlvdSwgSSBtZWFu dCB5b3VyIHRpbWUgYW5kIGV2ZXJ5IG90aGVyIHRoaW5ncywganVzdCBkbyBp dCBhcyBpZiB5b3UgYXJlIGhlbHBpbmcgeW91ciBvd24gYmxvb2Qgc2lzdGVy IG9yIERhdWdodGVyLCBJIGtub3cgSSB3aWxsIHBheSB5b3UgYgEwAQEBAQN0 ZXh0L3BsYWluAwMwAgN0ZXh0L2h0bWwDAzg-|
|X-YMailISG:||5OhUPuMWLDstQqSMqQ3cc.nACw1JtKnwbT4r9EcsM5YjdxYA aVvU7G9eFMgGCha5IbVhnP58IAFO8rb_.Jd4TNNflW9cn1a8HViTuX8xs3ZY PZpAZ12IgXwjIRP5lrHSKXicn5vb4nPEN_2U0PNik2u6DZBUR05N4DuR5qUN VVBcZENEPvQxMTsop2en_2BUXQhhAqWWOmDPnGHNzdA.qJiH8WB5o4EzAp4c Fr.0a8kKa8JldXASP7dyHDoLKyEHk6BTV9fiPT_YNwtP9TPwE1dKLrvzPPaf dArrnDePZR.fN0lSZEBKiBExrVEnlDvRamC6LQbldQnNAyMR30SV2S0yPe5J RRaaA2KLLaYB3fvYegmAR75c1MYOJFmHBCvTQzY4YnpHtdT6hPoSgaVQd02b mfQSxOYNLv4PI6thSMGPFCvW5VtoFCDbAEI0U5EWvQZPc9AC.4UEeXRFmbdI 7gvmM.e2bKdnDReU6wLe37P5QniAu_MKyOP3UGxi8_85PJBhquPIBG9rGqSl 6_kx.9WJLZKn_7DWLfDnFl2RmGOi2SCnL4bx3eNE50PaGOVn.AJAbztqLdxS v3FxROxndlMO6Myd6aU95ogsRKS7GDxMOwy999oCA147uf0VZJ7b3fF_szH2 PXiLSBhRAfFtt4s19atQwPKMW.sbTSFqcO2nC1P0dBZpRUiNzjLex.HvjR5R 4Ghbd4Nld3o_k6mUHp2rMqA3cKdDqWh6rEjnt3IbuiNb1F_HDNqDRnRQSNUF p2vS8GFBa3gsm21bINDAf0mMnN0n.AUtyot9VXuWdyxRGFFqDFeOUCNiZgRT Che.6QkQc9yPBZ7_QPtb6NsnUr3LRMswb01iLF__qY_XpYXSakiRucGka3S3 .PwFATAbM5y3POp4LRKw03NPvWRowctRrSWRxzDA5PbxkzFnivaDGcdLQB80 nfsEBY5lIl0EOU3o9kK.xEhLxRWZUxvCVyLSfOEXfB6KI1YlWLnTyCR05FUi 44EDaVbf75gHIlzHpo66cCOy0EM2aak4yB1ufkno_cilGCqc4uDLQ4lZMs1f 1RBN8oQo4AhaTdrCsHW2CU6YSUW6h8fWQZz8p91SeUxWDBw7iu5WEqGUQ8jE zJwwCnSXBdUy4ecrm9JCXYe3hsWXuhSHpxbi2nEKfZCQicIrSBSMOU6WVQAZ prqQ9imA.Kk6fyn3wm1uP3ojDzPmyOpOxePPEJimNbgy9N1Q3b1iOVc.Aaad eB1llAi3Wp2Rxlr.ldZH8FH8NWIAoSDN_WcIiiO23CnU4.RiQzsEMHrNiKbD ioSoRQK7o0wp7LbGZNWt5c5C94we8dNwqUCfrUxIpmIuCxVskA–|
|Authentication-Results:||mta1275.mail.bf1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)|
|Received:||from 127.0.0.1 (EHLO nm10-vm3.bullet.mail.sg3.yahoo.com) (188.8.131.52) by mta1275.mail.bf1.yahoo.com with SMTP; Tue, 06 Nov 2012 08:28:51 -0800|
|Received:||from [184.108.40.206] by nm10.bullet.mail.sg3.yahoo.com with NNFMP; 06 Nov 2012 16:28:44 -0000|
|Received:||from [220.127.116.11] by tm12.bullet.mail.sg3.yahoo.com with NNFMP; 06 Nov 2012 16:28:44 -0000|
|Received:||from [127.0.0.1] by omp1025.mail.sg3.yahoo.com with NNFMP; 06 Nov 2012 16:28:44 -0000|
|Received:||(qmail 78732 invoked by uid 60001); 6 Nov 2012 16:28:44 -0000|
|DKIM-Signature:||v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1352219324; bh=k9g9OMY0lvGtVsSaanQUUshZN4dAH6otQOfm9qU/cuk=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=PnYGWex4UOss1PCFdsmYx/u+i9lpEO5uEVQRluEIGFWNIh/qk2GkLRCnM1dVUTecZZjGqk8PlNbJ4uF980zpg98J+B6a0PwkuXVKgoz58j3IwGGeUDlMB4dKAwoaJYTr0vyEyuck5sD6Zsds21eByvzxiwez27aBK/TUJlpIyrI=|
|DomainKey-Signature:||a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=aAdeERUdkRYtzFQo/p07zjA/YZB5S+0omrDSS0C1JcTeijTRSb6vtwSffgjOGkoyvUMsH2Qe+qsi9PTEZYSabH9LH3IXrVXwJZyPUt+ks2EmbzmWe/GQi3ShFO1X8za4SqKk5LOFnM2lcoauWebw75ZGh9eVoOiCn6jXWApCizA=;|
|X-YMail-OSG:||UlSVAvAVM1kXmqxnwZJkvz_Wg7EjKEYZo_04wAj9s4JFqnc lWScB2UiC7bbjt9oniAhwlJ1h0wN4vPNerEjiiUSuyXi94jPpM23TOOvlGKF tL4kU5TxUYOv9icB3n8KzUKSW14fqyyMKkR8opRGx5ZIn4A5dm3_1s7l91cK wnEW6Clp9LHla3NSMRy8kUB9C7lDA9uZGKPCAWuIswYG45wD0Hl4VVS36uA6 aoNgAWhqpkltWUvW.Ly7tkcVXIZy4p5iiGP0KoJAFWhN6nsPUGzwRYnlzf7w EtlZDx1xrLWKJAJ9OOexRlstXSkpdfUe21s9RSoAUPLzeim7StZ9_qPjGAYF AeJsxBWnxaoo6E9I9MWIp4eSOESNlRha4QW9YQBawUf2XkZeFj8.uUV6WhZm U1A.BQfNaUuIYU_HSZrpNyCZRcNLFQsnyy_7Z2EY9Ng–|
|Received:||from [18.104.22.168] by web190201.mail.sg3.yahoo.com via HTTP; Wed, 07 Nov 2012 00:28:44 SGT|
|Date:||Wed, 7 Nov 2012 00:28:44 +0800 (SGT)|
Mercy Kings <firstname.lastname@example.org>
|Subject:||Re: deareat one|
|To:||(deleted for privacy reasons)|
I will update if more information is emailed to me.