RSS

“REV BEN PETER”

24 Dec

LOTTERY SCAM – NIGERIAN SCAMMER – ADVANCE FEE FRAUD

NOTE: THIS SCAMMER HAS BEEN EMAILING ME FOR MANY MONTHS UNDER MULTIPLE NAMES, EMAIL-ADDRESSES AND IP ADDRESSES — THIS IS A NIGERIAN SCAM ALSO KNOWN AS A 419 SCAM

BELOW IS THE MOST RECENT EMAIL SENT BY THE FRAUDSTER. THIS SCAMMER IS VERY PERSISTENT BUT UNORGANIZED. HE IS ALWAYS CHANGING THE AMOUNT OF MONEY I’VE SUPPOSELY ‘WON’ AND THE FEE THAT I AM SUPPOSE TO PAY.

freemoney

EMAIL: Reconfirm your Address,mobile for delivery of your ATM card $ 7 M

HEADER:

Return-Path: <webxx7601xxxxx@att.net>
X-YahooFilteredBulk: 98.138.90.65
Received-SPF: none (domain of att.net does not designate permitted sender hosts)
X-YMailISG: To35UWMWLDtpI31Kn.0SLqgNnW08Av0SCFAssCMR8A_Vo1GP GrWi2SRwEUK0_rS5ma.EeNhpXLBHGeRggiFG274YMQUgELYQceZCuxW3lQPN rUoT6knijOkKBdqZkH6wbwxbiX_cGEA41SNaj1GVee9_wEMb3td4XzfxKB2W QHrpIw5Zbu_LEuE.UohMdPBo5n_Z45sHFwPWKeKvax4FtRd9YMFoUrM1giBG C7CLdLh9vlCZzCePSppkA0cvOXt_.mjRjvpOP8QMqDhPOSUFydEEMwgIJns6 2p8QA6wY01j05hbhCrsTYjP7PMBklSFGar9DIbx_rQrES7XDMCtPwl3rskW9 mA0o9k.0wE8917_bR66zH6.r4hgk2Pq8J16QU1Lb0v752n9EcJJSbMbbFQCB wY0piVWQGMKir3JfkdVqWpd_w.T_TfFpxV4cemt1CKnbhoD0FsU7NfExkiJc A5joObOkIGO7Jd8HRyCdsMC_W94SyWlu8v8d0TzsLFjtxDlq1n1fiHfB1XRH vxTmJ6lgV_.c.iXkiuD9N3_pT1_aPP7W9IwCbbDIwtrF34MNw68hMJvJOUe2 pH.jPfBNQHLQFxWhxb6lyVSyv28tHpugjC308j7ixZ00K9T_7yuZ0IHQF6K_ Qd3WjZM3CHJaBIWb1rlNDSqMRfzuahAUzICBFaX8u4wMRTaHcpwTOp7nRUrm sazz9ZeJ7QdN8pKfGePiOZZHXxb1KoyvjL30TC9knrdnerK_gJQgdXaFI8Q5 3er.rbh.9662mA1tWwkL.uw.Ej8jeMmTC81X292stHfa_QQVzMpPvYAw5A9x eqmWm6ToSeMfSIvtRovTlmbB8SkoM4oN0TU4hSZuZ71YzhIaZGFXCNYoOJne 7vGYNkak_HoeCUFsGusF92TWky2Vc9PLHMAgihSZ5i2dv22EV6xQduzDwaC6 hR0YvxZO91Y5nEmgU4JgwTACDxEFzztQjg9nca9TEBemHGKAs_inoBvYmRgj 9NAenemYR2BttVDhS7s50y8s2lyYQLrcXQk7ozgN_n9MjmXaMO0PpbZ7Vpge 7kwg93PpaJb42PYuo_xuEisFLWcWM2dUBSchWFlLPJiuJh8X1JF31AOvxAaS y5zqbbq0gA5D6y8P6y7bvMT6GA.RJbBsQnHsqzQ9p62epYsuSBn.GO8e0Obr iTJkg19mglk6slzhX2ciB7jr2mRWI6xcf4zG3rU9Rruj0ndRzYpo_d30lRuc ri8BKqd2I3s9zVfL6sSwKtJADSftjvwW6RTUXPvc2TBzPoA_QfWHZLqs.vAD fbdtVFTINFo2tQp5xrw8ZD.fSJPwkEmhSP.jOfvKar5IpIk2JWk37aJ3w_S7 tgimEtxHc8pR
X-Originating-IP: [98.138.90.65]
Authentication-Results: mta1052.mail.ne1.yahoo.com from=att.net; domainkeys=pass (ok); from=att.net; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm2.bullet.mail.ne1.yahoo.com) (98.138.90.65) by mta1052.mail.ne1.yahoo.com with SMTP; Fri, 21 Dec 2012 23:21:59 +0000
Received: from [98.138.90.57] by nm2.bullet.mail.ne1.yahoo.com with NNFMP; 21 Dec 2012 23:21:59 -0000
Received: from [66.94.237.125] by tm10.bullet.mail.ne1.yahoo.com with NNFMP; 21 Dec 2012 23:21:59 -0000
Received: from [127.0.0.1] by omp1030.access.mail.mud.yahoo.com with NNFMP; 21 Dec 2012 23:21:59 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 33716.96789.bm@omp1030.access.mail.mud.yahoo.com
Received: (qmail 92006 invoked by uid 60001); 21 Dec 2012 23:21:58 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1356132118; bh=dspJXUMJQPVGARdDGpSJwFgAoFNKsOdNQ9FVUYxLdWs=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=Woh2WLpCF/uHtRoXtPW872YkOBFAAbqyMP8UUqzUgpelHH7rNoiWqa7ag0CmwrvT9rDXbc9/MwzRF4reRQJSiuyghbS6I2JNqrMwOvylD/dqh4XGMyzU7PbK4Pbexc0L8FA9JQhAW/6ELOL4sFG8D94kdkpAOh6L371vv4tS3iw=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=att.net; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=Wxssckm+WPOWZNoeqVo3J5A9eRTjFPzbZwjkMMleA6TNm0Z3g6oL7alYEXqc56/BtA40DPg9RuPmICUTXeH2deUrULLcyKl+UwLAW5iFZVcgFK96kZvnPQlno8bd2sihdj9TtprkLOV0FMx26eQMMkzUuHBXS3DHp6EcQHcqnms=;
X-YMail-OSG: FhAlJ8UVM1mfQErccxHLz3tuxCp1r4vGnWLUR8YRpQosJn0 41jiU0HfOZDG0kQmHMqh9ICSmXaeUKNHjf_woqZQa86_WB0hFCoBJ9tSIbnP Mwm_Tzot5n5.j.qSIOy00TIP8lP5luggtVz7caaD2_xg6Zh7HkAGgtTfgwB1 1WAhS2sqIs_p3RNlxJA6hbYu8KkdyLOzktPW1JRmwWHrxLfUm4eFUj6oPEXn 8oNzfmB9NOMY7zKPEBmCaQ1yjo7wnJFJHBS8kVzq16fTa98dCGZNheuL.CqO 5_c9tEoKAzDURA7_1BRR87wZUiUY14icB5MobkNiVuzKczqB1i.pYPVpGisr AExzvcXZ9pNJ9zI.QcYSMlgLTOo5CuQhY4uel.ztH5.tWJpHnx_jHfZd2IC4 aKjnnLxo9jTRnXuKc2sIDTrimc6Q_2BpalwQFLRKgXuEJiXQ.6fp1jpbAe3o 0zkK_380VGyPITTcie_SrkWj75HrFmt1WgNvCjcGXVNEKpmpolObG
Received: from [173.13.200.181] by web181205.mail.ne1.yahoo.com via HTTP; Fri, 21 Dec 2012 15:21:58 PST
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.129.483
Message-ID: <1356132118.91240.YahooMailClassic@web181205.mail.ne1.yahoo.com>
Date: Fri, 21 Dec 2012 15:21:58 -0800 (PST)
From: REV BEN PETER <webxx7601xxxxx@att.net>
Reply-To: asabamaka@yahoo.com.ph
Subject: Reconfirm your Address,mobile for delivery of your ATM card $ 7 M

FROM: REV BEN PETER webxx7601xxxxx@att.net REPLY-ADDRESS: asabamaka@yahoo.com.ph

173.13.200.181 <> 98.138.90.65

___________________________________

BELOW IS ADDITIONAL EMAIL ADDRESSES AND IP ADDRESSES SENT TO ME BY THE SAME SCAMMER(S)

2) LOTTERY SCAM – ”ATM payment” <webxl19917xx@att.net> REPLY-ADDRESS: atmpaymentcenttt@e-mail.ua

SUBJECT: your(atm) card worth of $5.5M is ready, send your Address and cell Phone

SOME IP’S USED BY THIS NIGERIAN SCAMMER: 98.139.44.156 <> 75.125.40.18 by web181105.mail.ne1.yahoo.com <> unitednationprogram101@gmail.com <> unitednations77@yahoo.cn <> apex.expressbj@hotmail.fr <> +22998660756 <> 85.95.227.44 <>

THIS SAMMER ALSO PRETEND’S TO BE United Nations Organisation AND WESTERN UNION OFFICE — I’VE POSTED ALL THE EMAIL’S AND HEADERS I’VE RECEIVED BY THIS SCAMMER BUT THERE ARE WAY TO MANY AND IT’S IMPOSSIBLE TO KEEP UP WITH. BUT THEY’RE ALL ON SCAMMER419.WORDPRESS.COM — AND I’M SURE THERE ARE MANY MORE EMAIL-ADDRESSES AND IPS, ETC BEING USED BY THESE CROOKS SO IF YOU RECEIVED ANY SPAM EMAILS BY ‘BEN PETER’,  PLEASE POST THE INFORMATION IN THE COMMENT SECTION. THANK YOU.
 
Leave a comment

Posted by on 12/24/2012 in Lottery Scam

 

Tags: , , , , , , , , , , , , , , , , , , , ,

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: