RSS

Tag Archives: 209.86.89.69

“Dr. William Smart”

ADVANCE FEE FRAUD / INHERITANCE SCAM

AN ONLINE BANKING ACCOUNT HAS BEEN CREDITED IN YOUR FAVOR

Monday, June 10, 2013 10:27 AM
From: “Dr.William smart” <email987673@earthlink.net>
AN ONLINE BANKING ACCOUNT HAS BEEN CREDITED IN YOUR FAVOR

I am hereby writing to inform you that the government of Benin has today afternoon deposit your inheritance $3.5 Million united state dollars with this bank.
The government had a clear mandate to open an account in your name with the bank and set up an on-line transfer that you will use to transfer the funds into your personal account.
However, the government deposited your funds to the bank . The bank has finally opened an account in your name,Be advice that the bank has already created on-line transfer with the account that opened in your favor this afternoon. And the $3.5 Million of funds has been transferred to the account that my bank open in your favor. The on-line banking account details are follows.
Welcome! To – UBA Online Pl c Secure Account Page
Account Name
Account Type
Activate
Online Banking Account
Created Opened
Account Balance
2013-06-10 $3.5M
Account Number
UBA Bank Sort Code
0020578055 1022-03-8733
Country
Name Of bank
International Money Transfer   Input

Swift Code PNBPUS33
Account Number 0020578055
Please Enter:
Transfer CODE TRANS-ID: 
Bank Name : 
Amount : Routing Number: Swift Code: Transfer PIN: 
The bank did not  charge you any fee. You need to obtain a Access Transfer Code, For your information, you will be able to start accessing your online banking account as soon as you obtain this code.
You are to pay $98.00 dollars to obtain the Access Transfer Code. Here is information on how to send the fee through western union.
Receiver’s name….. Okagbuo Ikechukwu Henry
Country.. Benin Republic
City.. Cotonou
Text Question..When
Text Answer…Now
Amount $98.00.
MTCN….
Sender…
Provide us with the MTCN and sender’s name once payment is made. The bank will issue Access transfer code as soon as we confirm payment details.
Sincerely,
Dr.William smart
Email; (directionboabenin2011@yahoo.com.ph)
Head of operation manager

Return-Path: email987673@earthlink.net
X-YahooFilteredBulk: 209.86.89.69
X-Originating-IP: [209.86.89.69]
Authentication-Results: mta1220.mail.bf1.yahoo.com
Received: from 127.0.0.1 (EHLO elasmtp-mealy.atl.sa.earthlink.net) (209.86.89.69) by mta1220.mail.bf1.yahoo.com with SMTP; Mon, 10 Jun 2013 03:27:43 -0700
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk20050327; d=earthlink.net; b=XHNxKa2tByd9aF4s0w50X/hFuvpSOizEHZoTQClvCa3Rc1BnACKlEWUMp7r3d+Nx; h=Message-ID:Date:From:Reply-To:Subject:Mime-Version:Content-Transfer-Encoding:X-Mailer:Content-Type:X-ELNK-Trace:X-Originating-IP;
Received: from [209.86.224.42] (helo=elwamui-muscovy.atl.sa.earthlink.net) by elasmtp-mealy.atl.sa.earthlink.net with esmtpa (Exim 4.67) (envelope-from <email987673@earthlink.net>) id 1UlzK8-0004AA-Mi; Mon, 10 Jun 2013 06:27:40 -0400
Received: from 41.216.50.109 by webmail.earthlink.net with HTTP; Mon, 10 Jun 2013 06:27:40 -0400
Message-ID: <10161286.1370860060664.JavaMail.root@elwamui-muscovy.atl.sa.earthlink.net>
From: “Dr.William smart” <email987673@earthlink.net>
Reply-To: Dr. William smart directionboabenin2011@yahoo.com.ph
Subject: AN ONLINE BANKING ACCOUNT HAS BEEN CREDITED IN YOUR FAVOR
X-ELNK-Trace: bd435d5e95be81d9abf6b361fe7749ea9ef193a6bfc3dd4832fd64ba193a0627019d291253ecb46e3788860f0b40a802350badd9bab72f9c350badd9bab72f9c
X-Originating-IP: 209.86.224.42

Subject: AN ONLINE BANKING ACCOUNT HAS BEEN CREDITED IN YOUR FAVOR
From: Dr.William smart <work83632@earthlink.net>

AN ONLINE BANKING ACCOUNT HAS BEEN CREDITED IN YOUR FAVOR

I am hereby writing to inform you that the government of Benin has today afternoon deposit your inheritance $3.5 Million united state dollars with this bank.
The government had a clear mandate to open an account in your name with the bank and set up an on-line transfer that you will use to transfer the funds into your personal account.

However, the government deposited your funds to the bank . The bank has finally opened an account in your name,Be advice that the bank has already created on-line transfer with the account that opened in your favor this afternoon. And the $3.5 Million of funds has been transferred to the account that my bank open in your favor. The on-line banking account details are follows.
Welcome! To – UBA Online Pl c Secure Account Page
Account Name

Account Type
Activate

Online Banking Account
Created Opened

Account Balance
2013-05-31
$3.5M
Account Number

UBA Bank Sort Code
0020578055
1022-03-8733
Country

Name Of bank
International Money Transfer
Input

Swift Code PNBPUS33
Account Number 0020578055
Please Enter:
Transfer CODE TRANS-ID:
Bank Name :
Amount : Routing Number: Swift Code: Transfer PIN:

The bank did not charge you any fee. You need to obtain a Access Transfer Code, For your information, you will be able to start accessing your online banking account as soon as you obtain this code.

You are to pay $105.00 dollars to obtain the Access Transfer Code. Here is information on how to send the fee through western union.

Receiver’s name…Okagbuo Ikechukwu Henry
Country.. Benin Republic
City.. Cotonou
Text Question..When
Text Answer…Now
Amount $129.00.
MTCN….
Sender…

Provide us with the MTCN and sender’s name once payment is made. The bank will issue Access transfer code as soon as we confirm payment details.

Sincerely,
Dr.William smart
Email; (directionboabenin2011@yahoo.com.ph)
Head of operation manager

Return-Path: work83632@earthlink.net
X-YahooFilteredBulk: 209.86.89.62
X-Originating-IP: [209.86.89.62]
Authentication-Results: mta1005.mail.bf1.yahoo.com from=earthlink.net; domainkeys=pass (ok); from=earthlink.net; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO elasmtp-dupuy.atl.sa.earthlink.net) (209.86.89.62) by mta1005.mail.bf1.yahoo.com with SMTP; Fri, 31 May 2013 09:52:49 -0700
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk20050327; d=earthlink.net; b=bujFAe33bxjr/10Hqd1oWOjruMsHkXaLvNHA4BrUb0Qy1mDIJPgvVWyfDKuwAxMl; h=Message-ID:Date:From:Reply-To:Subject:Mime-Version:Content-Transfer-Encoding:X-Mailer:Content-Type:X-ELNK-Trace:X-Originating-IP;
Received: from [209.86.224.48] (helo=elwamui-rustique.atl.sa.earthlink.net) by elasmtp-dupuy.atl.sa.earthlink.net with esmtpa (Exim 4.67) (envelope-from <work83632@earthlink.net>) id 1UiSZH-0005B5-AK; Fri, 31 May 2013 12:52:43 -0400
Received: from 212.119.105.65 by webmail.earthlink.net with HTTP; Fri, 31 May 2013 12:52:42 -0400
Message-ID: <27887717.1370019163045.JavaMail.root@elwamui-rustique.atl.sa.earthlink.net>
From: “Dr.William smart” <work83632@earthlink.net>
Reply-To: “Dr.William smart” <directionboabenin2011@yahoo.com.ph>
Subject: AN ONLINE BANKING ACCOUNT HAS BEEN CREDITED IN YOUR FAVOR
X-ELNK-Trace: 4001d4db8c104b8766e19d6f8fecf7737e972de0d01da9407577317fd13df37f0e45986745329564350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c
X-Originating-IP: 209.86.224.48

directionboabenin2011@yahoo.com.ph
Dr. William Smart

 
Leave a comment

Posted by on 06/09/2013 in Inheritance Scam

 

Tags: , , , , , , , , , , ,

Suspicious Spoofed Craigslist Email

SUSPICIOUS FAKE CRAIGSLIST EMAIL – PHISHING ATTACK

01/27/13, UPDATE – I received another phishing email by a supposed Craigslist user using the name Eduard Frank – I’ll will post the e-mails in order, newest to oldest, along with the header details.

I don’t have any Craigslist ads currently listed. Infact I don’t even list Craigslist Ads on the account I use to bait scammers so I was immediately suspicious when I received this Craigslist email alert. Not only are the two ‘Craigslist’ links spoofed (the actual URL is not Craigslist) — but the IP address is blacklisted on many anti-scam websites.

SUBJECT: i would like to buy your item from craigslist RECEIVED: Thursday, January 24, 2013 4:22 PM
From: Eduard Frank qdbfwp@hotmail.com

EMAIL: Hi Am very interested in your item posted on craigslist : https://post.craigsIist.org/k/EEEYZLFl4hGbaqXZBYzI7A/vh279?s=tou This is the same spoofed link from the previous emails. The actual URL is goo.gl/aiNwi 

is it still available?

HEADER DETAILS:

Return-Path: <qdbfwp@hotmail.com>
X-YahooFilteredBulk: 209.86.89.63
Received-SPF: softfail (transitioning domain of hotmail.com does not designate 209.86.89.63 as permitted sender)
X-YMailISG: f21Sl8cWLDuLkBRdjpHUdX9xerAr20OQ.qHh.cYAhFw5lSy9 InkNTHdcI2EA5oGO9s9WRGoE8X5ydhJMddl7xNfU7SS5DV.ZmEuoogthq2Mr ZvEhsMyuVJDUF.SjyE4Tc89NIsqgqTDyubXh8JCI4vlsSXzjTBeONvNIq6Kg cqZ8zxS3GmdYZWjr7H42UDM4exf6rEjAzJpgC8FAMm4ynJLZBkBoyWFfO2Ll qv.ng07yAnqBA3sFkFS_Y.CSVvZm88fwcMZlZyRi_4wzLBnT5yvTPIAuvqT5 tNs4bOiPVUJfXgqNLp7wrrOUqTjAkUqRUs66quJ6_O2JXVAoU.ZY6JoiL5EO kI0w0mTfK_Ywb.QBcTEUSmUWvqn_CQsUlSLAvyn.qxAh8Y2runI8uiQygKGz PJYlnCyv78fhIxh.nBTk_9CqekcGWowgPXwkvZapxZ5_jda.VjWRmrJQpk5Q 70.QaXHLbKcyWqGU_DdG7adHyc9kvV4EiGdecXmmVXU1qM_MUGmbhRHPkInj yzHCteTsIZesiuI0wKIPizjJTdqCC.NN.UiWyXZlMTJfPXtQTa4RlRBDDPyz Xy0ki7OZklAZBGKSTFhDY5BgR.NKTJ6XWiPXz9gttbYrBMBrNkY2HLd0zEHX 8NAX0o7PjQfXOIJ1a1EB.3ZhcDS7kWlm9ChTpiVdDLLcNq8IYZoGIXdR8X4R jHFX6pCqOPafF_ukxFRia_W66cmiyjhUISaBWM5GDA1bam3h8Q5iDQhonN0H mt38Vl9DJdp.0CCcpXnGj8EMezEmFErlX7riKAHti3bHf6B2psPM9F3Q66YD Yvev1gX2V8AXHutGkN5kqIbapmCsFrEcNlsQ6PWOa_MaF50swL7c3qegbBmB aX2qBolGvmVByMl7LRqFYxvUirxOQxoRYQgh3RsDrOckcbf6xCeNIX_BnCMK MHTpGaA4sYqPPKdCTky02qrqvsrC4jgmgJygFS.ok93p6xLaA7J18EWkLP0B 7HXxWRY4Gv70DVDXfCmC_W6S.wfF0Q96oxHXhE8eGCz32L.sDLEJ.lfp8PTT ta6RcLyAAW5spPFLk4cFqavI1kDCiU8FxlcCL0wbAWcL9MbA97xKPwuwfzTA onZcJp5qb2AhvBc2FN_LWuRAL6bE.1cit4BS_T1xjj6ZrGV9cm5KKu2Bb7tz rOMyUXhj_Jti6n0rBzP3FBJkgzc2j.vTFMrgV.gbGVH9vZRYfUui8ndHyPXU QaZMaLBHHys-
X-Originating-IP: [209.86.89.63]
Authentication-Results: mta1160.mail.gq1.yahoo.com from=hotmail.com; domainkeys=neutral (no sig); from=hotmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO elasmtp-junco.atl.sa.earthlink.net) (209.86.89.63) by mta1160.mail.gq1.yahoo.com with SMTP; Thu, 24 Jan 2013 08:23:36 -0800
Received: from [71.237.118.147] (helo=User) by elasmtp-junco.atl.sa.earthlink.net with esmtpa (Exim 4.67) (envelope-from <qdbfwp@hotmail.com>) id 1TyPZx-0002jO-Fi; Thu, 24 Jan 2013 11:23:05 -0500
Reply-To: qdbfwp@hotmail.com
From: Eduard Frank<qdbfwp@hotmail.com>
Subject: i would like to buy your item from craigslist
Content-Type: text/html; charset=”Windows-1251″
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <E1TyPZx-0002jO-Fi@elasmtp-junco.atl.sa.earthlink.net>
X-ELNK-Trace: 8219d692fd5468d6d780f4a490ca6956d5d4673fe7faad86623ec139337907e38e9f230fcf1cb831350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c
X-Originating-IP: 71.237.118.147

Your posting has been flagged for removal.
Approximately 98% of postings removed are in violation of craigslist posting guidelines.
Please make sure you are abiding by all posted site rules, including our terms of use:
http://www.craigslist.org/about/terms.of.use.html This was a spoofed link with the actual URL being goo.gl/aiNwi
If you need help figuring out why your posting was flagged, try asking in our flag help forum. Include posting title, body, category, city, how often posted, any images, HTML markup, etc.
If you feel your posting was wrongly flagged down (2% of flagged ads are) please accept our apologies and feel free to repost using the link below:
http://www.craigslist.org/about/ctd/repost.html This was a spoofed link with the actual URL being goo.gI/aiNwi
Sorry for the hassle, and thanks for your understanding.
——————————————————————————

Date: 1327114516
PostID: 24177504

HEADER DETAILS:

Return-Path: <dycsbl@craiglist-accounts.com>
X-YahooFilteredBulk: 209.86.89.69
Received-SPF: temperror (encountered temporary error during SPF processing of domain of craiglist-accounts.com)
X-YMailISG: 2h.FN3sWLDsEDE8qqS_yEcqB6M1HR9h.u85ZaLiGYL.IEQuU iab6_WhytOr0v8KZup3soVlAl7qxu2RiK1epX7ek6GeXBAj6poh2cJDD.zQg jPJjyPfclZKW_NnPFDTrSWD79AqrNkBBoJ5hW__LZXlZUz.ZLpSi3ZGXK4Ge VIQygP.nLCk6NbRgJn9twOcwwHoP9j9q6on5YSGUI.nb1gYsctI_PDBGrRnF KvveQMYnrrNG4DgZdrwZSRT2Ox8yP7gB51A8WWDw8krq9Pr5un4ainmeAweF XEuXHV0gt8Ow1O0rAIxiwCKOtJWaYKiesaCJl7_h6QSFdL1PpDwAqVZXazI0 QmP3DUNfRbb71rVQF.0VNpiFdohCTjJUO6uB0YxxGT6CZ10wN1eCKhe4eSPv e8vXdS37Jh0ofSMl9amPk1N5KfTnveNm2V6cqR1pA1vlUkaA_5CyVppBKBMz jtvxdFt.RDiMZzuE77R3OHnsdEvmu4PaX64_PEj.vf._aKc738JxzsFaHmf8 TQAsQMpo.WAEdh0b_5rITS4ima44rP.6UIKfFqAc31KrxVEBY9oGXCHB9nz9 V3nDA50qbSHIIagS9ZVZTstHWy4dum2Gaz9KgGNMoR6UIhnw4H6tagKAyPPY EnTD1ypXM8jQocv6l0dsJk3azMLION2iNB9P4Ow6gtjMwkVygfgFrchDUwRs fSxZ4_itBU3TG9KdPtUCdH5wUwuxAGiVBCjLVsLlg2d694opIOVX2J40BGRH IYhXAAfbxnnbpYnzY9.FWxSe.uRNv0UKJ5R91syZw_5x.ifYmztP8ZxSubqC 4PEvO1.qavB3u4KwY4riKy.H5mmZBAKLDx1EY4pYVofWYjywCEiVOuq0.KjM VszzfJPQT3i9fvKhxDE9THio9A1vagNxw1rThbN1v0cPF7CgwE1yGIXPKv3Y DjIOVLoI7C3ubQK1AioG3t6RCfO32iPiiefv0oWc4x6LYaDv0RMeO32XiVsm qoptc3moDkfy29NJAQZXHA9oO.GwX4fjNRIliMgY8OaK6zb2XRbBdDBfdD6f IVgVhUSeYJKmYxxWOmWP.DX1Jq2aZNU3LQ5MyOV0U054Ws9MRNZKjR3BJcCi 3tgqq1kcbrPHOhkWI0hjJNFaLZY8z3qLl41wPKkkq8H0FN0.6q._GbmNGB4z twsjMemUDLkyY32h.MUaQiL.3UvRYkY7mXIsQlCwKe4BeYyY0y03rcJMb3iF FIR2s29QvuOjBD7kRTSILNW1qwInYb3kFH_ODhQTUTLlYiic9f.M_uYkGXA0 X6nSS2lFS1d2hK.XlYnYjn49yt7oY0SVNiPQ6Z9FqiXwp4cT0cKnB6NX2NE8 DZGrkmlBsrgZmJA8n_9hHwi.7CKGEmLJnqP5MgQkCuKNEz_z0l7yYw22MkJH qqeHgmb75noxVzMTDd1KtfwgGTmnVGcBzo0vvAlk588aZfVAyXwXZMCX
X-Originating-IP: [209.86.89.69]
Authentication-Results: mta1220.mail.sk1.yahoo.com from=craiglist-accounts.com; domainkeys=neutral (no sig); from=craiglist-accounts.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO elasmtp-mealy.atl.sa.earthlink.net) (209.86.89.69) by mta1220.mail.sk1.yahoo.com with SMTP; Wed, 23 Jan 2013 12:58:50 -0800
Received: from [72.172.204.128] (helo=User) by elasmtp-mealy.atl.sa.earthlink.net with esmtpa (Exim 4.67) (envelope-from <dycsbl@craiglist-accounts.com>) id 1Ty7Nq-0004nx-4X; Wed, 23 Jan 2013 15:57:22 -0500
Reply-To: dycsbl@craiglist-accounts.com
From: Craigslist <dycsbl@craiglist-accounts.com>
Subject: flagged & removed 24177504
Message-ID: <E1Ty7Nq-0004nx-4X@elasmtp-mealy.atl.sa.earthlink.net>
0da15bcd0e72a23c13bbd08df6cfe9269ef193a6bfc3dd48c25deae7748207c3a2f7e1f2b096e1d07ef9f80aaf77e5a4350badd9bab72f9c350badd9bab72f9c
X-Originating-IP: 72.172.204.128

dycsbl@craiglist-accounts.com 72.172.204.128 <> 209.86.89.69

 

Tags: , , , , , , , , , , , , , , , ,

 
%d bloggers like this: