RSS

Tag Archives: 65.54.190.123

“Kung Yam Joseph” aka “Donald Stephen”

BUSINESS PROPOSAL SCAM – NIGERIAN SCAMMER

Kung Yam Joseph also sends scam mail under the names;
Joseph Kung Yam
Joseph Yam
Dennis Toure
Griffin Curtis
Donald Stephen

I’ve posted each email I received in order from newest to oldest.

Subject Line: ARE YOU INTERESTED IN THE CLAIM OF THE FUNDS?

ICEP is charged with the responsibility offinding bank accounts in Switzerland belonging to non-Swiss citizens, which have remained dormant since World War II.

It may interest you to know that in July of 1997, the Swiss Banker’s Association published a list of dormant accounts originally opened by non-Swiss citizens. These accounts had been dormant since the end of World War II (May 9, 1945). Most belonged to Holocaust victims. The continuing efforts of the Independent Committee of Eminent Persons (ICEP) have since resulted in the discovery of additional dormant accounts – 54,000 in December, 1999.

The published lists contain all types of dormant accounts, including interest-bearing savings accounts, securities accounts, safe deposit boxes, custody accounts, and non-interest-bearing transaction accounts.
Numbered accounts are also included. Interest is paid on accounts that were interest bearing when established.

The Claims Resolution Tribunal (CRT) handles processing of all claims on accounts due non-Swiss citizens. A dormant account of ORDNER ADELE with a credit balance of 50,000,000 US dollar plus accumulated interest was discovered by me. The beneficiary was murdered during the holocaust era, leaving no WILL and no possible records for trace of heirs.

The Claims Resolution Tribunal has been mandated to report all unclaimed funds for permanent closure of accounts and transfer of existing credit balance into the treasury of Switzerland government as provided by the law for management of assets of deceased beneficiaries who died interstate (living no wills).

Being a member of ICEP, I have all secret details and necessary contacts for claim of the funds without any hitch. The funds will be banked in any country of your choice outside Switzerland or a tax free country,
where we can safely withdrew the funds and we can share the funds and use it for investment of our choice. Due to the sensitive nature of my job, I need a foreigner to HELP claim the funds.

All that is required of you is to provide me with your details for processing of the necessary legal and administrative claim documents for transfer of the funds to you.

You can find additional information about unclaimed funds through the
internet at the following websites:
http://www.swissbankclaims.com
http://www.avotaynu.com , http://www.icheic.org ,www.livingheirs.com ,www.wiesenthal.com

The Holocaust Claims Processing Office has put funds in Escrow awaiting submission of valid claims for necessary disbursement. I find myself privileged to have this information and this may be a great opportunity for a life time of success without risks.
Please include your direct telephone when responding to this mail ,for further explanation to you.

Thank you for your prompt response.

Joseph Yam

Return-Path: josephkungyam@live.com
X-YahooFilteredBulk: 65.54.190.91
Received-SPF: pass (domain of live.com designates 65.54.190.91 as permitted sender)
X-Originating-IP: [65.54.190.91]
Authentication-Results: mta1493.mail.mud.yahoo.com from=live.com; domainkeys=neutral (no sig); from=live.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO bay0-omc2-s16.bay0.hotmail.com) (65.54.190.91) by mta1493.mail.mud.yahoo.com with SMTP; Wed, 13 Mar 2013 22:55:47 -0700
Received: from BAY161-W41 ([65.54.190.123]) by bay0-omc2-s16.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Wed, 13 Mar 2013 22:55:41 -0700
X-EIP: [Xj7i2g/BTr7SzLplzRgKBpDm6AjBnsOW]
X-Originating-Email: [josephkungyam@live.com]
Message-ID: <BAY161-W41FE8DF3FD8398A7D167EDCAEC0@phx.gbl>
Return-Path: josephkungyam@live.com
Content-Type: multipart/alternative; boundary=”_bce5dac4-59cb-4658-b78b-b6b2b7a73835_”
From: joseph yam <josephkungyam@live.com>
<griffincurtis19@yahoo.com>
Subject: ARE YOU INTERESTED IN THE CLAIM OF THE FUNDS?

joseph yam josephkungyam@live.com griffincurtis19@yahoo.com Griffin Curtis is another fake name used by Joseph Yam

Good day ,

Send the below letter to the lawyer immediately,Stop wasting time on this transaction.Go through this link and see what is going on in my bank.
spoofed link was here job(dot)aol(dot)com/articles/with a bunch of numbers/lettes

I want this fund to be transferred into your bank before the end of November.

Please the letter should be address as follows and sent to the lawyer fast:

Attention: Barrister Donald Stephen LLB (HONS),
Donald Stephen & Associates,
53-64 Chancery lane London
United Kingdom.

Sir,
Sub: Request for Retainership for Legal documentation/ Investment Liquidation transfer at UBS Bank Zurich Switzerland.
I am My fake name, and informaton I gave the scammer was posted here

Please use this instruction letter to act as a legal representative on my behalf at the UBS Bank- Zurich Switzerland in liquidating and transferring the sum of fifty-five million, three hundred thousand USD ($55.3M) into my bank account in the USA.
your details of UBS Rolling Fixed -Term Deposit Account of $55.3 Million.
Thanking you in anticipated co-operation.
Signature/ Date………………………………………………………)

best regards
Joseph yam…

HEADER:

Return-Path: <josephkungyam@live.com>
Received-SPF: pass (domain of live.com designates 65.54.190.92 as permitted sender)
X-Originating-IP: [65.54.190.92]
Authentication-Results: mta1042.mail.ac4.yahoo.com from=live.com; domainkeys=neutral (no sig); from=live.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO bay0-omc2-s17.bay0.hotmail.com) (65.54.190.92) by mta1042.mail.ac4.yahoo.com with SMTP; Sun, 18 Nov 2012 08:15:46 -0800
Received: from BAY161-W63 ([65.54.190.125]) by bay0-omc2-s17.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Sun, 18 Nov 2012 08:15:45 -0800
Message-ID: <BAY161-W63D5FF3DE5408855DBB0F3CA570@phx.gbl>
Return-Path: josephkungyam@live.com
Content-Type: multipart/alternative; boundary=”_379ae64f-a690-493a-83d7-da12adb7d73a_”
X-Originating-IP: [198.101.239.203]
From:
joseph yam josephkungyam@live.com
Subject: Stop wasting time on this transaction
SAME SCAMMER, DIFFERENT SCAM BELOW –

Received: by 10.216.223.203 with SMTP id v53csp54278wep;
Received: by 10.236.154.193 with SMTP id h41mr2070384yhk.58.1336464586424;
Return-Path: <dennistoure.960@msn.com>
Received: from blu0-omc2-s34.blu0.hotmail.com (blu0-omc2-s34.blu0.hotmail.com.
[65.55.111.109])
by mx.google.com with ESMTP id z10si16692091yhn.83.2012.05.08.01.08.46;
Tue, 08 May 2012 01:09:46 -0700 (PDT)
Received-SPF: pass (google.com: domain of dennistoure.960@msn.com designates
65.55.111.109 as permitted sender) client-ip=65.55.111.109;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of
dennistoure.960@msn.com designates 65.55.111.109 as permitted sender
) smtp.mail=dennistoure.960@msn.com
Received: from BLU162-W47 ([65.55.111.71]) by blu0-omc2-s34.blu0.hotmail.com
with Microsoft SMTPSVC(6.0.3790.4675);
Tue, 8 May 2012 01:08:46 -0700
Message-ID: <BLU162-W477F52CBA42A9BFEFEEA48B6100@phx.gbl>
Return-Path: dennistoure.960@msn.com
Content-Type: multipart/alternative;
boundary=”_348c38f4-e2c8-4829-acc9-a654fb38968f_”
X-Originating-IP: [41.202.74.253]
Reply-To: <dennistoure02@yahoo.ca> Dennis Toure
From: dennis toure <dennistoure.960@msn.com>
Subject: From Dennis and Alice.

From Dennis and Alice.
Dearest One
I know this mail may come to you as a surprise, since we have not known or
written before. I am Dennis Toure, 25 years old, I am contacting you on
behalf of myself and my youger sister Alice. We are an orphans.
Nationality: Ivoirians. Our late Father Mr Lawrence Toure was a
successful business-man whom before his untimely death , was a Cocoa and
Diamond Merchant based here in abidjan, Cote d’lvoire.Both our Father and
Mother were poisoned at a party organised by one of his business associates.

Before he died in a private hospital here, my Father called me and told me
that he deposited the sum of US$12.5m (Twelve Million Five Hundred
Thousand American Dollars), in a bank here which he used my name as next of
kin to deposit the funds as the only son.

Due to the problem that have arised in our family between my late
Father’s brothers over who should control his wealth and subsquent death in
the family, I have decided with my younger sister to transfer this funds
overseas for future investment after we finish our education.

We want to leave here and come over to your country to live and continue
our studies, because our lives is no longer safe here. We have heard from
a reliable source that they are planing on how to retrieve all the
documents concerning the funds from us, so that they can claim the funds.

Before contacting you, we have spoken with the local bank manager and worked
out modalities on how to transfer the funds to your country.

Please, we humbly seek your assistance in the following ways:

1- To assist us in transferring this fund quietly into your account in your
country.
2- To serve as the guardian of this funds since I am still in the university
and my younger sister is still in the college.

3- To make arrangement for me and my younger sister to come over to your
country to further our education and to help us secure a residential permit
in your country. Moreover, we are willing to offer you any agreed
(percentage) out of the total funds as compensation for your efforts/input
after the successful transfer of this funds into your nominated account
overseas, while some percentage will be set aside to offset any expenses we
may incur.

4- Furthermore, you can indicate your option towards assisting us as I
believe that this transaction would be concluded within the shortest possible
time.
NB: Please, if you are interested to help us, contact me immediately after
you read this proposal so that I may give you more details information how
this transfer could be carried out.
However, I wish to hear from you to know your decision concerning this
proposal. Please reply very urgent.
Sincerely,
Mr Dennis toure

BUSINESS PROPOSAL

DEAR .,
WHAT IS GOING ON I HAVE NOT HEARD FROM YOU IN MANY DAYS!! IS ANYTHING THE MATTER? PLEASE GET BACK TO ME TO LET ME KNOW IF YOU ARE STILL INTERESTED IN THIS MONEY TRANSACTION TRANSFER WHICH I WANT TO SEND INTO YOUR ACCOUNT…I WILL BE URGENTLY EXPECTING YOUR REPLY..
KIND REGARDS
JOSEPH

HEADER DETAILS:

Return-Path: <josephkungyam@yahoo.com.hk>
X-YahooFilteredBulk: 106.10.151.243
Received-SPF: none (domain of yahoo.com.hk does not designate permitted sender hosts)
X-Originating-IP: [106.10.151.243]
Authentication-Results: mta1263.mail.sk1.yahoo.com from=yahoo.com.hk; domainkeys=pass (ok); from=yahoo.com.hk; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm34-vm4.bullet.mail.sg3.yahoo.com) (106.10.151.243) by mta1263.mail.sk1.yahoo.com with SMTP; Tue, 05 Feb 2013 21:19:14 -0800
Received: from [106.10.166.126] by nm34.bullet.mail.sg3.yahoo.com with NNFMP; 06 Feb 2013 05:19:07 -0000
Received: from [106.10.151.218] by tm15.bullet.mail.sg3.yahoo.com with NNFMP; 06 Feb 2013 05:19:07 -0000
Received: from [127.0.0.1] by omp1016.mail.sg3.yahoo.com with NNFMP; 06 Feb 2013 05:19:07 -0000
X-Yahoo-Newman-Id: 471749.60985.bm@omp1016.mail.sg3.yahoo.com
Received: (qmail 85228 invoked by uid 60001); 6 Feb 2013 05:19:07 -0000
Received: from [137.189.43.90] by web192501.mail.sg3.yahoo.com via HTTP; Wed, 06 Feb 2013 13:19:07 SGT
X-Mailer: YahooMailWebService/0.8.132.503
From: Kung Yam Joseph <josephkungyam@yahoo.com.hk>
Reply-To: Kung Yam Joseph josephkungyam@yahoo.com.hk
Subject: BUSINESS PROPOSAL

Kung Yam Joseph josephkungyam@yahoo.com.hk

 
 

Tags: , , , , , , , , , , , , , , , , , , , , ,

“Nulty Rita”

419 SCAM / ONLINE DATING SCAM

NOTE: This scammer has sent a previous email which can be found here. 

WAITING TO HEAR FROM YOU SOON.
From: Nulty-Rita nulty.rita23@gmail.com
Hello Dear.

How are you today, hope nice? i know you be wondering while i keep silent, well am doing great health wise only

been so busy with a lot of duty as the assignment is still in progress,

I just want to know if you have received the parcel from Mr Sylvester, please do let me know if the parcel has come to your care.

Yours.
Nulty.

Return-Path: nultyri1980@live.com
Received-SPF: pass (domain of live.com designates 157.55.1.156 as permitted sender)
X-Originating-IP: [157.55.1.156]
Authentication-Results: mta1455.mail.gq1.yahoo.com
Received: from 127.0.0.1 (EHLO dub0-omc2-s17.dub0.hotmail.com) (157.55.1.156)
by mta1455.mail.gq1.yahoo.com with SMTP; Thu, 20 Jun 2013 05:09:19 +0000
Received: from DUB114-W131 ([157.55.1.136]) by dub0-omc2-s17.dub0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
X-TMN: [3a34Ffr58Po4PhIKfHhEAVGF1SUB1Smi]
X-Originating-Email: [nultyri1980@live.com]
Message-ID: <DUB114-W131EB32F1002E74F0735B02C28E0@phx.gbl>
Return-Path: nultyri1980@live.com
From: Nulty Rita <nulty.rita23@gmail.com>
Sender: <nultyri1980@live.com>
Subject: WAITING TO HEAR FROM YOU SOON.

MY ORGANIZATION25TH YEARS IN EXISTENCE.
Hello my dear,

How are you doing health wise,Hope good, i was so excited after the anniversary party, indeed i was filed with joy, on my mind, I wanted it to be a surprise for you, the organization where I am working just cerebrated the 25YEAR IN EXISTENCE,the party holed just two days ago, and been the organization departmental personal manager, i received some gift from the organization and friends, oh I wish you were here with me. But you know what, I didn’t forget you during this great celebrations.

Splendid my dear, I got some prize award and gifts from my organization, friends and relatives, your thought just came in my mind again and I decided to let you have some of the pleasant gifts and also to register in your heart that I valued our friendship so real and to wish you an awesome day as we are building more interest and oneness on our relationship.

I sent the gifts through our organization Gulf Chief Accountant, MR. BONFREY ERNEST, who went back to gulf regional continent since yesterday morning and I gave him the gifts package to deliver it to you when he arrives there since I was not really sure of your home postal address and I couldn’t wait for you to do that since he is in a hurry to catch his flight.

Right now am in Isreal for an official assignment, with some of our organization officials, which will take us a little time before completing the assignment.

I belief where MR.BONFREY ERNEST, is residing might be closer to you. Just contact him via email: bonfrey.ernest2@gmail.com ; and as well discuss with him on phone +228 90 56 57 81. Concerning on how you can receive my precious gift package for you.

Please do accept that token of gift for our friendship, I knew it isn’t much for the new year wishes but I sent it from my innermost heart and belief you will appreciate and apprehend it and everything inside the package cox it is coming from a special friend.

The content of the package are; a hp laptop 2012 edition, 2 I-phones, AN ENVELOPE, 1 Video Camera (Sony Camcorder) and some jewelries. I packed everything in a medium sealed carton and the Chief Accountant accepted to deliver it to you coz he didn’t return home with much luggage of his own. Please, Open the packet of the Laptop to bring out the envelope inside, it contains some of my recent photos and a surprise gift which I don’t want to disclose to you till you find it. Update me when you receive it,

So I will be aware, do comment on my photos, left with blue suit is my superior i at the other end and the middle is Mr Ernest incase when you meet with him you will not be confused. and the lest is members and my single view.

I’m wishing you a great and wonderful awesome season for the months of March, and as well saying happy new year 2013..

Yours truly friend,

Nulty.

“Nulty Rita” <nulty.rita23@gmail.com>
Return-Path: nultyri1980@live.com
X-YahooFilteredBulk: 157.55.1.174
Received-SPF: pass (domain of live.com designates 157.55.1.174 as permitted sender)
X-Originating-IP: [157.55.1.174]
Authentication-Results: mta1118.mail.gq1.yahoo.com from=live.com; domainkeys=neutral (no sig); from=gmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO dub0-omc2-s35.dub0.hotmail.com) (157.55.1.174) by mta1118.mail.gq1.yahoo.com with SMTP; Sat, 02 Mar 2013 07:59:15 -0800
Received: from DUB114-W98 ([157.55.1.136]) by dub0-omc2-s35.dub0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Sat, 2 Mar 2013 07:59:12 -0800
X-EIP: [CPXQ+HYlIHIvzdgyJaVbb1C2FpyQuO/c]
X-Originating-Email: [nultyri1980@live.com]
Message-ID: <DUB114-W98830642040CF06AAB2CF9C2F80@phx.gbl>
Return-Path: nultyri1980@live.com
From: Nulty Rita <nulty.rita23@gmail.com>
Sender: <nultyri1980@live.com>
Subject: MY ORGANIZATION25TH YEARS IN EXISTENCE.
References: <BAY146-W42CA7A7E6EE20E69E5C668C2010@phx.gbl>,<1360054761.17753.YahooMailClassic@web161001.mail.bf1.yahoo.com>

_____

Hello Dear,

It is nice and joyful to found your email address on the Internet search during my quest for friendship to keep busy the lonely and lovely world. Hope you fill the vacuum? I thought is beautiful to make you a friend in this regard. My name is Nulty Rita a Canadian nationality, female. My friends tell me that I am a quiet person with a good sense of humor.

I am always fair, straightforward, honest and easy going lady and I seek trust worthy friendship. I believe in giving and taking on both sides and I value faithfulness. I like people for what they are and not for what they are not. I want to be your friend, and let share whatever we have in friendship.

I will be detailed in my consequential mails and expecting same from you if both considered:

AGE: 29 languages spoken: Fluent English & little Spanish.

It will be nice to know you in this regard.

Yours truly,

Nulty.

“nulty rita” <nulty.rita23@gmail.com>

Return-Path: <michael.williams7763@yahoo.com>
X-YahooFilteredBulk: 98.136.218.151
X-Originating-IP: [98.136.218.151]
Authentication-Results: mta1248.mail.bf1.yahoo.com from=gmail.com; domainkeys=fail (bad syntax); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm3-vm8.bullet.mail.gq1.yahoo.com) (98.136.218.151) by mta1248.mail.bf1.yahoo.com with SMTP; Mon, 11 Feb 2013 05:54:36 -0800
Received: from [98.137.12.191] by nm3.bullet.mail.gq1.yahoo.com with NNFMP; 11 Feb 2013 13:51:16 -0000
Received: from [98.137.12.217] by tm12.bullet.mail.gq1.yahoo.com with NNFMP; 11 Feb 2013 13:51:16 -0000
X-Yahoo-Newman-Id: 28265.28690.bm@omp1025.mail.gq1.yahoo.com
Received: (qmail 39232 invoked by uid 60001); 11 Feb 2013 13:51:15 -0000
Received: from [41.207.163.1] by web163403.mail.gq1.yahoo.com via HTTP; Mon, 11 Feb 2013 05:51:15 PST
Message-ID: <1360590675.38942.YahooMailClassic@web163403.mail.gq1.yahoo.com>
From: nulty rita nulty.rita23@gmail.com
Reply-To: nulty.rita23@gmail.com
Subject: Hello

RECEIVED_IP: 41.207.163.1 IP_USED: 98.136.218.151 – Also going by the name Michael Williams

___

SUBJECT LINE: MY GOOD FRIEND

Message contains attachments3 Files (31KB) | Download All
hh.jpg
h.jpg
hhhhh.jpg

Dear Friend .

Thanks for your mail, for our friendship continuations. I have been so busy these days due to some official Assignments, Which I can’t afford to overlook. I have been so tight-up with much job on my table in our on-going Worker’s Employment/recruitment program-taking place in Canada, USA, UK, Australia-Europe and Africa. I guess you will be interested?

I’m Nulty Rita by name, Canadian by nationality, but working and living in United state of America, 29 years of age, female single. I have no child yet but really love to have in the near future. I’m the only daughter of my parents. My parent got Three kids, two Male and i female. My elder brothers were married.

I ‘m a staff in an employment, immigration and recruiting organization here in U.S. Washington, DC. I love Songs, to be precise singing is my best gift, and I have a keyboard and love playing it. My hobbies are watching music; driving when/where there is no traffic hold and swimming sometimes.

I live in a moderate quiet area and have adapted to it. Reside at 395-North to Rte 1-North. Cross the 14th Street Bridge, stay in the left lane the exit Right 1-North. Pass Thomas Circle and continue on 14th Street. Turn left on Rhode Island Avenue, go one block to 1666 K Street, NW Washington, DC 20006

I need you to completely understand who I am and what I can give. It may not compare to other persons or past friendship but that doesn’t matter, we can make the best of friend. We can be friend regardless of colors, race, age and sometime sex maybe considered.

Find also, copies of my picture attached to this letter. Send me mails at your best convenient and your pictures if available at the moment.

Yours sincerely,

Nulty.

HEADER DETAILS:

Return-Path: <nultyri1980@live.com>
X-YahooFilteredBulk: 65.54.190.85
Received-SPF: pass (domain of live.com designates 65.54.190.85 as permitted sender)
X-YMailISG: wOOOviMWLDtfnaUqhOT0TKjcn0VJNQgPdUYaZIInvGs5LdpM .ufhrZqSKewFi9qFKFkNsM8laT8vEJqiLhNJdedLFAxiJuHnOiSYoub.xJtg vi2Ks.yqDpiYu8SBSRAWg8KjkdleFMEBNDWZAqs94zMeHTZwfZ5eMe2SrtAP 8jtdsF6CLdyq7a3d4vKqiEh2xKiavjF1ixPK3fSBoJMBjNhrXQ_lFj3oYC6Q VGfs3mGst0xvjs..a1E1WVkzKB8PqHFMHTmx6bOSmR._MIwduQ2rLVpMJkXT jch22fX2UnJbRnXPwGP3.JtEqrbSTVGCvJk6g5RE6vKhAPZImTLNOx0wV_ae .wgQZHKg0yMfSkMa_SgJzm9ZYF1wdbuwYgOXKRVmqYS37PAOxXmeGc02L_Rf 4J1CFQtcon6hDAR2vCrt5izpUOxi2z4lrSKeYGJvE3c91MWyG5YvU.7y2rlB NvAmozoOb8lF_0RuS1FcQ.pbdH1F821IANneA9.bHmDwQ12tAWnrT40E7ksu wCKfRVllBvz_WWtaHObDODgn34Yr8WyF.GGGLJFfXOth2b3idEr5fBkxevsn mJj8d3vfs6Y8VKyj6R56iAhi0yESkCk9o_JdiLXVkJgYyvCbl5cGKYpYVJtD QIm3592llFKkKkEFADtEyPZDrTRl.KAx4l8Mc3or3BtW6SW86tQsgmVivi6J gksG_OUIa0ILQg7x4_WdXXbxQ5.IhNkQH2Omnk2Lh1Kbda5r6xwSVYyKPucn fFOI6dm8_P04VWpA1z2s6omcFu86.TRrfE5OfcxRoHJC7cmUkqnJf99D.fJQ QHRSTZL3KHksumqYJGFYdMrN6WWKoC8K4u3vZPueW4rrcfG0wWEHPVDoYEnx J4jViPuMxGeig.hPP_ANTaPB2BxV15tSoI98jxl1xkNDYmg12JlYIhd9VgWc dLrlVzjrxVRJtAXeNFN3uHpLd0qV45Zznd0VRhD4xdqEBDoWVqrSlTeu6Lbj EuScecsjA_u4_ncbp5.PgTHDyfKHde3VFf2DQGP2SZNYZEqkEkDDK9IT9E56 BtrrcPj63JrWho9VQrFVf6_utKkOi6a6Xi_Izw6H18kpnONMMCvg5diY8RLZ DrcIYOlX6CUplLVmlgZqZs1sXSAgVneN0jemr1eHmD7ZM.L9pZ2PO5gQtbVd X4d4ya_wRHUeBvuIhmFdLoBbX9ZzpxeIifqw5Pcwq85zXYLdVd9QVRnxODm8 W5n8nVBUNgSfKYWUf7E0XNVLry5Uy92JqBwGSb1xa4ExHyY0Ot2VEjwFj.UI YFWUUJoQP3UdfKgK2bM-
X-Originating-IP: [65.54.190.85]
Authentication-Results: mta1241.mail.mud.yahoo.com from=live.com; domainkeys=neutral (no sig); from=gmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO bay0-omc2-s10.bay0.hotmail.com) (65.54.190.85) by mta1241.mail.mud.yahoo.com with SMTP; Mon, 04 Feb 2013 00:59:06 -0800
Received: from BAY146-W42 ([65.54.190.123]) by bay0-omc2-s10.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Mon, 4 Feb 2013 00:59:06 -0800
X-EIP: [9x96LiugYipI8EjJRus/A+fVRPioWw/g]
X-Originating-Email: nultyri1980@live.com
Message-ID: <BAY146-W42CA7A7E6EE20E69E5C668C2010@phx.gbl>
Return-Path: nultyri1980@live.com
Content-Type: multipart/mixed; boundary=”_bcbaed7d-04e8-4fa2-a89b-36a03cb0dec1_”
From: Nulty Rita <nulty.rita23@gmail.com>
Sender: <nultyri1980@live.com>
Subject: MY GOOD FRIEND
In-Reply-To: <BAY146-W586EAFFEFCCB2B3E87369AC2020@phx.gbl>

RECEIVED_IP: 65.54.190.123 IP_USED: 65.54.190.85 

Below is the emails and IP addresses that NuIty Rita used in her first email. This is another great sign when trying to detect scammers. They always use different IP addresses and frequently change their email addresses and use a different reply/return address. Alot of their emails are similar and may be idenical but different email servers. Example: JohnDoe@yahoo and JohnDoe@gmail — Also, notice the return address michael.williams7763@yahoo.com ? This scammer most likely using the fake name Michael Williams in other scams.

nulty rita nulty.rita23@gmail.com RETURN_ADDRESS: michael.williams7763@yahoo.com RECEIVED_IP: 41.207.184.25 IP_USED: 98.136.216.199

 
Leave a comment

Posted by on 02/05/2013 in Romance Scam

 

Tags: , , , , , , , , , , , , , , , , ,

“nulty rita”

ROMANCE SCAM – ONLINE DATING – SCAMMER

All of the emails on this post are from Nulty Rita — I’ve put the header details under the emails. Scammer is using different IP and email addresses in each email.

romance_scams

SUBJECT LINE: Hello

Hello Dear,

It is nice and joyful to found your email address on the Internet search during my quest for friendship to keep busy the lonely and lovely world. Hope you fill the vacuum? I thought is beautiful to make you a friend in this regard. My name is Nulty Rita a Canadian nationality, female. My friends tell me that I am a quiet person with a good sense of humor.

I am always fair, straightforward, honest and easy going lady and I seek trust worthy friendship. I believe in giving and taking on both sides and I value faithfulness. I like people for what they are and not for what they are not. I want to be your friend, and let share whatever we have in friendship.

I will be detailed in my consequential mails and expecting same from you if both considered:

AGE: 29 languages spoken: Fluent English & little Spanish.

It will be nice to know you in this regard.

Yours truly,

Nulty.

___

EMAIL TWO –

SUBJECT LINE: waiting to read from you soon.

Thanks for your response and friendship continuation, am sorry for my late respond to you, due to some official jobs which i can’t over look in my office, I saw the picture you sent to me is very interesting and ham-some i love that, it gives me pressure when i read your mail, am looking for a serious relationship that will always exchanging ideas with me and the same time i will learn something from him, i think it will be interesting if you occupy the vacuum. I will be waiting to read from you soonest,

Thanks,Your beloved,

Nulty.

_______

THIRD EMAIL FROM NULTY RITA –

Thanks for your response and friendship continuation, am sorry for my late respond to you, due to some official jobs which i can’t over look in my office, I saw the picture you sent to me is very interesting and ham-some i love that, it gives me pressure when i read your mail, am looking for a serious relationship that will always exchanging ideas with me and the same time i will learn something from him, i think it will be interesting if you occupy the vacuum. I will be waiting to read from you soonest,

Thanks,Your beloved,

Nulty.

HEADER DETAILS:

Return-Path: <michael.williams7763@yahoo.com>
X-YahooFilteredBulk: 98.136.216.199
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: v_EU3goWLDtxr2FQVO1kRAvJR4p8Omw_uuoF7WARHE_SgVV_ bpbLV8e1qIRPWQALlOv138.Ok2_i41Jfi_sWdIhWeb2fUy6R.Kc7hPKPUMMi mdr8uBUz5AuqfDzFnqyFxvaBDSvhr725kMv1DiUeX7IabJOXM1aWO40XTceD ASSaaW0JH43vTjOeIV6_96mvOGj_lTmILiOK9XrOdkVBZKqWzTAU_w45I0bF aoArTHBH6Yjig.n_eq_1.gnx6T4gRxZE.bGc4oLGba7nKE_yCOmIRlXg6_Z5 8yaTLcK0PgmsZ8fmEs0eYOU9WKmXIVBANtTE6H2CwnwwDU8TIEY5BPg0djAx 9jrQ.4S.5qoO1MsYJ61FxDqhJARORWwm6cFijCg0.gzA6xXfaCgmBSziiSpS _L09_KbN7C1UZblljY1mTT2yhF7wd2sF22LK1qvwI.Ld0qxE0JKiksmBqutA MtwyPhEsyI45jaavUjQVRrWuC8iW6sfKBrrI_1EeSVRclO6gSXSTnAOCpq4J s4yA_mG07c7WgRKvbcz57_zmiaMblveBEFwdi1ZfuYfx7H046.oog2svJL6h DOMojjWxAaywELOVO5hH2FNrNghc1lxafwR9rLhOVxJomibqazix.nMyOBHn Ln9_HOexc46rXN7heZ1LaVogJMvpLALL7NuWAhLX8aMP3IjSZ244cajk1WM1 cxiptdrrIlRP6doBHuZ9L2XzXzeEs4qTwXoKborT.qWohUpebxPiv6VY9GZi YrjBFQQrthXQwDL2p5qvQb8FlE.RYH9G6HWy0_mDvxD5BcB9uETzKQnRw2bj rUI1XXqyR8YCF5_uwglfFkR0pLbqN_Ha_BZkAoV8JuMQyg7ONHDgomoeFDnd 2wVb0GfDxIx7C6MwaKwcx7fh4bZEmYJXqVl5J9nfXr.AUt9UXlqXi1L19wHg dWl1omgF48oVhllrYLKu3INJ028GiKBHpeCkgszIpzxZJ3Sl3vhIofwpE9GX L1NWXt2FxMvR1H5kWbHSkeMWKC1wjxFG5wnI7vL6.QCWVdeid1CNl.8C2T3B cuEZu8J0GYetrsgEgyce9mVx_yXJqWZLgftFfOTRwPlEz9d0Edvbdzvb2P0O IpX3NPltzUiAmXT6oqN8u6Cl5VytQ.0MmzfIyAbtuEMKiKQ.3NS1UWfGMciF doAZ9nFmiFHIWT7Z6_pQ1BEMaHjRyn8lgePCUuBoN5XkM9N2qOMyNwEBqM5U 9.WDL9g99tB1IUc0Z4S7f2C7fP5UHkwGaaXaiNF.oIIODWUhhrtBpH_r5lz5 Y8vLng37VNZGRMT0QqQP.Ykyk3QDyzFpVz86qw5lTV1WbnvycgD_RUYALS3u 4REp5mErkD3rVrZeuzRLM6uYeR7vtNkmigkEnXYyPQ–
X-Originating-IP: [98.136.216.199]
Authentication-Results: mta1382.mail.gq1.yahoo.com from=gmail.com; domainkeys=fail (bad syntax); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm30-vm8.bullet.mail.gq1.yahoo.com) (98.136.216.199) by mta1382.mail.gq1.yahoo.com with SMTP; Sat, 02 Feb 2013 23:18:10 -0800
Received: from [98.137.12.189] by nm30.bullet.mail.gq1.yahoo.com with NNFMP; 03 Feb 2013 07:18:10 -0000
Received: from [98.137.12.242] by tm10.bullet.mail.gq1.yahoo.com with NNFMP; 03 Feb 2013 07:18:10 -0000
Received: from [127.0.0.1] by omp1050.mail.gq1.yahoo.com with NNFMP; 03 Feb 2013 07:18:10 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 311370.83000.bm@omp1050.mail.gq1.yahoo.com
Received: (qmail 62306 invoked by uid 60001); 3 Feb 2013 07:18:10 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1359875890; bh=CYH4aW/vXnFu6XxmeTfb8LB5QPC+tPQSLrPr0gNnyR4=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=vyI+zCTHzdaW5W2vq8YuMJYcZxlo726RH+4c9hsFzpVw7Rqm0XWNnU6kMYCKjkVCwQCMEOx4kqjcWlxpNlVkpQ/jmVNPKGtkTCmr2Kz4mR/EFWsyhLzVaoLcu3ZcEivjixhhhppt4fPreHNsedxBUBc2QbtSU8165oHZRH+86u8=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=S9D1a3sEM64Qpx99F29253XC3e/QunCc4mkcVhh/UDKDs0PYUdC1B66APbJhvdS+iGCgNLg9fQX+HK5A72x1eZ/8XHq6pN9fjNi5Cr6V3y04xsDgc5dPhvcFq29VdbeXiZXf6drDvwNeuT/nMz3IFBK70J2lFlWhm8iyLASFiPM=;
X-YMail-OSG: vpBsc8AVM1ktRTNJG9zqZuIXG3eH1Do1oc6NjwgBAx6nqRt B9xVVUbwPPQyO.t0DRyVzQQO9xMpcz1fya0BVHXd8eLIfMw30JpR0bnppA6z LMCgOQZpCbFK_ewcc0W04BkU36BwFH6Uyx.n4.j.EXyrnKewca8JTOqVJej. FtzPkV63fiy4TCdIoBGxF0eEPdTlUx_wznhfWtWmh3pX3DuGxwP2Wm2NPr5k FYdhac6m2W3Jkcktx7RS1Evvp89Cu4dyZ9DEvSTf.tOuUEq442yQMIwWWhD0 hMVQYu1A30S7jxzAKDVImZG7Dmi3kt1sbXsoc88Dn9QJ82dekE739enmScRS 9M9nH2o0G_68mtPMK65aHTT4uUIkhyp1J5JGtqrVap9kFJuvKCymK2RQUZyr 9_nzXREArt4J1azO1SoTgJH8D81TGfDLyDzrPVggl2irAaC8ThEVvhMcgjLd zd3HBYpyT8Q5goXd2jsEYF6kOF7VJCMpqboofIvmz8wSl2T7XxeieAhs9YD9 k6W474_4G211.n1kvPmRyaE.Pci1eEsEnfJBIdn.Us6QCTvkVrnGrYCtbTFQ oXTaK8aD2u0POiavSwPbNwyGhr7Cfo_.qz0b_vAGo3MziGD7be0wb1FCgqlJ iLMkZaDZ9h4sU_uBNJIc-
Received: from [41.207.184.25] by web163406.mail.gq1.yahoo.com via HTTP; Sat, 02 Feb 2013 23:18:10 PST
X-Mailer: YahooMailClassic/15.1.2 YahooMailWebService/0.8.131.499
Message-ID: <1359875890.71870.YahooMailClassic@web163406.mail.gq1.yahoo.com>
From: nulty rita <nulty.rita23@gmail.com>
Reply-To: nulty.rita23@gmail.com
Subject: Hello

nulty rita nulty.rita23@gmail.com RETURN_ADDRESS: michael.williams7763@yahoo.com RECEIVED_IP: 41.207.184.25 IP_USED: 98.136.216.199

You can tell by the return address that this scammer uses, or used, the name Michael Williams to send out spam.

In the second email, the scammer used

Return-Path: <nultyri1980@live.com>
Received-SPF: pass (domain of live.com designates 65.54.190.100 as permitted sender) IGNvbnRpbnVhdGlvbiwgYW0gc29ycnkgZm9yIG15IGxhdGUgcmVzcG9uZCB0 byB5b3UsIGR1ZSB0byBzb21lIG9mZmljaWFsIGpvYnMgd2hpY2ggaSBjYW4n dCBvdmVyIGxvb2sgaW4gbXkgb2ZmaWNlLCBJIHNhdyB0aGUgcGljdHVyZSB5 b3Ugc2VudCB0byBtZSBpcyB2ZXJ5IGludGVyZXN0aW5nIGFuZCBoYW0tc29t ZSBpIGxvdmUgdGhhdCwgaXQgZ2l2ZXMgbWUgcHJlc3N1cmUgdwEwAQEBAQN0 ZXh0L3BsYWluAwMwAgN0ZXh0L2h0bWwDAzc-
X-YMailISG: s_YHocUWLDvKLd_cNdSu2_dyD.4lsfGNHQhkhqhTvUcUNJdI ePY7VF4_7F1qAJWmi.YJm1fRexH9K24EC1maTbj79iBn.wwzpxa8Gaxg7tF. D75_m2NdEhVLTZwssac61o1P4X8iir2vDnaTB6peXrLvCoNpRS5S8qPhE6hn qGzjv3bTyoS9Up0ZcLr.0RY1gF8q.e0_.5p7a79G1Yc1RX0v5EQLohOfrl0H mBCM3dMqDTOAVqDTgSR3iVVRRFplnGlEmUal2RlTzacFvLqXdvmq8_KlKES4 A4Q31BbUK2kyAQd66z5gEurFJZLo3fLPmuZr6zTyYURncXNz5rLlIx9Ff9Ck Og9ckAA4Bc0XFUJEtEfheC2H7ZvKmEm6_nWKLJFjcVWPyTKCKk2kXIjOjj9d OTToU0zY582zQTn4ZLtPSq31Ymm69zxMEk2k8ErSGvwu53Q2ZRkDxu8MNw7z ulthl5gYfthCuOORPhyJwcDnP3OHYTldtbqlKYkc76eUrZMnAIl6WO.PqJHZ 7qDdx6qzok_.KimW8KPrlRQ8MwpTtLwWSHIQHYiSmh1vPPcj13OQVN.9KXRj kA1LuSYJXGoAKepweHtseX5_wCiQuNMqO30yEKBVBTCcjVqxeLGen.gGz4kM InAXshcvL2MRZnlLArZWmI.4cpiz084Xm7VqzaDWmbPTok6bkRGKhPjCkguT fLZigDaRqms8sxEf_WGaTqH9iLVUAz7V2fn3UzJXZq_Hs68H0R3Y9t8yoYmi TMslobRyoP4nEMyrWSgJOOTWN3NsfahEdOkZK.I8OFwaRaS1Hy9r3Rpfu86q 25K0qPXMWJZXWchuecPIkSYDwaRCSLwfD9nXVk9alxP_EXWIW0idcnZ1xs9F x2fgym581CmR9vFludTJjNOtwaCI2M9ouG4Jo9yUB2hkLSZNHzy_x1nTG7xV rsdfZz0Ddvw2YfkEk.O8uhcPehW_wTXIQvYKTboGD8S4wjmD3YjuOZJip51u N..aXDyZWGzKds74PmPYS7tBDoukidFnBBI5c93iVKkgq9vrggeQW5cjw680 IDGt_odGzjD5gn_qOLtFw_fdJWggpHKZB.OAtVhAUu6hRbyecfYDUAjauwtl adjxmNJvSZaBMuKcTUpH0XLdSfP2fp.Oog39p4TNSdj79MqmqL00Sa66VTMv gZVNiWqmyfO3Uh0.cxPyMsCSanIW7k4GX7uUVcZTrJhgAU7wDn49rNVmd80u jVObxIKhgxlHesSrtdjwzwnkX59rYkyy65n4cKTh1gDFD0aKZAkjOFJnLXvt mnkVAUzRCEALkco-
X-Originating-IP: [65.54.190.100]
Authentication-Results: mta1263.mail.ac4.yahoo.com from=live.com; domainkeys=neutral (no sig); from=gmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO bay0-omc2-s25.bay0.hotmail.com) (65.54.190.100) by mta1263.mail.ac4.yahoo.com with SMTP; Thu, 07 Feb 2013 03:39:50 -0800
Received: from BAY146-W18 ([65.54.190.123]) by bay0-omc2-s25.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Thu, 7 Feb 2013 03:39:49 -0800
X-EIP: [IqVGmK0w0oLjwT2X+oNKJGn1RTxTliB1]
X-Originating-Email: [nultyri1980@live.com]
Message-ID: <BAY146-W18416BA2828AD7841F411EC2060@phx.gbl>
Return-Path: nultyri1980@live.com
Content-Type: multipart/alternative; boundary=”_9a9adec8-f8e1-4b56-8b33-1467878732f5_”
From: Nulty Rita <nulty.rita23@gmail.com>
Sender: <nultyri1980@live.com>
Subject: waiting to read from you soon.

RECEIVED_IP: 65.54.190.123 IP_USED: 65.54.190.100

THIRD HEADER:

Return-Path: <nultyri1980@live.com>
X-YahooFilteredBulk: 65.54.190.102
X-Originating-IP: [65.54.190.102]
Authentication-Results: mta1285.mail.ac4.yahoo.com from=live.com; domainkeys=neutral (no sig); from=gmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO bay0-omc2-s27.bay0.hotmail.com) (65.54.190.102) by mta1285.mail.ac4.yahoo.com with SMTP; Thu, 07 Feb 2013 03:24:22 -0800
Received: from BAY146-W47 ([65.54.190.123]) by bay0-omc2-s27.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Thu, 7 Feb 2013 03:24:20 -0800
X-EIP: [GjEee5wEdwhjQ6WfsAb/S8iGhYrE9CEz]
X-Originating-Email: [nultyri1980@live.com]
Return-Path: nultyri1980@live.com
Content-Type: multipart/alternative; boundary=”_fb412a94-7270-497c-9056-a6250dfe01a4_”
From: Nulty Rita <nulty.rita23@gmail.com>
Sender: <nultyri1980@live.com>
Subject: WAITING TO READ FROM YOU SOON

 
1 Comment

Posted by on 02/04/2013 in Romance Scam

 

Tags: , , , , , , , , , , , , ,

“Rev, Mark Hill” “DR. PETER CHEQUE”

CHARITY SCAM – COUNTERFEIT CHECK – FRAUD

THIS IS A NIGERIAN 419 SCAMMER

UPDATED I’VE POSTED SEVERAL EMAILS THAT I’VE RECEIVED BY PETER CHEQUE (ALSO KNOWN AS) MARK HILL

check-fraud

EMAIL: Hello: My Dear:

I wish to inform you that I concluded this transaction successful last year
with a lady in London and I am currently in St Thomas Hospital in London
waiting for the right time of God.

I dropped the (cheque in bank draft) for Your compensation, by trying to
assist me but it did not work out between
Us. The amount is US $ 5,500,000.00.
now contact my secretary Dr,Peter Cheque he will help you process.

I did this out of sympathy and good desire, I want you to make very good use
of this fund to assist the less privilege as I have few months to stay alive,
I have a kidney cancer and I know that am going to die soon.

God will bless you for your efforts and I hope you will be Satisfied with this little compensation, I will advise you to contact him

Immediately through his e-mail address 😦 secretarydrpetercheque@live.com ) for the Delivery of the bank draft to you, I hope you will have a nice life with My token of compensation for your efforts and God bless you.

Sincerely yours

Rev, Mark Hill

HEADER:

Return-Path: <revmark.hill@yahoo.com>
X-YahooFilteredBulk: 93.180.20.164
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: pwvmn3QWLDtkn6kYY_YMNtA2mo2KVOO1jpnUxR_xqcd3L6Za tTjpQHR2NMrvDpI9Ie8mJSa8nJCF_JaK1curhsIxxrCXDh963xR72_M5ZEXq 2USwVCxvOlVYGFDtvt4yCgh380X8rrXpmCzfp_YdjH.urQ7xEvzHoHWBEecK JKgFiXHwnNha7dOH3JIsYOstf5QTjAcP1MS.c0zev280tHGT_qQfiEeytuAl JQKyqrcQ5UMJipgnONdkhb0vCOBaVjon0rdOcJ7Eq2UTnR.gQz61YopdQgcD EBpxtDG.Hh6QyT40tRmgNytNt5Y3icvs2ahBMJd3eerdtTFpH9A3_845D28R f5OBFW_INRSPXlBsdjP1QR4EJ3cuqMsXRxsAGXiLr7As.YBVUG9leL6Vb0SL jK2tz_8sN4.8dysipI.PpCLxtzG2sasSzzPwT9yGe7ybfprmyCJh213lHNq0 P3VGFFv6pHN0_gd8o4uYcoVWhrsHa2Dpd7407MCOFdo4TkpZPFi.XiIJudH. PNhZcMfIY6p2miXudToKgKASedTZZfNUHD8TnDg6F0Oz7J9dkgje1DuH_LcU tzAF1g_gMYGBRXndY5gRracjt83LlDmsCj4Nq..cly_fI3HhCTbEPCsfDCWS VmODBLTxT595IxuVppGWhEHkSnPpOmq_qJz.AaDiNHKOCuB77SKbfb4pn4u4 1C7EOU9cmiaDTdwlrLY9qaZty6vHSgEOgmrRfc8JGzHCi9rSjeRKJyPVRKeA 1uP1T0j2GM1eOJYyX8n0gIvVj6oQ8wMzRWF7LR4fLjm49D7.JLch46acVP4y geKejT5nm05MkyoD2iLYS0iXTeWXPFkLTxmDuul8YhjuX2bvr9Q19MV21hZF edU0xZg1KTTvMGFBvKgz5juU.ikCl1tIuXkcY2MXmK6thLxA4D3R2liFEuV3 OAd.v4BkOu6Og_5wGOfDSK2vcxXE2hGhL5G88M.OFzn0FkuVky0_Kti_GGwU FyRKA0ZudYx6MPIP5by7EfyRu.KmOe_EClbMoNtqt7dIokp87gwQxwUjzJIg h4fQG_kDSEhZlEs1GtdwHmxo1J.qZlZeZqKoi1GQfSvYRlk0IOFYd7SiPtP. G56xaMfm2O50wWasX7vFDzR2NwqlZZjlq_81XnD2JRl0Y3GykV6HaBm.9olz lPQBTIA6yCi.n7yFLkQnejEjq.4seWdDdsm4A4M8fL.arU5m9IG9hfgRwR2M jVvhkuHykVtOyeeW7qL.G3NHK43MhpquRtuQD07HqWptUaTsU6qIv..D02yS hOjvpgYqd9NtER1ki4ibyeUinmLbv03czD7Ovk2gJhC8ue.rrV6UMznuTPBs dfqeR5_xLD378tEXNTto4Uj5vj9ZkmZ4QcpT1ULIJmVEu_1FDHlTVpsfy2RW V8FbAzp9NKN4tjbpRsLjI_9PgxD3dXSXyYFS8.jvokd9ySTPJZnE9EW2repn q_kZSqDOwKz7Mi47jxaJeA4XEPm.n7TvP4zskyT9TKxDgnbx5XamL4jekcbn 00WRYhYNCqbzs7VUjBy_tF_akjdlXSuLlK7L9U4awS3WnM2LW4KLQybRgH6a zNcZJVPFzg–
X-Originating-IP: [93.180.20.164]
Authentication-Results: mta1492.mail.mud.yahoo.com from=yahoo.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO mainframe.localhost) (93.180.20.164) by mta1492.mail.mud.yahoo.com with SMTP; Mon, 17 Dec 2012 19:07:42 -0800
Received: from User (unknown [41.211.201.178]) by mainframe.localhost (Postfix) with ESMTPA id 3A91433EEDB9; Sun, 16 Dec 2012 20:21:06 +0400 (MSK)
Reply-To: <secretarydrpetercheque@live.com>
From: “Rev, Mark Hill”<revmark.hill@yahoo.com>
Date: Sun, 16 Dec 2012 18:30:11 +0100

Rev Mark Hill <revmark.hill@yahoo.com> RETURN-PATH: revmark.hill@yahoo.com REPLY-ADDRESS: secretarydrpetercheque@live.com

X-YahooFilteredBulk: 93.180.20.164 RECEIVED-IP: 41.211.201.178 LOCATION OF IP: LAGOS NIGERIA Dr Peter Cheque secretarydrpetercheque@live.com

________________________________________________-

RESPONSE EMAIL:

EMAIL: Mr __________,

i have receive your message, yes i am Dr.Peter .O. Cheque the secretary to Rev,Mark Hill and am so happy to hear from you because your cheek has been long with me and am waiting to receive your mail since my boss kept this cheek with me.now i want to know how do you want to receive your cheek is bank to bank or do you want it through courier service.

i want you to make everything fast because we are about to enter Christmas before the date we will celebrate Christmas.

do not fail to call me immediately you receive this mail.

Dr. Peter
+2348035762383

NOTE: AN ATTACHED FILE WAS ALSO SENT WITH THIS RESPONSE EMAIL. I DIDN’T CLICK THE FILE BUT THE TITLE WAS ID_CARD1.JPG

HEADER:

Return-Path: <secretarydrpetercheque@live.com>
Received-SPF: pass (domain of live.com designates 65.54.190.101 as permitted sender) IG1lc3NhZ2UsIHllcyBpIGFtIERyLlBldGVyIC5PLiBDaGVxdWUgdGhlIHNl Y3JldGFyeSB0byBSZXYsTWFyayBIaWxsIGFuZCBhbSBzbyBoYXBweSB0byBo ZWFyIGZyb20geW91IGJlY2F1c2UgeW91ciBjaGVlayBoYXMgYmVlbiBsb25n IHdpdGggbWUgYW5kIGFtIHdhaXRpbmcgdG8gcmVjZWl2ZSB5b3VyIG1haWwg c2luY2UgbXkgYm9zcyBrZXB0IHRoaXMgY2hlZWsgd2l0aCBtZQEwAQEBAQNt dWx0aXBhcnQvYWx0ZXJuYXRpdmUDAzMCA3RleHQvcGxhaW4DAzACA3RleHQv aHRtbAMDMgJJRF9DQVJEMS5KUEcDaW1hZ2UvanBlZwMDMTM1
X-YMailISG: RUSkN6gWLDtVRR2I.osOnZooN6mof1tzTkJBSELxSzvipL2U wlBMz4XHvtip6BJimPiY3ANJpiunpS_P4t7.2UBBu67Afnlkq.PVu8k2.mbW maprp2gMR8v.iOe5sx8uj746OaF4yWi7XIT6j6MY.9iHB85lozYudtyn3MTR d4hfTWMNA1or45531SO7UrO7YC7AXu8BSAxlQfuZikUF_sjf0m4wAqJyzHeX iUWCLP.7RNA5YrCp8GGULn_5m4vXN.Qe1NR25UPRXtrMHhqsldFv5SHdpYI9 3bMw53Ry6Koa__vfO6GmqPpQkU2qiPNSJoX6.mBXDZHj_PjQohyZZ.NGeFny _2FMUJq1Eebewrq6yjHUVCAGitlH70HPTWsH5axyEaStXjlMJufOcOF2VBoY A6qEu3WI5ud2bp2jAWm3JFLniLjQWl1_scqj_lZGK.ojL.372ajYAq2ibxZK 9fD_iulppvkxLfziYl84ZCHYcHhnzD7aLh2C5veXJhAU1r.zEzkgI3qLTYD8 Dnsk9u547G4XMLgcpzOd6IuZXV9Yk4SiC9mlzHR2E4aq.PnQ3y24eVy9WMNk 9cHnUC4GIuq7hBqcK1agWzWj4WvEz4rHQ2k_FGCgdtq9nJTKkopxr1fly.Tq ktyAucn3XVU3R_8HHbaya_3BZdTQ7CloOAImnHAEKgcNKvVyXmr0lWZJmcek GXeQIfUzGSJ_LCQXoE2SyhY8MuiXW.y_bG1zZzp1Gfnh8GRDPWTjc4WQ_1bi uIBSdhjH5e9hXfFNPdASN8YeLYj7SCqzM14hLe.u277C6p..x3Fc5HDO8RPi OOxKex2UCvKl8x2QmMvcRIOBJOoLn3.ddvbQ7FjEcTY3MJWhsKZ4WZ1wIiMZ 1gIo0DzXU4Jmqv_JwKvhfh_E5AVfGFYbg50XotCg_lFJwyCq.wpolxuuVH3u nlc1AbVE99vR7UuBBbpIRsGBivT2K2Fiid.fwUZ8lyf9RF.asdeS62y7ntUn BFThAsAWLAKpDNy6YMw4RBou_kPTk1aBdldafhI2W12s9iHKsbnxW87LPKaj lGMjlHvA9_UT1nqVSLdzL8EmTXX2RoaBBmAU.PI1vLpDrbQP4C0iWaBe_xF. XP1MnJ382xCgWS37RdTUZifGQ3ZAKssK8Ip6FKH8SRqtU7HlUvhO1E02y0Tb CYixL7UcirFuTOabQf.GX5xZCtHbWr_swjJ2FeTVGkYKyOs.N_fr_rR4P0BV RqGPee3YabHAYEsmk6Q6BWCqbfnzno_hFre0itCMOdkyzCGqvlnPiNUbNpbP kh0h1EcKAvhS1k5xCmO1yh3O88Y3oXW0Jw8-
X-Originating-IP: [65.54.190.101]
Authentication-Results: mta1151.mail.mud.yahoo.com from=live.com; domainkeys=neutral (no sig); from=live.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO bay0-omc2-s26.bay0.hotmail.com) (65.54.190.101) by mta1151.mail.mud.yahoo.com with SMTP; Tue, 18 Dec 2012 13:14:57 -0800
Received: from BAY155-W28 ([65.54.190.123]) by bay0-omc2-s26.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Tue, 18 Dec 2012 13:14:29 -0800
X-EIP: [NvgX5uvdCFPPz2bU+U8E9Qs+5Fla2BpP]
X-Originating-Email: [secretarydrpetercheque@live.com]
Message-ID: <BAY155-W28E7CCA29165639E797CC5B0310@phx.gbl>
Return-Path: secretarydrpetercheque@live.com
Content-Type: multipart/mixed; boundary=”_6622ba1a-8445-4dd5-8cb6-c35ba5e65254_”
Reply-To: <secretarydrpeterchequ@hotmail.com>
From: “DR. PETER CHEQUE” <secretarydrpetercheque@live.com>
To: deleted@yahoo.com
Subject: RE: Hello Mr (fake name)
Date: Tue, 18 Dec 2012 22:14:28 +0100
In-Reply-To: <1355814088.88125.YahooMailClassic@web161002.mail.bf1.yahoo.com>
References: <1355814088.88125.YahooMailClassic@web161002.mail.bf1.yahoo.com>
X-OriginalArrivalTime: 18 Dec 2012 21:14:29.0111 (UTC) FILETIME=[AA87D870:01CDDD64]

FROM: DR. PETER CHEQUE secretarydrpetercheque@live.com REPLY-ADDRESS: secretarydrpeterchequ@hotmail.com RETURN-PATH: secretarydrpetercheque@live.com X-ORIGINATING-EMAIL: secretarydrpetercheque@live.com

X-ORIGINATING-IP/X-YAHOO-FILTER-BULK: 65.54.190.101 RECEIVED-IP: 65.54.190.123 — +234-8035762383

__________________________________________

DO NOT TRUST ANYONE WITH CHECKS IF THEY CANNOT EVEN SPELL IT CORRECTLY!

MOST RECENT EMAIL RECEIVED ON DECEMBER 24, 2012 —

FROM: DR PETER CHEQUE secretarydrpetercheque@live.com REPLY-ADDRESS: secretarydrpeterchequ@hotmail.com (NOTE: BOTH EMAIL’S LOOK THE SAME BUT THE LAST LETTER OF ‘CHEQUE’ ISN’T ON THE RETURN-ADDRESS AND DIFFERENT EMAIL SERVERS (LIVE AND HOTMAIL). SCAMMERS TRY TO BE SNEAKY, HOPING THE DIFFERENCE WONT BE NOTICED.)

EMAIL: Mr (fake name used) ,

i have receive your message, yes i am Dr.Peter .O. Cheque the secretary to Rev,Mark Hill, i sent you an E-mail and since then i did not hear from you and am so happy to hear from you because your cheek has been long with me and am waiting to receive your mail since my boss kept this cheek with me.now i want to know how do you wish to receive your cheek is bank to bank or do you want it through courier delivering service.

i waiting to hear from you as soon as possible.

do not fail to call me immediately you receive this mail. here is my official ID Card.

Dr. Peter
+2348035762383

A LINKED FILE TITLED ID_CARD1.JPG WAS ALSO ATTACHED TO THIS SPAM EMAIL

HEADER:

Return-Path: <secretarydrpetercheque@live.com>
Received-SPF: pass (domain of live.com designates 65.54.190.101 as permitted sender) IG1lc3NhZ2UsIHllcyBpIGFtIERyLlBldGVyIC5PLiBDaGVxdWUgdGhlIHNl Y3JldGFyeSB0byBSZXYsTWFyayBIaWxsLCBpIHNlbnQgeW91IGFuIEUtbWFp bCBhbmQgc2luY2UgdGhlbiBpIGRpZCBub3QgaGVhciBmcm9tIHlvdSBhbmQg YW0gc28gaGFwcHkgdG8gaGVhciBmcm9tIHlvdSBiZWNhdXNlIHlvdXIgY2hl ZWsgaGFzIGJlZW4gbG9uZyB3aXRoIG1lIGFuZCBhbSB3YWl0aQEwAQEBAQNt dWx0aXBhcnQvYWx0ZXJuYXRpdmUDAzMCA3RleHQvcGxhaW4DAzACA3RleHQv aHRtbAMDMgJJRF9DQVJEMS5KUEcDaW1hZ2UvanBlZwMDMTM1
X-YMailISG: u7Xw5CgWLDskNbn_vf28.6TFtwB8ZjMwD3Tr9g7mPToJbbmb qMLKMUH9Q3aUWOMruqQtUyeZT3qb70PQLUefoD5lm1jWzAawy5lgU4LJYTy3 1118IDtbWA8MAiAa6IYDI_JTW9rJqZPYcOjqWvfyAnM2aDs4_a15FWyzMsql .LvKJ6IV_HYq9uddIgSvKDZAolhSD7PIj.4b4G2f5R5r3OlrDTcFke0iLDBN AT8AI5_gh_XDBOdW9VGLf7S6ROvcCuxRwL9vy9V0LSWuptXfX6NIrNwlKnNG kC5kU7zMB63.t0bd4ZlB9Bh1fISYZzwXaxwDKMYp8NigkCruFZC0e_wsjruX X4ubJmnvqY4NN2e7UleQdF3TS0ntxX9lobcH7NkzqPOGIE1di9X5MnG2yMc9 I_AqDqmuY_neshsenroHWAUiunfWWaj6.xrv0PRcsfRnSt6Yi0O_cGYFZAQ7 4chcyWUgHi8_I4G1jGAmbYbRph5bLpOTxKRKbXs6nWkl7ZLZvbNmRfY1N14c CM3uKpPGErwMJrP4z3JDavBlz8K1P5fGcJjwvxS9ZRsqgB8j8YBLHSH3wRFd yuM8P7aIKKlEJZ8Gqw3fwett8rquubrlDvd.xF5kCGS1cWNbDHmlwKnSKZkk E_w8lcHe3BEEutUwqyY4aAC1Uqi4kU56wQgHeBHf1zO1VNKPlKaIhm7ubDul HZYXxmntR93qMGrclxIueQWvk_FnJpnozLrgjMV9BdD7X8agF9nS5ZI4IeCz rfueY5q5auoteKHQx9RUyTJ6Qsi7NVIdCqsAQJc7677ftOAb1Z_NNKQgSua. DUoLqO_.tVqz3vWPEJJSbOlFIihLHpazSLUbfT5FXfA7a1RZf548tB.4t9zY ZfbZUqVhfkZQfMus2Aj8HUljvBcfnAaBH_1vyQMewExzsULYNZZ2zK.jJxem 1Nmw_.tGS_YrCAK5A1Jp3TxedgUYThYTTBFWXiuV.gUEfBLjmzIopdrsh82l rLJh5acYoaliKMHuRn6XF3XFSOFgI03R7NdKEXVElP_CyzRlpJkUP_BjJgux BNwsgOqAAo3ocEHzmMMwEMjNCPcI50uMwsOxhr9WS6StZIp2xBkhVFObLsx9 uwRviUfvGVx1NU3fIqB0lCtqj3j5HR7d9Gvzjj_11dM5pRoAoIZ2e25n2n8W xYdRRlV28Jbawfj4mXyolDt9I8QfH9aZuFQ6hHZzA6uF.SZfIzyAdZUc8aaL GCee_WkMwEZiO4JvdIgqndkS5poxhvxbQ0m7LJXrthUUjPWHSP0ERxKLDqHE NI1UU65OnE1DSwyK97w24w3uhAzf.IOl0Q0B7w–
X-Originating-IP: [65.54.190.101]
Authentication-Results: mta1263.mail.ac4.yahoo.com from=live.com; domainkeys=neutral (no sig); from=live.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO bay0-omc2-s26.bay0.hotmail.com) (65.54.190.101) by mta1263.mail.ac4.yahoo.com with SMTP; Mon, 24 Dec 2012 02:02:38 -0800
Received: from BAY155-W49 ([65.54.190.124]) by bay0-omc2-s26.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Mon, 24 Dec 2012 02:02:37 -0800
X-EIP: [BeN0YL2exaSamhdrCnicMrY51kryhvHh]
X-Originating-Email: [secretarydrpetercheque@live.com]
Message-ID: <BAY155-W4968A3A75E3CF4E33A318AB03B0@phx.gbl>
Return-Path: secretarydrpetercheque@live.com
Content-Type: multipart/mixed; boundary=”_053f2ce7-b584-4572-aae5-f7de5b457928_”
Reply-To: <secretarydrpeterchequ@hotmail.com>
From: “DR. PETER CHEQUE” <secretarydrpetercheque@live.com>

ORIGINATING IP: 65.54.190.101 RECEIVED-IP: 65.54.190.124

 
 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , ,

 
%d bloggers like this: