RSS

“MR. SUNDAY OKEOKE” fedexcouriercompanyinternational@yahoo.fr

08 Nov
  • NIGERIAN 419 SCAM – SCAMMER SENT NUMEROUS EMAILS. I WILL UPDATE WITH ADDITIONAL IPS/EMAIL ADDRESS IF NEW ONES ARE SENT.
  • MR. SUNDAY OKEOKE <> webnetxxx4040@att.net <>  fedexcouriercompanyinternational@yahoo.fr

    Subject of Email: This is the registration Number of your Package Fed/122p/mtm/2007Zip Code; 0113388

     

    Email: The actual email’s were links/documents that the scammer wanted me to click on. I wasn’t comfortable clicking or posting the link on here but I did post the headers to each email. The second header is a email sent by the scammer a few months back. If you received a suspicious email/document and would like to compare, I can do so privately. If the Nigerian scammer sends anymore emails I will update.

    If you looked up an IP address and it brought you here then there is a good chance it’s a scam/spam. If you would like me check out the IP then just let me know 🙂

    HEADER:

    Return-Path:   <webnetxxx4040@att.net>
    X-YahooFilteredBulk:   98.139.91.230
    Received-SPF:   none (domain of att.net does not designate permitted sender hosts)
    X-YMailISG:   Mgld3gYWLDvLU8XE6jJvtheNb9l4kzntoNgz4Vt_h_MJvFod mRrulGWnhB0Qs.uWfI9OTBRwQjtVAhLXhe2pSl3_16AYc8fqMvUNyIsPOsQv 6D.KdH63Te_Jo_GEOHGhfjDuqUfRlcE7WJ.rjcEyarei39KDbFR3MGfEsiRO wUJg_yBDdbZYoGDF.dRe5r.OgcVsXpt5EGdhV_Xn3dBbhSOwBGwLJZmxZpnt bxzKssazUav1OWdVSvbajRs60nRQrWx5OQ_KrxuSPf87IScAHhnxaXSdaqqR GVTRghlQ1w3SSCras4kchZGs_OjmpwcAD9JWaNqJyt6CRpicHgrRI6YUzSSC fxuYEI1M8ndWcyBWS9xYCChcUHFfebRn6i1wbzSJ0NLHpNT5fVKiE2W.llb4 W0coIwliWir4Fj6oaM7MIU_b_SIWZsSo1Mc6AKaS.1xqNHe2kyL7IsUmY3OD dvMCm7LpJICYxuIVShjIP_QPrc_LMLJWJaV73OhJrzoCM1gakwVcrK0Pdykw GuKny0vCilWlt_wJl75Z1ylBM1_YErQjhMkZZv9zh6GGuCZ5dNBMkH_Ed_zx 5z1fOvxyM98X7k7MxU_HGVqHDLIxR4RdwRxCSufZY0o17_P4ftGhvYLMKORx aharan3d99Aq9bam.OOXKmPzFFBC62RsdSUhe1RnkGwR576.uwFSXnoByzVL dKque8aUo2BkfnZtW7XYoGNbp_aPleXVFctY10g62fowTlcsKGRMDaWw9IQ2 pGQHkOy.ImDbca4r998gK6zLFce4ANfi9fQ8rtLyBTOKwOjcdAkpSgF8g86P uCpGvQX7kWuuUQivCfitQhzXqS0fjjcpwVrPXoK_voL_IfI2aiuvT.VvLSix V_lnt5x3TE98SOIwrTYylhPfI6h_p7zXkU1oP8.TWj48thCQTRxJi.cioDyg jxIptHjqcPsSjjKf1AsdAMxSpyMbJnDLpfiDB_oAdcqRaw1qp9xo19g.PpcF KhPuoRumaVaKFnUzlTE0BS3MXy2wYBWeRKFHiHskRRLGEaJhE2JlRCb30tcR GVNlJqYn_ol5DQTW4gsQ4z9w5ZUsEgNfBGvIfH3tmb2E71THvH_WEm_tEhWt A1tu6pWLF._wbMqN2qvJIlcEJC4y.Be9JUvRuGxoHKdB4_a8LpQTRNI3S4D_ 6vf0_vqp7P23PmPvw6RnFO.42A.ewlsIhsrY.WgLOmoD6lor0P_8YprNRvL2 l_cZP_pzrpdf40gCFRWECHppF_DOVb2LBlqryEP59S.Tc4J_QLnIdoHrPjbq x0WmledrhokudFaj29aNKs2UXuateHw39AZPqjTFhHQpRLK46ayYb7xWiA3T RpgznZPzIszdPhim
    X-Originating-IP:   [98.139.91.230]
    Authentication-Results:   mta1190.mail.gq1.yahoo.com from=att.net; domainkeys=pass (ok); from=att.net; dkim=pass (ok)
    Received:   from 127.0.0.1 (EHLO nm26-vm0.bullet.mail.sp2.yahoo.com) (98.139.91.230) by mta1190.mail.gq1.yahoo.com with SMTP; Tue, 06 Nov 2012 02:53:52 -0800
    Received:   from [98.139.91.69] by nm26.bullet.mail.sp2.yahoo.com with NNFMP; 06 Nov 2012 10:53:51 -0000
    Received:   from [98.139.44.81] by tm9.bullet.mail.sp2.yahoo.com with NNFMP; 06 Nov 2012 10:53:50 -0000
    Received:   from [127.0.0.1] by omp1018.access.mail.sp2.yahoo.com with NNFMP; 06 Nov 2012 10:53:50 -0000
    X-Yahoo-Newman-Property:   ymail-3
    X-Yahoo-Newman-Id:   706843.37610.bm@omp1018.access.mail.sp2.yahoo.com
    Received:   (qmail 9176 invoked by uid 60001); 6 Nov 2012 10:53:49 -0000
    DKIM-Signature:   v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1352199229; bh=VoKVL9Dpu1gK7+y2P+pUS1l1Bycf9lrDU+ZnJvMXF5M=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=Rn+MyXyewzHF7MZXKF3CJARLqpTiM6TR2QL/4Wi4zztxzTiecj4Fy9d8eTOz+7XQXyedU+rDti+VeqMr6gmhpjOlIYRF5+7oma+qNTa/2djhh8EIrU8TOcid6bUn+CGfwCQSl0utljn1CFwYL7Q0++qfHpGeIdsbVS4EyN/RcEA=
    DomainKey-Signature:   a=rsa-sha1; q=dns; c=nofws; s=s1024; d=att.net; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=XBg23H9oO2u7YSI7NpWcYwXNTnYlkhteiEtC5rNMSEfWB81q+DEhXVlpg5YaAhKcGo8udU6mDIUUDw20t6lIS1dkMWlz+EFdjW1KXlclXIbi5rEn03M2Kv88YcP2tuTmQUcjAA0DxkjnL/em5svgUMf6q0QXiQIobH3f7YS6xpU=;
    X-YMail-OSG:   hvdIGx0VM1kD238KfcRedz1V…5rKzqeg6DCiG4Wi73xEP 8hr9Ut8.E5WK0liZS6GWA28fPKXTkynNOsr4NH9eY.623X2TUMPZ7Qb5c_.p EtM0JQvLbmT5gFdDz5.R9YizImvmvVCkoyauAAHALAJkVvsZok9fweIbF8U2 yvV8aFKpo8W0ZxLtLTGUDV_UiPhNFPQbjulbgRWrefhzj6GYGiKi95qN4ve4 yilu0n.BIJ0NWe8TtGq.kmS1NvxYsIcjkpmpzo7LnJVvkKailC1hfZUjDzgd YXxDqGrlzyq4pmfYVe0YHTVdyN1VO_2ylVAAPpu2ZLGqNY2sMOCvAX2lHpk7 PY64SODsgg7Fj951lFDU1Wxq__7L69_f.rP2x0HdSKBrnkqoOxBzZ7HGbzmn Fslt6Zs7GJRH17DRGzVCX735yP3iJMV1BZNuPVjol6EYCNhTraZ0HHq0V7ip Y4OpgQJXxOS.kMLu5BvAjq8E_a9WnXmymUF1eMa9AoC.wwSPnWsPu88TkkQF xtQ–
    Received:   from [173.244.161.84] by web181602.mail.ne1.yahoo.com via HTTP; Tue, 06 Nov 2012 02:53:49 PST
    X-Mailer:   YahooMailClassic/15.0.8 YahooMailWebService/0.8.123.460
    Message-ID:   <1352199229.89056.YahooMailClassic@web181602.mail.ne1.yahoo.com>
    Date:   Tue, 6 Nov 2012 02:53:49 -0800 (PST)
    From:  
    “MR. SUNDAY OKEOKE” <webnetxxx4040@att.net>  
    Reply-To:   fedexcouriercompanyinternational@yahoo.fr
    Subject:   This is the registration Number of your Package Fed/122p/mtm/2007Zip Code; 0113388
    To:   undisclosed recipients: ;
    MIME-Version:  

    1.0

    Content-Type:   multipart/mixed; boundary=”2000407196-2022396180-1352199229=:89056″
    Content-Length:   226175

     

    SECOND EMAIL HEADER:

    Return-path: 
    Received: from nm26-vm0.bullet.mail.sp2.yahoo.com ([unknown] [98.139.91.230]) 
    by vms172049.mailsrvcs.net 
    (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009)) 
    with SMTP id for x; Thu, 
    01 Mar 2012 19:25:06 -0600 (CST) 
    Received: from [98.139.91.68] by nm26.bullet.mail.sp2.yahoo.com with NNFMP; 
    Fri, 02 Mar 2012 01:25:05 +0000 
    Received: from [98.139.91.5] by tm8.bullet.mail.sp2.yahoo.com with NNFMP; Fri, 
    02 Mar 2012 01:25:05 +0000 
    Received: from [127.0.0.1] by omp1005.mail.sp2.yahoo.com with NNFMP; Fri, 
    02 Mar 2012 01:25:05 +0000 
    Received: (qmail 9744 invoked by uid 60001); Fri, 02 Mar 2012 01:25:05 +0000 
    Received: from [41.216.50.79] by web113409.mail.gq1.yahoo.com via HTTP; Thu, 
    01 Mar 2012 17:25:05 -0800 (PST) 
    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rocketmail.com; 
    s=s1024; t=1330651505; bh=hRte/spOoUeHzo1fKyW/pPAt9dCM4mEM5nKE4Bviylo=; 
    h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; 
    b=zAe1oupoN3n9J2ujluinyPWOHs3hdbzIciK/IjeTQmki+iDAOyl58j0e7YMKmNAbf04sYzOaZuCkwVbLF0y7YNUyNY9JnTZBYBJh48uGBq2DcTKL7g3L1aGrKhnNt4sdpxRUyX5WMbWmSi9fZoGSPQNLfPbHVoECb0LTXsnvVI0=
    DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=rocketmail.com; 
    h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; 
    b=kIC6JTlIkhW4JIlXAi5bBYTg7M89+wGf6L70sNBwGw0IBA8VxhacaSH3O9KJqcqFKLSIl+Fuis0FATPhkPkRWR6xou8QIvekgyAJR5sHiAYdcoQoZeCBjgqjle8sMFxPknpr5DkT45eU98YNM6BPoVLuTKV4OSf2W5yocEqKvtA=; 
    Date: Thu, 01 Mar 2012 17:25:05 -0800 (PST) 
    From: WESTERN UNION 
    Subject: YOUR $200.000.00USD COMPENSACTION FROM BENIN REPUBLIC 
    X-Originating-IP: [98.139.91.230] 
    To: undisclosed recipients: ; 
    Reply-to: westernunion716@gmail.com 
    Message-id:

Advertisements
 
Leave a comment

Posted by on 11/08/2012 in Uncategorized

 

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: