419 SCAM / ONLINE DATING SCAM
NOTE: This scammer has sent a previous email which can be found here.
WAITING TO HEAR FROM YOU SOON.
From: Nulty-Rita email@example.com
How are you today, hope nice? i know you be wondering while i keep silent, well am doing great health wise only
been so busy with a lot of duty as the assignment is still in progress,
I just want to know if you have received the parcel from Mr Sylvester, please do let me know if the parcel has come to your care.
Received-SPF: pass (domain of live.com designates 188.8.131.52 as permitted sender)
Received: from 127.0.0.1 (EHLO dub0-omc2-s17.dub0.hotmail.com) (184.108.40.206)
by mta1455.mail.gq1.yahoo.com with SMTP; Thu, 20 Jun 2013 05:09:19 +0000
Received: from DUB114-W131 ([220.127.116.11]) by dub0-omc2-s17.dub0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
From: Nulty Rita <firstname.lastname@example.org>
Subject: WAITING TO HEAR FROM YOU SOON.
MY ORGANIZATION25TH YEARS IN EXISTENCE.
Hello my dear,
How are you doing health wise,Hope good, i was so excited after the anniversary party, indeed i was filed with joy, on my mind, I wanted it to be a surprise for you, the organization where I am working just cerebrated the 25YEAR IN EXISTENCE,the party holed just two days ago, and been the organization departmental personal manager, i received some gift from the organization and friends, oh I wish you were here with me. But you know what, I didn’t forget you during this great celebrations.
Splendid my dear, I got some prize award and gifts from my organization, friends and relatives, your thought just came in my mind again and I decided to let you have some of the pleasant gifts and also to register in your heart that I valued our friendship so real and to wish you an awesome day as we are building more interest and oneness on our relationship.
I sent the gifts through our organization Gulf Chief Accountant, MR. BONFREY ERNEST, who went back to gulf regional continent since yesterday morning and I gave him the gifts package to deliver it to you when he arrives there since I was not really sure of your home postal address and I couldn’t wait for you to do that since he is in a hurry to catch his flight.
Right now am in Isreal for an official assignment, with some of our organization officials, which will take us a little time before completing the assignment.
I belief where MR.BONFREY ERNEST, is residing might be closer to you. Just contact him via email: email@example.com ; and as well discuss with him on phone +228 90 56 57 81. Concerning on how you can receive my precious gift package for you.
Please do accept that token of gift for our friendship, I knew it isn’t much for the new year wishes but I sent it from my innermost heart and belief you will appreciate and apprehend it and everything inside the package cox it is coming from a special friend.
The content of the package are; a hp laptop 2012 edition, 2 I-phones, AN ENVELOPE, 1 Video Camera (Sony Camcorder) and some jewelries. I packed everything in a medium sealed carton and the Chief Accountant accepted to deliver it to you coz he didn’t return home with much luggage of his own. Please, Open the packet of the Laptop to bring out the envelope inside, it contains some of my recent photos and a surprise gift which I don’t want to disclose to you till you find it. Update me when you receive it,
So I will be aware, do comment on my photos, left with blue suit is my superior i at the other end and the middle is Mr Ernest incase when you meet with him you will not be confused. and the lest is members and my single view.
I’m wishing you a great and wonderful awesome season for the months of March, and as well saying happy new year 2013..
Yours truly friend,
“Nulty Rita” <firstname.lastname@example.org>
Received-SPF: pass (domain of live.com designates 18.104.22.168 as permitted sender)
Authentication-Results: mta1118.mail.gq1.yahoo.com from=live.com; domainkeys=neutral (no sig); from=gmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO dub0-omc2-s35.dub0.hotmail.com) (22.214.171.124) by mta1118.mail.gq1.yahoo.com with SMTP; Sat, 02 Mar 2013 07:59:15 -0800
Received: from DUB114-W98 ([126.96.36.199]) by dub0-omc2-s35.dub0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Sat, 2 Mar 2013 07:59:12 -0800
From: Nulty Rita <email@example.com>
Subject: MY ORGANIZATION25TH YEARS IN EXISTENCE.
It is nice and joyful to found your email address on the Internet search during my quest for friendship to keep busy the lonely and lovely world. Hope you fill the vacuum? I thought is beautiful to make you a friend in this regard. My name is Nulty Rita a Canadian nationality, female. My friends tell me that I am a quiet person with a good sense of humor.
I am always fair, straightforward, honest and easy going lady and I seek trust worthy friendship. I believe in giving and taking on both sides and I value faithfulness. I like people for what they are and not for what they are not. I want to be your friend, and let share whatever we have in friendship.
I will be detailed in my consequential mails and expecting same from you if both considered:
AGE: 29 languages spoken: Fluent English & little Spanish.
It will be nice to know you in this regard.
“nulty rita” <firstname.lastname@example.org>
Authentication-Results: mta1248.mail.bf1.yahoo.com from=gmail.com; domainkeys=fail (bad syntax); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm3-vm8.bullet.mail.gq1.yahoo.com) (188.8.131.52) by mta1248.mail.bf1.yahoo.com with SMTP; Mon, 11 Feb 2013 05:54:36 -0800
Received: from [184.108.40.206] by nm3.bullet.mail.gq1.yahoo.com with NNFMP; 11 Feb 2013 13:51:16 -0000
Received: from [220.127.116.11] by tm12.bullet.mail.gq1.yahoo.com with NNFMP; 11 Feb 2013 13:51:16 -0000
Received: (qmail 39232 invoked by uid 60001); 11 Feb 2013 13:51:15 -0000
Received: from [18.104.22.168] by web163403.mail.gq1.yahoo.com via HTTP; Mon, 11 Feb 2013 05:51:15 PST
From: nulty rita email@example.com
RECEIVED_IP: 22.214.171.124 IP_USED: 126.96.36.199 – Also going by the name Michael Williams
SUBJECT LINE: MY GOOD FRIEND
Message contains attachments3 Files (31KB) | Download All
Dear Friend .
Thanks for your mail, for our friendship continuations. I have been so busy these days due to some official Assignments, Which I can’t afford to overlook. I have been so tight-up with much job on my table in our on-going Worker’s Employment/recruitment program-taking place in Canada, USA, UK, Australia-Europe and Africa. I guess you will be interested?
I’m Nulty Rita by name, Canadian by nationality, but working and living in United state of America, 29 years of age, female single. I have no child yet but really love to have in the near future. I’m the only daughter of my parents. My parent got Three kids, two Male and i female. My elder brothers were married.
I ‘m a staff in an employment, immigration and recruiting organization here in U.S. Washington, DC. I love Songs, to be precise singing is my best gift, and I have a keyboard and love playing it. My hobbies are watching music; driving when/where there is no traffic hold and swimming sometimes.
I live in a moderate quiet area and have adapted to it. Reside at 395-North to Rte 1-North. Cross the 14th Street Bridge, stay in the left lane the exit Right 1-North. Pass Thomas Circle and continue on 14th Street. Turn left on Rhode Island Avenue, go one block to 1666 K Street, NW Washington, DC 20006
I need you to completely understand who I am and what I can give. It may not compare to other persons or past friendship but that doesn’t matter, we can make the best of friend. We can be friend regardless of colors, race, age and sometime sex maybe considered.
Find also, copies of my picture attached to this letter. Send me mails at your best convenient and your pictures if available at the moment.
Received-SPF: pass (domain of live.com designates 188.8.131.52 as permitted sender)
X-YMailISG: wOOOviMWLDtfnaUqhOT0TKjcn0VJNQgPdUYaZIInvGs5LdpM .ufhrZqSKewFi9qFKFkNsM8laT8vEJqiLhNJdedLFAxiJuHnOiSYoub.xJtg vi2Ks.yqDpiYu8SBSRAWg8KjkdleFMEBNDWZAqs94zMeHTZwfZ5eMe2SrtAP 8jtdsF6CLdyq7a3d4vKqiEh2xKiavjF1ixPK3fSBoJMBjNhrXQ_lFj3oYC6Q VGfs3mGst0xvjs..a1E1WVkzKB8PqHFMHTmx6bOSmR._MIwduQ2rLVpMJkXT jch22fX2UnJbRnXPwGP3.JtEqrbSTVGCvJk6g5RE6vKhAPZImTLNOx0wV_ae .wgQZHKg0yMfSkMa_SgJzm9ZYF1wdbuwYgOXKRVmqYS37PAOxXmeGc02L_Rf 4J1CFQtcon6hDAR2vCrt5izpUOxi2z4lrSKeYGJvE3c91MWyG5YvU.7y2rlB NvAmozoOb8lF_0RuS1FcQ.pbdH1F821IANneA9.bHmDwQ12tAWnrT40E7ksu wCKfRVllBvz_WWtaHObDODgn34Yr8WyF.GGGLJFfXOth2b3idEr5fBkxevsn mJj8d3vfs6Y8VKyj6R56iAhi0yESkCk9o_JdiLXVkJgYyvCbl5cGKYpYVJtD QIm3592llFKkKkEFADtEyPZDrTRl.KAx4l8Mc3or3BtW6SW86tQsgmVivi6J gksG_OUIa0ILQg7x4_WdXXbxQ5.IhNkQH2Omnk2Lh1Kbda5r6xwSVYyKPucn fFOI6dm8_P04VWpA1z2s6omcFu86.TRrfE5OfcxRoHJC7cmUkqnJf99D.fJQ QHRSTZL3KHksumqYJGFYdMrN6WWKoC8K4u3vZPueW4rrcfG0wWEHPVDoYEnx J4jViPuMxGeig.hPP_ANTaPB2BxV15tSoI98jxl1xkNDYmg12JlYIhd9VgWc dLrlVzjrxVRJtAXeNFN3uHpLd0qV45Zznd0VRhD4xdqEBDoWVqrSlTeu6Lbj EuScecsjA_u4_ncbp5.PgTHDyfKHde3VFf2DQGP2SZNYZEqkEkDDK9IT9E56 BtrrcPj63JrWho9VQrFVf6_utKkOi6a6Xi_Izw6H18kpnONMMCvg5diY8RLZ DrcIYOlX6CUplLVmlgZqZs1sXSAgVneN0jemr1eHmD7ZM.L9pZ2PO5gQtbVd X4d4ya_wRHUeBvuIhmFdLoBbX9ZzpxeIifqw5Pcwq85zXYLdVd9QVRnxODm8 W5n8nVBUNgSfKYWUf7E0XNVLry5Uy92JqBwGSb1xa4ExHyY0Ot2VEjwFj.UI YFWUUJoQP3UdfKgK2bM-
Authentication-Results: mta1241.mail.mud.yahoo.com from=live.com; domainkeys=neutral (no sig); from=gmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO bay0-omc2-s10.bay0.hotmail.com) (184.108.40.206) by mta1241.mail.mud.yahoo.com with SMTP; Mon, 04 Feb 2013 00:59:06 -0800
Received: from BAY146-W42 ([220.127.116.11]) by bay0-omc2-s10.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Mon, 4 Feb 2013 00:59:06 -0800
Content-Type: multipart/mixed; boundary=”_bcbaed7d-04e8-4fa2-a89b-36a03cb0dec1_”
From: Nulty Rita <firstname.lastname@example.org>
Subject: MY GOOD FRIEND
RECEIVED_IP: 18.104.22.168 IP_USED: 22.214.171.124
Below is the emails and IP addresses that NuIty Rita used in her first email. This is another great sign when trying to detect scammers. They always use different IP addresses and frequently change their email addresses and use a different reply/return address. Alot of their emails are similar and may be idenical but different email servers. Example: JohnDoe@yahoo and JohnDoe@gmail — Also, notice the return address email@example.com ? This scammer most likely using the fake name Michael Williams in other scams.
nulty rita firstname.lastname@example.org RETURN_ADDRESS: email@example.com RECEIVED_IP: 126.96.36.199 IP_USED: 188.8.131.52