RSS

Tag Archives: Canadian African Lottery

Three Nigerian scammer’s bundled into one post

NIGERIAN SCAMMER – ADVANCE FEE FRAUD 

Below is a list of three scammer’s involved in online fraud. If you receive an email or have been contacted by any of the Nigerian’s listed, STAY AWAY!

orange line

I’ve traced some IP’s back  to these scammers. Check the headers on the three emails below because the three IP’s i’ve listed here, are not the listed IP’s in the emails below. Some are Yahoo service IP’s but are blacklisted and used by scammers including

66.196.118.36 – 98.139.54.60 – 66.196.118.33  Address 66.196.118.36 — 66.196.118.33 — and 98.139.54.60 

 are blacklisted IP’s and according to CBL, appears to be infected with a spam sending trojan or proxy. It was last detected at 2012-11-10 00:00 GMT (+/- 30 minutes), approximately 4 days, 10 hours, 30 minutes ago. This IP is operating (or NATting for a computer that is operating) the “sendsafe” or similar (such as Advanced Mass Sender – AMS) bulk emailing malware. This software is almost exclusively used for sending “Nigerian 419″/”advance fee” frauds or phishing attempts. It is also used occasionally to send pharmaceutical spam.

orange line

NAME & EMAIL-ADDRESS: Rosa Raspaldo <> citychic03@yahoo.com <>

EMAIL: I just sent the money now, It’s taken me over three hours to get this to you. Washington DC is hard to get to on the weekends, but I got it done. You will need this info. The MTCN# is 6666212499. The answer to the question is 12 months.Without answering these two he will not be able to get the $.I have scan the WU receipt to the email. Total sent $1950.00. Let me know when you have pick up the money
Hope all is well, and stay in touch.
Cherry

HEADER:

Return-Path: <citychic03@yahoo.com>
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts) ZSBvdmVyIHRocmVlIGhvdXJzIHRvIGdldCB0aGlzIHRvIHlvdS5XYXNoaW5n dG9uIERDIGlzIGhhcmQgdG8gZ2V0IHRvIG9uIHRoZSB3ZWVrZW5kcywgYnV0 IEkgZ290IGl0IGRvbmUuWW91IHdpbGwgbmVlZCB0aGlzIGluZm8uIFRoZSBN VENOICMgaXMgNjY2LTYyMS0yNDk5LlRoZSBhbnN3ZXIgdG8gdGhlIHF1ZXN0 aW9uIGlzIDEyIG1vbnRocy5XaXRob3V0IGFuc3dlcmluZyB0aAEwAQEBAQNt dWx0aXBhcnQvYWx0ZXJuYXRpdmUDAzICA3RleHQvcGxhaW4DAzACA3RleHQv aHRtbAMDMQJXZXN0ZXJuVW5pb25SZWNlaXB0UERGIC5leGUDYXBwbGljYXRp b24vb2N0ZXQtc3RyZWFtAwMxOTIz
X-YMailISG: kKEwAFwWLDuxMBwYDLCN6gDJgTBLtGF.i0Fa880ESkzjFA87 NtoRXrqtZI3FSfZ1XlGl.DLr1q4Jk8MvFDm5CD92Rgi88Dtd4CdNhoLF8FWt naLaXenM20DovarZL4wVMB61SRNqYySNE8R1m2EJanbC5wyuLMqrFdFSEz3b sntM6unHAqNmYfxlHg966yzTKkITo9rhEQPzuqjfU.RHE05wZ6pwRDm2.tbp bnPUV8S782HbhsWTloax7XwrweMjUpTyiuruETKXmFKoIm8vg4S2YBNYMZU0 cLkm_J27Fl7FUanL7N_9cLiKcepSdPNlpoljJPf1C1oKKs4JE.SRnIrmgdSu 8k1mFweFbriV17mV5RAaI_04jmVGf_TTPcDCToDa_APY.9_4y41AkEQ6dkC0 R74sSJDJiuFsq1FTCicM52f2.M714v5uy2edVVRfIZAnzkDN40XFxvET9eq2 rIR7bF4IWSLZX.CE4zoD6o8f5DpgTOyxpYP9OU_Pw6Yj_kiznLCoysyDD8aV u8N2fk7BOG0Kzd7hzydCn8tA1T2M6u2cct3W8x8fGnp90_IRIw5YpcafdjX3 oCtVNXfUngHe_WxbFMhodIQofx94f2UdhnVUYWpCvUKVifpcZ2X96IRwtDrG 6kJ_Zt.LV4Tf5yyzMniof22ZwwY6DhZieBApzVEDFYewJqvzl_jMr.sLxjWc XxpQPrY_LHPOROxfGjXidycF2BtoY67.CAl.AJRNz6YNGan4eTYtVmfexo4z riFhdKNt9dtIzYSNVLUaUt1sxXbyGArNOKS2MIWxZuWo34996Caae5os27Wd q6kGW2WOTSHrilOBmGEECZBH55FWO.UbFFbAiwal7kuvT26XTcFJ39AvKjO9 3xc7drKAxwpZ4GWmJooA4m72WOCK713vVMlGxbNKceZ7oa2xQcgjYm813fzy tf_x2dk0WLlXhznMJ.3V7hYg11rLMBHbvfgbVdlquvyU0C8JgL95sxdFKXMc gmBPgEdHMssP2JdVtZLv2JqU7zFb7Ji2Pzuq6g–
X-Originating-IP: [98.139.91.41]
Authentication-Results: mta1207.mail.bf1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO omp1041.mail.sp2.yahoo.com) (98.139.91.41) by mta1207.mail.bf1.yahoo.com with SMTP; Tue, 13 Nov 2012 12:22:13 -0800
Received: (qmail 53008 invoked by uid 1000); 13 Nov 2012 20:22:04 -0000
Received: (qmail 81464 invoked by uid 60001); 13 Nov 2012 20:22:01 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1352838120; bh=wtYjGovTUoVKR97LxRYCc8nGTumdRkYBp8+assuvFjQ=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=tticQ2vFAhygTw9xhpf1ZJja9ecIYaZibn4kA9k2r53KX9Aeki1uTR9R+cA3kR/h47MicevEvSx8dkHZdWGokkNAIJvFB9s43ks96Q0f4JM6NbJSDW/2d1JWR49hPkgow93bLtw0vb0fsHZdt9QIROfLc/UFW444D1f9MzLHYt8=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=L1MI5DnDWnWoevKmbAhSy25JQRsOFge8f/BvzkAoIUvmMKfAUaBrTVlH2wM3Ly+Ep3oZa2BRGUf3hnhRpVMbn9kgiUGq19WB1hawUdRaUF2zezhND+tot/XM5a6htIDRdtI+CCIc83eB3HBJRc+19xmbB/qsHuBCVqpM2qKiPhE=;
X-YMail-OSG: u6CUSv8VM1kxQOTNV199XWW0VODyCpxMwheiUEJWZAmoFCl esdVieBmM2sKbZzD8fXGjyuNJWwoFNRH1ms7vMwaFDNC_37MYlWJqxelhBPr dNC9HOz69mI.OjTlGh2TLd78Fscnri.iW2RXiVruslgn.XQgdEt_Vj11UWGz 3ZzOAessLgCpHOdkoq5P.pykMggZtniFX9x7B2zh3C6IAaSWXLtC.WfnfP5f SD48IAzkl1vKZ8ibsldX2w37WUC9vdIugINVL70VXRME7zaPX_iC32WUg6oj OkFstnpcVaE2bxi6HZBxmclaahDaEmuPr.tYY6Q4CNQVW1p.FLqrCg.VVVhP Wk9fNiFoSmXDSjJlSWAwWGuzLgY1aYpK4RGAjFw9sdSdIppq3Nwjwj_D_sXz x8HDzFIBBG84LRBiWKzassaVKCjus2v0S_qw.sWJJkdhb6ro-
Received: from [96.47.228.158] by web113304.mail.gq1.yahoo.com via HTTP; Tue, 13 Nov 2012 12:22:00 PST
X-Mailer: YahooMailWebService/0.8.123.460
Message-ID: <1352838120.81012.YahooMailNeo@web113304.mail.gq1.yahoo.com>
Date: Tue, 13 Nov 2012 12:22:00 -0800 (PST)
From: Rosa Raspaldo <citychic03@yahoo.com>
Reply-To: Rosa Raspaldo <citychic03@yahoo.com>
Subject: Money Sent!!!!!!
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary=”318340449-1208781365-1352838120=:81012″
Content-Length: 1969949

98.139.54.60 <> 66.196.118.36 <> 66.196.118.33

orange line

UPDATE: John Philip (a.k.a Philip John ) is under a new name and pretending to be UNITED NATION FUND ORGANIZATION under new information including:  MRS MARIA JONATHAN <> Mr John L Williams <> Mr. Obiorah U. Nwakacha <>  xxxx447@yahoo.cn <> mrjohnwiliam@hotmail.com <> homelandservce@yahoo.com <> <> westnun1@kimo.com <> obionwakacha@rocketmail.com <>  mrs.rosepink@yahoo.cn <> officef54@yahoo.cn <> 203.188.200.65 (fake proxy ip) <> homelandservce@yahoo.com <>

There is additional names, email addresses and IP addresses by clicking the United Nation’s Fund Origanization link provided.

Inheritance ( Beneficiary ) SCAM

NAME/EMAIL-ADDRESS:  Philip John <> ikjim840@yahoo.com.cn <> western.union_ben@ws-loei.ac.th <>

EMAIL: Attention:  Beneficiary,
We have concluded to Send your payment through western union $5,000.00 daily
until the ($900,000.00USD ) is completely transfered. Meanwhile, Mrs Ruth Duke
has instructed to Send you $5,000.00 in your name today. So contact our Western union
payment Agent to SEND you the mtcn to pick up this $5000 now:

CONTACT PERSON: MR FRANK BENSON
Cell Phone +22998845962
Email Address: ( western.union_ben@ws-loei.ac.th )
Please remenber to Call and ask him to give you the mtcn, sender name,
question and answer to pick you to $5,000.00. Also you should send to him
your informations.

Your receiver name :::::::::::
Your full name :::::::::::::::::
Your address ::,::::::::::::::::::
Your country ::::::::::::::::::
Your direct phone number ::::::::
Text question and answer::::::::

Thanks
Mr Philip John
WESTERN UNION HEAD OFFICE DEPARTMENT
REPUBLIC OF BENIN CALL ME +229-98845962
FOREGN CONTRACTOR PAYMENT OFFICE

HEADER: 

Return-Path: <ikjim840@yahoo.com.cn>
X-YahooFilteredBulk: 203.188.200.180
Received-SPF: none (domain of yahoo.com.cn does not designate permitted sender hosts)
X-YMailISG: Ie_k7WQWLDsw9rLSiaH.oTV9EwwzQvw.1bub9p1kZTLRnAwM ycLV1DXGz1ckn9_pwJYNt2SUUTBV1BO7gORFgrZDxqHZyWAnOAClfDJo.gaQ v6fxulcGI7eKBVQ8ZaCAomCLkZRzUoWqjS23SpZAPTfVrcqVutsl0_NbyczY 0Dsg1PFPY0VUwXbwQXjFYqG9H9fO0XDq9v4by5hS3h_A7coz_MhwSNKnnhd_ BOzHuDRUOkGrKO1sQliOrl028CvdQzElKoAq3uI8SHMPwDIKZUhBTefhYYdj qGR60qhg_iqFDbTvblRds.zd8l7zkqnzP5WPAaNLcWBIjQ.nGC0ldPaEfY0i v4Ox65rkgt_E5jDk.XWdpkeHvu0LDiWPa8hH09ZtH_bMLJssebYsyIaEif7i xfddMeXOg8zfgZLZwmkzBGnopyYoWKHD1Pm7KfFMSCzSVqqz2v2Ft48wgj1j QLT3R0D5YFSnBoqJ2Naoblq.twBLU1dedXwNbc73TW0mali50V5fpDgx9UAK BCkIuN42b_PET00EL4SmAbBx_2B8i8JvW7_3ISQgNVVVfifJ645ksFnv7mSN CWHDpUUsQQmLfJaSsCdCIeQCr0FyEE9QjEFRYM8bNbriTW3niXJYcz6SYKyP uRMNZjNcgISjfCu.SyNXxPN3Dv4zqZD92VsuyRBL5eYQgzvCrw0odHf1H3H2 L2Tm8SWHMmHtMk2su7jy.XhlRiL2YHZQGzjCQoJvUwLnD57zN.fxnjBmhzei MxEXKh6NVVLf6yQssDDt8rADTubc1yo2fccHHZOKV8k_SbUVjJ4shsCEwrVL 47mVp310.QGFgOpe4K9xPlqUaOHNTE7pjJM95WHt4zTENSMn33Yp472_P2p6 L6K_IBrGN1r3ZVNDf0nqhlRp95y1nl4QMs1lRrPTgxi7g4Gn55QYqW5Ut7gl WRP37wreBEupEHjxxa0YEq1BDgvVm7l8b0Xpxs7_QUiXSQqAop56.BxkNSEV 8hsIkutZgOKHnS8g.8AIfGSTu5U.Z9yQKqZuwiEFfapWUlCPJazCjuI3lPWk ozbAfQkLQf5DthJ29KSFlAlineh1Nsnrfg2nDAY5klAi79__6jBZ4AfN3MgG Jum_w59hE05f19NSP0n7mAgrkaVaGQ1ua95V28hESYYwelEVwhHaA7ifqFfB lkNGdrrbfC.YKiRP7P4OUG8kQR39ZVJNWz1FJ99ld6X4oTfQH8P2V0ujhmW6 bq7Z.ZPaePYcy5KO_LoQM9g1zdQGZhkoPYG.
X-Originating-IP: [203.188.200.180]
Authentication-Results: mta1168.mail.bf1.yahoo.com from=yahoo.com.cn; domainkeys=pass (ok); from=yahoo.com.cn; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm1-vm0.bullet.mail.tp2.yahoo.com) (203.188.200.180) by mta1168.mail.bf1.yahoo.com with SMTP; Fri, 09 Nov 2012 05:53:49 -0800
Received: from [203.188.200.142] by nm1.bullet.mail.tp2.yahoo.com with NNFMP; 09 Nov 2012 13:53:47 -0000
Received: from [203.209.230.76] by tm4.bullet.mail.tp2.yahoo.com with NNFMP; 09 Nov 2012 13:53:47 -0000
Received: from [127.0.0.1] by omp105.mail.cnb.yahoo.com with NNFMP; 09 Nov 2012 13:53:47 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 199691.83000.bm@omp105.mail.cnb.yahoo.com
Received: (qmail 47267 invoked by uid 60001); 9 Nov 2012 13:53:46 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com.cn; s=s1024; t=1352469226; bh=TOL0NVTbPNoOlF9liB0lmGgcLu0UCdoGN1bHOd6a0OI=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=A5yWlW6PYJ1//VLq2Hm4eWzHoCFtoKpPUPG74cCEykzhT71ASh0RBiOEdeVMo6ZaXCjpgWfgA2xzftNgjJsrPm1NFnRTY6khYgc1JaTCexmYT8WdLGXHrjc39yd1ck21hNxeY7e6lX8d5ketFFd65cVMsPa7kiJAd/I62zeKV6c=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com.cn; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=YCPQRG69wtDUsCb/O+qYwNeNb9LqKQfY/o826yyYoOfdTC2O9gJiT2OYB1eqHNFSysJ2kOvuBPm9nGkwG5GjGP8SBgwYGghyX9PnVMcQxMVLEsIzI02yMehKqu9Xy4uTqpJMI5K0j0S8FKmTK3A52vjBnG/PsY7iRgHa87yhopU=;
X-YMail-OSG: 7f_LNVMVM1k5M2dVSvmDOn0kXGul.MEdJjnHv1DfYTuqDP7 Mf5IcO26s
Received: from [81.91.228.125] by web92416.mail.cnh.yahoo.com via HTTP; Fri, 09 Nov 2012 21:53:46 CST
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.123.460
Message-ID: <1352469226.46007.YahooMailClassic@web92416.mail.cnh.yahoo.com>
Date: Fri, 9 Nov 2012 21:53:46 +0800 (CST)
From:
Philip John <ikjim840@yahoo.com.cn>
Reply-To: western.union_ben@ws-loei.ac.th
Subject: About your ($900,000.00USD payment !!!
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=”1574124242-2105172878-1352469226=:46007″
Content-Length: 10408

orange line

Lottery Scam – Nigerian 419 Scammer

NAME/EMAIL-ADDRESS: MR. VICTOR RICHARD <> webtvzzzz1233@att.net <> nelsonwilliams7813@yahoo.com.hk <>

Email: Scammer sent a attached file titled “YOUR CONFORMABLE ATM VISA CARD $8.5M USD.DOC”

HEADER:
Return-Path: <webtvzzzz1233@att.net>
X-YahooFilteredBulk: 98.139.91.190
Received-SPF: none (domain of att.net does not designate permitted sender hosts)
X-YMailISG: CxPdmEYWLDv6iWmFTy6vPskj4aBwRDKY1MP9rFHip4RHyb2m M1LpJQRBpL4B422maBiAO6iPnT.yt3gJWUK71f2koifpwbw7dNeaGE6NtA7L iPInwH56qtd48ABf2JRLy341_sN1kxNrVcNFzGiiHwIsgZ9sAtYagfzw9iTv IlBIl8TcmugctUkHkvfEYP6adRd.TGDa27SkQ3Z3Kp5w9ZgNSDx1yK_T7elY zIoXoJq7b4Hg5sX43Zd4A7b95CXvmSfv7LJMEgw0M6DKbVMJJKOsZUNl83qP fTGR_A9e3LAJC4RlXl2WVSFwA8kRHAXBYYlmSlKaYN60oijB.xvCMC6YoOrq qYwIdLveu5HkJM45Nq9Gn5.fVm9xQ4feBx7cnfPDeOlr2Ltv4MhbbNSutBuo UjlH0N0coU7PcfISb5977PAhCZKLAC4hs0KF86P4kW5AzWZMSdFI8WS0as3H Z6cVMuU1ZctgzIqYeKHQ_C4hJKg_.lxUlstve70Thxjl6pBz7mwxTE65lxuE tbluVDekDrlfypPWmRKnltdovc1euNnMSySsP0LtcEUE5Sq_z46hRy6SDKGg 9ZoFgnkk2E6Gi_nA92ryAlDahEbkeinsZHkcHgx87A1fFji5jUmtuQ2Iolyu VSbf9ia1oKOuWj77R2zA1vSxa4YH4lWC9GPMN_zQjhlL15EIQzqG3ipgaLLo cXxBSa2A4OUX2LnjvOGTj97oweQXlX6aa3BdjoWOpGKoJBs6BRaKsHz90iIZ 6M_rGLEfVsZnv4qzk4tDTOJnSB7v59SkJ1IjNs8dJu_x.cGrjTuGwk26fIXB H5w.9awFXgKlru.SAs3SnfKlBXO_1FQVYEjySWfTIHP5I5L6cZZyPrmyPXy7 bY17l51YwTCUki1dhi76Coyew0eBjLI9DXYwcla0I98XQ_hdhX8uh34mWOOr VYTDV.yxVJ0nHH1Vke.4KyK0nmi_eQAxvspfC7MslhyEkPlqxWpeiS_SwYS7 GLXXnOsIdihvGQytCov1JUUSBfY.g41AEo_4pZJ0ytuvU3gtY5PcZLkbPTZ7 0cD5yjShWxN.OcPdd5MLrGsDMcGXS1uV6hd1H330TbXpuQlk_WBbI_r4L1Jh t6oxA1izXHFjcT2aIOX4b73KzS7ocmMKwEEDGW92jvQvKAD0r3eb9R47XJ.2 KLyO7jiS34.0hhXtsIBXUxR4dcPDjLVOo5B1vtJ2RF832qYStQmZK2jUrqIv 5EeS_8WfzK1qDIpicTZyG6IjQ3LQ1tJhvq9Uk.OdIAGXs7Z2vd14ntYhN9lf _X7BkT4PVBXeiaq3s0NCIfM-
X-Originating-IP: [98.139.91.190]
Authentication-Results: mta1333.mail.mud.yahoo.com from=att.net; domainkeys=pass (ok); from=att.net; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm4-vm0.bullet.mail.sp2.yahoo.com) (98.139.91.190) by mta1333.mail.mud.yahoo.com with SMTP; Thu, 01 Nov 2012 09:45:27 -0700
Received: from [72.30.22.92] by nm4.bullet.mail.sp2.yahoo.com with NNFMP; 01 Nov 2012 16:45:27 -0000
Received: from [98.139.44.79] by tm14.bullet.mail.sp2.yahoo.com with NNFMP; 01 Nov 2012 16:45:27 -0000
Received: from [127.0.0.1] by omp1016.access.mail.sp2.yahoo.com with NNFMP; 01 Nov 2012 16:45:27 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 152894.8156.bm@omp1016.access.mail.sp2.yahoo.com
Received: (qmail 39361 invoked by uid 60001); 1 Nov 2012 16:45:25 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1351788325; bh=29gsUTQRrnnufLb0EHIuIt9r5RhqGYUQZ7dtA7hv3ww=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=fwb2MAMe+MeR+fAWmhteJpPGddGBQqMTJHNc+n5VJebKboOU4jBSpxF5mKKHZioisoSEspEungIoA4lUfLc+I2r7cW3k6iZp7mMvyBw8FgLFkKR6j3HMj2zCfj7U0WdBTXO4AVZLbB29hTbdVvMNJgv3NIek0khwiU27jWOqPXA=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=att.net; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=G8cM3rjM6GvGZ4WpV4CdEWw9eWTzEznsIoC/H0BvskupDy29BcC0s5i2aT2d+zQPqs/qJSilRfSOfs8vj3RzL94t+Uush1hcO+TIlisGIxwYogBd39WCmpnJmzAQaWbrbrNxZynezCamSCYdNK1SVB+Y4Z8EuoI9r3Mswd0JILg=;
X-YMail-OSG: P47MLm4VM1nquCF7CvUnm1iCTWikqyoIrbIoL5KvWEGWpst AAcZdHvE91Vf4p1Pceyu4hxnoe0GctwHEKdHeME891Xjp8y4U9k7bspEZec9 gY3wOjnhTtQEKtwpMQZapS9RyCUTNs6hwO0gqG1t2MGXmTcgL7FCThVrp04a 3eoEpf9x17EkEdkG8hb1M7nelI8Qn1yrBLz0zpMBGkYZDdROFt10jdykbg5O DDkxRpVtkd6OAnPM5BdfEyKtaq9vUs7wS0Hlt5cMSgmaV4qCSSzArUAs7id2 ODUK7CDRF0hVyveKjyLCq.tyOFVhUiNNUWUQeF1F5nNlTFYouODhpat8P54t W2AWfxolk2RjUY9qua0sjYIJE_xBnLTvKW_IbtX_RCZKwpKdPFs6MEInLseh 2XSKNuJ0bW3my1FX78uO2aTkxew.7eCIhzuI6UexRT.xN9a_AJLWHhbIi2C9 SdpdnCmhbJVttr4kirn5N1ttuXAQedc7hbLIniwrSEEYVFrYv2aCnz29oMg- –
Received: from [23.22.188.60] by web181305.mail.ne1.yahoo.com via HTTP; Thu, 01 Nov 2012 09:45:25 PDT
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.123.460
Message-ID: <1351788325.38612.YahooMailClassic@web181305.mail.ne1.yahoo.com>
Date: Thu, 1 Nov 2012 09:45:25 -0700 (PDT)
From:
“MR. VICTOR RICHARD” <webtvzzzz1233@att.net>
Reply-To: nelsonwilliams7813@yahoo.com.hk
Subject: OPEN THIS ATTACH FOR YOUR CONFORMABLE ATM VISA CARD $8.5M USD
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary=”1256088246-1767008780-1351788325=:38612″
Content-Length: 30671
Message contains attachments
1 File (22KB)
 
 

Tags: , , , , , , , , , , , , , , , , , , ,

“MR ALEX PEDRO” claimagent338@gmail.com

warning_1.gif - (7K)

NIGERIAN 419 LOTTERY SCAM

 

Name & Email Address: MR ALEX PEDRO <> claimagent0012@gmail.com <> claimagent338@gmail.com
 
EMAIL: KINDLY OPEN THE ATTACHED FILE –  ‘ Canadian South African Lottery Email Draw Ontario.doc
 
HEADER:
Return-Path:   <claimagent0012@gmail.com>
X-YahooFilteredBulk:   98.139.91.205
Received-SPF:   neutral (98.139.91.205 is neither permitted nor denied by domain of gmail.com)
X-YMailISG:   tP1VSAAWLDuS6rPafk_RrRpK7ruueoIm4D2rHqHmpFpQpVeg JjLWNapIGZeqxGLw4pTaGODgfhsTPx3_egnUCG0oINsQC0Tgtv79xhfK1gtc dMBWh3KSQJzwenzejsv2K7bekvjsGCWG.Rnk4JoMRS8dCDXRYysDDRD0J.VL LHj92m.O5z4czu2aEEOic02CNGBHilHOCtbduU4XLlpK25uvWQCPohd4D9NJ d0Ffr2QfI97AVAXC7LuHEprWjUEkyVyRHpHWmwqcpd.uOMPOWPpI6X8u6DNk V.XladKA4nAGMnnhNhu8Hx04mvoNnk_Ud_36SckbB1f98cZsWYw9hi94my.g bZ06TH3E5lgRJlG1XfIUTO6bBWS9PNsxMIHLvw.dAMqu0fjNNhSgawbEy3TV jacxp8Vz50WBOMwPy3Yp5HC8RXbYYsRI3zXp8_xQXlWdOUauhXRnuSRCenpV _8kwCjrKVtTEjQlOtg3hF7rcKwf8.r1ylhMjmiIR5_AshA8QCuOQhr3mO6sA OEmMo2qHLh7uiPwTpaIJ_XXGtoBgBy78WZleeG3aZBLqlOfncx_vuyebzxtN EoQitGJOn.WllhirbALkdvfeNLnsttCk36aHS9pJ9EnoXjSBY4UbWWWUuV6w 6wjineLwhttBI42nECgqeMay8CFX6uPMkmAg9qz_j25ufJWZh5xbMPTifLr_ 1dVjre00n_WuOAFgxaR3B3GqN4x3gP8RV6ooC_qS.WaRvZIzTnKWXbC5vJr1 bIoBixPff4YJN0sL7VxtNIVsmStbfMfnvL7Ml0N2b8daxuY7woKLEM73zaC4 y4rONL9b5MvwMVDtwPDCJBuX9OawJV3sr9gGFsP87JMoHnpdKGksNvgJI6Qb O2kYRiRnXasKZqEYP0P4GWkRNXw5YhtOuMOyU1gk0Hw9UJLbrGorq8YQlBfa roHrnpW0eYog0FvVaXX1s3AjeMvHXqLUWfnHYufAYzvWhSJEddbO4GBvEWPg DmXpSi6V3_lLriCaA6ALXPbDGCNGSDqLxWE.sgopboKklok_GLEyNFdG.qlf 46rqVFaFUIkx7ZuGsotLxmme1w–
X-Originating-IP:   [98.139.91.205]
Authentication-Results:   mta1284.mail.bf1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=pass (ok)
Received:   from 127.0.0.1 (EHLO nm5-vm1.bullet.mail.sp2.yahoo.com) (98.139.91.205) by mta1284.mail.bf1.yahoo.com with SMTP; Thu, 08 Nov 2012 19:32:29 -0800
Received:   from [98.139.91.65] by nm5.bullet.mail.sp2.yahoo.com with NNFMP; 09 Nov 2012 03:32:26 -0000
Received:   from [98.139.44.76] by tm5.bullet.mail.sp2.yahoo.com with NNFMP; 09 Nov 2012 03:32:26 -0000
Received:   from [127.0.0.1] by omp1013.access.mail.sp2.yahoo.com with NNFMP; 09 Nov 2012 03:32:26 -0000
X-Yahoo-Newman-Property:   ymail-5
X-Yahoo-Newman-Id:   342441.36957.bm@omp1013.access.mail.sp2.yahoo.com
Received:   (qmail 37593 invoked by uid 60001); 9 Nov 2012 03:32:25 -0000
DKIM-Signature:   v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1352431945; bh=afWVS+HvQ5qsJBcmLn53721G0UoJgzer/d95vj+/hJE=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=X4be2LumqJyvl8YtWpGqhBY4m871VwOvWUUhm+7SVEm74eCtlgYXklzhIOLQxyr3QKgvK8VVp6T+edraebBsEoK7X/FYtyVfbQCZVs7X1S2VmcV6aLSs+wRcNYuMAn2ra5EONRs1tTeIBdNAJrHT2mwd5cpe+0aH6kK00UOYCus=
X-YMail-OSG:   O1atqwYVM1mCeyLq2mbLb6aIhsBmgmRJR9_EWicVqg_3ecQ ZnSdh2ivV_24RijAemXAyc7a8R6LMSy7IiUYm5XKED93NPwS_1v2MonGwmR4 CR1g73qxEfzISareWZOS9aiy2MpfadWNynQ0c6gIMN0ekUBm.GtzLcRtPxnq 4rhSJpZyjXxfm0YxHvMqTMAm37t4B5WKA9naJTW37iI3MLvdXqlZYrD9F43E KI3JRYBn2IslSKesccAe9FmbpZMfWo5KkfSvmbRT_5EEkz1PWNUUmmmRIRlh bMHCIRBB8lkBaqeSvaoFsBn0_arWNk7f.X5fMr2Soo8vDKeNv5c3.QyirAD5 fWVt52pWjh0LM_N8RwtXgT7OD7jj7oha.JH1A5AIjd3jFycIyhfgliIDTdGb yFw9E66QuvNk3Aah4uX.6JzD1km026xbGuufBwvxlAa4OVBXs4he3XBmxxnY Y7Ca_IvBtQqFBAdJqCbdq2gHPTpDSoYpo.ZLZPrQj84hYLOdDRxLxtvbjeZh 30kIGe3ixp_2JRM5NtA–
Received:   from [174.137.184.37] by web5705.biz.mail.ne1.yahoo.com via HTTP; Thu, 08 Nov 2012 19:32:24 PST
X-Mailer:   YahooMailClassic/15.0.8 YahooMailWebService/0.8.123.460
Message-ID:   <1352431944.36702.YahooMailClassic@web5705.biz.mail.ne1.yahoo.com>
Date:   Thu, 8 Nov 2012 19:32:24 -0800 (PST)
From:  
MR ALEX PEDRO <claimagent0012@gmail.com>
Reply-To:   claimagent338@gmail.com
Subject:   WINNING NOTIFICATION
To:   undisclosed recipients: ;
MIME-Version:   1.0
Content-Type:   multipart/mixed; boundary=”-1696256133-1186200212-1352431944=:36702″
Content-Length:   314172

 

 

If you have been contacted by this scammer under a different name, email address, IP(s), etc, please post!
 
Leave a comment

Posted by on 11/14/2012 in Lottery Scam

 

Tags: , , , , , , , , , , , , ,

 
%d bloggers like this: