RSS

“Office Customerscare”

05 Dec

ADVANCE FEE FRAUD – LOTTERY SCAM

This post shows 4 different emails from the same scammer. I’ve been scam-baiting this one but stopped over a month ago and I still receive emails daily so it’s hard to keep up. This particular scammer(s) always emails under different IP’s and email-addresses so I have posted each header in order as well.

1st EMAIL —

WESTERN UNION MONEY
HELLO MY DEAR
THIS IS SEVERAL TIMES WE WESTERN UNION BENIN REPUBLIC ARE SENDING YOU THIS THE SAME EMAIL TO START PICKING UP YOUR PAYMENT AS WE TOLD YOU BEFORE THIS INFORMATION REACH US SINCE LAST THREE WEEK AGO FROM OUR CORPORATE HEADQUARTERS ECO BANK WESTERN UNION,
STATES THAT YOU ONLY HAVE 48HOURS TO EFFECT PAYMENT FOR THE ACTIVATION OF YOUR MTCN TO ENABLE YOU CASH UP YOUR FIRST $5,000:00 FROM YOUR TOTAL (FUND) SINCE YOU ARE FINDING IT DIFFICULT TO MAKE THIS PAYMENT WE HAVE DECIDED THAT YOU ARE TO GO AHEAD AND PAY WHATEVER YOU HAVE FOR THE ACTIVATION FEE SINCE YOU ARE NOT ABLE TO COME UP WITH THE REQUIRED SUM $250, TIME IS OF THE ESSENCE HERE,
SINCE YOU DON’T HAVE THE REQUIRE SUM OF$250, SO GO AND SEND ANY AMOUNT OF MONEY THAT YOU HAVE AT HAND STARTED FROM $40 TO UP $250, WE WILL ACTIVATE YOUR MTCN AND SEND TO YOU TODAY, UPON RECEIPT OF THIS PAYMENT,
BELOW IS THE MTCN OF YOUR FIRST PAYMENT, SO YOU ARE TO TIPE WWWW.WESTERNUNION.COM AND PUT THE SENDER FIRST NAME AND SENDER LAST NAME BEFORE THE MONEY TRANSFER CONTROL NUMBER (MTCN): THEN CLICK THE STATUS THEN YOU WILL SEE THE AVAILABILITY OF THE FUND ONLINE BUT IT CAN NOT BE PICKED UP DUE TO THE TRANSFER NEED TO BE ACTIVATED OKAY

1.WWW.WESTERNUNION.COM
2.MTCN 0560139994
3.SENDER EMMANUEL OKOYE
4.AMOUNT $5,000
BE INFORMED THAT YOU WILL HAVE TO PAY THE BALANCE SUM OF YOUR ACTIVATION UPON CASHING UP OF YOUR FIRST 5,000:00 USD, ALSO I AM USING THIS MEDIUM TO INFORM YOU THAT FAILURE TO PAY THE BALANCE SUM WILL LEAVE US WITH NO OPTION BUT TO DEACTIVATE YOUR MTCN OF WHICH YOU WILL AND CAN NEVER CASH UP THE BALANCE SUM. SO I WANT YOU TO SEND THE AMOUNT YOU HAVE AT HAND. WITH THIS INFORMATION BELLOW. AND UPDATE US AMOUNT THAT YOU SEND AND THE MTCN.SEND THE PAYMENT DETAIL TO THIS EMAIL,(officecustomerscare@yahoo.com)
1. RECEIVER NAME… Ikwunne O Anthony
2. COUNTRY… BENIN REPUBLIC.
3. CITY… COTONOU.
4. TEST QUESTION…HONEST
5. ANSWER…TRUST.

THIS LAST NOTICE TO YOU IF YOU FAIL TO SEND THE MONEY TODAY YOUR PAYMENT FILE WILL BE CANCEL FINAL SO RUSH TO WESTERN UNION OR MONEY GRAM NOW AND SEND ANY MONEY THAT YOU HAVE AT HAND NOW START FROM $40 TO UP $250,
CALL ME ON THIS LINE AS SOON AS YOU SEND THE MONEY  +229 68377742
DR.CHINEYE NWACHUKWU
OPRATION MANAGER.
WESTERN UNION DEPARTMENT
PHONE NO.. +229 98677751

2nd EMAIL (RESPONSE) — Hello my dear you can go ahead and the send the one that you have at hand ok waiting for your urgent reply with the payment information, good luck?

3rd EMAIL (RESPONSE) — Hello my dear you can go ahead and the send the one that you have at hand ok waiting for your urgent reply with the payment information, good luck?

(The 3rd email is the same as the second but was sent on a seperate day with seperate header information)

4TH EMAIL — ATTENTION BENEFICIARY; THIS IS TO INFORM YOU THAT WE HAVE CONCLUDED TO EFFECT YOUR PAYMENT VIA WESTERN UNION BY $5000USD DAILY UNTIL THE TOTAL PAYMENT OF$1,500,000,00USD IS COMPLETELY SEND TO YOU.THE DIRECTOR ADMINISTRATOR OF FUND RELEASE HAS ALREADY SIGNED YOUR PAYMENT.NOW CONTACT WESTERN UNION PAYMENT OFFICER WITH YOUR FULL INFORMATION TO START RECEIVING YOUR MONEY AND ALSO FOLLOW THEIR INSTRUCTION.

YOUR FULL NAME :::::::
YOUR PHONE NUMBER:::::
YOUR COUNTRY:::::::::::
YOUR ADDRESS:::::::::::

CONTACT PERSON MR TERRY SAMSON
E MAIL ADDRESS (western_union09@wss-id.org)
PHONE NUMBER +229 98841150

Regard
Mark James.
WESTERN UNION PAYMENT
SECRETARY HEADQUARTER

1ST EMAIL HEADER:

Return-Path: <office_dooog@yahoo.cn>
X-YahooFilteredBulk: 203.188.201.73
Received-SPF: none (domain of yahoo.cn does not designate permitted sender hosts)
X-YMailISG: YTQQLVYWLDtr8GvJiSxswwRjP7wnkQFwbp2etVmaNl0FiaXv WEWUyzcgnOMV_Qxqdh9W6bDVUk0oJ2n4H_.OqH3FVMd.Y5SeQLY8WPB3FzvF PDksuUJsc8jsOTNRuyWFfYR3l5wAZDJgIWuiiGdSmgdTu68C3rqyg3O3KdWs h.EODC.8..TyOEAnTAvAstMaGS8Ncy0SIJObOaOjtoBxXs6HTVJjL2nLqQq. V8jcqhibon.BQ9tsji3ubP5LyOllUnFxk7kElsMu7n0vVWWSlivsKIy_S5n1 TnjjQsj6Z6unrH0LPjxjeSxKbAjjeU63LUw4W.D9he2EEs26JXAWNlSyN_RA mHtPVevectbOeAKgC.m._frVA4tVlBJnUDlnVGkTYGWpICSFxTT9LPW_EEeJ l2XotLG4IwrFUfDfi_oT5YhbAo7jPwjxliFYxO_jm1h_wnaqEAIoQUqbckjp VIOOy.9bM6cUUjn4sXuLElKl.HyFw3R3uBNExQYnmx4RLVovyUrURD0ciS64 y4A8HjS0d8vV45llBD7G.G.oahtQT4gZsScBryrPWxrTQ3pLGp8tSk2zK.n2 eeTHvEQSRnZIbN0eOuFt75vrczEzEp24_Wxy.kkTt24Ghr67RLbx14T8AWJX oN_fjH0I4fLe4bZg9kWJjC5AIUtbrQ2yjsGa8Rqmniy4tDcDdplQBJNCIttH Y6iPtc8dzN6XRG89qgna5ydQU4LybEz.EW03VSf5bIAK7G7wCnLMhQCLLxgk ly1aVYK.aBw2ZGGdBfsnGxEQGmjWgPW9Y8yaS38MKaKk5BlVKjdKTv4Du9tr 7v1Q0Ahg1rbEQYh8bXhTn4R03SCnAeBhjAproiLkSzIk_nlJpbqzYS_tDYFN eublP_kgPayXAilWx.ksYpuHs_SFNkLaI2tWIn4oFvj8Hul6cqhvS1pJwTK2 8xjAkTjf5BRCJ73jx3wjykpTf9CXKVLe4qVn43MdJwIGfeb9p6tuMcY5ae7w c0GAOM3ZK4N_pO93ZKX2sJA.aGW8uNMDRTGyX1W7L7EKmy.ZYJQMjrOnd1Pp 8VcXJpyj7WUoKAXFir41peZR3kuJAGhW1GbparzRRCsM53A5wxeRRRvbeQlP o9SRMR9hJ7G68eklKQlZiNlLHYAN75iIROMHam0GQkoQl658wOksxxV0w1yE mwld8PgOs6.ieT5hfoq6JOm_CZnFaWvDCuNdzu7iw15xSb996aG1QW0ovKDm ivdO.r3OOe2nezrbgWHscU8DcPD0SD__8p7aOAMpHGW.0iovFBMBhXwhAkfD _c5Tjzjt4SpvsBLMK1O5olWM9ZTOgPGebcxgdbmbvX9l8w–
X-Originating-IP: [203.188.201.73]
Authentication-Results: mta1299.mail.sk1.yahoo.com from=yahoo.cn; domainkeys=pass (ok); from=yahoo.cn; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm9-vm7.bullet.mail.tp2.yahoo.com) (203.188.201.73) by mta1299.mail.sk1.yahoo.com with SMTP; Thu, 15 Nov 2012 00:06:47 -0800
Received: from [203.188.200.142] by nm9.bullet.mail.tp2.yahoo.com with NNFMP; 15 Nov 2012 08:06:45 -0000
Received: from [202.165.102.48] by tm4.bullet.mail.tp2.yahoo.com with NNFMP; 15 Nov 2012 08:06:45 -0000
Received: from [127.0.0.1] by omp102.mail.cnb.yahoo.com with NNFMP; 15 Nov 2012 08:06:45 -0000
X-Yahoo-Newman-Id: 597653.91745.bm@omp102.mail.cnb.yahoo.com
Received: (qmail 1033 invoked by uid 60001); 15 Nov 2012 08:06:44 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.cn; s=s1024; t=1352966804; bh=sqgSO8xP/LR+hXQMdA2e6Ah1eNeIaTHiSoq/jXQJhqw=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=Yws8UW5RVEL2oPJjowNq8quCXz9OzL0CxZrfGMUtTLq9P49zyzmh4cHIIaccgUS6cadGW2uanBjRYI1LgN7qnDfXWjIk1fJUorh8XSrtSnhaoUyUmvLuinqV/FZQLQV6ArVs06/OCE6rJG6RrChDzUt4hI5ALQRFiJ3ZkZnKHy8=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.cn; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=Lytcrsw3vUiLafw/lAGi2G0Q0Tb6yrnlT4ruv+ReTjQFhJriBDR+YxFNsAJmBt2mYpnus+zpYYvm4eYTFIsF0fqvBhc21W3x1a+iiSAPgC+CPtqGdn9cWtDgfR5n6UI9cuY9jwzCd+BU5PzXNKOXbca69Rp1IZVW4Uh5V+L0jKc=;
X-YMail-OSG: O7Gnv7UVM1lkD_jTVvQ9yvdVYlFxea2vZYOteXXHXMW9Qko jdT9UCaq6
Received: from [41.216.44.199] by web92416.mail.cnh.yahoo.com via HTTP; Thu, 15 Nov 2012 16:06:43 CST
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.123.460
Message-ID: <1352966803.94317.YahooMailClassic@web92416.mail.cnh.yahoo.com>
Date: Thu, 15 Nov 2012 16:06:43 +0800 (CST)
From: “DR.CHINEYE NWACHUKWU” <office_dooog@yahoo.cn>
Reply-To: officecustomerscare@yahoo.com
Subject: WESTERN UNION MONEY

2ND EMAIL HEADER:

Return-Path: <officecustomerscare@yahoo.com>
X-YahooFilteredBulk: 98.139.212.254
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: VLLNlMkWLDtUbQTbov0porruXohSlGjiyaNfjajWB0Cduvem OEGnfKhhlF4xKrU2tbM7tHSjRtnksOtCmBni7.2lTKxqM.zJc0kyzLSmp0nG i_CbXXHC8eh56HcFkIULD.BdzbjU3UfTNf7R.IJyVWYbK4FdG2DbERiFQ4AL 2W3kyMd2NrGNWVi84alfEJaPHmLcuiCe1dLIUuBMMg3BNKZYFjFuj1Cbr1QS fmYvDQcEL9QkVQFRA1r4HQalx1x.gCGsnuJ2c9o5WMKTqxEw1lfIpbsWdvZb 0oKivkDXKT0HKUzKdomv4xD1rCw13jYJ0yXJK0BLZfjeePYsPyENUOsfKq9Y Nsoj1dG59zkCJKyLFnd4kgct.GcOBFGPoqpevxYvub8VNcT0gOhnFqLdU38G 72Wja4aTwyX2PGzlzRnU6lmTFEBVcSg3lAYandBAzew3G7Yidyq9q1dnArb3 aue0WfEzyULn8QnrFCgUnH0L2oQF5ev9nBRp.V7MwiTHNOL02o3SMhpcTzSL 52bdZyM3GnxXlVmICHIGyw3cjZkp4_5N.3WtCcf84ScjcaJVKOWt4ReEQVXz 1BtjyULP_fiWN1GESbbrTsmE5WwCpijqJaFqFw45b6wli268.1f0LfkNr.4z YlGykrhi5NCIpY_7esUOObjfjns3nvhb2j5mCdx7_hWj9lolzI2w0DcE3rdp sgN2GDBvVZ680RMztbImaCT.cTURBiiCwvdgTcUy0Mu0E.lTCpJPstDT6ZlW Di1Hoob5dN4ln1HGBipY7Z5mrwTFmtlfI1gjFum_SEDYSmuHGh7eTWZ.BoSU ..k.g0Z8apbapJclKdfT1VK5b1PTmnhtp0OwH3TkTAIf_pAo19ji1fUKzKDZ EMdkEFWD_lfFSXaZjN5LQxHHk0l0N6rCojsf0_lY0srKWve2SaahYAwGBjAV tPNotMOJ51vzMiyw9Zlgyn_jFQ6KxZb5_8Jf8wqtd85wZFjSV6QXpmyxDCKT BahVlS5eGljKzuKTRb0dPV1.M9TxnEImZOHOKCzELtPfnvAeYRoQI25sr133 QlJUxK4HOn1WdLoMNCYBk5J9fmNaV4mS4MQtnFmyIz6wEMbpqkh5CYIrF_8a 5wUl2MuedcVKiMKjzJ2tIETeEsnKcOIDytHmAkQDqTOW2ji6B9lvQQmqB4Ad A9EnFyF4tcz6dmhzNuJh.b_dhtlKSZ.m4PC6WeOEvnrqaf5k3Sy5nN11UGqE 6ok1.QuDzlLWvjzFTfU4a4QZxV5a7pd64zvhBsFGvxUQSVvpBL.8YqBW77Wu hit9.w–
X-Originating-IP: [98.139.212.254]
Authentication-Results: mta1227.mail.sk1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm15-vm0.bullet.mail.bf1.yahoo.com) (98.139.212.254) by mta1227.mail.sk1.yahoo.com with SMTP; Sun, 02 Dec 2012 22:55:27 -0800
Received: from [98.139.215.141] by nm15.bullet.mail.bf1.yahoo.com with NNFMP; 03 Dec 2012 06:55:26 -0000
Received: from [98.139.212.223] by tm12.bullet.mail.bf1.yahoo.com with NNFMP; 03 Dec 2012 06:55:23 -0000
Received: from [127.0.0.1] by omp1032.mail.bf1.yahoo.com with NNFMP; 03 Dec 2012 06:55:23 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 790906.43532.bm@omp1032.mail.bf1.yahoo.com
Received: (qmail 63457 invoked by uid 60001); 3 Dec 2012 06:55:23 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1354517723; bh=D22VWzs/hPiPuo7CTSZY9WVrAb3WF520cs1fAxQD+yQ=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=M+WHRGyJ+Obkc6ezHvdZOt7XhENLPL3udu25sOZBN2bEv8bvyklwtQ6DLpmKzRRpBXOT706jn4vx+mPHl7Ss1QRzP9+0Wo6Ei7G3drwBg4JNSK0krATXorvXYUy6GzTqTOR3umwdQ0HSFEkjOZOm/e7lrZzQypAAF2HsfzCs/yE=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-
Received: from [41.216.44.199] by web161601.mail.bf1.yahoo.com via HTTP; Sun, 02 Dec 2012 22:55:23 PST
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.128.478
Message-ID: <1354517723.57854.YahooMailClassic@web161601.mail.bf1.yahoo.com>
Date: Sun, 2 Dec 2012 22:55:23 -0800 (PST)
From: Office Customerscare <officecustomerscare@yahoo.com>
Subject: Re: WESTERN UNION MONEY
In-Reply-To: <1354346435.35920.YahooMailClassic@web161004.mail.bf1.yahoo.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=”-83809723-1967636313-1354517723=:57854″

3RD EMAIL HEADER:

Return-Path: <officecustomerscare@yahoo.com>
X-YahooFilteredBulk: 72.30.239.148
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: 19QBmTwWLDt95EV2ebP6OidYWqd1j1U2Pdisxv.rlfwDDGY5 69ILUE_kjRPOWAe40.wXl4PoTGUhChdXTKcgusQIibh0IPY_D0Ei53Wrj3P2 DDAmqC8G56tWm3H_2xzLI52rgBO8bDRU9eSbv2pm3Azd_QOUM2JKPXkfNgvF tl4uGNQOLg59unuxlWy7GcvTf7k_qoqXCzJmrjoh8hal1wltXqDrPCdnPvy. gFAaiJyTkAU00qxgTiQBoHammaTYZ4ZKrv1Bj7dJ1Ay0unZZGeZ_8m2Gszaf Hwkx24CP1NPhsf3bn1yuJzkA3iUs9lmwihY8jKVEyWkaKzas.DMkI_qi4SpH ZcprZOz7Wo6Ip0Xe7ngKq.DJvGhyKa6y3Mo9rBfkwPSE1QwldTeMrv.HiKNc J7.fdByCHPm9iuieID3uhsZuZxJJIk_dE_HSPw5N3kU3zc7fJYmx.cnjr3Wf 2ypCCkWSg4Xl.J_9t27tMPFXSJSoGwnm1vLC91UKaZD.u1dtZUXXxB5tay_6 GXotgxrPGmqkwvJ1U.b3XhbbjAW7JSmUeiIRB4cduWQUVHj_rnXP_czMPQVD 4N5bIlcCPjZh3eSRW3gf3AEFVFfPfJx8dm3puMNiCNIHEOWM.KXpLJkyXgwj CXCCZTVhjugOJr6sn4MUCKseOTSyKsr9xa8mUcQ7Ob3w7yUH9YsolFteJokZ 791VNvwM.fuDRTa4C7_GNiOQkrjQtbT08_fPhS4e5p8AUbAPtXoVVhGyrysS WNwPxxltk8XRhk_dX67wDsZjyOfXPmDB3HLalZHqy18lbOcSTBFWISoihgww mPfGu3xD9UWTgN63IDe.rcwpwuXNg9AUAD4WI2TC1TkLuaiTIMBHc1hUskD6 YD46YkgYu9COqzPN4SopL_xQJrvUF.PV5BY4NQB5A_ZB2qJd1gRrxiH7F2oM WMR0CXNOYrY9TXM7XVLamxfO0CSlGMEfV72DaaT_VdZEOlfYoPd4lJDJmB_N sx2jYYAEsdbk4xs6H_9732N8KEwn6jyiAlysubWeSNzm_bnMmkZWyun_skUk lz4XKNVqrbYacm35w2StbbyHFWA8Oo1zW2qh9zv_DmYJfZdb6uGfCzwiuoY3 n24tw2e56bUSpjpwHGWyNJG5h17GA.7b0IXQjO.t5i4rXNFLy4dlPo8Ql.KL 7o3hOnvqv8SS3l.1ctFHuH50C0Qb8SFAoSBMFFfAJNxfMjdPOZxRzdCI54Rr wbWeyGdrtM3CPB2GdyVVli6zsFLRpSNohN6nXHYzK_sThaAO.uWlopq9Mi7R 7gMJVHuSRow-
X-Originating-IP: [72.30.239.148]
Authentication-Results: mta1368.mail.mud.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm39-vm4.bullet.mail.bf1.yahoo.com) (72.30.239.148) by mta1368.mail.mud.yahoo.com with SMTP; Mon, 03 Dec 2012 06:21:13 -0800
Received: from [98.139.215.140] by nm39.bullet.mail.bf1.yahoo.com with NNFMP; 03 Dec 2012 14:21:11 -0000
Received: from [98.139.212.194] by tm11.bullet.mail.bf1.yahoo.com with NNFMP; 03 Dec 2012 14:21:11 -0000
Received: from [127.0.0.1] by omp1003.mail.bf1.yahoo.com with NNFMP; 03 Dec 2012 14:21:11 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 750916.31792.bm@omp1003.mail.bf1.yahoo.com
Received: (qmail 15592 invoked by uid 60001); 3 Dec 2012 14:21:11 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1354544471; bh=+YYliwmsShAvNwhPLyzJNYE1MPX34bjAR9RvOUaGZQw=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=T9KwqKkebNxfAW3bEGZimvC7gz9wDwXYuJCHcFJKyIMKz+2fgGWIXJY7hbmEDeCEDL5nkFpao0O8/BJLEktQpgL/Oc8jlwc4lhbKFPAsVSV5XtdqnIgfQv+QUZOwGSNXAEzCLteM/75epq2GVgFNFQgSBnbamPziTry6CjeHtGA=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=o9sVFcOkfqm1EvfSTDuAbchXwIrh1CcZ/q9lVAsMZNG9iKgZzGUjcyCwN6W2BlBR/8N1BCU063PBnoZz65AMfqMww9vx0tKyy44myRUE6CCrpuSb6Q4IvBJvmXmIBv8uMwFHW7T9qQ9GntFtNWZAEBsJEOoiU1w2LqVEwcJ/LaA=;
X-YMail-OSG: 01EGTb8VM1m0Oj0eiFuBd82hpLH5OcmVrv4NLOE.DGTQuBD xtJPpsSc0mVlekI3jqbZq
Received: from [41.216.50.26] by web161604.mail.bf1.yahoo.com via HTTP; Mon, 03 Dec 2012 06:21:11 PST
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.128.478
Message-ID: <1354544471.96769.YahooMailClassic@web161604.mail.bf1.yahoo.com>
Date: Mon, 3 Dec 2012 06:21:11 -0800 (PST)
From: Office Customerscare <officecustomerscare@yahoo.com>
Subject: Re: WESTERN UNION MONEY
In-Reply-To: <1354346435.35920.YahooMailClassic@web161004.mail.bf1.yahoo.com>

4TH HEADER:

Return-Path: <yajie3128198@yahoo.cn>
X-YahooFilteredBulk: 203.188.201.9
Received-SPF: none (domain of yahoo.cn does not designate permitted sender hosts)
X-YMailISG: emIYTZsWLDsWBcwgel.WAdTfmAz7lIDU50.tyqE5VPt1VGpv VeukhIjY1Cn.KU8zhzCD_Pw_36n4JbpBBnAvEduvgl5qSCqKBsweGyX_h2Ds wNqtHkWk84quxCURRbnzMjvGUohntskqKJ9WLPygNjL0APgEgATzpDrLvj8k VuA9FW29oKwfhjurxzDZCcZH2Oo2zAfZnsdooccof.1DHRU8.6up3Noi8BNz 8uT6vrZfuFUPZ8DeDut0XwFw6QVwjr1qEX04NI..JcSraqBEfIQfTaoAwHus vr6Lj_dvPNX5tWGkfcNnjurajknIRROwwtXaASLQ7Cx8Uh3N5NoiCPSRcyUG yKVTej8g1qqyPvMgRR.Xg5HP87.bsB_o_vmswcSNF8KDt9Xkig3exi2o.Llu bLaJLyQxnGQMqS2eBdVt7G9icsk0YsTnLfPjvmsUkuS7kjMMvIL8AvgT8Wld 0y2mIrI71WQLbuCmqFVBhujChu2eWJ200uDJKrDtjv9_yZnFECzHIn02pCyw CDCDxpVA63zdAbSelgfxij7sHg1_jZCnlbyUm2cEPdLk15uFHsM.7nvxrgUY 5LsHbzlOaBg0rJ9x6AjwIurAG9AqXXMS28ewOfH2p.VXst11fH7r9U5jjOcl nrsDfP6NHDykG0m5xL.B6nKv_VGrJFtJ2d7bJ49SJD3fHvm08HTy3IukXkbR _af4nG35A546UhnaBoCPZY2XgqgjyqfjS7wIp_.Xpne8dHrzvdiv2fGZoxNs cdmCT929aSNoBVS7qmf.Vqh4Ba0Cq0iGPC69oPzjoseElXh_w.rLeV3Vhtmh v4w396qlHszg2qTh1ti6kqxrlGBJ5Es5_rFAUpfV_Iyc523_g9gcXSF639qk 5L5ibU_TC20R6g7C8emmS0Xz4A881Mgir2IBDvlQCykLm36iOT7Jt3KtGd0Q 8zo2IoPSQNQeUnRVvOOs_1u4tawNtF3beclZPl1jNKjb13l6FkwaL.Pl0fMr 0zPIZaLlHadKxr2LSmAlVNFkwxzVF.ejbaqH1T4Bf.HF1_4vrPHyGwypU4oT _Rd9trwPjtmiazFmvyW4zVt6P3uo6oNViHQvSKESLhBEb0dp1mJ24JmpYudY 9FOXDLAfJNTHD0OBlfo4j0ZN5tFbVqku8MM2wJkkVdHXcav.NP88edHCmGkG 3hnvwRmaS.xRh57w.78MDdmqgr8JsPvQbi7hbuZbxtyPysPjavf.Mn1dKiU8 MDzL6_L.ARVxcwWXZuD__sEtleqB
X-Originating-IP: [203.188.201.9]
Authentication-Results: mta1048.mail.ac4.yahoo.com from=rediffmail.com; domainkeys=fail (bad syntax); from=yahoo.cn; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm8-vm7.bullet.mail.tp2.yahoo.com) (203.188.201.9) by mta1048.mail.ac4.yahoo.com with SMTP; Fri, 30 Nov 2012 06:06:08 -0800
Received: from [203.188.200.80] by nm8.bullet.mail.tp2.yahoo.com with NNFMP; 30 Nov 2012 14:06:04 -0000
Received: from [203.209.230.76] by tm1.bullet.mail.tp2.yahoo.com with NNFMP; 30 Nov 2012 14:06:03 -0000
Received: from [127.0.0.1] by omp105.mail.cnb.yahoo.com with NNFMP; 30 Nov 2012 14:06:03 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 676497.39980.bm@omp105.mail.cnb.yahoo.com
Received: (qmail 62200 invoked by uid 60001); 30 Nov 2012 14:06:03 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.cn; s=s1024; t=1354284362; bh=y53EsIyh7n71+dZ/04bpw8ev0uIRHfZGOGFr7f2xT6g=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=2YdCEBsGYX6t8lq6v3RHWBeQNjh949+Bf0uHOzdQF4HHzc99e4R1GTkk82F+ACxM92FYk6ciYRMBFJjgw2vTXqxajDQF2mGe9gcYWTzOWlcMZcKOpAlTdfZ0a/Q5L57cgywjlceOUq8CTwQTYdP7c8C7RolTF4JhNYOVKXiweg8=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.cn; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=GvTvbvzMaFegUf3UU+0sN9uBuXGXz9nGn8DJZsM7LuwwyYt/3ZLa/bfYTxLdIOMSKzvNeyVM1QZb+7O0P99zR4/vnljfB45mZ1c63OSyAeHSYzBLiIpy7fSSyVzqdmyGQmITI9SAFiL0VKPGWWc8GDdA8JtUfxELE16aQoEAntI=;
X-YMail-OSG: uMubNSsVM1lY53F0TXaMY83uS7TEq6JQlDsaehAolKSsGNi urJ9D0OkSh22JWyfGoQTj
Received: from [41.216.63.171] by web92205.mail.cnh.yahoo.com via HTTP; Fri, 30 Nov 2012 22:06:01 CST
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.127.475
Message-ID: <1354284361.58719.YahooMailClassic@web92205.mail.cnh.yahoo.com>
Date: Fri, 30 Nov 2012 22:06:01 +0800 (CST)
From: OFFICE <offficialofficee@rediffmail.com>
Reply-To: western_union09@wss-id.org
Subject: REPY TO WESTERN UNION PAYMENT OFFICER

“Office Customerscare” <officecustomerscare@yahoo.com> <> DR.CHINEYE NWACHUKWU <> westernunion09@wss-id.org <> offficialofficee@rediffmail.com <> +22998841150 –  +22998677751 – +22968377742<office_dooog@yahoo.cn>

_______________________________________________

Associated Email: western2union1money0transfer@live.com
Associated User Account: Mr.Barry Grant
IP: 41.216.63.171

Associated Email: johneric777777@yahoo.com.ph; western_union2011@superposta.com
Associated User Account: Mr. JOHN ERIC.

The ip address 41.216.63.171 has been recorded as a spammers ip. If you have had a member sign up with this address you may want to consider contacting them, and possibly banning them from your site.

Other scammer IP’s in this range:

41.216.50.26
41.216.44.198
41.216.44.37
41.216.50.204
41.216.50.32
41.216.192.148
41.216.133.26
41.216.50.182
41.216.63.171
41.216.44.196
41.216.50.181
41.216.63.171
41.216.50.33
41.216.50.33

________________________________________________

Associated Email: kennethkuye58@yahoo.com.ph; emscompany78@yahoo.com.au
Associated User Account: Kenneth Kuye
IP: 41.216.44.199
The ip address 41.216.44.199 has been recorded as a spammers ip. If you have had a member sign up with this address you may want to consider contacting them, and possibly banning them from your site.

_______________________________________________

Associated Email: office.filemail21@yahoo.com.ph; western_union3852253@yahoo.com.au
Associated User Account: Mr Kenneth Kuye
IP: 41.216.50.26
The ip address 41.216.50.26 has been recorded as a spammers ip. If you have had a member sign up with this address you may want to consider contacting them, and possibly banning them from your site.

_______________________________________________

The additional IP’s have been blacklisted on atleast one anti-spam (scam) website and reported by other internet users.

Spammers Sent From 72.30.239.207
From: Standard Credit International Finance <thomasdavid
Subject: none/blank
From: Nadia kallon mbembe <nadimbem@rambler.ru>
Subject: Hello dear
From: Ibrahim Sanogo <ibrahimsanogo@voila.fr>
Subject: GREAT CONFIDENTIAL BUSINESS
From: “DR. B.S RUMA”<bsruma1@hotmail.com>
Subject: Call for assistance Tel: +44 (702) 401 6959
From: 郑���阳
Subject: 艳君
From: “ypyqv” <zabelvineewm@yahoo.com>
Subject: 何丽壤何丽壤
From: 唐湘祁
Subject: 楊家團
From: “Mrs. Sharon Crawford”<info203932@skymail.mn>
Subject: COMPENSATION ALERT, OPEN ATTACHMENT TO READ ALERT
From: YAHOO MICROSF 2012 <claimagent45@gmail.com>
Subject: Co
From: EURO LOTTERY PROMOTION AWARD <drmartins123@gmail.c
Subject: YOU HAVE WON
From: MATHEW SILVER <mathewsilver1290@gmail.com>
Subject: DETAILS OF THE MONEY IS ATTACHED
From: “AGENT JAMES BURTON”< kjhguigu@hotmail.com>
Subject: FROM FEDERAL BUREAU OF INVESTIGATION {FBI}SOLID PR
From: UNTED NATION PAYOUT <anthonymark.clyd@gmail.com>
Subject: (FIND ATTACHED) TO CONFIRM YOUR PAYMENT INSTRUCTIO
From: dso <obregonhjmou@yahoo.cn>
Subject: 请查收!
From: “Mr.Law Kanu” <lawkanuu@gmail.com>
Subject: AT LAST YOUR PART PAYMENT HAS BEEN APPROVED
From: “MR. SUNNY LUCAS” <sunluccas111222@rediffmail.com>
Subject: SOUTH AFRICAN NETWORK FOR WOMEN
From: “CARD OFFICE”<drgoodluck001@aol.com>
Subject: payment of US$2.182.Million Dollars only via ATM C
From: “Mr.Ibrahim”<lamored.ibrahim8442@live.com>
Subject: VIEW THE ATTACH OF YOUR COMPENSATION FUND
From: “MS GRACE SMALLWOOD”<mr.johnwalker444@hotmail.com>
Subject: HIS IS TO NOTIFY YOU THAT YOUR FUNDS ARE CURRENTLY

From: COMMITTEE ON FOREIGN PAYMENT <web.np@att.net>
Subject: ATTENTION
From: john graig <web66778822@att.net>
Subject: GOOD DAY
From: Nadia kallon mbembe <nadimbem@rambler.ru>
Subject: hello dear
From: “Mr.Steve Gulliver” <stevegulliver001@gmail.com>
Subject: INVESTMENT PROPOSAL
From: “Mr. Donald Wilson”<michealscolls25@att.net>
Subject: Confidential Account information
From: UNITED NATIONS ORGANIZATION <unitednations22010@gm
Subject: PAYMENT ORDER VIA ATM CARD
From: pavel_stuleanic_12@yahoo.com
Subject: Curs Italiana – Invata italiana fara profesor
From: Zana Clement <zanaclement2011@yahoo.com>
Subject: From Miss Zana Clement
From: e_x_t_r_a2000@yahoo.com
Subject: Economizor de energie electrica!
From: emo_love191@yahoo.com
Subject: Economizorul care reduce factura la curent cu cel
From: “United Nations�”<publication@un.org>
Subject: Attn: BENEFICIARY, Notification of Your Unclaimed
From: Oferta zilei <alexandra1975stefan@yahoo.com>
Subject: Tigaia magica Dry Cooker
From: Google Corporation <claims.sector@webname.com>
Subject: Google’s 14th Happy Anniversary
From: POWER-BALL ONLINE PROMOTION <info.pball.promotion1
Subject: CONGRATULATIONS. (VIEW THE ATTACHMENT FILE FOR MOR
From: MICROSOFT AWARD <awardm2012@gmail.com>
Subject: Good News And Congratulations You Are Lucky Winner
From: CANADA UK LOTTERY PROMOTION
Subject: Congratulation,[Kindly Open The Attach File
From: Musa Ahmed <musaahmed20222@gmail.com>
Subject: CAN WE WORK TOGETHER WITH TRUST?
From: William Nii Offori <douglaakana12@gmail.com>
Subject: Dear friend kindly view the attached file and get
From: “tristardamith@yahoo.com” <tristardamith@yahoo.com
Subject: GUESS WHO HAS A CRUSH ON YOU!
From: HEINEKEN PREMIUM PROJECT 2012
Subject: HEINEKEN PREMIUM PROJECT 2012
From: Felix Hachel <felll_hachel@hotmail.com>
Subject: Your transfer is ready
From: “#10090246 _____Get-a,holiday-bonus!_____Last<Hour
Subject: Last Hours to Save! 40% Off! Order #10090246Exp|re
From: MRS GRACE MANDA <gracemanda147@gmail.com>
Subject: I NEED YOUR ASSISTANCE ON THIS TRANSITION

Other Spammers IPs in this Range

41.216.50.33
41.216.133.26
41.216.50.204
41.216.50.182
41.216.44.198
41.216.50.33
41.216.50.26
41.216.50.79
41.216.50.33
41.216.160.135
41.216.44.37
41.216.50.26
41.216.38.164
41.216.40.128

 
Leave a comment

Posted by on 12/05/2012 in Lottery Scam, Other

 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , ,

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: