RSS

Tag Archives: 41.79.217.121

“Sarah MCGUIR”

WARNING – CHARITY SCAM / NIGERIAN SCAMMER

I’ve posted all the emails from Sarah Mcguir below starting from the oldest to newest received.

avoid-scams
Subject Line: I CONTACT YOU FOR A DONATION PROJECT

Hello,
I have an investment project which consists of a hand to help poor children, orphans and people in difficult situations and secondly to build factories. I want you to help me achieve these important projects in your country. I will put at your disposal all the necessary financial means for its realization. If you agree, please contact me on my private address: sarahmcguir@ymail.com. Thank you and God bless you.

Return-Path: <farmacianigro@alice.it>
X-YahooFilteredBulk: 82.57.200.117
X-Originating-IP: [82.57.200.117]
Authentication-Results: mta1310.mail.gq1.yahoo.com from=alice.it
Received: from 127.0.0.1 (EHLO smtp301.alice.it) (82.57.200.117) by mta1310.mail.gq1.yahoo.com with SMTP;
Received: from feu1-alice (82.57.204.56) by smtp301.alice.it (8.6.058.01) id 50AA536405A116F5
Received: from (189.17.38.226) by alicemail.rossoalice.alice.it; Tue, 19 Feb 2013 12:10:58 +0100
Message-ID: <13cf2263ee0.farmacianigro@alice.it>
From: Sarah MCGUIR <farmacianigro@alice.it>
Reply-To: sarahmcguir@yahoo.fr
Subject: I CONTACT YOU FOR A DONATION PROJECT
X-Originating-IP: 82.57.200.117
Sarah MCGUIR farmacianigro@alice.it sarahmcguir@ymail.com

Subject Line: Re: I CONTACT YOU FOR A DONATION PROJECT

Message contains attachments1 File (931KB)
Madame-SARAH.JPG
My beloved in The Lord,
Thank very much for your early response and may almighty God bless you.

Pls in attach file, you will see my picture , for God sack I require you to handle this transfer very quick and I am going to send you a contact of the barrister that will assist you for the documents that will back up you so that this funds shall be quickly transfer to your bank account on Time because i advice you to started this project at the beginning of next month.

Again, I please you to handle the project very well with the money (€2.500.000) for the building orphans home and also help peoples in a difficult moment or build a social centre for destitute persons, make poor families happy. Kindly send to me the info demanded bellow to enable my Barrister arrange for the certificate of DONATION in your name:

As follows:………..:(1) Your Full Name:……………..(2) Your Full Address:…………..(3) Your Phone Number:…………..(4) Your Occupation:…………….(5) Your Age:……………………………

(6) Your Nationality:……………………

I wait for your response soon.

Mrs. Sarah McGUIR
Mobile: 0044 70 45 71 85 56

Sarah Mcguir sarahmcguir@yahoo.fr
Return-Path: <sarahmcguir@yahoo.fr>
X-YahooFilteredBulk: 212.82.108.247
X-Originating-IP: [212.82.108.247]
Authentication-Results: mta1089.mail.bf1.yahoo.com from=yahoo.fr
Received: from 127.0.0.1 (EHLO omp1012.mail.ird.yahoo.com) (212.82.108.247) by mta1089.mail.bf1.yahoo.com with SMTP; Mon, 11 Mar 2013 12:53:21 -0700
Received: (qmail 60527 invoked by uid 1000); 11 Mar 2013 19:53:17 -0000
Received: (qmail 64067 invoked by uid 60001); 11 Mar 2013 19:53:17 -0000
Received: from [41.79.217.113] by web171704.mail.ir2.yahoo.com via HTTP; Mon, 11 Mar 2013 19:53:16 GMT
X-Mailer: YahooMailClassic/15.1.4 YahooMailWebService/0.8.135.514
Message-ID: <1363031596.61516.YahooMailClassic@web171704.mail.ir2.yahoo.com>
From: Sarah Mcguir <sarahmcguir@yahoo.fr>
Subject: Re: I CONTACT YOU FOR A DONATION PROJECT
00 447045718556

Subject Line: Re :

My beloved in The Lord,
Thank very much for your early response and may almighty God bless you.

Pls in attach file, you will see my picture , for God sack I require you to handle this transfer very quick and I am going to send you a contact of the barrister that will assist you for the documents that will back up you so that this funds shall be quickly transfer to your bank account on Time because i advice you to started this project at the beginning of next month.

Again, I please you to handle the project very well with the money (€2.500.000) for the building orphans home and also help peoples in a difficult moment or build a social centre for destitute persons, make poor families happy. Kindly send to me the info demanded bellow to enable my Barrister arrange for the certificate of DONATION in your name:

As follows:………..:(1) Your Full Name:……………..(2) Your Full Address:…………..(3) Your Phone Number:…………..(4) Your Occupation:…………….(5) Your Age:……………………………

(6) Your Nationality:……………………

I wait for your response soon.

Mrs. Sarah McGUIR
Mobile: 0044 70 45 71 85 56

Return-Path: <sarahmcguir@ymail.com>
X-Originating-IP: [77.238.189.63]
Authentication-Results: mta1415.mail.mud.yahoo.com from=ymail.com; domainkeys=pass (ok); from=ymail.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm6.bullet.mail.ird.yahoo.com) (77.238.189.63) by mta1415.mail.mud.yahoo.com with SMTP; Mon, 11 Mar 2013 12:44:03 -0700
Received: from [77.238.189.230] by nm6.bullet.mail.ird.yahoo.com with NNFMP; 11 Mar 2013 19:43:59 -0000
Received: from [212.82.98.103] by tm11.bullet.mail.ird.yahoo.com with NNFMP; 11 Mar 2013 19:43:59 -0000
Received: from [127.0.0.1] by omp1040.mail.ir2.yahoo.com with NNFMP; 11 Mar 2013 19:43:59 -0000
X-Yahoo-Newman-Id: 629180.51372.bm@omp1040.mail.ir2.yahoo.com
Received: (qmail 20237 invoked by uid 60001); 11 Mar 2013 19:43:59 -0000
Received: from [41.79.217.113] by web172201.mail.ir2.yahoo.com via HTTP; Mon, 11 Mar 2013 19:43:59 GMT
X-Mailer: YahooMailClassic/15.1.4 YahooMailWebService/0.8.135.514
Message-ID: <1363031039.17695.YahooMailClassic@web172201.mail.ir2.yahoo.com>
From: Sarah MCGUIR <sarahmcguir@ymail.com>
Subject: Re :
Sarah MCGUIR sarahmcguir@ymail.com
00447045718556

X-Originating-IP: [77.238.189.71]
Authentication-Results: mta1025.mail.ne1.yahoo.com
Received: from 127.0.0.1 (HELO nm18.bullet.mail.ird.yahoo.com) (77.238.189.71) by mta1025.mail.ne1.yahoo.com with SMTP; Tue, 12 Mar 2013 06:26:26 +0000
Received: from [77.238.189.233] by nm18.bullet.mail.ird.yahoo.com with NNFMP; 12 Mar 2013 06:26:25 -0000
Received: from [212.82.108.121] by tm14.bullet.mail.ird.yahoo.com with NNFMP; 12 Mar 2013 06:26:25 -0000
Received: from [127.0.0.1] by omp1030.mail.ird.yahoo.com with NNFMP; 12 Mar 2013 06:26:25 -0000
X-Yahoo-Newman-Id: 607377.28429.bm@omp1030.mail.ird.yahoo.com
Received: from [41.79.217.113] by web172206.mail.ir2.yahoo.com via HTTP; Tue, 12 Mar 2013 06:26:25 GMT
X-Mailer: YahooMailClassic/15.1.4 YahooMailWebService/0.8.137.519
Message-ID: <1363069585.48950.YahooMailClassic@web172206.mail.ir2.yahoo.com>
Date: Tue, 12 Mar 2013 06:26:25 +0000 (GMT)
From: Sarah MCGUIR <sarahmcguir@ymail.com>

Mrs. Sarah McGUIR
Mobile: 00447045718556

Return-Path: sarahmcguir@ymail.com
Received-SPF: none (domain of ymail.com does not designate permitted sender hosts)
X-Originating-IP: [77.238.189.218]
Authentication-Results: mta1214.mail.sk1.yahoo.com from=ymail.com
Received: from 127.0.0.1 (HELO nm11-vm0.bullet.mail.ird.yahoo.com) (77.238.189.218) by mta1214.mail.sk1.yahoo.com with SMTP; Tue, 12 Mar 2013 23:16:25 -0700
Received: from [77.238.189.57] by nm11.bullet.mail.ird.yahoo.com with NNFMP; 13 Mar 2013 06:16:23 -0000
Received: from [212.82.108.115] by tm10.bullet.mail.ird.yahoo.com with NNFMP; 13 Mar 2013 06:16:23 -0000
Received: from [127.0.0.1] by omp1024.mail.ird.yahoo.com with NNFMP; 13 Mar 2013 06:16:23
X-Yahoo-Newman-Id: 368147.77679.bm@omp1024.mail.ird.yahoo.com
Received: from [41.79.217.121] by web172204.mail.ir2.yahoo.com via HTTP
X-Mailer: YahooMailClassic/15.1.5 YahooMailWebService/0.8.137.519
Message-ID: <1363155383.31908.YahooMailClassic@web172204.mail.ir2.yahoo.com>
From: Sarah MCGUIR <sarahmcguir@ymail.com>

Sarah Mcguir also sends out scams under Dr Cheickh Tidiane N’DIAYE (below is a piece of the header to the email sent by Cheickh N’DIAYE (also, notice he spells his last name in all caps just like Sarah Mcguire does.)

Received: from [41.138.89.39] by web121203.mail.ne1.yahoo.com via HTTP;
Message-ID: <1347776310.47775.YahooMailClassic@web121203.mail.ne1.yahoo.com>
Date: Sat, 15 Sep 2012 23:18:30 -0700 (PDT)
From: =?utf-8?B?RHIgQ2hlaWNraCBUaWRpYW5lIE7igJlESUFZRQ==?= collins_tg@yahoo.com
Reply-To: boabankcontact@yahoo.fr
Return-Path: <collins_tg@yahoo.com>
Received: from nm8-vm4.bullet.mail.ne1.yahoo.com (nm8-vm4.bullet.mail.ne1.yahoo.com 98.138.91.168

Advertisements
 
 

Tags: , , , , , , , , , , , , , , , , , , , , ,

“Dr. Robert Williams” a.k.a “Mr. John Williams” a.k.a “Peter John” a.k.a “Mr. John Mark”

LOTTERY SCAM – ADVANCE FEE FRAUD

ATTENTION: This fraudster has been very persistent, spamming my inbox for months under various names, addresses and IPs including Barrister Nector FBI OFFICE Scam as well as (MR) Paul Johnson Lottery Scam — Below is a list of several emails sent by this scammer.

Subject: HELLO ,
From: Mr. John F. Williams peterjohn848@yahoo.cn

HELLO ,

I have contacted you because I’ve sent you the first payment of $5,000 today from your winning funds total amount of $1.5Million USD,Therefore you need to contact western union agent Mr. John Mark for him to give you the transfer payment information and MTCN.

Agent: Mr. John Mark
Email: ( nunionwester165@yahoo.fr )
Phone: +229 68433916 nunionwester165@yahoo.fr

Please try to contact him today for him to forward the payment information to you, Remember to Indicate the registration code of EB-2520 to him when e-mailing or calling him, Also he will be sending you $5,000.00 daily as per my discussion with him, this is what he needed from you to send you the first payment.

You’re full Name…………
Your Country………………..
You’re Telephone Number……..
Your Age……………………..
You’re Copy of Your ID………..
Your Sex …………………….

Do get in touch with me once you have got the transfer.
Sincerely,
Mr. John F. Williams.

Return-Path: <peterjohn848@yahoo.cn>
X-YahooFilteredBulk: 106.10.151.65
X-Originating-IP: [106.10.151.65]
Authentication-Results: mta1575.mail.ne1.yahoo.com
Received: from 127.0.0.1 (EHLO nm23-vm2.bullet.mail.sg3.yahoo.com) (106.10.151.65) by mta1575.mail.ne1.yahoo.com with SMTP; Tue, 09 Apr 2013 13:53:54 +0000
Received: from [106.10.166.120] by nm23.bullet.mail.sg3.yahoo.com with NNFMP; 09 Apr 2013 13:53:51 -0000
Received: from [106.10.151.138] by tm9.bullet.mail.sg3.yahoo.com with NNFMP; 09 Apr 2013 13:53:51 -0000
Received: from [127.0.0.1] by omp1006.mail.sg3.yahoo.com with NNFMP; 09 Apr 2013 13:53:51 -0000
Received: from [41.79.217.121] by web15303.mail.cnb.yahoo.com via HTTP; Tue, 09 Apr 2013 21:53:46 CST
From: “Mr. John F. Williams” <peterjohn848@yahoo.cn>
Reply-To: nunionwester165@yahoo.fr
Subject: HELLO ,

 +22968433916 nunionwester165@yahoo.fr Mr. John F. Williams
FBI OFFICE INHERITANCE LOTTERY SCAM

Subject: TRANSFER MTCN

Hello,

I am contacting you because I have sent you the first payment of Euro 5, 000 today from your winning funds total amount of Euro1.5Million , Therefore you need to contact the western union agent Rev. Jerry Young for him to give you the transfer payment information and MTCN to pick up the money at WU Branch over there.

W.U Agent: Rev. Jerry Young
Email: wu_payment0@yahoo.com.my
Phone: +229 98644349

Please try to contact him today and ask him to forward the payment information to you, remember to indicate the funds registration code of EB-2520 to him when e-mailing or calling him, Also he will be sending you Euro5,000.00 daily as per our board discussion with him.

Do get in touch with me once you have received the transfer.

Sincerely,
Dr. Robert Williams
IMF Managing Director Benin.
E-mail: bobwilliamson@superposta.com

HEADER:

Return-Path: <yiyu2016@yahoo.cn>
X-YahooFilteredBulk: 203.188.201.71
X-Originating-IP: [203.188.201.71]
Authentication-Results: mta1285.mail.ac4.yahoo.com from=superposta.com; domainkeys=fail (bad syntax); from=yahoo.cn; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm15-vm3.bullet.mail.tp2.yahoo.com) (203.188.201.71) by mta1285.mail.ac4.yahoo.com with SMTP; Wed, 12 Dec 2012 02:55:25 -0800
Received: from [203.188.200.82] by nm15.bullet.mail.tp2.yahoo.com with NNFMP; 12 Dec 2012 10:55:20 -0000
Received: from [202.165.102.49] by tm3.bullet.mail.tp2.yahoo.com with NNFMP; 12 Dec 2012 10:55:20 -0000
Received: from [127.0.0.1] by omp103.mail.cnb.yahoo.com with NNFMP; 12 Dec 2012 10:55:20 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 348533.56547.bm@omp103.mail.cnb.yahoo.com
Received: (qmail 16962 invoked by uid 60001); 12 Dec 2012 10:55:19 -0000
Message-ID: <1355309719.81269.YahooMailClassic@web92104.mail.cnh.yahoo.com>
Date: Wed, 12 Dec 2012 18:55:19 +0800 (CST)
From: “Dr. Robert Williams” <officefilepayment@superposta.com>
Reply-To: westernunionmoneytransfer403@yahoo.fr Western Union Money Transfer
Subject: TRANSFER MTCN

FROM: Dr. Robert Williams <officefilepayment@superposta.com> REPLY-TO: westernunionmoneytransfer403@yahoo.fr RETURN-PATH: yiyu2016@yahoo.cn
ANOTHER ADDRESS GIVEN BY SCAMMER – bobwilliamson@superposta.com
RECEIVED IP: 41.223.248.96 LOCATION: Benin, Nigeria

Below is a phishing scam email / header sent by the same received IP as the scammer above. The originating (fake) IP are different but if you receive a unknown email with any IP’s shown on this post, you’re more than likely dealing with a scammer.

Return-Path: <carecustomer625@yahoo.com>
X-YahooFilteredBulk: 98.139.91.80
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-Originating-IP: [98.139.91.80]
Authentication-Results: mta1031.sbc.mail.sp1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 8.224.216.104 (EHLO fgateway15.isp.att.net) (207.115.11.45)
by mta1031.sbc.mail.sp1.yahoo.com with SMTP; Sun, 23 Sep 2012 07:26:25 -0700
Received: from nm10.bullet.mail.sp2.yahoo.com ([98.139.91.80])
by att.net (frfwmxc15) with SMTP
id <20120923141959f01008dmffe>; Sun, 23 Sep 2012 14:19:59 +0000
X-Originating-IP: [98.139.91.80]
Received: from [72.30.22.77] by nm10.bullet.mail.sp2.yahoo.com with NNFMP; 23 Sep 2012 14:19:59 -0000
Received: from [66.94.237.111] by tm11.bullet.mail.sp2.yahoo.com with NNFMP; 23 Sep 2012 14:19:59 -0000
Received: from [127.0.0.1] by omp1016.access.mail.mud.yahoo.com with NNFMP; 23 Sep 2012 14:19:59 -0000
Message-ID: <1348409998.34442.YahooMailClassic@web182201.mail.bf1.yahoo.com>
Date: Sun, 23 Sep 2012 07:19:58 -0700 (PDT)
From: Yahoo Member Services <carecustomer625@yahoo.com>
Reply-To: carecustomer625@yahoo.com
Subject: Yahoo Warning

EMAIL: Dear Subscriber,
Your E-mail account has exceeded its limit and needs to be verified, if not verified within 24 hours, 
we shall suspend your account.Click to verify your email account.
Please note: You serve the risk of losing your account permanently if it is not verified.
Thank you for your usual co-operation.
We apologize for the inconvenience

Sincerely,
Yahoo! Mail Product Management.
Copyright © 2012 Mail! Inc. (Co. Reg. No. 2344507D)All Rights
Reserved. Intellectual Property Rights Policy

 
Leave a comment

Posted by on 12/14/2012 in Lottery Scam

 

Tags: , , , , , , , , , , , , , , , , , , , , , , ,

 
%d bloggers like this: