RSS

Tag Archives: Beneficiary

“Mr.Conor O’Dea, FCA”

WARNING: INHERITANCE SCAM – FRAUD

monkeyscamgif

SUBJECT: Re:SEASON’S GREETINGS-(DID YOU RECEIVE MY EMAIL) ?

EMAIL: Complements of the Season

I have beign trying to reach you for the past few months without success,I
do not know if you received all the emails I sent you in the past months ?
Well I am writing you again now because it is the holliday season and I
believe you will have the time to check your email regularly now. My name
is Conor O’Dea, I am currently the Senior Executive Vice President,
International Banking Butterfield Bank (UK) Limited . Please view the link
below to verify my identity.

http://www.butterfieldgroup.com/About/corporate_governance/mgmt_team/Pages/ConorODea.aspx

I have the opportunity of transferring a substantial amount of money to
you from one of our banks in Europe. The money was deposited in our branch
in United Kingdom a few years back by a wealthy contractor who is now
deceased and fortunately you have the same SURNAME with the
depositor.Considering the fact that the depositor has no traceable
relative who will eventually apply for the claim, I decided to contact you
so that you can apply for claim “WITH MY ASSISTANCE” and take custody of
the funds for our mutual benefit. I will not mention the amount of money
which runs into millions of USDollars presently until we have agreed to
deal. I trust you will understand the need for such precautions.

Please note; in 2001, I succeeded in claiming $32million with the help of
an American, but by the time I went to receive my share of the money from
her 2 days after the money was released into her account, she had changed
her home address and moved out of CALIFORNIA to another state and till
date, I am still searching for her. But because it was a deal and
confidential matter, I could not seek legal action against her or even
inform the authorities. So to ensure that I do not make the same MISTAKE I
made in 2001, I will have to meet with you physically for discussion
before we can proceed with the deal.

I CAN ASSURE YOU THAT MY PROPOSAL IS NOT A HOAX, AS I AM READY TO PROVE MY
IDENTITY TO YOU AND THE REALITY OF THE DEAL WITH VERIFIABLE DOCUMENTS.I AM
SURE OF SUCCESS IN THIS DEAL BECAUSE I HAVE DONE THIS BEFORE. For more
details, here is my direct contact email ID :
conor.odea@ukbutterfieldgroup.com and Call me on my Director Phone number
: +44 7045777868

Thank you in anticipation as I wait to receive your response.

Mr.Conor O’Dea, FCA
Senior Executive Vice President,
International Banking BUTTERFIELD GROUP
Direct Phone : +44 704 5777 868
Direct Email : conor.odea@ukbutterfieldgroup.com

HEADER:

Return-Path: <conorodea_creamsontide@hotmail.com.au>
X-YahooFilteredBulk: 72.3.230.98
Received-SPF: softfail (transitioning domain of hotmail.com.au does not designate 72.3.230.98 as permitted sender)
X-YMailISG: VWfCZooWLDtob_5I7zp.u7JKrasPt6sWIe4W7rBfQ5VjEMGl zVbWn1k6Dej4Yr9vM36uHpWWJQKE8HUZKcYplM5pImARjTdhFkj7gtZgd5Ms uHZXe9xS4PBdI6zrS5d7.VLandDtsQovOxYf.XauaSXfRynmUqODYmjOs1Yv c_3G.ygbLa2clhRoJTpKK81ICqgJxtcDY1eDMITG8w1AqxAQauU5HZ84ZD2w 42Yln7iDMW0t5ItvezGcFxELMjUFZSwGlI1W_ER4unAXaSzPIF96Hf1RR6x6 6_6V0_EsqN9UjXdelpN6.w0kadBov2CjG25dkZUC5EsbClmaRImd3yLrlnMB fzG5EcQlrjdgHAFuXyAMzjzisU6xpxvgd0sRbtIr1fTwWvrUYVkULTg3UkBd AHIEFFXeFsl2tforTZLYlaEpxDHo6g.iUjZzOGo6pH6ELw2lvVCE5wpH21OQ AOk4VF_gBBIJg03rEA9zOFnW4bYJBBMF0CN.jmq2YAm1ktkaMAikVJCghhxM fjauG6C8iB9OPQl1S_bCRS9P3uFl_Rto9Iq5e4v_oqt51K4T89w0Dxyac8Cv KGXUbqsPbO33ZqOuM7b9kLDHhuww2b37qngpWwDmFhkowu9W04TpVmRlJo5M fBI5vL4DtB9XZm5LryRTzqS6REHytBycMgMjhfCckJ4mrDNjUzAFRrSA31sL yT9o58eP8edlGVlTrcZnueQ90cJbb6RSwNiDKLNBqKWYPnAK.oXsnQB89.c3 OSIRGyfiDaT9P19Bwm87VSBkrFPEFmP2Fd_qQRtTcVLEIYdNUNtYYyjWoG3Q tCB2xbTORL4WptfD7RoFLMGp8xb19y3bmd7sVAClvl0aM3IkhHoiIp5pEfA7 lQHSWNVsqpJP58RzbskeM9bQZA.uVm4DvPluFug6lySz6GtFzvH3F2dF.9lM .keQBronlq0v82bd5XSmT3Zou8LobOhTYqxADJmq0CvKQ7J6V9GgMpCuDjOi LPnIVAoloVqtQC8ZDz3XLA93pUWef1wTo2s4nJjGVMPSgvP_maKiVQRenVyk WKPOeX_.hAz.2uCbyzqvKP8FMM_VNB4wdyKiHSR9DLWosps9aeS5_uJRQ8Xy t1oGT49jF8MxNvNjmdmsDFzfeaC9BeH8AysfuZe5N4QV01n4LZvveF9WHyca cEPXaemBUOoasqkvjoMPjV8NDIeAGbrcMk7_2RuC7_ITFBZzDQeaAlZ9i66V 1JuhgivGzqi7tHGsCgLcVIuSCMEzZ23IZifSVG1moA4ALAiKuJQOOxWByqTk pEvUwy6M_pN1A.6X64duMFGb0xjof3W2_EJFSm62.t7AjXwleI_dTMuH6n0E yceXZvRIxNdhVa8qe5gAdnMzQuYQtQod2tPX9z1a8mhqxatXdwTU69kPLxjH Olix1i5miyPTGkcqFrC.5.ML7RfUvaXjOpboSkR9Gaeg2UfSVW4Giw–
X-Originating-IP: [72.3.230.98]
Authentication-Results: mta1073.mail.ne1.yahoo.com from=hotmail.com.au; domainkeys=neutral (no sig); from=hotmail.com.au; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO 86883-web1.www.welist.com) (72.3.230.98) by mta1073.mail.ne1.yahoo.com with SMTP; Sun, 23 Dec 2012 11:53:03 +0000
Received: (qmail 25153 invoked by uid 48); 23 Dec 2012 03:55:13 -0600
Received: from 74.95.184.209 (SquirrelMail authenticated user nathan) by 98.129.39.50 with HTTP; Sun, 23 Dec 2012 03:55:13 -0600 (CST)
Message-ID: <5619.74.95.184.209.1356256513.squirrel@98.129.39.50>
Date: Sun, 23 Dec 2012 03:55:13 -0600 (CST)
Subject: Re:SEASON’S GREETINGS-(DID YOU RECEIVE MY EMAIL) ?
From: “Mr.Conor O’Dea, FCA” <conorodea_creamsontide@hotmail.com.au>
Cc: conor.odea@bankersmail.net
Reply-To: conor.odea@ukbutterfieldgroup.com
User-Agent: SquirrelMail/1.4.8-18.el4

FROM: Mr Conor O’Dea FCA RECEIVED-ADDRESS: conorodea_creamsontide@hotmail.com.au CC-EMAIL: conor.odea@bankersmail.net REPLY-ADDRESS: conor.odea@ukbutterfieldgroup.com RETURN-ADDRESS: conorodea_creamsontide@hotmail.com.au +447045777868

74.95.184.209 98.129.39.50 ORIGINATING-IP: 72.3.230.98

Advertisements
 

Tags: , , , , , , , , , , , , , , , ,

“Daniel Lukas & Co. Solicitors.”

WARNING: INHERITANCE SCAM – FRAUD

UPDATE: There are three emails sent by this scammer posted below. The most recent email being 01/18/13 — I’ve also posted the header details under each email.

EMAIL: — Inheritance funds in your favor from my deceased client. Please contact me for further clarification.

Regards,
Daniel Lukas
Daniel Lukas & Co. Solicitors.

HEADER:

Return-Path: <rvillarreal@eup.k12.mi.us>
Received-SPF: none (domain of eup.k12.mi.us does not designate permitted sender hosts) IG15IGRlY2Vhc2VkIGNsaWVudC4gUGxlYXNlIGNvbnRhY3QgbWUgZm9yIGZ1 cnRoZXIgY2xhcmlmaWNhdGlvbi4gUmVnYXJkcywgRGFuaWVsIEx1a2FzIERh bmllbCBMdWthcyAmIENvLiBTb2xpY2l0b3JzLiABMAEBAQE-
X-YMailISG: H7GTMzEWLDth8XsbWMN0eof8uRII2KL9R5W7qCjkkZ1RGEa2 xViCZM1ZfjNHSRJBwFstj5uMtYLyEB3.9fqI2fPVgdhM8PQAZ4RhuQ_iqt9i O3viernQ8UZU5UEzB_P1TN2nUwhMpCQvyyahwciA7xXnKIB4iT.gtlKEobYJ LQA9ZsL_zj3jN1hQjNqQtJ4iNiUe_oa.oLTK1i4eVwJ5F375UjTp.bBJmzsu mkqUHiPOco8z2veiUP2JKAddJDr5L1QVmfVvpIyNKXuNcn6.5UqNJfKaI0UI m7iJU7v10OJwfVvOIwjAH4dfQ4V3uhZYM.H55YiMzhgmZXRdAa5HoREfhvjA 6I.Hgeq23YIGd8GJ.7FWKFcoh_1bi2imijagPHuhxKo_y_ah7932yHNqqXjk 84LhBlk2Y7fu7TYrbLW3j0ewNknA15_NpLftxjm8dXbuh3_kxp4QlgLVQuNm 2uOXwwmwmy53hsvuqseLBCm_STiSCr2xe90.Y27ujXlb.HFN_LQpK5XBecp. IEiZ7MLtlB0w7sirxL0CvahU19lp7X.zFAEYUeeOUUcn31mEBKkamIaDuvaC UFHTkZbp7s2v9D.uD1EOTueBSixJeHfBxHmswQYebf9mb_U9EUwnqlGucD9h eVql1XrlGX5sCEkMFU1DyyZmJMybXtLv8Q7EOTNs8WpbWOulY1NOShXqyi7f eJfKARTa5VTY9zFJzpvBbH6jxNR2yWEsX1MIdDIr9bflcIZ72jqEKoilUPBb 63JPBG.ohv7RvpvcvPuylwmKP0kpGPi6cNzh6.UhCW4BiUd167gUmAauRUAP xKZCDqR7dMILoQn_Xk9JzH_nPOKJD6JX2xhmPw_jmHVHBwgYsxhI4ALg7q6u JSGhG4E6iG7Piho2_fdNPK24FsxU_hIqCCbyc1sw0tm8W5BDhFfuZWBDMC72 B7vXI9Bl1wwynyC0s5tdHCHZBOEgOmL4vqXSjdScxTbEhHFrRuZmac38YbeR iNKM2k3KDpyUZ.O.PWs1mkdGeSF9u39Yugv.lv6lwhFBLyXBoP1_4zGLHZo8 mFWCBC4fgkvuyZp1_FPTtZGGX8xxJ85VAk2Y6E_Km9q8kaXEYYzp9_yY1JLQ UM0CZ_3H7sMiyEH2UyOL3_qQZKf1s4jGn1LlH4jWY8_swQP47MT0u751iLMl o6n5Jkk_mnsovRgv_8fnW_y39sTPBX6Bu8_FtQyRDwaCVGY0h9R66BwUSIy. DYJXx6HJV7SdGRdY6kM9U0.FuSGct6LDENYUmOO1Mbn8
X-Originating-IP: [209.85.220.194]
Authentication-Results: mta1253.mail.bf1.yahoo.com from=eup.k12.mi.us; domainkeys=neutral (no sig); from=eup.k12.mi.us; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO mail-vc0-f194.google.com) (209.85.220.194) by mta1253.mail.bf1.yahoo.com with SMTP; Wed, 19 Dec 2012 08:54:57 -0800
Received: by mail-vc0-f194.google.com with SMTP id m8so583375vcd.1 for <>; Wed, 19 Dec 2012 08:54:57 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:reply-to:date:message-id:subject:from:to:content-type :x-gm-message-state; bh=jTcCiqbk1kb9vbH2HVVJCUQUQpB+q5Ldv/qV/McSoH0=; b=KE/VRmZpZQX2AGxze9+sfnTDLJnNr/xpn5q/rvZWQDHarjqlAIH8eNIhnkdaOCENd/ cm6Z+6kbhCNlauDDlK3OHmX/C7so3pVyRBC6D9f+fSeLQm2QwobW5vk8w8REV6LlAMxJ shJYwCVbN4xWPhmYYoIAqu1mGyu+ID59QXsp6B6IVnjFAMJEZYgeWjCKWhguXRJejbLm Xby0i5j4RnyO0Ao7fMWeY7fb5OXSJFCfs7D23akbc74+Ip2WxyyeSe+Twwoltj6cOKaY DLdTmkUD+dFtMT/Dy/nOGe6+3Zxshb7Dj6oR5Bm+4G4TBL8asYkdo2Fc2DlBDpR9vuO8 bkdg==
Received: by 10.52.71.174 with SMTP id w14mr8392003vdu.122.1355936097412; Wed, 19 Dec 2012 08:54:57 -0800 (PST)
Received: by 10.220.42.201 with HTTP; Wed, 19 Dec 2012 08:54:57 -0800 (PST)
Reply-To: daniellukas622@yahoo.ca
Date: Wed, 19 Dec 2012 17:54:57 +0100
Message-ID: <CAE1ot+mwwbGvrDuV0FYdmPYa5BJHcaqEtT+pyAX0cjf_oBOsxg@mail.gmail.com>
Subject: Inheritance funds
From: “Daniel Lukas & Co. Solicitors.” <rvillarreal@eup.k12.mi.us>
Content-Type: text/plain; charset=ISO-8859-1
X-Gm-Message-State: ALoCoQnIbnjpcEb8tIJzi7AjSWURITUopYnYykI6WAxnCb8oifW/ARz9psKqGaMhwlwlEnaTfuh8

Daniel Lukas & Co Solicitors rvillarreal@eup.k12.mi.us REPLY-ADDRESS: daniellukas622@yahoo.ca

RECEIVED IP: 10.52.71.174 X-ORIGINATING-IP: 209.85.220.194

__________________________________________

Dear Friend ,

I understand that through the Internet is not the best way to link up with you because of the confidentiality which my proposal demands. I hope that this letter will not be a surprise to you, Sequel to your non response of our earlier letter sent by post to you.

We wish to notify you again that your name was listed as a beneficiary to the total sum of £24,500,000.00 Twenty Four Million Five Hundred Thousand Great British Pounds in the codicil and last testament of the deceased. Name now withheld since this is our second letter to you.

I contacted you because you bear the surname identity and therefore I can present you as the sole beneficiary to the inheritance. I therefore reckoned that you can receive these funds as you are qualified by your name identity. Please note that I never said this person was your known relative, but that you were nominated for a simple reason; which is you bearing the same last Name. This would be done in accordance with the Inheritance Laws of United Kingdom by obtaining the Court validation paper as well as a Letter of Administration.

We have the responsibility to do this, without this process the inheritance would be taking over by the Crown Court and released to the Government coffers. As soon as we get further response of your acceptance to receive this sum, we will forward to you all the relevant papers and forms by email or fax because we hope to finalize everything within the shortest possible time with your full co-operation.

However, the same United Kingdom inheritance law prevents an Attorney, Solicitor or Law Firm from being a beneficiary of an Estate of any client; hence our reasons for contacting you since you bear the same last name. Therefore, in plain words we are nominating you to accept the responsibility of becoming the Administrator of the estate, which is, receiving the Inheritance Estate £24,500,000.00 Twenty Four Million Five Hundred Thousand Great British Pounds for the purpose of distributing it between you and me on this ratio thus; 50% for you and 50% for me .

The funds £24,500,000.00 Twenty Four Million Five Hundred Thousand Great British Pounds belongs to one of our foreign client / customer who died along with his entire family. We cannot release the fund from his account unless someone applies for claim as the next-of-kin to the deceased as indicated in our judicial laws. Upon this discovery, we now seek your permission to have you stand as a next of kin to the deceased as all documentations will be carefully worked out by us for the funds to be released in your favor as the beneficiary / next of kin.

I am assuming that this is acceptable to you, so please confirm that and I would be forwarding in my next email what needs to be done.

I look forward to your prompt response.

Regards,

Daniel Lukas
Daniel Lukas & Co. Solicitors.
6 Park Lane Wembley
Middlesex HA9 7RP,
United Kingdom
+44 795 529 4300

HEADER:

Return-Path: <daniellukas495@live.com>
X-YahooFilteredBulk: 65.55.111.79
Received-SPF: pass (domain of live.com designates 65.55.111.79 as permitted sender)
X-YMailISG: c_XA6CMWLDs_FBgANc1wfBTctUXii7zCfC6Q.2kPUZkC_L14 Xa8Dy600bk1nB8I9dJBlqxSpQ71DqfqEQ1BMKizVJmcCOf67QmSUBkEG65.R 5vlHcmy1uOEdv14TEXFNZZhxWzr5H2lyVPqRzzB2_k0skh_Uhua4wrFafa4V Z5C_xfJX5y.mgjWOyIcbAoCJOEnVzWzlcNG1as9VdZY_5pteQz5ozEms2hfV 62SnuWlQ32foO9tQaFLTuNa9OyVUGC9HUHyqgF8sOllZSyxjRn5A2UUZrXcN ndeFGsdrCV7rySUitAWwpFwa2npAnV41Z7fIthnScg8_lN.zzx10HU72TmRQ 6KMej7naGmV0y0nzB6yZZbUD9tr2vhMMRIXS1djubeHYF1_Pf20fz0ZUnLDZ QXy_L5p3SaZ1v9tsJDaHBIh7GOvAu9hqwKSDWrgwuXnuJcMVbFRldGpkYV3n ki7GafmndBfk5VMQlqgaUHzOxgma.7LgV2XTcr87Oy6T2lf4fzHuiSrYX8EG ed_dQDGTFr6.sLZ86xJYVDbXQb6yMd_UUw1J.tQGyerFjRxB9FHWJw9Ko2Uv hpnWAj0VfXg9u.5WP9ravleA1pPbt96BGSH4Dgt35xSqcEBSaHxx5YGLJHgy KZc3pCP6bUhiWsycPoZbczlymm2WYTSshxR7DHKFkNTaC41EzUUhr5PdG59_ 8Iwd3lYAdgfM69k53iUNcvcvhR1xetUtHCJKeX204AgDdg6h.Au.SotrdceL 8Q.eJGQ4Poex1xAUfqP1CNATIOk4VOtub7U1F7gVwh.WicOLSm4kr6_JkrTj tjWXNrZ5aj9QD1VWxJ8Z2e4OCs2JqufFCdS8vb5lrwVX8a8lG1_D9dxSIzao acddb2zzj8DmtdwOU4W9NQWwT0JWRwhzY2y7VNmswxLDXAtuTkx4cy..Kl9e DyxD31G.d4OfY6r1pJ0JTyD4xLqyti7mGLdraMgLLldtu6VHK6m6H87fCm8S meRoti..Nd4mnhOH7ZD4toDj7RWxdhKV1QNYJHiDsXDWZdCiKdwgSFK_d2N9 wYLPnn8DCg37HGrFBt3dtViiApGhHorULptnwWXmVl0OrI4zMhivr3bm0x4U ULa6jzkKSkcybwggCRvxfH2npd9v1RmrR.F_y1eUnbhF52HcgmuuE2xK85df zGA66.WgxExPEQyMrPXmo_M.L77yCvHndTVPOGaixesg91BNRA4Eu0lQWwjH NfWz9MTCJA79_iQCKV4fgi35E3RWUyd1oVsQlU32Ckk8xJyn09ZJoCGq8_bZ 4iprbMvMI2Ep2VqYy4b4kywwtR_ih39W4xCeExgNec834uoc2PQBs.k1i9jB
X-Originating-IP: [65.55.111.79]
Authentication-Results: mta1181.mail.gq1.yahoo.com from=live.com; domainkeys=neutral (no sig); from=live.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO blu0-omc2-s4.blu0.hotmail.com) (65.55.111.79) by mta1181.mail.gq1.yahoo.com with SMTP; Thu, 20 Dec 2012 00:06:33 -0800
Received: from BLU155-W15 ([65.55.111.73]) by blu0-omc2-s4.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Thu, 20 Dec 2012 00:06:32 -0800
X-EIP: [w04cDCDdghp6VuOJt91EdSPVqP1WmDTw]
X-Originating-Email: [daniellukas495@live.com]
Message-ID: <BLU155-W156FADA2D96FDD37DEEFCEF0370@phx.gbl>
Return-Path: daniellukas495@live.com
Content-Type: multipart/alternative; boundary=”_b5ecd59c-1419-4798-9b36-d8c4e0e3f396_”
From: DANIEL LUKAS <daniellukas495@live.com>
Subject: RE: Inheritance funds
In-Reply-To: <1355982066.61663.YahooMailClassic@web161004.mail.bf1.yahoo.com>
References: <CAE1ot+mwwbGvrDuV0FYdmPYa5BJHcaqEtT+pyAX0cjf_oBOsxg@mail.gmail.com>,<1355982066.61663.YahooMailClassic@web161004.mail.bf1.yahoo.com>

DANIEL LUKAS daniellukas495@live.com 65.55.111.73 – 65.55.111.79 – +44-7955294300

________________________________________________

THIRD EMAIL RECEIVED ON JANUARY 18, 2013

Inheritance funds in your favor from my deceased client.
Please contact me for further clarification.

Regards,
Daniel Lukas
Daniel Lukas & Co. Solicitors.

HEADER INFORMATION:

Return-Path: <INFO@msn.com>
X-YahooFilteredBulk: 200.11.139.134
Received-SPF: softfail (transitioning domain of msn.com does not designate 200.11.139.134 as permitted sender)
X-YMailISG: 4N_QCnUWLDsqZ0c.6Auymmof9TwGSeQXE8PX0G06ZMKKCyOb MUIys9bEDXG20hiyp8C5VrdCM6lA.TKvtSKbS6SUV82BD5v1TdpbnYWwd5S0 .D6jldiv_S6ghXDxe4NvAtprQPQFnstFAxX2Ff8FigCs6goKTrqCf5txRMtP 0JRWjmXJYaOHsJTlPL2UqPUpzLm8zzw38dClEvV1b8wirs4n9rVSOsN6dGnu r8Bj3jlTzXgqdwt0vYQGI.Qs7iuyYEttepy7M8IGnMnkqmwCJSVxwZbbJDta jHczdIekcfj6H4LQpJfUtL35VnoeQGWUVjKKlt3UlsH5jNKVqSTzNT1xpN_h UiIbRGDGMcu6Dth.P5nJMc500vApyYzODKm6Q7TumsJ7ViioNgwVIEDmqytn iLIjqJjPkl3gnNyPJwwn8WVLXmLF66dAuygeS9wnH2EjLArNGQ_Ygj3mGkdu wDCaPWOj5msEz14Unw7omDqszsLc4gIzyJJR3L7dNMmVGge_TccwLXWdfEKN Ci7_ohOIj8G75g6FGP5KDHGkryjy_wWgAgivPCMZ_ve4bxpzz2LNMYSNzjjo CAUsl0hB27rahPkL.WIPryO8Vsyk_VqetEYfSHevO3jen6Fyv6_TbVgPaEKV _6XKjo0OxUmvDcFZUfz3nQCh0o4hSl2772BecWIOYzStU4kLaNHHkErKqFji K4bNk11zRayrALgdMzyvyL.DwnuzMjVpzOeYlnF4WfZNR.45XMU29wB1LQtO wcP1dj3ZiiRdfisT2DUHvK48lX_e.z5LbuvAdkDxDVe3wr8aihXC5HXK2HUI FBdEXAcreoe5xdAbj_ZX2SJngxYzp8DgGNqnS_5DLlcBz9ewPqxSUQpfZBdc 9QDTdiAsCEsMVaF62kF6tOn34hOwP8dXUt97gRmaS.gf2Q1cnk1k.8muUb8y 7RBmUkjY8pXtPlHksWNObsspiQewqNcVtEv64yXHfoWavy2qkWOYgV6pThQH YBqzlwJdlL4HjImFp_aa_yMIenAidgKULjUTlsNIYegxFfE4Jzn2lwViysyI aqub_FqFFAO5wvoEMoR5wdMj_qcuPDeOK2r3uEP9EjvVhrcAGtCIe7Ya1cBP n53ax3C7wCgdqJMAaZLhtxplTokJsz3l61F6sotQGpNg.2rvYmv.2SpIrETP TTsSOu6BhvFGLwWfmbqNYATIYbuk_NpvQsDG1g1pYt2HzOYhqS83hYEcqkMH Kp7QPWyBivfjEIbVPWBzQ5oVlRInD4W9Tp.tt2tFvyX6uh1NZ_LlWln6skxv cpxOcm4jHdRu6OzbcMPDpUycnyBev8y2I1QBrmOIWA1vrcKoWglLnWezpW7b pwQz18_CTtMxlN00Doadb4HMME89R9gEqG7WaQVzXHVmVr14KVZ..TdWu0.F qnHwGTRMOOvkc8ZFi4zmgg3XOwP6i8xXKGJEHNRcgBb2xcLMu8xgWhbVx8Yc cq930vJNNUfxlcwchihm2VpJuv7yKTBfKHtiDIOT05ouvRiyqF7F4Iob3wi8 FbgraxMyceI8Zf9DNS4ngoFozFxjq5Kw4BNvy1bij8oN9Ll7hfP4uAMhNXr8 lS_WiNG.3P4WIYVce8VtoCfjcDusK.umjwISrs8DMk72i1FZWMfQmWAF18IK z_6m5r9bLRgJPTk5s.CnGmHFPUXgPFrKyhBBqkdw_lbatnkMWMsD0.A2bmYP Hk3sWJgq945Z6ehSzVgquCQqJol_G5u6J.CUjaVMDoa2hbDnkL0AR6ceroQY yg9OuqucsKVyRQcDh1_rk8gRX_06NBbUf3uWNxD0eM8rKAY-
X-Originating-IP: [200.11.139.134]
Authentication-Results: mta1021.mail.ac4.yahoo.com from=MSN.COM; domainkeys=neutral (no sig); from=MSN.COM; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO correo.snc.gob.ve) (200.11.139.134) by mta1021.mail.ac4.yahoo.com with SMTP; Sat, 12 Jan 2013 22:58:33 -0800
Received: from localhost (localhost.localdomain [127.0.0.1]) by correo.snc.gob.ve (Postfix) with ESMTP id E19A6415FAB94; Sun, 13 Jan 2013 02:28:31 -0430 (VET)
Received: from correo.snc.gob.ve ([127.0.0.1]) by localhost (correo.snc.gob.ve [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yi7rtzwbUC3R; Sun, 13 Jan 2013 02:28:30 -0430 (VET)
Received: by correo.snc.gob.ve (Postfix, from userid 999) id E88A1415F4EFF; Sun, 13 Jan 2013 02:21:04 -0430 (VET)
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on netserver.snc.local
X-Spam-Level: ***
X-Spam-Status: No, score=3.0 required=5.0 tests=ALL_TRUSTED,BAYES_50, FREEMAIL_FORGED_REPLYTO,FREEMAIL_REPLYTO_END_DIGIT autolearn=no version=3.3.1
Received: from correo.snc.gob.ve (localhost.localdomain [127.0.0.1]) by correo.snc.gob.ve (Postfix) with ESMTPS id 28D1D415F5D42; Sun, 13 Jan 2013 02:17:15 -0430 (VET)
Received: from 10.10.10.2 (SquirrelMail authenticated user dirdemanda) by correo.snc.gob.ve with HTTP; Sun, 13 Jan 2013 06:47:15 -0000
Message-ID: <a9f1ce800a868ffc7527780b4b642814.squirrel@correo.snc.gob.ve>
Date: Sun, 13 Jan 2013 06:47:15 -0000
Subject:
From: “Daniel Lukas & Co. Solicitors.” <INFO@MSN.COM>
Reply-To: daniellukas709@yahoo.ca
User-Agent: SquirrelMail/1.4.21

Daniel Lukas & Co Solicitors INFO@MSN.COM – DIRDEMANDA 200.11.139.134

 
Leave a comment

Posted by on 12/20/2012 in Inheritance Scam

 

Tags: , , , , , , , , , , , , , ,

“Mr. Stephen Fred”

ATM CARD MONEY TRANSFER & COUNTERFEIT CHECK SCAM – NIGERIAN 419 SCAMMER

There are two email’s and two headers below. The first email and header was published on scammer419 Yesterday 12/17/12 – the second was published today (12/18/12) — Same scammer using different addresses and IP addresses.

EMAIL #1 –

TO: 4thekids1234@gmail.com, jlpurtee1218@yahoo.com, lschum6@aol.com, vikhadd068@aol.com, childcare4yours@gmail.com, jessicaspitler@hotmail.com, monkeyforthezoo@yahoo.com, angelinahudak@gmail.com, bruces_lil_sis@yahoo.com, pmiller140@woh.rr.com, chelli4dottogo@yahoo.com, shannonschapiro@yahoo.com mschutt5@woh.rr.com, phillips.april@ymail.com, ticktockclocking@gmail.com, aprilsplayhouse@att.net, lrichards7@cfl.rr.com, rosa8485@gmail.com, mommyme0107@yahoo.com, armstrongcare1@yahoo.com, albart@bellsouth.net, new.horizons322@att.net, thebestsweep@yahoo.com, missalisha08@ymail.com, dezy2224@yahoo.com, morgragedanielle@yahoo.com, joanna.sweet@hotmail.com, adenelly@aol.com, pratherjck3@aol.com, camillephlps@yahoo.com, cs09jedq@yahoo.com, baby_pmpn@yahoo.com, kmiller182@cfl.rr.com, kayladaniels90@yahoo.com, lisaconradi@gmail.com, confidence07011996@live.com, poncallinfo@gmail.com, myfamof3@gmail.com, kjg36@comcast.net, missrosesdaycare@yahoo.com, cooljet6@yahoo.com, anged98@yahoo.com, cowboydad75@gmail.com, crawbox08@gmail.com, sacpr210@yahoo.com, khusfelt1991@yahoo.com, dskupien@delawaresafetycouncil.org, primaryyears@aol.com, kidz1st@gmail.com, bonclaude1@aol.com, millerv25@gmail.com, krosieone@aol.com, poohcc07@aol.com, ironhilldaycare1@yahoo.com, bangelique95@gmail.com, truruler@yahoo.com, denisedr54@comcast.net, sromasko@verizon.net, portiabusaitis@gmail.com, portiabusaitis@comcast.net, dawnschafferman@comcast.net, elevatedplaceslearningcenter@gmail.com, gerlacht00@comcast.net, melissalee1209@hotmail.com, valdave@comcast.net, rgoo135623@aol.com, baybeesteps@msn.com, rhino_07@comcast.net, mseekids@yahoo.com, faithshouse@live.com, jeanneflynn59@gmail.com, rachel_vigil@yahoo.com, gspederson55@q.com, ptrcgzmn@yahoo.com, thomasjohn1088@gmail.com, earlybirddaycare@gmail.com, sabrinareiman@yahoo.com, letmcg@ymail.com, brandon.carson25@yahoo.com, christinamauro23@msn.com, katielewnard123@hotmail.com, porkyexposed@yahoo.com, mgfbower07@gmail.com, lonniejbeard@hotmail.com, aklittle0102@aol.com, jennywarn@live.com, leyadewey122@gmail.com, neen062964@hotmail.com, info@need-a-nanny.com, dork_britt@yahoo.com, tinytots80123@yahoo.com, caycestaubin@yahoo.com, ivana331@gmail.com, tstots@hotmail.com, bballvarsitygirl@gmail.com, alwaysforhim2@gmail.com, degutii@msn.com, tiffjowilliams@gmail.com, patriciacallan@msn.com

FROM: “Mr. Stephen Fred” <mr.stephenfred@yahoo.dk>

SUBJECT: DEAR BENEFICIARY———— YOUR FUNDS HAS BEEN RELEASED BY THE FBI TODAY CONTACT US NOW!

EMAIL: Federal Bureau of Investigation Anti-Terrorist And Monitory Crime Division. Federal Bureau Of Investigation. J.Edgar.Hoover Building Washington Dc Customers Service Hours / Monday To Saturday Office Hours Monday to Saturday: Dear Beneficiary, Series of meetings have been held over the past 7 months with the secretary general of the United Nations Organization. This ended 3days ago. It is obvious that you have not received your fund which is to the tune of $3.5Million due to past corrupt Governmental Officials who almost held the fund to themselves for their selfish reason and some individuals who have taken advantage of your fund all in an attempt to swindle your fund which has led to so many losses from your end and unnecessary delay in the receipt of your fund. The National Central Bureau of Interpol enhanced by the United Nations and Federal Bureau of Investigation have successfully passed a mandate to the current president of Nigeria his Excellency President Good luck Jonathan to boost the exercise of clearing all foreign debts owed to you and other individuals and organizations who have been found not to have receive their Contract Sum, Lottery/Gambling, Inheritance and the likes. Now how would you like to receive your payment? Because we have two method of payment which is by Check or by ATM card?

ATM Card: We will be issuing you a custom pin based ATM card which you will use to withdraw up to $5,000 per day from any ATM machine that has the Master Card Logo on it and the card have to be renewed in 4 years time which is 2015. Also with the ATM card you will be able to transfer your funds to your local bank account. The ATM card comes with a handbook or manual to enlighten you about how to use it. Even if you do not have a bank account.

Check: To be deposited in your bank for it to be cleared within three working days. Your payment would be sent to you via any of your preferred option and would be mailed to you via UPS. Because we have signed a contract with UPS which should expire in next three weeks you will only need to pay $180 instead of $420 saving you $285 So if you pay before the three weeks Dec 2012 you save $285

Take note that anyone asking you for some kind of money above the usual fee is definitely a fraudsters and you will have to stop communication with every other person if you have been in contact with any. Also remember that all you will ever have to spend is $180.00 nothing more! Nothing less! And we guarantee the receipt of your fund to be successfully delivered to you within the next 24hrs after the receipt of payment has been confirmed.

Note: Everything has been taken care of by the Federal Government of Nigeria, The United Nation and also the FBI and including taxes, custom paper and clearance duty so all you will ever need to pay is $180.

DO NOT SEND MONEY TO ANYONE UNTIL YOU READ THIS: The actual fees for shipping your ATM card is $420 but because UPS have temporarily discontinued the C.O.D which gives you the chance to pay when package is delivered for international shipping We had to sign contract with them for bulk shipping which makes the fees reduce from the actual fee of $420 to $180 nothing more and no hidden fees of any sort!

To effect the release of your fund valued at $3.5Million us dollars you are advised to contact our correspondent in Africa the delivery officer Mr Stephen Fred with the information below, Name:Mr Stephen Fred Email:mr.stephenfred@yahoo.dk You are advised to contact him with the information’s as stated below:

Your full Name.. Your Address:….. Home/Cell Phone:…….. Preferred Payment Method (ATM / Cashier Check)

Upon receipt of payment the delivery officer will ensure that your package is sent within 24 working hours. Because we are so sure of everything we are giving you a 100% money back guarantee if you do not receive payment/package within the next 24hrs after you have made the payment for shipping. And make sure that you keep the receipt of the $180payment that you made because that is the prove you will show to the delivery team when they arrive at your door step with your package of delivery

Yours sincerely, Miss Donna Gwen FEDERAL BUREAU OF INVESTIGATION UNITED STATES DEPARTMENT OF JUSTICE WASHINGTON, D.C. 20535

Note: Do disregard any email you get from any impostors or offices claiming to be in possession of your ATM CARD, you are hereby advice only to be in contact with Mr Stephen Fred of the ATM CARD CENTER who is the rightful person to deal with in regards to your ATM CARD PAYMENT and forward any emails you get from impostors to this office so we could act upon and commence investigation.

HEADER:

Return-Path: <albanesi@dmghost.dmg-hosting.com.ar>
X-YahooFilteredBulk: 200.58.125.17
Received-SPF: none (domain of dmghost.dmg-hosting.com.ar does not designate permitted sender hosts)
X-YMailISG: G4vRLFYWLDtBXE2mxgWetbgPe68s2c_J4Sy1u3QrHo_wMTq2 7ltguaR_7OqUckxfw_6vp2Lr1Jg7Eu.nS2bLDg6fo4oYGP7MTDSxe12a7pKp vDuNtWg442ZrtozAbb4qwjv9yjVKzjc3q6SUJC3ROeRuYcRhx4ZTHNEwa9dJ RRunFvOz3W.7zc.2.2cpeXIR1pV74p_qpVqC3m7H8mdBoPRVTOHo4yAvFEyq HBGagGWmoRoWFUM6WeZcFGLRRd9yG4M2adkg0pGcbx9auO2ojmtRX.d4awpI tNrecy67Vucu5czgWkng.ADegJxE6eNLDqWhXtM8r1A7O_E267YruDaoRxO6 _sIUXJPaS8LB26kJPkafbJgK7Q9bXgF9ll5Efh6DIfA71GiZ_BFxWhGrotmy _KZxe6vxBpdwxzK0Rxlr8WrNY0QZMLOp0hD28W3sC.84e3mVvDE1o89.CZ5h 9jg8M2nfaP2qu3nHGA54gPG1P9JZx9oasJlLQdjhkEP6ND1NMGwvMf48kGMY 3mnmKiJxTzCRP42tdS7Y8Ho32JKgSZ3qE_UtRHNqJnXY6nt4cEAR35W0rrKt Rxajt4Z12QQVP6ynOi0a9qX6gOBgqHI0ImNxtkZaeznZBDB94jKQgd6rsgsf F.xd9S3BVrxw5c_tcsF2ZfpH5vlPphmuFtr.6wHtqPTbo1WcAAW3TzAVQgd5 P1qNkbouaz9T_2LDTBLWIumE0eZYfRwlzjApSWZq5xN7T443jat0wR.gnq8Y dJGDz8sxqmnuHdASS5COEyfmLADo5GME9Hr1nFYnYoUc9gMY6EgDUlovdax2 JWSXg640Sl6p_WEGbvRpunnYfKhxouArjEiZxy2c4lMKAGhYcq0JrGub358H ai9FMNMHAkRnf4b18ttxSIYK5obMdAtyW.Vw4jaqgXYO540R_KQljdv7peAg k9p124LIGZdkN7S_XKaNsg3O.ey154tsrBwhl14kTdz57ZxzNc7niAYFQF1V VUTONPpN4iNZT_t8.LcVzBcHhSjrqoWJ2SMpE28MH6cyiV8IsUDbddT1YIcM iZAV58stob2h.JyLctYJZ.g5G.VYjJubKffjKBTkHbCYZ1wNzGE8sWDDIJwo eRX04Jtt4F13ZI2AARhKdrG8DAr2NSIhIUoWXKs.qbgWrQgZleThlG8O6OOT G1avOrcRyDcNaaQxG32I
X-Originating-IP: [200.58.125.17]
Authentication-Results: mta1317.mail.mud.yahoo.com from=; domainkeys=neutral (no sig); from=yahoo.dk; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO dmghost.dmg-hosting.com.ar) (200.58.125.17) by mta1317.mail.mud.yahoo.com with SMTP; Mon, 17 Dec 2012 05:44:35 -0800
Received: from albanesi by dmghost.dmg-hosting.com.ar with local (Exim 4.71) (envelope-from <albanesi@dmghost.dmg-hosting.com.ar>) id 1Tkafo-0004nX-Uf; Mon, 17 Dec 2012 10:24:00 -0300
Date: Mon, 17 Dec 2012 10:24:00 -0300
Message-Id: <E1Tkafo-0004nX-Uf@dmghost.dmg-hosting.com.ar>
To: 4thekids1234@gmail.com,jlpurtee1218@yahoo.com,lschum6@aol.com,vikhadd068@aol.com,childcare4yours@gmail.com,jessicaspitler@hotmail.com,monkeyforthezoo@yahoo.com,angelinahudak@gmail.com,bruces_lil_sis@yahoo.com,pmiller140@woh.rr.com,chelli4dottogo@yahoo.com,shannonschapiro@yahoo.com,mschutt5@woh.rr.com,phillips.april@ymail.com,ticktockclocking@gmail.com,aprilsplayhouse@att.net,lrichards7@cfl.rr.com,rosa8485@gmail.com,mommyme0107@yahoo.com,armstrongcare1@yahoo.com,albart@bellsouth.net,new.horizons322@att.net,thebestsweep@yahoo.com,missalisha08@ymail.com,dezy2224@yahoo.com,morgragedanielle@yahoo.com,joanna.sweet@hotmail.com,adenelly@aol.com,pratherjck3@aol.com,camillephlps@yahoo.com,cs09jedq@yahoo.com,baby_pmpn@yahoo.com,kmiller182@cfl.rr.com,kayladaniels90@yahoo.com,lisaconradi@gmail.com,confidence07011996@live.com,poncallinfo@gmail.com,myfamof3@gmail.com,kjg36@comcast.net,missrosesdaycare@yahoo.com,cooljet6@yahoo.com,anged98@yahoo.com,cowboydad75@gmail.com,crawbox08@gmail.com,sacpr210@yahoo.com,khusfelt1991@yahoo.com,dskupien@delawaresafetycouncil.org,primaryyears@aol.com,kidz1st@gmail.com,bonclaude1@aol.com,millerv25@gmail.com,krosieone@aol.com,poohcc07@aol.com,ironhilldaycare1@yahoo.com,bangelique95@gmail.com,truruler@yahoo.com,denisedr54@comcast.net,sromasko@verizon.net,portiabusaitis@gmail.com,portiabusaitis@comcast.net,dawnschafferman@comcast.net,elevatedplaceslearningcenter@gmail.com,gerlacht00@comcast.net,melissalee1209@hotmail.com,valdave@comcast.net,rgoo135623@aol.com,baybeesteps@msn.com,rhino_07@comcast.net,mseekids@yahoo.com,faithshouse@live.com,jeanneflynn59@gmail.com,rachel_vigil@yahoo.com,gspederson55@q.com,ptrcgzmn@yahoo.com,thomasjohn1088@gmail.com,earlybirddaycare@gmail.com,sabrinareiman@yahoo.com,letmcg@ymail.com,brandon.carson25@yahoo.com,christinamauro23@msn.com,katielewnard123@hotmail.com,porkyexposed@yahoo.com,mgfbower07@gmail.com,lonniejbeard@hotmail.com,aklittle0102@aol.com,jennywarn@live.com,leyadewey122@gmail.com,neen062964@hotmail.com,info@need-a-nanny.com,dork_britt@yahoo.com,tinytots80123@yahoo.com,caycestaubin@yahoo.com,ivana331@gmail.com,tstots@hotmail.com,bballvarsitygirl@gmail.com,alwaysforhim2@gmail.com,degutii@msn.com,tiffjowilliams@gmail.com,patriciacallan@msn.com
Subject: DEAR BENEFICIARY———— YOUR FUNDS HAS BEEN RELEASED BY THE FBI TODAY CONTACT US NOW!
From: Mr. Stephen Fred <mr.stephenfred@yahoo.dk>
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname – dmghost.dmg-hosting.com.ar
X-AntiAbuse: Original Domain – yahoo.com
X-AntiAbuse: Originator/Caller UID/GID – [826 825] / [502 502]
X-AntiAbuse: Sender Address Domain – dmghost.dmg-hosting.com.ar albanesi@dmghost.dmg-hosting.com.ar

Mr. Stephen Fred <mr.stephenfred@yahoo.dk> <albanesi@dmghost.dmg-hosting.com.ar> mr.stephenfred@yahoo.dk

__________________________________________

EMAIL #2 –

TO: deleted@yahoo.com

FROM: “vikhadd068@aol.com” <vikhadd068@aol.com>

SUBJECT: Re: DEAR BENEFICIARY———— YOUR FUNDS HAS BEEN RELEASED BY THE FBI TODAY CONTACT US NOW!

EMAIL: http://oabfranca.org.br/entrance.php NOTE: I DID NOT CLICK THE LINK AS I DONT CLICK ANY LINKS/FILES RECEIVED FROM SCAM EMAILS.

HEADER:

Return-Path: <>
Received-SPF: none (domain of imb-m01.mx.aol.com does not designate permitted sender hosts) AQEBAQ–
X-YMailISG: fG83VQIWLDuwe8ej5n0IaROXvxrlzu18BJ2irW7rRnkNUMiR 0Ctsgto2LNAskyV2Q6ixNssLOsmnFDVOBVCrL.Ma4HX.zvoh5.y.Me6a47y1 Y.s4vBi98z.8nCoiFrNhF8AthsY6JNRIP0mO3NwL6he8knCzy63JqA9qhhqY FQRl4qMLiHM902WJNFvAOn.XvAyS6gBl90P7phn5AwFtzDAnWp7SjQKS8yd9 2cqKCaMlnKRjdDDXjb2Q70KZ_PcWA5mIrPPIPxX4lk8JBJe._gcgSX6kzAYp 4YvvqU7x6K6snhfvbJKtaMeaXIjmTDn.pLJ6GEKwthBTc3K6CzQF1pPdkRRD yra8kG4Jxtlb_RaSjcjAXw5qpiHxnBAx3Oek1rLM84NqcWLvSV3nRFriYeYV nhI5BWjm8wwT3AcOsJUwm97do1.YsTka4wRMCVD6cqiCuU2jAKvwx1uDI2.b RoFUQReDBAjwqAAHPZLlkdarxo05P1Uwq5jHR99zLNJlOjaSRiMEUe0PS9zs QDsD3ljuWathFexCSe6PKWbyt3x4XQhQYjJ8mtq3elH0LdNeIuahbPv6S4G8 hueVJ.bJ9cI2b2jYCsk1qnouy2MQDdlL5VbiPxDCWp7AsBes8Nb4BepjQsVR w2UcWs9.Sy1V065valQ1_avr4y87pRQOmtt5dWEaxIAO8bWhK4iCTfcE1cJY 20x8ZehazHdzyZAVwjK95yH6Y0LghsrH75EbuSGscuYeXfnXpPOU0lHJOYpM Smn8XIi4jgWio99h4HL5hAKWRirLVLu_X5PDmHnYDie5ONFtGejBROGsblcC rl9jhZH6AJlOWZyqVTRM5Ppp3S6YCnbXEAxRydb6MzVMCUdDrES1gAdSYuc_ i5b5UqWEyedgNzG5O1cUaG9VQQWVQd26QYIhUn1LH8p5cF1d4w9e3Y7VQQ8N MYYqmESf9lsGNdZFCRFIMXXUdD5OQpzT7199rPh0OAQ6e5FssdlgeHW5u8Oe Qm9rwYEstTmh6VWIAnHdJLj59EuoMNynb0YBxAks2F6YXhwIzblZ4az3IDAf 3UW5o76BBwQ424rwxaewfRAxh33BT18DwtTa_1U0vcIPi7ooZSfLIzHxatMM tdMmB1yNMhgNeqj41iMGVgytMBZI7HV5OTRdtnMQsAoEFr2MQitM8bjxFQ4k VUhdeQ30xHi1UVWyJwl9l8xmrHA-
X-Originating-IP: [64.12.227.42]
Authentication-Results: mta1395.mail.mud.yahoo.com from=aol.com; domainkeys=neutral (no sig); from=aol.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO imb-m01.mx.aol.com) (64.12.227.42) by mta1395.mail.mud.yahoo.com with SMTP; Mon, 17 Dec 2012 23:38:11 -0800
Received: from mtain-mf12.r1000.mx.aol.com (mtain-mf12.r1000.mx.aol.com [172.29.96.160]) by imb-m01.mx.aol.com (AOL Mail Bouncer) with ESMTP id B186A382B708 for _______ Tue, 18 Dec 2012 02:35:08 -0500 (EST)
Received: from core-mic004a.r1000.mail.aol.com (core-mic004.r1000.mail.aol.com [172.29.104.4]) by mtain-mf12.r1000.mx.aol.com (Partner Internet Inbound) with ESMTP id 9ADBB3800008A for _______ Tue, 18 Dec 2012 02:35:08 -0500 (EST)
Date: Tue, 18 Dec 2012 02:35:08 -0500 (EST)
From: vikhadd068@aol.com
Message-ID: <52151792.8536.1355816108626.JavaMail.zimbra@core-mic004.r1000.mail.aol.com>
In-Reply-To: <1355816106.93122.YahooMailClassic@web161004.mail.bf1.yahoo.com>
Subject: Re: DEAR BENEFICIARY———— YOUR FUNDS HAS BEEN RELEASED BY THE FBI TODAY CONTACT US NOW!
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Auto-Submitted: auto-replied (aol; away)
Precedence: bulk
x-aol-global-disposition: G
X-AOL-SCOLL-SCORE: 0:2:335928000:93952408
X-AOL-SCOLL-URL_COUNT: 0
x-aol-sid: 3039ac1d60a050d01cac1b64
X-AOL-IP: 172.29.104.4

64.12.227.42 — 172.29.96.160 — 172.29.104.4

 
1 Comment

Posted by on 12/18/2012 in Lottery Scam

 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

Mary Thomas

INHERITANCE / CHARITY SCAM – NIGERIAN 419 SCAMMER

UPDATED RESPONSE FROM MRS MARY THOMAS WHO WENT ME ANOTHER EMAIL ON FEB. 2, 2013. ALSO, TO SEE OTHER EMAILS FROM MARY THOMAS SENT TO ME IN DECEMBER, CLICK HERE.
I posted the header details to both emails because the scammer is using different email and IP addresses.

No-Scams

FIRST EMAIL: Greetings,

I am Mrs.mary THomas an aging widow suffering from long time illness.
I have some funds I inherited from my late husband, the sum of 5.9 Million us Dollars and I needed a very honest and sincere Individual or cooperate organization that will use the fund for work of humanity,
I found your email address from the Human ressources data base and decided to contact you.
Please if you would be able to use the funds for the work of humanity as i have stated hear To fulfilled my late husband wishes please , kindly reply me back through my private email adress for more explanations

Regards,
Mrs mary Thomas
Private Email Adress ;marythomas000@laposte.net

FIRST EMAIL HEADER:

Return-Path: <uwesuza@yahoo.fr>
X-YahooFilteredBulk: 77.238.189.217
Received-SPF: none (domain of yahoo.fr does not designate permitted sender hosts)
X-YMailISG: SC577cwWLDt8fgUiBGSZs_l1.S6NL16kUKFmPeyCUuwKXDx0 LQpr05r5mnCTnnjpDIMSX.BWZZZTt0srB8sJmP419uubxFQ25OchWDJJFQZY d7Zh44U1xH_aRxB7YgMJfIrwiVerWdo7G8Uq1xhIwYDC4ETjeZ3ntN3sLmW3 h5PMSDsAYV.FBLq2LtnT8fQSQMgWwPUvaVUalTz0MEaMTaS7RWZVx0s7azmI z1xYE81zOpdDybxvOr.CrfRP9H7jSqGXITd1b_iLX5A7H7LzZGm1I3px2WIO ThlEpnNrwIbDyJ6lhrp7Yr6aDpJiP5KZcNQlbJiLmviXc1eY4maqQ4oY5Gpl VMDo3WFCjocsvgoj7.CDzH6AInH5qbQUr9KYTDdZ57DqQnq.1_toF_QZEDXS r8MgUAsGizi_Hud5D_wMeiFg_8mpNQ94BFK7fxK4eAbyoFzyVq6F6NNVQrki SdkL_Ce6ZkKaqB3kPgdyRMGZnrjXZ.2gPbunnMmC6xWzsctPswWvUaHfwhbC hf6cqCpgJ1rElDjRe7c6seP8WZveztghm6nDDegnG25eBxZodBKAn7Y23.lt Aq3iG07HMywpDGyAP_bTDy7I5KeJt3_qBlliRYr1FhGa7nZ2yXG8r_m9KMLO HYFxerJpdGdUgMdy_yNyNh8WGI4__XiKyg0j_D9R3O9A0E1pKCwNFTOg5qvl C0Fuz6ra0.5yMKcaB.QaIhpt3bnhCeNIrA2m1nHf.ZHx1T9PMPToQuT9rb._ 1OxYFPQ4kRsj_b8NXZ7I4XVfRZ3AjZSqr5Ui4RP.D12QCSyhoQcBnyLOWGdh RrSzM6cDpFEw1TpKZrb.2Ml6vpT.lfGTlvK.OG99WskzVyANqIVr1BGBBkrC mlI4NvRJqzbuQ2lKeiV6HwtUcgfjaSZZhBWb_62zyR_Ov7VHiyoYrfzVd.Ba MywUpcSIrqpwAxb1VJF_w3tp1YnAyffA_iHfBYqU_Cmb7VliQiCmiKu7N_6Z xF5vGrJRTWq..bCzKUusy0eG61U7xgudzI13TK7kRaoDe0P3L2NdtB726M4l Rkc8FlhV9wjX_9YDpvz5s2egI_oSXOpsPFw49WxnxYGQfJn3EtCur5HD6EAZ ezYV_o_OvSQU5xgFyeqqDb7YAoLKg0P6qzt5FHFAd7_uFsedXvCRL_Jq7_YV LzHNgYRPiCmFe0XOZPFbkEuZf.0T
X-Originating-IP: [77.238.189.217]
Authentication-Results: mta1367.mail.mud.yahoo.com from=laposte.net; domainkeys=fail (bad syntax); from=yahoo.fr; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm18-vm1.bullet.mail.ird.yahoo.com) (77.238.189.217) by mta1367.mail.mud.yahoo.com with SMTP; Mon, 17 Dec 2012 07:08:05 -0800
Received: from [212.82.105.244] by nm18.bullet.mail.ird.yahoo.com with NNFMP; 17 Dec 2012 15:06:11 -0000
Received: from [212.82.108.120] by tm16.bullet.mail.ird.yahoo.com with NNFMP; 17 Dec 2012 15:06:10 -0000
Received: from [127.0.0.1] by omp1029.mail.ird.yahoo.com with NNFMP; 17 Dec 2012 15:06:10 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: 949478.22736.bm@omp1029.mail.ird.yahoo.com
Received: (qmail 39973 invoked by uid 60001); 17 Dec 2012 15:05:33 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.fr; s=s1024; t=1355756733; bh=Wi3t1Mw4cOeOZaiIj6FTnhrcSujPfpi9ysov9+EFzTs=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=BLIPvWB3XAnlaUImaAfnXQ0/oJbtPqXKF2cE5euMDmSUuQ0slv1y9TBybEaPtwCLYF+HfEV7VOnltCtCIObNOkrCEY8Kn4VYT0NWxIQehmc0eFkln24FzWo9rx+ZVZxhiqrVkyvGfif+kt4hgTc8i2eZmKyNdkoEAM4oxFMqbY4=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.fr; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=1zorBhLHvLc4mQ5UyD2ZtVHpKCALPrGZyLajIV6Xxu50b/RHI2VSZdkPp4f0ijkBpqyQpam78rOajD/p31OqPSrqg/d3lGvrm72YBfy0KmGiszMow2sUaQvZecT+d9o4yh8niJjpjpsQt1tH6t3YcJ1CUlGUXo/T0Llg3dTm1rY=;
X-YMail-OSG: dsy1MXsVM1leax8HSVJp6uDTpPXsP.awPBJ0qZiveJS_e18 uXw25Fdq7hj5WYpU6qbcn
Received: from [41.203.224.254] by web171204.mail.ir2.yahoo.com via HTTP; Mon, 17 Dec 2012 15:05:33 GMT
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.128.478
Message-ID: <1355756733.37025.YahooMailClassic@web171204.mail.ir2.yahoo.com>
Date: Mon, 17 Dec 2012 15:05:33 +0000 (GMT)
From: “marythomas000@laposte.net” <marythomas000@laposte.net>
Reply-To: marythomas000@laposte.net
Subject: Hello

FROM: marythomas000@laposte.net <marythomas000@laposte.net> RETURN-ADDRESS: uwesuza@yahoo.fr RETURN_ADDRESS: uwesuza@yahoo.fr ADDRESS GIVEN BY SCAMMER – marythomas000@laposte.net ORIGINATING-IP: 77.238.189.217 RECEIVED-IP: 41.203.224.254 LOCATION: AFRICA marythomas000@laposte.net

_____ _____ _____

UPDATED EMAIL –

Greetings,

I am Mrs.Mary Thomas an aging widow suffering from long time illness.I have some funds I inherited from my late husband, the sum of 5.9 Million us Dollars and I needed a very honest and sincere Individual or cooperate organization that will use the fund for work of humanity, 
I found your email address from the Human ressources data base and decided to contact you. Please if you would be able to use the funds for the work of humanity as i have stated hear To fulfilled my late husband wishes please , kindly reply me back through my private email adress for more explanations

Regards, Mrs.Mary Thomas

Return-Path: <dragonknightuk@yahoo.co.uk>
X-YahooFilteredBulk: 77.238.189.209
Received-SPF: none (domain of yahoo.co.uk does not designate permitted sender hosts)
X-YMailISG: HafQ25cWLDsqSszvRos0oFDBwr4a2tKFqo1Ieo4e9uEs4HpD HLYl95WqTdSC0gSRmyUbpFETm6WC7c4eNb.vr7VyV_vDXF167o2UL1ImhcsK izBrl2O6sIsKwC8eH2.KZUvR5gt2bXHmUk4hKDpiowEkZP1Nm45aGPhuSoaW Cw0FPo2ZsZF087FCUlzwqCOamBQTtxx2KBYAx6SuGlLAgnLTpCC3S2UDQwOT gJyGfQmTndbt3Vo0jIhTJ9NonCzrwA_a4NQNd19octkfjxztZNSksOgDQrmY EaOEkjnLH3OYoyiPBsaaiefg5NS8.I4FQ0vUhF8SJQPsdUIhArVUdl2NGRFj h5HkDh.LlzVJvvmxAABL.kVMzzMP8ac8fmuTA4O3mStFk..00PYtENHOwVMW CRcr.4a8XWnpGZPc1mdtcujhKPPGwC3XlAyZBAMAmDxsfYze7Utoe4..6LZ9 j54GXXDDUqLu2XBfq__KcCeI6n8B5AOv2ored18_9GO9RpTWB2A3vveLjg8B 6w4SnNNxUlL7.WxKtVcsrsaXJc._2EyV1eTetC4WoMt0o9eD2PNclUgNH.Oh su1cSim4_uYld3K1TeW3.qjZPa16774447c0UlXdHAMYPTeVuklfi7ItA461 9VMkjiGsskZasL5D1XcY5NUSnJXzsGqh5Jp5UGpaeP5yXldas2BZj8cfOSlt NHYyFF_D6Grg35viF1RDwRmOk9OXmN991kME5oG8cvW.glBFBRLpzkvwbJ3X hkD4yq8OqPLbm6Oio6F6dWBcWI.PCqdXfBpiHJjp8msF690g_qLvuq0sHrap XbFMmfZ0dKRKi6.9x7YbyLYcb9ne1vn3U9hVonpQxu5AYFtnzrdwQSbLGluF 1BVr_Y2WTyx9thp_5ZPaT9Tg82.Y9RjI0PX85cz6LtJlPPOZ8Id_fonGeulP sbXysc9OjJrTDfM3DlAwTFfHk1tLKrQYOi2EZ4SlIJ63g1uIMAeHUw0bBjYB l.jMIAoPINziPOO8gauHLkn.f7Qq7uuNyRxK2qZzoKJjI6G6APmwwssynZ64 3H0sVgQHPyQT6F9g16ud4wqKhdMudAhsWUNJaHqgsUP9r.0v_AVLbum1SQ–
X-Originating-IP: [77.238.189.209]
Authentication-Results: mta1276.mail.mud.yahoo.com from=laposte.net; domainkeys=fail (bad syntax); from=yahoo.co.uk; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm13-vm1.bullet.mail.ird.yahoo.com) (77.238.189.209) by mta1276.mail.mud.yahoo.com with SMTP; Sat, 02 Feb 2013 06:52:41 -0800
Received: from [77.238.189.55] by nm13.bullet.mail.ird.yahoo.com with NNFMP; 02 Feb 2013 14:52:37 -0000
Received: from [212.82.108.251] by tm8.bullet.mail.ird.yahoo.com with NNFMP; 02 Feb 2013 14:52:37 -0000
Received: from [127.0.0.1] by omp1016.mail.ird.yahoo.com with NNFMP; 02 Feb 2013 14:52:37 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: 605740.60374.bm@omp1016.mail.ird.yahoo.com
Received: (qmail 12425 invoked by uid 60001); 2 Feb 2013 14:52:37 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.co.uk; s=s1024; t=1359816757; bh=E7QMpM2rn2XQaRvyUiATTtTxqfxfTkH4nuX3bVTWjeI=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=OO6e3Ke4SBmcF+lJqNKKa1u8d0zIw1QNIeREdc2hPcB6rGAs6W4rhEkOrF7hq34HQ1FPPLajiBn9mBfzM0w8jpW5twCyberDggoo9rGya3hImikYnP4zO/qer1JakfPNFPr+srYTS+K/KYrO9EPxMe5zjMPpn2qO3VqiJv7oIk8=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.co.uk; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=SzybGBX2KKs98lY3XdgXVfOEN1mCQXwZnekJJzqCE4aLyDywqYesnTjkmUVlMFyBdSxR6au6X9HGb3lGUV2o1MWz6+suBI6GTAGeRTB/En0p1cLnTv4NkOwi7EE4zWnhq5F6iZ2nNZHzg08sMxEJ8Owb02f1Wq4O1XSbnqcpoxw=;
X-YMail-OSG: z3bBI5QVM1nfBHHYSK_VSbjdLWoHrGZuGD1vKSojvX87NQM 2L_2OTrX6wvqo7Ps21s8sErfnQOLAEdhVuCI10xMpEutdEMP9tV7mh_hFkHv CauvBZHChfYMbpVhK15E0NmqOBallzMw0q35H31lBDoVXBe7IUWy3hhGZqJF 9UbPEbrDWWnykfewjzCYfUPOQXShwUNu5kYuJAn8eACwzB_fbqisa9s1TKl. vqiW5nXqNN3Biktbv.KV62DBVk0s43Ku2ZPGAxn5BWAAJYedL4bWKg9x9oCV Sx_DxmrvdLm5YxghA2MVBL1XJoiMKoyMJ87vmeP6oWKXqBv.HOAvYw1nZXOO B2kenX5jh8gygoqNeN_bs6FKtJV.3YX4bwIyQIaitmNWLlbFx_U7wQK_1I.Y dewSxVsCA_K93NTZgP4_xPPMqzJWaNM_rl8UEq5vUmn2ZCpwYMI1hARjypZ1 EDH7cHQrDsZqYCUuqVjaFFkkxYdsYDy5AWRBUKtM296EbwqSE5adBPW361AY gwkzMiXjNlSmPI.lYJa4vDq_ATKeHaKsyZkaCBrw7D.ddp7qMJjw4RrGh3.W BLPjY1BIcHQFMahkbSxaLjwOPtDj7Tt4q8dli2t0zHBH71ABUuNfY6ZvKu2K 8W9WS9OnDZPWO5OqaxbxVILM-
Received: from [41.203.226.228] by web172006.mail.ir2.yahoo.com via HTTP; Sat, 02 Feb 2013 14:52:37 GMT
X-Mailer: YahooMailClassic/15.1.2 YahooMailWebService/0.8.131.499
Message-ID: <1359816757.10339.YahooMailClassic@web172006.mail.ir2.yahoo.com>
From: “mrs.marythomas00@laposte.net” <mrs.marythomas00@laposte.net>
Reply-To: mrs.marythomas00@laposte.net

Mrs. Mary Thomas mrs.marythomas00@laposte.net <mrs.marythomas00@laposte.net> RETURN_PATH: dragonknightuk@yahoo.co.uk IP_USED: 77.238.189.209 RECEIVED_IP: 41.203.226.228 LOCATION: Africa

BELOW IS A LIST OF OTHER EMAIL ADDRESSES, NAMES AND IP’S USED BY SCAMMERS WITH THE SAME RECEIVING IP (41.203.224.254) AS THE ABOVE SCAMMER
Hassan Ali hassan.40ali@gmail.com <> matuskudus@yahoo.com
X-YahooFilteredBulk: 77.238.189.61 <> 65.38.94.59 <<>> 83.133.124.245 <<>> 218.30.22.82 Reply-To: hassanali06@voila.fr Subject: My dear Friend, I am Mr Hassan ali a chartered chief auditor with BANK OF AFRICA of Burkina Faso Ouagadougou West Africa
 

Tags: , , , , , , , , , , , , , , , , , , , , , , ,

“Roberta Jordan”

LOTTERY SCAM – ADVANCE FEE FRAUD

FROM: Roberta Jordan <e446212411@exchange.1and1.com>

SUBJECT: FW: carlmorris00004@hotmail.co.uk

EMAIL: An attached link/file was sent with this email. This scammer has been emailing me for months now. This is a lottery scam – the attached file says Dear Lucky Winner .txt

HEADER:

Return-Path: <e446212411@exchange.1and1.com>
X-YahooFilteredBulk: 74.208.4.195
Received-SPF: none (domain of exchange.1and1.com does not designate permitted sender hosts)
X-YMailISG: BBhzdgUWLDtgKtEk_QjWk7NEEGWTWBqLmKuXbSQ8_LmePfUq 2YJNbkxefs7j7xq6468puhFY6GyMtiW8Eq4hCzFdgTJ8nHvu1HCMMd7HbVSn zhZNH7W.aZmIBPTht_QDuMuh1pxb_veOY2y4yk0UNAeMnttbFRwDwF6f.QIt rbLgS_vxJE6pjsfAJb.5TfjLCep9jADlZuIaWlha8_pv5G1yEPTF5ntJDynz dYrRfHAffzmDEa9bQPLNTTH4GYEIagg62K5OTPzvJh8o5X6B9y4ZyuTzWRIp 5ht53JxCYcOItIDeVo6w4bjro.kqhKf8TPix9EdLJyy3VdY1dMycXoXwzEqT tz0_DMtAz8JES86qF9Ir8WSnifLMF4ay6_WywWRPRc3M1NOTKHiW0zMpQRmu MwV3zxRu5oX1Kz8poQoe59kQUICxLbINqLxJmd_xiomg8oKOWPwsLLVwRFXW TKhiCiYTq_GxZAHUOeZgXyW7176gdplAAATtRz.wKH69diSmM_zdSDUdh59b BlH91pMRSM_w6WXlToZtsJDBMs.NBV4nOyTFoN1_rIGN.sJTL89c2h4tirao dB9Ghm02qeCqkeuXrS2R6Y9j7jh1Ig7kH1cHCE1k26dunFxg2NFJbvaTEpjG TuSqJwcBaA09vaTFX9kMcVI.9jDaE.a7VKIpdwWxKzFdVhYqpYbONjyHA2wc t_oJd4TSdNj00S1uuV6IkGS83W7Poi5S2qNu6Hc_G.7OkMguvIZK2pBFkNMq bfmDrZPRJwTGkTKC9mqeh6QahuQwjtkwqsMAxu_G9GXTglHpO67qJeop2JVH gGnFiEeTasbrA4VEhXiUldZTNXwjXMoKzrnk1c7S4nVF2Hwm8dmVbTqZFT5n hqcfdofzVMNj5EIq9TkaJD8PiSpfzpRbI4In3Rkb5YbiOlAdxUEG0FfOrop8 61o3LrfSseW61XJ.RZu0OqxQYVVmeMeF2thkF3d5pV5cxM8gc4FK34HUShnx GYo6qat_YHxea5jLCZS0QXFWv91BkoIeBcNR2aVEXQJeiIFNpWy93hKEoNes AMFZJyLpCWK1je6v.tmxiVsZkXuO4CA_xJ19VvgvYLw_ulCQ0R93KBwtYji4 W4.gMhrxyyQSuq3AEYAbZ9evdFvtL9afZ.C9PpMT.R5GzYxo7eJOLNR7pPMJ JhTAuuK9I1wDhFXW_9.aO9dDYMMpAtoc2kRPAzT6m3YHX8S4yvvih396UxdW eIi8cBOe5hgx.0GosSbVGdqWxlqXXMIUx2kAJtjpZnQvEIEkUiYMX80IMe55 K1jCcn8alRY2ST5KGw_3QV9yefIM4cE_.RT70JmRocXvPMGPmALfhcHCmf9J eXqis2pG2Hy3twsHFNtUOMod4FS7zrr7mg15Kfsq.Js1k9BrDF7C75peUdvF XNmGO5V.lCz4OYRgLA.rAS5pLMcBemxItAzaWFFXG4eysxxwabbASBsFQjnI Lbuq9Z_1lOwuy5bgJwePL_85szQEQi95a8IFpyjUtjzyavxA3qfIp99SVPlN _paYZ1SDB984FBCFMbqSh5GtLNlkHbHioOfAxoj130.sYiCUA3T5UdSx3x9W UsxITm8Mn21zyArIDYB1XpyunWUOiYfqyzu0aeOrpPZrSOuejDehiHCq.PQr Ak6Ls_HG_A5gKYEEPCDgPQyv9Mvr6A–
X-Originating-IP: [74.208.4.195]
Authentication-Results: mta1389.mail.bf1.yahoo.com from=exchange.1and1.com; domainkeys=neutral (no sig); from=exchange.1and1.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO mout.perfora.net) (74.208.4.195) by mta1389.mail.bf1.yahoo.com with SMTP; Fri, 14 Dec 2012 04:47:13 -0800
Received: from winxedgeus02.exchange.xchg (winxedgeus02.lxa.perfora.net [172.23.130.34]) by mrelay.perfora.net (node=mrus2) with ESMTP (Nemesis) id 0MVNTS-1TdXCp3sqc-00ZAno; Fri, 14 Dec 2012 06:15:54 -0500
Received: from WINXHUBUS05.exchange.xchg (172.23.130.24) by winxedgeus02.exchange.xchg (172.23.130.34) with Microsoft SMTP Server (TLS) id 8.3.279.5; Fri, 14 Dec 2012 06:15:04 -0500
Received: from WINXBEUS26.exchange.xchg ([172.23.130.69]) by winxhubus05.exchange.xchg ([fe80::b4d2:7ab6:7111:440c%10]) with mapi; Fri, 14 Dec 2012 06:14:57 -0500
From: Roberta Jordan <e446212411@exchange.1and1.com>
Date: Fri, 14 Dec 2012 06:14:56 -0500
Subject: FW: carlmorris00004@hotmail.co.uk
Thread-Topic: carlmorris00004@hotmail.co.uk
Thread-Index: AQHN2eh9gJyGV758YkGLyCNlkKs6pZgYHUBXgAACnSU=
Message-ID: <B353BE0D877992409CB2153398733B8163391C1F@winxbeus26.exchange.xchg>
References: <B353BE0D877992409CB2153398733B8163391B52@winxbeus26.exchange.xchg>,<B353BE0D877992409CB2153398733B8163391B8A@winxbeus26.exchange.xchg>
In-Reply-To: <B353BE0D877992409CB2153398733B8163391B8A@winxbeus26.exchange.xchg>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
acceptlanguage: en-US
X-Provags-ID: V02:K0:R/uE6IJLyYorPWHyYeu3XIC871sOpVEXb2QO3oKDUcV YX2Ojw3YB8lqWc58U8LNnc+dQeQNi00IqqV45cvA+KyyfQ1c0C D8PYf43NpesWWm8cn7dok4W1HrmzvBP+GNtrbGkjWWdWWGFviX 6NWN+7Bf3Jdwu96Jkp3TPewAabRdfkMqzdEqTVjtLfXc5JD8pr aHw9dfFqVuEvQt2yoozpuCMrsSz+GvWz7UVCkXqb6sORm2ez0Y jkhuT190BE0jQnVElOT1+egHGPfnFwrBmoN29mSnE4hjbcahEn 0/ROyx6K2RAdo6zI0SkSAw6TE+BoidBuOGaJSnSvfDUcuelYum hCZkRjMT4thvZLb2ne+Pm5XgrDUPGklaO4BfAwu2pt8KadWYVo Nfnw7/KLw7Cm+QuW86Dr4/2MryYF5ajNW0=
Content-Type: multipart/mixed; boundary=”_002_B353BE0D877992409CB2153398733B8163391C1Fwinxbeus26excha_”
Return-Path: e446212411@exchange.1and1.com

172.23.130.69 <> 74.208.4.195

 
1 Comment

Posted by on 12/15/2012 in Lottery Scam

 

Tags: , , , , , , ,

“Dr. Robert Williams” a.k.a “Mr. John Williams” a.k.a “Peter John” a.k.a “Mr. John Mark”

LOTTERY SCAM – ADVANCE FEE FRAUD

ATTENTION: This fraudster has been very persistent, spamming my inbox for months under various names, addresses and IPs including Barrister Nector FBI OFFICE Scam as well as (MR) Paul Johnson Lottery Scam — Below is a list of several emails sent by this scammer.

Subject: HELLO ,
From: Mr. John F. Williams peterjohn848@yahoo.cn

HELLO ,

I have contacted you because I’ve sent you the first payment of $5,000 today from your winning funds total amount of $1.5Million USD,Therefore you need to contact western union agent Mr. John Mark for him to give you the transfer payment information and MTCN.

Agent: Mr. John Mark
Email: ( nunionwester165@yahoo.fr )
Phone: +229 68433916 nunionwester165@yahoo.fr

Please try to contact him today for him to forward the payment information to you, Remember to Indicate the registration code of EB-2520 to him when e-mailing or calling him, Also he will be sending you $5,000.00 daily as per my discussion with him, this is what he needed from you to send you the first payment.

You’re full Name…………
Your Country………………..
You’re Telephone Number……..
Your Age……………………..
You’re Copy of Your ID………..
Your Sex …………………….

Do get in touch with me once you have got the transfer.
Sincerely,
Mr. John F. Williams.

Return-Path: <peterjohn848@yahoo.cn>
X-YahooFilteredBulk: 106.10.151.65
X-Originating-IP: [106.10.151.65]
Authentication-Results: mta1575.mail.ne1.yahoo.com
Received: from 127.0.0.1 (EHLO nm23-vm2.bullet.mail.sg3.yahoo.com) (106.10.151.65) by mta1575.mail.ne1.yahoo.com with SMTP; Tue, 09 Apr 2013 13:53:54 +0000
Received: from [106.10.166.120] by nm23.bullet.mail.sg3.yahoo.com with NNFMP; 09 Apr 2013 13:53:51 -0000
Received: from [106.10.151.138] by tm9.bullet.mail.sg3.yahoo.com with NNFMP; 09 Apr 2013 13:53:51 -0000
Received: from [127.0.0.1] by omp1006.mail.sg3.yahoo.com with NNFMP; 09 Apr 2013 13:53:51 -0000
Received: from [41.79.217.121] by web15303.mail.cnb.yahoo.com via HTTP; Tue, 09 Apr 2013 21:53:46 CST
From: “Mr. John F. Williams” <peterjohn848@yahoo.cn>
Reply-To: nunionwester165@yahoo.fr
Subject: HELLO ,

 +22968433916 nunionwester165@yahoo.fr Mr. John F. Williams
FBI OFFICE INHERITANCE LOTTERY SCAM

Subject: TRANSFER MTCN

Hello,

I am contacting you because I have sent you the first payment of Euro 5, 000 today from your winning funds total amount of Euro1.5Million , Therefore you need to contact the western union agent Rev. Jerry Young for him to give you the transfer payment information and MTCN to pick up the money at WU Branch over there.

W.U Agent: Rev. Jerry Young
Email: wu_payment0@yahoo.com.my
Phone: +229 98644349

Please try to contact him today and ask him to forward the payment information to you, remember to indicate the funds registration code of EB-2520 to him when e-mailing or calling him, Also he will be sending you Euro5,000.00 daily as per our board discussion with him.

Do get in touch with me once you have received the transfer.

Sincerely,
Dr. Robert Williams
IMF Managing Director Benin.
E-mail: bobwilliamson@superposta.com

HEADER:

Return-Path: <yiyu2016@yahoo.cn>
X-YahooFilteredBulk: 203.188.201.71
X-Originating-IP: [203.188.201.71]
Authentication-Results: mta1285.mail.ac4.yahoo.com from=superposta.com; domainkeys=fail (bad syntax); from=yahoo.cn; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm15-vm3.bullet.mail.tp2.yahoo.com) (203.188.201.71) by mta1285.mail.ac4.yahoo.com with SMTP; Wed, 12 Dec 2012 02:55:25 -0800
Received: from [203.188.200.82] by nm15.bullet.mail.tp2.yahoo.com with NNFMP; 12 Dec 2012 10:55:20 -0000
Received: from [202.165.102.49] by tm3.bullet.mail.tp2.yahoo.com with NNFMP; 12 Dec 2012 10:55:20 -0000
Received: from [127.0.0.1] by omp103.mail.cnb.yahoo.com with NNFMP; 12 Dec 2012 10:55:20 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 348533.56547.bm@omp103.mail.cnb.yahoo.com
Received: (qmail 16962 invoked by uid 60001); 12 Dec 2012 10:55:19 -0000
Message-ID: <1355309719.81269.YahooMailClassic@web92104.mail.cnh.yahoo.com>
Date: Wed, 12 Dec 2012 18:55:19 +0800 (CST)
From: “Dr. Robert Williams” <officefilepayment@superposta.com>
Reply-To: westernunionmoneytransfer403@yahoo.fr Western Union Money Transfer
Subject: TRANSFER MTCN

FROM: Dr. Robert Williams <officefilepayment@superposta.com> REPLY-TO: westernunionmoneytransfer403@yahoo.fr RETURN-PATH: yiyu2016@yahoo.cn
ANOTHER ADDRESS GIVEN BY SCAMMER – bobwilliamson@superposta.com
RECEIVED IP: 41.223.248.96 LOCATION: Benin, Nigeria

Below is a phishing scam email / header sent by the same received IP as the scammer above. The originating (fake) IP are different but if you receive a unknown email with any IP’s shown on this post, you’re more than likely dealing with a scammer.

Return-Path: <carecustomer625@yahoo.com>
X-YahooFilteredBulk: 98.139.91.80
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-Originating-IP: [98.139.91.80]
Authentication-Results: mta1031.sbc.mail.sp1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 8.224.216.104 (EHLO fgateway15.isp.att.net) (207.115.11.45)
by mta1031.sbc.mail.sp1.yahoo.com with SMTP; Sun, 23 Sep 2012 07:26:25 -0700
Received: from nm10.bullet.mail.sp2.yahoo.com ([98.139.91.80])
by att.net (frfwmxc15) with SMTP
id <20120923141959f01008dmffe>; Sun, 23 Sep 2012 14:19:59 +0000
X-Originating-IP: [98.139.91.80]
Received: from [72.30.22.77] by nm10.bullet.mail.sp2.yahoo.com with NNFMP; 23 Sep 2012 14:19:59 -0000
Received: from [66.94.237.111] by tm11.bullet.mail.sp2.yahoo.com with NNFMP; 23 Sep 2012 14:19:59 -0000
Received: from [127.0.0.1] by omp1016.access.mail.mud.yahoo.com with NNFMP; 23 Sep 2012 14:19:59 -0000
Message-ID: <1348409998.34442.YahooMailClassic@web182201.mail.bf1.yahoo.com>
Date: Sun, 23 Sep 2012 07:19:58 -0700 (PDT)
From: Yahoo Member Services <carecustomer625@yahoo.com>
Reply-To: carecustomer625@yahoo.com
Subject: Yahoo Warning

EMAIL: Dear Subscriber,
Your E-mail account has exceeded its limit and needs to be verified, if not verified within 24 hours, 
we shall suspend your account.Click to verify your email account.
Please note: You serve the risk of losing your account permanently if it is not verified.
Thank you for your usual co-operation.
We apologize for the inconvenience

Sincerely,
Yahoo! Mail Product Management.
Copyright © 2012 Mail! Inc. (Co. Reg. No. 2344507D)All Rights
Reserved. Intellectual Property Rights Policy

 
Leave a comment

Posted by on 12/14/2012 in Lottery Scam

 

Tags: , , , , , , , , , , , , , , , , , , , , , , ,

“DR FRANK COLLINS” – DR COLLINS PETER

LOTTERY SCAM – ADVANCE FEE FRAUD

ATTENTION: Below will show two email headers sent to two different people (including myself) – It’s the same scammer, same scam as well. The header information is different however so check both for the different IP’s and addresses the scammer is currently using.

UPDATE: Dr Frank Collins is also going by “Dr Collins Peter” and “Collins Peter E” under the email addresses / IP’s – “Collins, Peter E” <collinsp@newtrier.k12.il.us> <info@notice.com>  YAHOO-FILTERBULK: 157.55.116.165 RECEIVED: by 192.168.194.152 — X-ORIGINATING-IP: 41.71.173.93 Also,  Dr Collins Peter web52644778980000x@att.net REPLY-ADDRESS: collinpeterclaim1@yahoo.com RECEIVED IP: 172.163.86.61 – X-ORIGINATING-IP: 98.136.218.126 onlineme20@gmail.com – Scammers number: +2347030115459 X-YAHOOFILTERBULK: 98.136.218.126 — For more information click: Dr Collins Peter

UPDATE EMAIL FROM DR FRANK COLLINS A.K.A DR COLLINS PETER (I dont even think he realizes who he has emailed because he emails me with different, similar names on a daily basis.)

EMAIL: Attn: ,
This is to officially inform you that (ATM Card number:4083-0521-0032-0293) has been accredited in your favor. Your Personal Identification Number is 822. The ATM Card Value is US$1,500,000.00. You are advice to contact me with the following information: Name, Address,Phone, Age, Sex, and Occupation. You can also call out hot line +234-703-011-5459- to confirm.

Thank you,
Dr Collins Peter
ATM Logistics Unit,
Tel: +234-703-011-5459

_______________________________________

SUBJECT: PAYMENT VIA ATM CARD.

EMAIL: Reconfirm your Address,mobile for delivery of your ATM card $10.M

HEADER:

Return-Path: <webxx120999xxxxxxx@att.net>
X-YahooFilteredBulk: 98.138.91.88
Received-SPF: none (domain of att.net does not designate permitted sender hosts)
X-YMailISG: FaLTslcWLDv_37lDMJwvUepYgmnqCzD2WWiLYIVYEvzWiVdj yeMdZg1sVqQZNMLZIrI8jrEhVaMXPsJIY6kRf0cbjnqQCPsaLbBdN2aERrfI RwOChZVFmKW9DzDxir.njJLHD.QY8j_y83jLRI4.AuI7k8QKdHjPvXXJYEFV 3YQAPmqS_78yqhLNbejZcKD5irk7feyqBo.GgWWRjUtr0XeJzJNqaql0h8sA e8RvUpWShCVHN2SyD1tuM0Deb4D1Ji8Vbh6LO0l1rw9cI0_sIz.vHpe_EiGP kHJSq4cVZ_zI24xSaJVH2nairx_S7dPagQ15pHcUhTSBMqGEgXXNeB1Y2oeP 3JU6qx6vSLkN2q.zt9EL5Vwas.VQ3VnnTXDqHLBdVcKU94hP0GlXAupk.DHM obtlUYCC1aCFRuuf3fyqc0LusjLnspK7JnjoOa4trRGPkJ_SlfDp0ggLrEaT v9a7lqaWeBT9EICtLA0FkLq3C2n40JFv19b2vJ8kTWkPK9_CQXXHvPmE9PZ3 kFs1luoQlTk_lzaBG6mXtSkUeA_7vvUTiNlT90e4_xcWHLkMi_qHUB6.MOXY KpjgBBptr6h8HH8BTrub.bb.IWuBN9wzFL2saNzKwsyxCm4lKMw9.xwDm5uJ Gq5wsKY8oAk.ZAm83V.RXXdQZhrYHzq2HI4TEsDuXnxCeBPNS3yCscgHGdua .5bviyYzefeg3tnvzHHkzRlzxSKw4QvlmuuqcChqscR9kCPiJLD.cgAs4kGP VstUFHd.bksAH552CD3i0lwkON5VfmeiESgRCGTPFvptnIKly2v3rZiX6esg GPPtVuH2VF9JGdJc2Ymbkp7azmUteBWNDdU3UBhVs441.EpCaWrI_sm_fe57 OiQyUOywnO1yRAtKJ_SFta4rGiPKLZ0KmWOm2iWxo40gyrpOgSF7vvvDlD.8 TTvxrpElU4SLFTn.GO1zFIFIOghPlKF4MTDaE1.cfSBA7OvaqPPhZB7CbD_P PbifHGwGIUcvjwXFo2GX_MJ9efyRaqwJ8RNv5bv_PmOjBSyxnqzPybf5N4_3 8R6NtlZnqM1b4Enrf9rnVdKOJneQ2FJhZVcYPrtDlcrfum9mFoOorxfoQHmz TE17GM57C0B.ILT43WlnmpnQdle96RtuSiqxmvsRzRStRdaGzDZuic8L7wei rjZENREYOwxD5PakTFL_xFmWBDMWOtezwqcs9j2HaBsIHEPGCa_w1BQb4H7T Rhg.rsLZhUpnUmz3kwbcPdV9Pc8UNCPtAWRE0QCMgwjeBn0ZXdINEcVudxSA YTcOMC4k95wVfJ8oF7eiOod5Qae2n5Ov7WwjD_lXqOtSBIc3J87zhs.HmSjX 7WlsWTwwXn.I_l4fa3NQ.mKYBKo-
X-Originating-IP: [98.138.91.88]
Authentication-Results: mta1228.mail.sk1.yahoo.com from=att.net; domainkeys=pass (ok); from=att.net; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm12-vm2.bullet.mail.ne1.yahoo.com) (98.138.91.88) by mta1228.mail.sk1.yahoo.com with SMTP; Wed, 05 Dec 2012 09:33:37 -0800
Received: from [98.138.226.178] by nm12.bullet.mail.ne1.yahoo.com with NNFMP; 05 Dec 2012 17:33:36 -0000
Received: from [98.139.44.92] by tm13.bullet.mail.ne1.yahoo.com with NNFMP; 05 Dec 2012 17:33:36 -0000
Received: from [127.0.0.1] by omp1029.access.mail.sp2.yahoo.com with NNFMP; 05 Dec 2012 17:33:36 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 198054.18868.bm@omp1029.access.mail.sp2.yahoo.com
Received: (qmail 22514 invoked by uid 60001); 5 Dec 2012 17:33:35 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1354728815; bh=2E+CXVEN1MfcfJaq2e/eZV5TviX4n2QY/x1KeAa5kws=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=f9JOS/YO8YXlmc9hJrpoWT06BSgD+eIddQyPZn984pugXI47aiHJ+HigDAW5KKMMOSqrOWONnAJiCoEyKoSjzteAYzjouKnJuSd9FFAPV7YDDY5OHZP5iSipgSUv3aNEhW/Rsnl4Ln0GS2YFkeMhoGRqYTKiUP5YtCqljvaDNow=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=att.net; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=TW9B75gLmG8YEH2Fs0wWUR6quUgNgKf4vKcOC0lU58OuZZxvfbAEilc6hFgOyOvoldI//PR2xiJZNGeYJsT5o76o0CJS8W8mbj8ANAI1PafbE8IT034u3iHRas9fZymmyVV0ARoaM4Pmz0UzVZK0Jim/YrB1484O5fKsUOiyGTM=;
X-YMail-OSG: WdGt0KwVM1lOyB0NVRZY5rrxYN4NyBpT08THjv3T0blrAYl g.fSaOnJGDgT6qOWJLehIImpPX16weUxpsraTUfiislliLwCl2K7v8Pp.iJQ a9TSaK3Cg8mAMGQLpgboaXsnY0P.gbcdPD9a2TYU3MLMz9.msdkdNVne7srD CGKrYap1ePNIkrvsumj.6_CYvw30FkImKkDHHf5IXtzUrxF4x8.QVPZL.F5P 1sCi9c6SjI1P.GeZm2DnWTw.VoPokMuHr44zOJyF208V.uJqcKGplN1blft8 NRD73m_UrMPrQXsfdMEk9IKg0jGHRledxyRP7NbPnmUmTJk5sWb6g7mibQcN lZBmrszbkEqY7Gci4Eh5lmEYhM0EH9ITd3rAkZfbRlBlo5s8MbxSVEa73EvH muyMHoTdJMpwvibAS8LsfWhBVw4Fzpyj.JdfnQdukkFQX5QRnWlt3FtcARkq hyy26DJRYTbzGN4Eyk0EL9EDXp1SGqp9Lk4FU_Cz6Hw4qjqgVzWqnIza_ijq nvI9omJY1Dw0WycuWs.OkVnfl
Received: from [108.174.51.231] by web184901.mail.gq1.yahoo.com via HTTP; Wed, 05 Dec 2012 09:33:35 PST
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.128.478
Message-ID: <1354728815.12889.YahooMailClassic@web184901.mail.gq1.yahoo.com>
Date: Wed, 5 Dec 2012 09:33:35 -0800 (PST)
From: DR FRANK COLLINS <webxx120999xxxxxxx@att.net>
Reply-To: drfranklcollin@kimo.com
Subject: PAYMENT VIA ATM CARD

FIRST EMAIL – “DR FRANK COLLINS” <webxx120999xxxxxxx@att.net> REPLY-TO: drfranklcollin@kimo.com RETURN-PATH: webxx120999xxxxxxx@att.net

SECOND EMAIL – Dr Collins Peter <webxixxxxx266xxxxx@att.net> REPLY-TO: collinpeterclaim1@yahoo.com RETURN-PATH: webxixxxxx266xxxxx@att.net

BELOW HEADER FROM COLLIN PETER EMAIL:

Return-Path: <webxixxxxx266xxxxx@att.net>
X-YahooFilteredBulk: 98.136.217.214
Received-SPF: none (domain of att.net does not designate permitted sender hosts)
X-YMailISG: 2lU7wkQWLDvBCg5Cg1wZtIwDNUzuGrZVVXK9H6ZxiRnCF9q8 3T_Z2xZXeKmdhjE03ZY1nNRa1P6Zz09tc3Suud6PVBq3vexxPmov8AXjPV9n h21FBi8fEfSTSwVFhhvzk7V6R63Puryrkha1Mb3jaVwNputKdVPkDPhjUMeo RVMMb4_9ds7LkdO1tAhp2nowUz6sKBD4buJmSanxkzHUpRwUVtPLKq8B09eN Rl25hxMaIQHn74TwJlEJoWwVxtvh8Jkr9b8xgoPVsHTD4d3rIEAmrBO8jRyd GelLKjDpe6gEZSWQukIvbii_.zMj02LUFMIXNqSXg2JTLp15U5_jUlo0usw3 1Q9ij8R.SuZ80..F80EMLcQO1SXMjqWDf6xkVHWwRChYckM8P0zLXQwmLzCh cXZIqLnw6xfz6lcwu0_mQkN.aX.hIIycQN9E431bkyzpAK8Sh0ATdnfKruuc hDUY3uEtvred._LLnnYkhYpxqfc_nSy4oYmmhRytYX5eJDo3.jrNS61KZPV6 YQ56CR6JtF_A6Hafi5rSLv5qgM4p8VJZi7448tERIhykcwaijsPjcAOenatn YK3BKAuoLWZ0KHPHNvGKAWVEbv9QWSQF39Q.EEP1LmrPyvSdcGkLUJurop.B aYWv4YFGCdGxSazNRDxvtgoiaK6SIwQ.bpgk7uq2vF3rcb50kF6JNxWrLg.n 7Tth7XBQ.W0dZ6SeRl5BddGt0PedKs6csdJXP3rAEuRx9HhVbiFWVgdNijR3 _dNog5Qebj0UNBN3_ZYEN_KnDptPkNdpsJ8OGplwzrinpWeXcnwHVgAbUTdo 18VmNYVRbtilZoPybybViqmTdRB30nDou7y.RzfJPpp93GHAGPmJapCeotd7 c17h.xTgmXwnesQYx8oH1A8HMZj9YMgj2Hn78UbjDz5iO3dLZZQwGJc37EEe Irpsy5SaXtVD8MbmmPkhMrhk8K30Dviwqq4hDE5WgxBlGVonuDQoGK3aEt2T nvWx.JhFmNOhCyTBWuANJwIBh0YVHlt7UHVip3l.jut4onQ9R4CDyP6sbX2c lfshiCRIJ9lEvHbvGo40N55AdITysTVwpsKYdhO1zKO2KEhE2HbINU3NSVAp mVO8xztcsAawulFbZ5PKA.HviU.utyPlT0yMvzwTHn_QINVPcYodx0NOT_5q eROgjgZ35jOw55jeTpgP2qOvmDNkeadY.RrCfkVM_h_Ewvbns5N8m8wKWn4F 71xz.y4o8QBLLz0jb4jMAFmUekk5PrMNZ0E-
X-Originating-IP: [98.136.217.214]
Authentication-Results: mta1191.mail.bf1.yahoo.com from=att.net; domainkeys=pass (ok); from=att.net; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm19-vm9.bullet.mail.gq1.yahoo.com) (98.136.217.214) by mta1191.mail.bf1.yahoo.com with SMTP; Fri, 14 Dec 2012 03:36:45 -0800
Received: from [98.137.12.58] by nm19.bullet.mail.gq1.yahoo.com with NNFMP; 14 Dec 2012 11:36:43 -0000
Received: from [98.139.44.70] by tm3.bullet.mail.gq1.yahoo.com with NNFMP; 14 Dec 2012 11:36:43 -0000
Received: from [127.0.0.1] by omp1007.access.mail.sp2.yahoo.com with NNFMP; 14 Dec 2012 11:36:43 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: 191480.20265.bm@omp1007.access.mail.sp2.yahoo.com
Received: (qmail 75889 invoked by uid 60001); 14 Dec 2012 11:36:42 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1355485002; bh=2TQXuFSDKzJQh2ItoNfMPDU7xRHv3E+CGrBMw/1Ns0g=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=MdiZ1jC0egJ3jeK8x+wAmlqoZyMp98AiD2wzzG+et6zE3r4jYBfuYUoMttuA+gtIjRNvWXQLaTtg0u215rggtB9Wpx8OQWJMI3iQKHU+C0WdAONnnis/01rbGL8rLVp8QUEopIB3M6ep93e/l0o2GTcA+2tm8NmXdnIzOrTvHgs=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=att.net; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=tLrXvMlZ1AfWS1oRs/q6h6HUMYi/LUcbnjbU0+wRSPWQr/1rUxJ+mPFD5IS+2J+xhqTW8fnpv0P89+O46Kg0ZaIi52L7OqBpBWUtxGIOrGGuRKY65NxHoyuM/9fcPmg6OxN2t9IVr/IQmo5FIYMQAlTgtLYGxzIx8tus9kjh4UE=;
X-YMail-OSG: 3ICaliMVM1ngoXiqNpguRRh2iYwL78sXplySeVxex0hGQX. 9amYG0XA4OBV26LpGFUMshO4W2d_k7Z_a2Ijy9UC4MhQCts27.mEJf9MSo4o gLC1yrqEZW2qVfkENJcHqLvP6x22811UE_jYQp539eFIcLW5RWUDAU4t9CGn OdkUZ.I3db4Y0_pc3qHbfrO34x9zDWKUFRwLqnQ.wNCnHD8dS3WSTofCFWm8 DRISKdISfGE2ytoF4IzvXsFuyje2c_qd6tqdnmTw5Z9mBhssXb94A4biy5CF qnxB_1TEOjTWqKHDrBY4BU1EdgOFfYQNqvwQ4XtGhinDlu0jMGic.YAmQBDt z00_WMAOIdc6llHVKxJwh0yh_xgWL5D6rgLOTnmN2Mo2vI.t3Ls.zQwRBRhe SaGInzRlMMto6OJd7AVEbCSpnmZYicQHhMCbjMxGPX2KPd4Tv0fL_cU_plDm egb7i9XYQocNBXLDzdzIfmk9Um9FTZk5b6spv87aUQEG.1MjrCbB7UdYQ0uO JpvS8DhYL5XyxrsNNIFxmRpV2b8I07Jm9LTn8wKS_hqGegIf5feMr.9cGJzH 7hgKyGs0sihPG_k5JCSaI1yCjgZYK79b_xhXuvMQeLOYyQDygzxrr8813RrH cC8L9RfM7BsB3QMN75qyv.pCG1ZbybDazG.TyLuGLgdSNZ6KwYSh_mQ–
Received: from [172.162.63.104] by web185004.mail.gq1.yahoo.com via HTTP; Fri, 14 Dec 2012 03:36:42 PST
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.128.478
Message-ID: <1355485002.70723.YahooMailClassic@web185004.mail.gq1.yahoo.com>
Date: Fri, 14 Dec 2012 03:36:42 -0800 (PST)
From: Dr Collins Peter <webxixxxxx266xxxxx@att.net>
Reply-To: collinpeterclaim1@yahoo.com
Subject: ATTN:BENEFICIARY

108.174.51.231 << 98.138.91.88 <<

________________________________________

Click SCAMWARNERS for email to below header which was sent by the same scammer as above.

Return-Path: <web1xxxxx12000bvvv@att.net>
Received: from nm12-vm4.bullet.mail.gq1.yahoo.com (nm12-vm4.bullet.mail.gq1.yahoo.com [98.136.218.191])
(8.14.4/8.14.4) with ESMTP id qBAFqXcC024177
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
(envelope-from web1xxxxx12000bvvv@att.net)
Received: from [98.137.12.190] by nm12.bullet.mail.gq1.yahoo.com with NNFMP; 10 Dec 2012 15:52:33 -0000
Received: from [98.139.44.75] by tm11.bullet.mail.gq1.yahoo.com with NNFMP; 10 Dec 2012 15:52:33 -0000
Received: from [127.0.0.1] by omp1012.access.mail.sp2.yahoo.com with NNFMP; 10 Dec 2012 15:52:33 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 169461.26588.bm@omp1012.access.mail.sp2.yahoo.com
Received: (qmail 11627 invoked by uid 60001); 10 Dec 2012 15:52:32 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1355154752; bh=6IEXAnuDHUzPM2GG6BZxFSMMGXUzzTJH/x0iCKn3gNM=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=ZNpQDXqA6YKLygx/Mgp0kaQY3hShe48iYfThTEb8Iru1MOJkFmAxYG7WRpbG0vEzb8sVOXBWUD70FlpkHY32sc3lcnQRUH9EWyjF33/6bxeK6Wl/Hf7syjgMKen3IrPrVrQM7QP70aIkEYevI/L1VoeaKi0X05zrl/mkFKlZJB8=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=att.net;
h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b=C3u05KWRUG4yec6yjYc58jVUZqKqPra/xpCRYFkhi2pi73G7p5xYJt3avwhjC1pd5gHT2g6XMST7DkGiaRchRZYYa/jODcoZt4R+AhzCt86vNfdJ8r54ZScNvyU4Y+I8mpF49mKbuYWh9Qw+6o/yW3f8qclaMsyNAu3ATH2SDAs=;
X-YMail-OSG: p5tUyUsVM1nSNbno0XpFEzLZade1sG0k1LIN6NkNDDbP4ts
LfsdXeXxUn6OgEkvAzJFUKDvuIBVeFzZtgkksCNzN7YM7NYxZZELCIFArcbu
_mj1sx3mmaRRFlhLnDPO0Ud9acKn6RdXUuy0Z2D2THjsSnJnY9sU7qqlRMsY
RFxlusC6GZdc5g0kSlEJ9Q6m1NFt621vubnU3dlWx9BHYYswZA3GlYEoIQOZ
znu.EmXiL_e6NkgO6Xi3U8TlgxDHH.J2V.gjmQeJjgeleOz.cmjSiQf65.01
pFSPJQ.uJV2ZQQDmhoA_f4DIGHOLzIEM54oMAKodxlcGehFjRCB.Otx7qJ99
LLzSejt_DN_c3T7KOCmzn30gBLvM4NW04V6Q7K4N69QA7XOIUNPQflttOcPQ
QUh_J5vkppPwzXQ7X5ZwbRUsdfsHhuaz1XhXMvrY6vOWGj_WLL3kyxKoNNTD
o2PEbuViIVuMH9ocliCObq_Z7Olxp0coTXqA6vhkTd_030aE_Rclf5k8sFU.
neOYXj1nWJo0ZcsSoOLW7
Received: from [64.72.78.27] by web181404.mail.ne1.yahoo.com via HTTP; Mon, 10 Dec 2012 07:52:32 PST
X-Rocket-MIMEInfo: 001.001,DQoNClJlY29uZmlybSB5b3VyIEFkZHJlc3MsbW9iaWxlIGZvciBkZWxpdmVyeSBvZiB5b3VyIEFUTSBjYXJkICQxMC5NATABAQEB
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.128.478
Message-ID: <1355154752.62957.YahooMailClassic@web181404.mail.ne1.yahoo.com>
Date: Mon, 10 Dec 2012 07:52:32 -0800 (PST)
From: DR FRANK COLLINS <web1xxxxx12000bvvv@att.net>
Reply-To: dcollins@kimo.com
Subject: PAYMENT VIA ATM CARD.

 
1 Comment

Posted by on 12/11/2012 in Lottery Scam

 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

 
%d bloggers like this: