RSS

A list of three scam emails

06 Dec

I’ve compiled a list of THREE scams that were sent to me back in September 2012 and they kept getting pushed down in my spam box. i’ve looked up each of these scams and they ip’s and/or email-addresses have been either blacklisted, reported, or both. they are 100% scams!

______________________________________________

1) Mystery / Secret Shopper – JOB SCAM

EMAIL: Work as Evaluation shopper and earn $500 weekly reply if interested.

HEADER: 

Return-Path: <rbud743@yahoo.com>
X-YahooFilteredBulk: 74.208.4.194
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: AKqJ9t4WLDuLDZ8EZZ2u3Vhgs2RNEh4aXjZ7kSSWXBbVAv27 JuBiH_aCg6MvjBaLtMO.0JhXLKpM8ii1YEm8h.bFObLns4nMQlhEuIaOypzf YAFLEAhgf2YH3_pDJA6RPA1iH4GD82FsJ1hxzx8FwLfw9flBPA_QVArVHg_h m.nDYlX6pFBPN1kN5BXyTwsrpS8DrWxf5h9pc5u0ORutRWVmmWxtyTqongzC AZxsQhOSTAeUSgJlrWrj13kGVmyz5egnbmw71fMxby9dLjhQZ_I.65L5aVED uaj9eUARz5uXxA9Nr98SIEpyTsr7qpzboLTSAxZHGXwTxG6WaoqigWyqxPNB 8tkNBi2aZZc82kCiAZ6y4bIJIsGVQv2KbAzEQihTxZ0q8zpkpD1LLH1PGih5 a82YTC.4HsC2HXhwZeUKptTF2_JEKlnhXNn9tegHb3_vx9h2hx5nH9JlZDF9 GYjXQ4BHx8UFQ8IpAAB3lKXN1Rl1l82cHtG2x9XSWas3T71G1EnTjIW.UnJL 8Wy.OICrembxbDZik.cv_yj_7APLx4POhhoSXnmOkgg1zWZfdqVRhjOw.Pk3 qruW_GaAce8POox4vtMRUHwd5ec1p922vVYgZmceTMr2KgfAT.ALodh_crPy wYcjUG_wpNMK3q5_QGyhnzcLNz.w7boX6vI9rqYnVC93nBK6jicjPHfE_p09 EQN9gYTlrmX_OkOhZtosYI9CjI4d7awR.RjWmpFiU7w7gZSVuSbNvej7_dPA QR3_BaQXgMfbD9f9Bcd4BBm6Ncwo3hQI8pYMJMaJxjZTwQGiLQSHOAWgk1bE 3PmyPCxH2BUw6B4yjRwPf32ee.qd3yU3c9T60ZaYsOKq8H2oC34IphIKeX9c Zp_CGasShwklc4Bc6J1V4dNHSpE91ybvbKiK_QCETua1O.Jnn_BmFO.X0tBW qvW8MSKLQI3dxIVuxVD6wQqjdrlbRjBOsZTXa0ZNYeWBxEkbDTAoHvqm1GkO qOC1bLUtx2b71g3GZpPxGQb_WUnhoQRtBAtFRiB7VJj.vQ6jFEI6uxk9DeQm iEjd7zK4s4139xO7eIBpSSEy2oaUzqsEtTavLSA6KHgB87t5IQtPA6aCdsE1 3iuDjHCuQ_Tx2tw0UAgnKWm13UKA6QV84.cN
X-Originating-IP: [74.208.4.194]
Authentication-Results: mta1236.mail.bf1.yahoo.com from=yahoo.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO mout.perfora.net) (74.208.4.194) by mta1236.mail.bf1.yahoo.com with SMTP; Thu, 27 Sep 2012 05:37:30 -0700
Received: from icpu2633.perfora.net (infong656.lxa.perfora.net [74.208.16.162]) by mrelay.perfora.net (node=mrus1) with ESMTP (Nemesis) id 0MNJ6P-1TO6Ag00Cn-006tJO; Thu, 27 Sep 2012 08:37:29 -0400
Received: from 64.62.210.227 (IP may be forged by CGI script) by icpu2633.perfora.net with HTTP id 3pIPGX-1TlNhr3xrB-00o06f; Thu, 27 Sep 2012 08:37:26 -0400
X-Sender-Info: <154550926@icpu2633.perfora.net>
Date: Thu, 27 Sep 2012 08:37:26 -0400
Message-Id: <3pIPGX-1TlNhr3xrB-00o06f@icpu2633.perfora.net>
Subject: Earn $500 as an Evaluation shopper in your area.
From: Secret shopper <rbud743@yahoo.com>
Reply-To: bunniebug@gmail.com
Content-Transfer-Encoding: 8bit
X-Provags-ID: V02:K0:q7XGMi78NyFU2vB+AV5/lUFl9H98ItYD9tLebyHhAA9 D0m97d8zgZKfxlxuq9UDrMJegI60FkR/i9yiR6s+ClfFhTdW82 rAyxkW0MOpaOrk4OGp145YpcbEzlvc2VFiYRQ/rs6aB2qcOPN3 NWsuAhg3PAiNdEwA6dwxoRHieSsNCys0MCLKU+1KwF9t3ityOb +0h6hFjTSFQcDRe/zyg06xnSxE3maK6IsAX2Nd1M4qbEFSyI9i 5Fun6VBXSQ6J+ZAUIsFI5SJ89/OaBqUYBkxv20+wKWBINPrD9L DG+HtYDgwRcz0KeXzqNl6gn4xUUQtJvPCBgosLOpKvKwgM7+xm b8vfu2v3JIk8MzEz+GiIGqRcrSOI0MNEZ0pg3V0jcmYI6z5qOg uRKeU9ng+gFFtzlnhdhW3SfwBG8kAe5MbgLNhihFFOcitw1pvf 2JJM8

Secret shopper rbud743@yahoo.com – Reply-address: bunniebug@gmail.com

______________________________________________

2) INHERITANCE SCAM – NIGERIAN SCAMMER

FROM: “BARRISTER IAIN WRIGHT” <barriainwrightchambers@yahoo.es>

EMAIL: A “Next of kin” file was attached to the email I received in my spam-filter.

HEADER:

Return-Path: <barriainwrightchambers@yahoo.es>
X-YahooFilteredBulk: 98.138.91.65
Received-SPF: none (domain of yahoo.es does not designate permitted sender hosts)
X-YMailISG: M2_fjBkWLDtzFm2rFbGuKofV838RG80_qXL6ZuDED.RFpUhN QzoD5j712gVhOoEJsZ_uRf.2zvCTUEDGuBwy7ek.Z_cs1.Ow_uuIMz1W0KW5 jz3j8cAvY4pVwyF92hL8sb0bk5etdgQljeePH7D7H0t4.QwwJ0D3rZLAmRtX EA.nsroRjdhC77B3fJekjgoYlRDbjEQ04x121ZVEfEWe.3fW5SyxaTfR4KgF kzRSvkuZWiHMl.95_MNF52w6FlXZe0s57mnJ39QygzPNuwxz8r9ltiLrDxzW CEcFpO9AFuqw8nCW_R1XtK6G1b6huW8ePJC.leD0fnho.XtvHjoDVo_y2ZfO WqNr4Oio3P19odWSC_sGQEZrl0EM.EkuUagsnXV7xRvQu0jtqShpW31_Z.tT Js6CVCXWfKboozjD9cQ3Gw5bIsAuPseovHYlMJDKjcPbBvIYONMkwcJm7g2s 0kCNA.NZ8XAplJwzsrfD6kozvvEtlBUiYF3WgpuwanpG5wdit6Ji_PU9PfOC K1Yz9q3yP.kaa5agusvK9DslBIL2BI1sE8wAmfxOndoXnT_OBg1A89tKyHvi 1NU.rgxEXocZHUvCmOi6finC8JS_HOXotztzI3k1UAF3p7LtuGi1rlULN_t9 ZlqKoyi9DKSLjJr7mmT2JNYk3Dg.8I.Ufm1UafFyn.vMw8Leij6Hz2bF2v4Z iDKSJttG_KsvKA8BBFrV4D29WitXnXW952k5J4ki0t2MJGF_52sryyhf4Xbc V5VMk8lFNV3RnVxbzFZ4F.Giex.EZykeqvgYWpD19NU_Aa9Bl_Gj6jfDvnBA VxjF4ZQdNb8ILQC2s7WQ5xxYqTIRJSny3nDVLHk0CsksYsoQa1ZsyQcnzmlD .BbVo322yE5eFDLysimD_pbd9GGtPqvHK0oFnA87dDQ8m6EwoczOZyq5MLZh 6ak6I15eZdeXgBCGjDot4PbER8YPaczjKa1gS35fSifWN6mdVTfrENbi1KI3 trybU9EqYKxs.Fpi7cVpEvg3_7dDpGnTc4sHhBRgEdf1RHq4SAIt4iYl59iZ dPLvX48BTVkdm_jRpF_bSsX18FONqMeNma.2vF7zQyPEos7t9v.zV4BCFg5K D8KR4VuGmgZUv0rs9LTQMcmeGz5EdaudBaAQNTIdiFhnYQt4ueJdCwRRX.iJ 4itjVlPHvxCwCSOCk2pTW.fWLQ6tzFDa0wLErfkvjqPzSZQlvl5P_dKFrKkU Qw2FXmcwWByns0lIRh4e
X-Originating-IP: [98.138.91.65]
Authentication-Results: mta1268.mail.ac4.yahoo.com from=yahoo.es; domainkeys=neutral (no sig); from=yahoo.es; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm8-vm1.bullet.mail.ne1.yahoo.com) (98.138.91.65) by mta1268.mail.ac4.yahoo.com with SMTP; Thu, 27 Sep 2012 04:58:00 -0700
Received: from [98.138.90.50] by nm8.bullet.mail.ne1.yahoo.com with NNFMP; 27 Sep 2012 11:57:57 -0000
Received: from [98.138.226.126] by tm3.bullet.mail.ne1.yahoo.com with NNFMP; 27 Sep 2012 11:57:57 -0000
Received: from [127.0.0.1] by smtp205.mail.ne1.yahoo.com with NNFMP; 27 Sep 2012 11:57:57 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.es; s=s1024; t=1348747077; bh=hGsZAt5nOQ2q54GDVUA2RwhZC83Cp9+/EC4wFdxVyYY=; h=X-Yahoo-Newman-Id:Message-ID:X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Reply-To:From:Subject:Date:MIME-Version:Content-Type:X-Priority:X-MSMail-Priority:X-Mailer:X-MimeOLE; b=MoAzd3e63PqKFngqb3VCbC/Uo5orULDk1RIM6/2B2RYLBM6h8uptxC+sRFQJ5iLRKi39kay5dKraN2XrKP9u9wtXAlDdkFnIeciEVnV6i7gEZEbsYRdtEOasJq/ybFCUCe0XpeR66OnUwYqE/p86ZL91DAWHBLrkFvdalJQMAxk=
X-Yahoo-Newman-Id: 947141.79026.bm@smtp205.mail.ne1.yahoo.com
Message-ID: <947141.79026.bm@smtp205.mail.ne1.yahoo.com>
X-Yahoo-Newman-Property: ymail-3
X-YMail-OSG: rcoOjawVM1mWxeqldCK7BSKWgrYcBs1inBlj1z5n9ltVGqo lXNdgbkjin6Ym0hriCxY8RhKC9z3UHynFaVcypefuZJk2AfXmrAilKSE4vb5 KeOc2ioP7iy1rfjaZZVzV.cycy5VbHL7AbItmNPTqrNiyjcb6iaEiRVHxvik NfO9dnBB94DVyHbVr29ZagMutfYnQg5KSy5ewpvMP4MtcfN2sKjatIfTNS4D L4jPTAEBbDvd5mh_QaFWkJE3.eudqrsdxkVy.YLapxZkLJyfub4CI6iGV9HD D4elT72CmoNh.KfYjif0wZS8DIXtc0oDVVaNR_ovjQW27WIB3VWtwpk00VZ1 0wK_SM7gHK.xJVFiu3aG.hYTYe8.gByUW0F44tzkpBVsFkSYXI9zlI5KUuy_ pkATHZ1qonT9DuCxgQgGPlMDlUztCamZhoye_.Bt74oBCHBS2vEhHI0yvsVg X93Q9Qaw5R_gx8iEan8y1B6IR9ErqB9iC43JStRYaXZmWkR0-
X-Yahoo-SMTP: bFYQ04.swBA5PmeNAjXtnC8HS1fNQYaHrFuwM8HILFjy
Received: from User (barriainwrightchambers@41.58.49.104 with login) by smtp205.mail.ne1.yahoo.com with SMTP; 27 Sep 2012 04:57:57 -0700 PDT
Reply-To: <iainwrightchambers@yahoo.es>
From: “BARRISTER IAIN WRIGHT”<barriainwrightchambers@yahoo.es>
Subject: WITHOUT PREJUDICE..PLEASE READ MY ATTACHED LETTER AND REPLY

REPLY ADDRESS: iainwrightchambers@yahoo.es IP ADDRESS: 41.58.49.104 LOCATION: NIGERIA

______________________________________________

3) BENEFICIARY – 419 SCAM

EMAIL: Hello, 
I am Mr. David “Dave” Darrah the Assistant Director Inspection Unit/United Nations Inspection Agent in Hartsfield Atlanta International Airport Georgia USA. During my recent withheld package routine check at the Airport Storage Vault, I discovered an abandoned shipment from a Diplomat from London and when scanned it revealed an undisclosed sum of money in a metal trunk box. The consignment was abandoned because the Contents of the consignment was not properly declared by the consignee as “MONEY” rather it was declared as personal effect to avoid interrogation and also the inability of the diplomat to pay for the United States Non Inspection Charges which is $3,700USD. On my assumption, the box will contain about $2.5 Million to $3 Million and the consignment is still left in our Storage House here at the Hartsfield Atlanta International Airport Georgia till date. The details of the consignment including your name, your email address and the official document from the United Nations office in Geneva are tagged on the Metal Trunk box. 

However, to enable me confirm if you are the actual recipient of this consignment as the Assistant director of the Inspection Unit, I will advise you provide your current Phone Number and Full Address, to enable me cross check if it corresponds with the address on the official documents including the name of nearest Airport around your city. Please note that this consignment is supposed to have been returned to the United States Treasury Department as unclaimed delivery due to the delays in concluding the clearance processes so as a result of this, I will not be able to receive your details on my official email account. So in order words to enable me cross check your details, I will advise you send the required details to my private email address which is ( davidddarrah@zing.vn ) for quick processing and response. Once I confirm you as the actual recipient of the trunk box, I can get everything concluded within 3-6 hours upon your acceptance and proceed to your address for delivery. 
Lastly, be informed that the reason I have taken it upon myself to contact you personally about this abandoned consignment is because I want us to transact this business and share the money 70% for you and 30% for me since the consignment has not yet been returned to the United States Treasury Department after being abandoned by the diplomat so immediately the confirmation is made, I will go ahead and pay for the United States Non Inspection Fee of $3,700 dollars and arrange for the box to be delivered to your doorstep Or I can bring it by myself to avoid any more trouble but you have to assure me of my 30% share. 

Mr. David “Dave” Darrah 
Assistance Inspection Director 
Hartsfield Atlanta International Airport 
574 Airport South Pkwy 
Atlanta, GA 30349-8642

HEADER:

Return-Path: <pop@allencountyohio.com>
X-YahooFilteredBulk: 76.2.207.6
Received-SPF: none (domain of allencountyohio.com does not designate permitted sender hosts)
X-YMailISG: EUAkKlQWLDtsLHISUQeKpcEKYRzqJ7wJNr_C7p9ML278m16_ Za6J9Pq_buEhDSzzga9w7u3z1iiVkG7gWd3.2GgTG8oqtDYIY8JzWTuAyM.W WLRMqYmljQmJWsOxzbD8S_fg8qHSwLKsMrgjFNK__hHCWl_OkV2lCszsEvIo k27rgsD051sETLW6NnPpM5Y0gQvMg0ZtrVWFgeC.9GTGxpsgbdMFgmTRfqmM pheXss97gqtPwEg8Visf4uC1SekpoOiJm3EwqEomx9xhSJT79hjaDWhgzH6_ COw4PblMM0YnLd9ye88K602PP4Itc87alAKLw9aAh2N61EqrpnDdzqGvP0PZ HfeXg75.3G2CXJAiHD0FHo9JgFp7aG9KyBmrFWRU5648VTW3mDKWe2C25sU4 98uMND3e3IyyDdn1_MHnUp537ptCYyHU6paAoF.omX_bckCR1_VtbfFifDzv _3ILiunWcszXX50ipE1PPMoucSObhqP4Gc2UPSwgz1IBcjQ.YxxbHwcsCz6h vUw3MG57kjqDaJWcy7ip0UHvAnkL64hsG8UKNWHQFtXI3hKpZmc7pOZN42Ai SiJass6CfuEA_t0BXQjGsOrKMoSy.baT7g5EOOpiLtalKToSBZ2KQUBykov1 ODt408PwIyv_UTtB9Vn44XSBJRdE1pVeBwI70kTBC7XD7iU5RfQEau1BG5.8 .QV9vamuNCWep66Ro4xk67qxP6uFL5Q7AbQkujfaZt48c9Dlqae4ZQYuBY58 q4tchcGcICVFhqNUkkDxvwp0xBFxpRplgsJNrg4cKiYTWNQjtcDifMnu.4tE ZMaxugmgEuDm_fMvwqdzJ4sSf29PXJGtI5UserjFwSqYNUhP.PdnaRPwmsvj MeNyxMnzF79dlwPy5dvtSHHyshVxes0Kav8q7gwt8IvbjDFCPrQs2yYehH0W 63ywC7.8X7qlHDgqBcijwuALY9.aI79s77ktX.3z2ITl4YjnXnLRnar5.uhg FL68BNGEBL889saAu6hE0kDLmVkjZ8.COuqfoJc2bkgkT_..DnxIummB1vyv _xT9agrwPBPnUSAlr4CuMCm0hNl30RlWKczWH5sSV1o72hzr5Y6aQY.ZV2Gi .miiKTWsDm1oPmRIR1XtGbCqdrWipNC0MDw4U_NDKhgsqe_vSZC.4xB0.FXJ AmJK6BheyqKbdPqbEmwIQJyDDTBZQlC1QR_m0qgumrsxGuM86obaeiFMLugP M0KnER8ZIyhxrn0ZYCLRCkBF7JcP4l1ZQ.x9pI58fA8YQXHL2.e.Uaqv45PB nW1q.c60yFPROZVrD0jAphIl74s0LojMk0tLhgnvWODWpMVigRHIQXPjwC3N CkpHlCjBQGVFLSppGYFJdqcLxysTIF0ZfcTNB6jwLcwa7EoynkQahjiudRpm _rJngrLoamoCJcV53j5adQ.GLSpkcTsSNjZ6fBDmjeEnr5sklf7302qx3lGz m6UkBOA_.jgAksqlCvX3yDdeNH0_gwNaP.eqIvVP3pOyD7d6glmnjQVHKsr_ ARaX9Yl5LxZKu9MMZFP7uGcbf7L9Ei_RlRJ6UU2F5Q–
X-Originating-IP: [76.2.207.6]
Authentication-Results: mta1089.mail.ac4.yahoo.com from=allencountyohio.com; domainkeys=neutral (no sig); from=allencountyohio.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO mail.allencountyohio.com) (76.2.207.6) by mta1089.mail.ac4.yahoo.com with SMTP; Thu, 27 Sep 2012 01:35:25 -0700
Received: from localhost (localhost [127.0.0.1]) by mail.allencountyohio.com (Postfix) with ESMTP id 2D621122C8C; Mon, 24 Sep 2012 13:25:46 -0400 (EDT)
X-Virus-Scanned: amavisd-new at allencountyohio.com
Received: from mail.allencountyohio.com ([127.0.0.1]) by localhost (mail.allencountyohio.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J5DNgyAg-5Go; Mon, 24 Sep 2012 13:25:45 -0400 (EDT)
Received: from mail.allencountyohio.com (mail.allencountyohio.com [76.2.207.6]) by mail.allencountyohio.com (Postfix) with ESMTP id 8E249122A27; Mon, 24 Sep 2012 13:25:35 -0400 (EDT)
From: “Mr. David Dave Darrah” <pop@allencountyohio.com>
Reply-To: “Mr. David Dave Darrah” <davidddarrah@zing.vn>
Message-ID: <683849525.104969.1348507535471.JavaMail.root@allencountyohio.com>
Subject: Await your Urgent Responds !!!!
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Originating-IP: [64.250.124.220]
X-Mailer: Zimbra 7.2.0_GA_2669 (ZimbraWebClient – FF3.0 (Win)/7.2.0_GA_2669)

Mr. David Dave Darrah – davidddarrah@zing.vn – pop@allencountyohio.com – 64.250.124.220 – 76.2.207.6 – 

Advertisements
 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: