RSS

“John Sola Savimbi”

07 Nov

Nigerian (419) Scam

 
Name/Email-Address: John Sola Savimbi <> johnsolasavimbi2@yahoo.co.jp <> johnsolasavimbi1@yahoo.co.jp (Notice how sneaky these Nigerian rats are. If you don’t notice, i’ll point it out.. both email addresses look similar, only the scammers return email address has a “2” instead of a “1” – I’ve come across alot of email scams and noticed various tricks scammers will do to try an avoid detection. Being very attentive is important.)
Subject: Proposal of (US$42million), View my Attached file.
 

 Email: Proposal of (US$42million), View my Attached file (attached file was sent with this email as well.)

 
HEADER:
Return-Path:   <johnsolasavimbi2@yahoo.co.jp>
X-YahooFilteredBulk:   98.139.91.193
Received-SPF:   softfail (transitioning domain of yahoo.co.jp does not designate 98.139.91.193 as permitted sender)
X-YMailISG:   EQBpob8WLDuYslh31C4YsEV0MgxAzQ9EOaLLgVlL1_7ZlGBK 2jVSwfsbvDrnEqVbEpe2sYpIhUi79zBoUjt9yLNqu2kPTdmHPHcCXFG0wqeb 1L6hP.2jOkGlbJlZNSoq438WJqNV8ojjX5l0PnSnvTdhWhctMu7PnVLnFc0K Bs5ma3HHmc4QRFmZRMKv20oSPlkz6tTmR7FXNYl0pF_SWKxPbeCkOgCXWTsX 9yuOcpuT9Xu474tu8PsGQnrMDK51eejI1fYoRV0k5XzbjGDORnfbharwrS9S IAKtyzXiwC5ZXeCayvT3fP3wwrrGhC1QpYbEQwP1rSy4_obOIyYxTMu_J6cs 9UwTF7O1APV1jE.puwvkXkN1mhFFjky1Bbd76lw5F0tJdPxaxJI52Tph5A0Z bRRbNGmy7J.h7IBQ7xCj8E0_CwCnNgRJwHYp.kErcs9bvpOEM4IVEAo52AIS GSleRsaji9nbBzqx5V4vSxQRYix_W7duieiIDBfDjjNqhk0dSysEOIOfktGi J.OvV_JyTGTp7AlAs8jzlAMQCe3zyRHsn0gWyI7mYa2UojVn2Ji6iIcoTVXA o5jy2XK3lkGl2kfGwY.yS7qHJpy.WmjDUSwQWLjTFOXoZo7cZAQayYzBurOx PYDKjL2A9FoaQzkbw93.UMRmxQ1Ebbd0C7cwZ9dwa84wIrAbAEFjTllHXJXS Lz_dn79g03_ubWuFPITFxTEIsFbA2oWtf8fZOAy3Vc5gZ42zo6.LfuQeJwGK tHKognV0a35Qu.ZlBNTun1ZRfMZfUezmjegUkVOwetvfscLljFkbMXPpr6qF lzlwn3pjtF.0CfUrN2j1i.YRRXDD8W991juqI6IkFaLS0zTWJP4ub5l2A_p6 pnCVzaV_h8gDCcOzyBf3e1M37DqXEfcBJOetS_9DdU6Nx2Wm38wWjQfNbc33
X-Originating-IP:   [98.139.91.193]
Authentication-Results:   mta1008.mail.bf1.yahoo.com from=yahoo.co.jp; domainkeys=neutral (no sig); from=yahoo.com; dkim=pass (ok)
Received:   from 127.0.0.1 (EHLO nm7-vm1.bullet.mail.sp2.yahoo.com) (98.139.91.193) by mta1008.mail.bf1.yahoo.com with SMTP; Tue, 06 Nov 2012 08:51:43 -0800
Received:   from [98.139.91.70] by nm7.bullet.mail.sp2.yahoo.com with NNFMP; 06 Nov 2012 16:51:40 -0000
Received:   from [98.139.44.92] by tm10.bullet.mail.sp2.yahoo.com with NNFMP; 06 Nov 2012 16:51:40 -0000
Received:   from [127.0.0.1] by omp1029.access.mail.sp2.yahoo.com with NNFMP; 06 Nov 2012 16:51:40 -0000
X-Yahoo-Newman-Property:   ymail-5
X-Yahoo-Newman-Id:   224036.88452.bm@omp1029.access.mail.sp2.yahoo.com
Received:   (qmail 69973 invoked by uid 60001); 6 Nov 2012 16:51:38 -0000
DKIM-Signature:   v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1352220698; bh=X1pLbrcf5wI399NQ2w3DxbseUUDY+YPXPjwz1oT+xcA=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=pFSKG2zzeSGZN/3rroxHW6TBjGdIksgSj4WKKTpNbuWtz0XNcIilV2e4SAG5FovPPlJMe34plIreJ+hhnfJa4CMs06akvdRA2VVjV54nOzlXfY1z8lsMK5AXoZACa2+GyuYwTqrywA3rl5XQxbUnEwOJrb3XnKNG8JW27SZ+xuE=
X-YMail-OSG:   5iHQZVcVM1kNFG8OHs0QQnq4C8.VJzZq6JLOmgcJvXf8XeF ZB5uTnWx1Nanw5e2Ze6Vyrry6DA_mOj22S6l97_CsgSaeiK1dfsk93b9CP9u TMVGlX1RgFSRTVBjIwsvIy.SbB_H499EcSdb7UBkPSD2domCscXYu.PMcKVi PiPTzo8GmHy7r5Jsu.6p.sdtcwwTyNGd3dJB9Cwf3_NuA3nA3I8_Y8RbwkL2 68HLzBWLOBsbhrP9SCLmfj8icDwreWDjbkCTpa5xZAJPp62gWsxWELoVoZfg L4jaG31N.vpve4vtS8J_x4zqSSt1tOe_K8oF7yBUYYCH.QO2aiqyGp6PvM3w FlfwiB.d_y88pBupScEGamvRGmE2urzJoBO4O8G2aycPkxkhz7sD0xeaG2ls 2goO9F4JA_ZpYFJXE.yd2rjRJ5eCkA1u_e6kVd3G_t4ZPf03IyBFOG5fmk5p HeJxVgna0pR58E7ki5TVMMwJ5uQAJpkXgC.lxXQ5b8ZkLH4MCBcrdlSy5vk0 Rftl.imYboxlrK6KMpA–
Received:   from [174.137.184.37] by web5706.biz.mail.ne1.yahoo.com via HTTP; Tue, 06 Nov 2012 08:51:38 PST
X-Mailer:   YahooMailClassic/15.0.8 YahooMailWebService/0.8.123.460
Message-ID:   <1352220698.66367.YahooMailClassic@web5706.biz.mail.ne1.yahoo.com>
Date:   Tue, 6 Nov 2012 08:51:38 -0800 (PST)
From:  
John Sola Savimbi <johnsolasavimbi2@yahoo.co.jp>  
Reply-To:   johnsolasavimbi1@yahoo.co.jp
Subject:   Proposal of (US$42million), View my Attached file.
To:   undisclosed recipients: ;
MIME-Version:   1.0
Content-Type:   multipart/mixed; boundary=”805399167-1672277851-1352220698=:66367″
Content-Length:   11641

Other email’s sent by scammers associated with the same IP address below:

Dr. David Nello <> imf-officenigeria@pobox.sk <> IMF OFFICE NIGERIA <jjjj——–ma7466@att.net> ma7466@att.net <> Received: from nm7-vm1.bullet.mail.sp2.yahoo.com ([98.139.91.193]) <> Content preview: INTERNATIONAL MONETARY FUND (IMF) HEAD OFFICE NO: 23 ADEBOYEST,APAPA LAGOS. TELEPHONE : +234-805666-1848 <>

IP address – 174.137.184.37 which is associated with the above IP’s but not the main IP, is a comment spamming according to PHP and below are a list of SPAM URL’s posted from the IP.

Domain: http://www.monster-beats-2012.com
URL: http://www.monster-beats-2012.com/beats-by-drdre-pro-c-3.html
Keywords: cheap christian louboutin
Domain: http://www.monster-beats-2012.com
URL: http://www.monster-beats-2012.com/beats-by-drdre-tour-c-1.html
Keywords: cheap christian louboutin
Domain: http://www.monster-beats-2012.com
URL: http://www.monster-beats-2012.com/beats-by-drdre-solo-hd-c-4.html
Keywords: cheap christian louboutin
Domain: discountuggs2012.weebly.com
URL: http://discountuggs2012.weebly.com
Keywords: cheap christian louboutin
Domain: 2012beatsbydre.weebly.com
URL: http://2012beatsbydre.weebly.com
Keywords: cheap christian louboutin
Domain: http://www.woolrich-arctic-parka.net
URL: http://www.woolrich-arctic-parka.net/
Keywords: cheap christian louboutin
Domain: http://www.woolrich-arctic-parka.net
URL: http://www.woolrich-arctic-parka.net/woolrich-parka-damen-c-2.html
Keywords: cheap christian louboutin
Domain: http://www.woolrich-arctic-parka.net
URL: http://www.woolrich-arctic-parka.net/woolrich-parka-herren-c-1.html
Keywords: cheap christian louboutin
Domain: http://www.woolrich-arctic-parka.net
URL: http://www.woolrich-arctic-parka.net/woolrich-accessories-c-3.html
Keywords: cheap christian louboutin
Domain: http://www.woolrich-arctic-parka.org
URL: http://www.woolrich-arctic-parka.org/woolrich_coats.html
Keywords: cheap christian louboutin
Domain: http://www.woolrich-arctic-parka.org
URL: http://www.woolrich-arctic-parka.org/
Keywords: cheap christian louboutin
Domain: http://www.cheap-christian-louboutin-boots.co
URL: http://www.cheap-christian-louboutin-boots.co
Keywords: cheap christian louboutin
Domain: http://www.monster-beats-2012.com
URL: http://www.monster-beats-2012.com/beats-by-drdre-pro-c-3.htm
Keywords: beats by dr dre pro
Domain: http://www.monster-beats-2012.com
URL: http://www.monster-beats-2012.com/beats-by-drdre-tour-c-1.htm
Keywords: beats by dr dre tour
Domain: http://www.monster-beats-2012.com
URL: http://www.monster-beats-2012.com/beats-by-drdre-solo-hd-c-4.htm
Keywords: beats by dr dre solo hd

 

 
Leave a comment

Posted by on 11/07/2012 in Uncategorized

 

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: