“Mr. Stephen Fred”

ATM CARD MONEY TRANSFER & COUNTERFEIT CHECK SCAM – NIGERIAN 419 SCAMMER

There are two email’s and two headers below. The first email and header was published on scammer419 Yesterday 12/17/12 – the second was published today (12/18/12) — Same scammer using different addresses and IP addresses.

EMAIL #1 –

TO: 4thekids1234@gmail.com, jlpurtee1218@yahoo.com, lschum6@aol.com, vikhadd068@aol.com, childcare4yours@gmail.com, jessicaspitler@hotmail.com, monkeyforthezoo@yahoo.com, angelinahudak@gmail.com, bruces_lil_sis@yahoo.com, pmiller140@woh.rr.com, chelli4dottogo@yahoo.com, shannonschapiro@yahoo.com mschutt5@woh.rr.com, phillips.april@ymail.com, ticktockclocking@gmail.com, aprilsplayhouse@att.net, lrichards7@cfl.rr.com, rosa8485@gmail.com, mommyme0107@yahoo.com, armstrongcare1@yahoo.com, albart@bellsouth.net, new.horizons322@att.net, thebestsweep@yahoo.com, missalisha08@ymail.com, dezy2224@yahoo.com, morgragedanielle@yahoo.com, joanna.sweet@hotmail.com, adenelly@aol.com, pratherjck3@aol.com, camillephlps@yahoo.com, cs09jedq@yahoo.com, baby_pmpn@yahoo.com, kmiller182@cfl.rr.com, kayladaniels90@yahoo.com, lisaconradi@gmail.com, confidence07011996@live.com, poncallinfo@gmail.com, myfamof3@gmail.com, kjg36@comcast.net, missrosesdaycare@yahoo.com, cooljet6@yahoo.com, anged98@yahoo.com, cowboydad75@gmail.com, crawbox08@gmail.com, sacpr210@yahoo.com, khusfelt1991@yahoo.com, dskupien@delawaresafetycouncil.org, primaryyears@aol.com, kidz1st@gmail.com, bonclaude1@aol.com, millerv25@gmail.com, krosieone@aol.com, poohcc07@aol.com, ironhilldaycare1@yahoo.com, bangelique95@gmail.com, truruler@yahoo.com, denisedr54@comcast.net, sromasko@verizon.net, portiabusaitis@gmail.com, portiabusaitis@comcast.net, dawnschafferman@comcast.net, elevatedplaceslearningcenter@gmail.com, gerlacht00@comcast.net, melissalee1209@hotmail.com, valdave@comcast.net, rgoo135623@aol.com, baybeesteps@msn.com, rhino_07@comcast.net, mseekids@yahoo.com, faithshouse@live.com, jeanneflynn59@gmail.com, rachel_vigil@yahoo.com, gspederson55@q.com, ptrcgzmn@yahoo.com, thomasjohn1088@gmail.com, earlybirddaycare@gmail.com, sabrinareiman@yahoo.com, letmcg@ymail.com, brandon.carson25@yahoo.com, christinamauro23@msn.com, katielewnard123@hotmail.com, porkyexposed@yahoo.com, mgfbower07@gmail.com, lonniejbeard@hotmail.com, aklittle0102@aol.com, jennywarn@live.com, leyadewey122@gmail.com, neen062964@hotmail.com, info@need-a-nanny.com, dork_britt@yahoo.com, tinytots80123@yahoo.com, caycestaubin@yahoo.com, ivana331@gmail.com, tstots@hotmail.com, bballvarsitygirl@gmail.com, alwaysforhim2@gmail.com, degutii@msn.com, tiffjowilliams@gmail.com, patriciacallan@msn.com

FROM: “Mr. Stephen Fred” <mr.stephenfred@yahoo.dk>

SUBJECT: DEAR BENEFICIARY———— YOUR FUNDS HAS BEEN RELEASED BY THE FBI TODAY CONTACT US NOW!

EMAIL: Federal Bureau of Investigation Anti-Terrorist And Monitory Crime Division. Federal Bureau Of Investigation. J.Edgar.Hoover Building Washington Dc Customers Service Hours / Monday To Saturday Office Hours Monday to Saturday: Dear Beneficiary, Series of meetings have been held over the past 7 months with the secretary general of the United Nations Organization. This ended 3days ago. It is obvious that you have not received your fund which is to the tune of $3.5Million due to past corrupt Governmental Officials who almost held the fund to themselves for their selfish reason and some individuals who have taken advantage of your fund all in an attempt to swindle your fund which has led to so many losses from your end and unnecessary delay in the receipt of your fund. The National Central Bureau of Interpol enhanced by the United Nations and Federal Bureau of Investigation have successfully passed a mandate to the current president of Nigeria his Excellency President Good luck Jonathan to boost the exercise of clearing all foreign debts owed to you and other individuals and organizations who have been found not to have receive their Contract Sum, Lottery/Gambling, Inheritance and the likes. Now how would you like to receive your payment? Because we have two method of payment which is by Check or by ATM card?

ATM Card: We will be issuing you a custom pin based ATM card which you will use to withdraw up to $5,000 per day from any ATM machine that has the Master Card Logo on it and the card have to be renewed in 4 years time which is 2015. Also with the ATM card you will be able to transfer your funds to your local bank account. The ATM card comes with a handbook or manual to enlighten you about how to use it. Even if you do not have a bank account.

Check: To be deposited in your bank for it to be cleared within three working days. Your payment would be sent to you via any of your preferred option and would be mailed to you via UPS. Because we have signed a contract with UPS which should expire in next three weeks you will only need to pay $180 instead of $420 saving you $285 So if you pay before the three weeks Dec 2012 you save $285

Take note that anyone asking you for some kind of money above the usual fee is definitely a fraudsters and you will have to stop communication with every other person if you have been in contact with any. Also remember that all you will ever have to spend is $180.00 nothing more! Nothing less! And we guarantee the receipt of your fund to be successfully delivered to you within the next 24hrs after the receipt of payment has been confirmed.

Note: Everything has been taken care of by the Federal Government of Nigeria, The United Nation and also the FBI and including taxes, custom paper and clearance duty so all you will ever need to pay is $180.

DO NOT SEND MONEY TO ANYONE UNTIL YOU READ THIS: The actual fees for shipping your ATM card is $420 but because UPS have temporarily discontinued the C.O.D which gives you the chance to pay when package is delivered for international shipping We had to sign contract with them for bulk shipping which makes the fees reduce from the actual fee of $420 to $180 nothing more and no hidden fees of any sort!

To effect the release of your fund valued at $3.5Million us dollars you are advised to contact our correspondent in Africa the delivery officer Mr Stephen Fred with the information below, Name:Mr Stephen Fred Email:mr.stephenfred@yahoo.dk You are advised to contact him with the information’s as stated below:

Your full Name.. Your Address:….. Home/Cell Phone:…….. Preferred Payment Method (ATM / Cashier Check)

Upon receipt of payment the delivery officer will ensure that your package is sent within 24 working hours. Because we are so sure of everything we are giving you a 100% money back guarantee if you do not receive payment/package within the next 24hrs after you have made the payment for shipping. And make sure that you keep the receipt of the $180payment that you made because that is the prove you will show to the delivery team when they arrive at your door step with your package of delivery

Yours sincerely, Miss Donna Gwen FEDERAL BUREAU OF INVESTIGATION UNITED STATES DEPARTMENT OF JUSTICE WASHINGTON, D.C. 20535

Note: Do disregard any email you get from any impostors or offices claiming to be in possession of your ATM CARD, you are hereby advice only to be in contact with Mr Stephen Fred of the ATM CARD CENTER who is the rightful person to deal with in regards to your ATM CARD PAYMENT and forward any emails you get from impostors to this office so we could act upon and commence investigation.

HEADER:

Return-Path: <albanesi@dmghost.dmg-hosting.com.ar>
X-YahooFilteredBulk: 200.58.125.17
Received-SPF: none (domain of dmghost.dmg-hosting.com.ar does not designate permitted sender hosts)
X-YMailISG: G4vRLFYWLDtBXE2mxgWetbgPe68s2c_J4Sy1u3QrHo_wMTq2 7ltguaR_7OqUckxfw_6vp2Lr1Jg7Eu.nS2bLDg6fo4oYGP7MTDSxe12a7pKp vDuNtWg442ZrtozAbb4qwjv9yjVKzjc3q6SUJC3ROeRuYcRhx4ZTHNEwa9dJ RRunFvOz3W.7zc.2.2cpeXIR1pV74p_qpVqC3m7H8mdBoPRVTOHo4yAvFEyq HBGagGWmoRoWFUM6WeZcFGLRRd9yG4M2adkg0pGcbx9auO2ojmtRX.d4awpI tNrecy67Vucu5czgWkng.ADegJxE6eNLDqWhXtM8r1A7O_E267YruDaoRxO6 _sIUXJPaS8LB26kJPkafbJgK7Q9bXgF9ll5Efh6DIfA71GiZ_BFxWhGrotmy _KZxe6vxBpdwxzK0Rxlr8WrNY0QZMLOp0hD28W3sC.84e3mVvDE1o89.CZ5h 9jg8M2nfaP2qu3nHGA54gPG1P9JZx9oasJlLQdjhkEP6ND1NMGwvMf48kGMY 3mnmKiJxTzCRP42tdS7Y8Ho32JKgSZ3qE_UtRHNqJnXY6nt4cEAR35W0rrKt Rxajt4Z12QQVP6ynOi0a9qX6gOBgqHI0ImNxtkZaeznZBDB94jKQgd6rsgsf F.xd9S3BVrxw5c_tcsF2ZfpH5vlPphmuFtr.6wHtqPTbo1WcAAW3TzAVQgd5 P1qNkbouaz9T_2LDTBLWIumE0eZYfRwlzjApSWZq5xN7T443jat0wR.gnq8Y dJGDz8sxqmnuHdASS5COEyfmLADo5GME9Hr1nFYnYoUc9gMY6EgDUlovdax2 JWSXg640Sl6p_WEGbvRpunnYfKhxouArjEiZxy2c4lMKAGhYcq0JrGub358H ai9FMNMHAkRnf4b18ttxSIYK5obMdAtyW.Vw4jaqgXYO540R_KQljdv7peAg k9p124LIGZdkN7S_XKaNsg3O.ey154tsrBwhl14kTdz57ZxzNc7niAYFQF1V VUTONPpN4iNZT_t8.LcVzBcHhSjrqoWJ2SMpE28MH6cyiV8IsUDbddT1YIcM iZAV58stob2h.JyLctYJZ.g5G.VYjJubKffjKBTkHbCYZ1wNzGE8sWDDIJwo eRX04Jtt4F13ZI2AARhKdrG8DAr2NSIhIUoWXKs.qbgWrQgZleThlG8O6OOT G1avOrcRyDcNaaQxG32I
X-Originating-IP: [200.58.125.17]
Authentication-Results: mta1317.mail.mud.yahoo.com from=; domainkeys=neutral (no sig); from=yahoo.dk; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO dmghost.dmg-hosting.com.ar) (200.58.125.17) by mta1317.mail.mud.yahoo.com with SMTP; Mon, 17 Dec 2012 05:44:35 -0800
Received: from albanesi by dmghost.dmg-hosting.com.ar with local (Exim 4.71) (envelope-from <albanesi@dmghost.dmg-hosting.com.ar>) id 1Tkafo-0004nX-Uf; Mon, 17 Dec 2012 10:24:00 -0300
Date: Mon, 17 Dec 2012 10:24:00 -0300
Message-Id: <E1Tkafo-0004nX-Uf@dmghost.dmg-hosting.com.ar>
To: 4thekids1234@gmail.com,jlpurtee1218@yahoo.com,lschum6@aol.com,vikhadd068@aol.com,childcare4yours@gmail.com,jessicaspitler@hotmail.com,monkeyforthezoo@yahoo.com,angelinahudak@gmail.com,bruces_lil_sis@yahoo.com,pmiller140@woh.rr.com,chelli4dottogo@yahoo.com,shannonschapiro@yahoo.com,mschutt5@woh.rr.com,phillips.april@ymail.com,ticktockclocking@gmail.com,aprilsplayhouse@att.net,lrichards7@cfl.rr.com,rosa8485@gmail.com,mommyme0107@yahoo.com,armstrongcare1@yahoo.com,albart@bellsouth.net,new.horizons322@att.net,thebestsweep@yahoo.com,missalisha08@ymail.com,dezy2224@yahoo.com,morgragedanielle@yahoo.com,joanna.sweet@hotmail.com,adenelly@aol.com,pratherjck3@aol.com,camillephlps@yahoo.com,cs09jedq@yahoo.com,baby_pmpn@yahoo.com,kmiller182@cfl.rr.com,kayladaniels90@yahoo.com,lisaconradi@gmail.com,confidence07011996@live.com,poncallinfo@gmail.com,myfamof3@gmail.com,kjg36@comcast.net,missrosesdaycare@yahoo.com,cooljet6@yahoo.com,anged98@yahoo.com,cowboydad75@gmail.com,crawbox08@gmail.com,sacpr210@yahoo.com,khusfelt1991@yahoo.com,dskupien@delawaresafetycouncil.org,primaryyears@aol.com,kidz1st@gmail.com,bonclaude1@aol.com,millerv25@gmail.com,krosieone@aol.com,poohcc07@aol.com,ironhilldaycare1@yahoo.com,bangelique95@gmail.com,truruler@yahoo.com,denisedr54@comcast.net,sromasko@verizon.net,portiabusaitis@gmail.com,portiabusaitis@comcast.net,dawnschafferman@comcast.net,elevatedplaceslearningcenter@gmail.com,gerlacht00@comcast.net,melissalee1209@hotmail.com,valdave@comcast.net,rgoo135623@aol.com,baybeesteps@msn.com,rhino_07@comcast.net,mseekids@yahoo.com,faithshouse@live.com,jeanneflynn59@gmail.com,rachel_vigil@yahoo.com,gspederson55@q.com,ptrcgzmn@yahoo.com,thomasjohn1088@gmail.com,earlybirddaycare@gmail.com,sabrinareiman@yahoo.com,letmcg@ymail.com,brandon.carson25@yahoo.com,christinamauro23@msn.com,katielewnard123@hotmail.com,porkyexposed@yahoo.com,mgfbower07@gmail.com,lonniejbeard@hotmail.com,aklittle0102@aol.com,jennywarn@live.com,leyadewey122@gmail.com,neen062964@hotmail.com,info@need-a-nanny.com,dork_britt@yahoo.com,tinytots80123@yahoo.com,caycestaubin@yahoo.com,ivana331@gmail.com,tstots@hotmail.com,bballvarsitygirl@gmail.com,alwaysforhim2@gmail.com,degutii@msn.com,tiffjowilliams@gmail.com,patriciacallan@msn.com
Subject: DEAR BENEFICIARY———— YOUR FUNDS HAS BEEN RELEASED BY THE FBI TODAY CONTACT US NOW!
From: Mr. Stephen Fred <mr.stephenfred@yahoo.dk>
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname – dmghost.dmg-hosting.com.ar
X-AntiAbuse: Original Domain – yahoo.com
X-AntiAbuse: Originator/Caller UID/GID – [826 825] / [502 502]
X-AntiAbuse: Sender Address Domain – dmghost.dmg-hosting.com.ar albanesi@dmghost.dmg-hosting.com.ar

Mr. Stephen Fred <mr.stephenfred@yahoo.dk> <albanesi@dmghost.dmg-hosting.com.ar> mr.stephenfred@yahoo.dk

__________________________________________

EMAIL #2 –

TO: deleted@yahoo.com

FROM: “vikhadd068@aol.com” <vikhadd068@aol.com>

SUBJECT: Re: DEAR BENEFICIARY———— YOUR FUNDS HAS BEEN RELEASED BY THE FBI TODAY CONTACT US NOW!

EMAIL: http://oabfranca.org.br/entrance.php NOTE: I DID NOT CLICK THE LINK AS I DONT CLICK ANY LINKS/FILES RECEIVED FROM SCAM EMAILS.

HEADER:

Return-Path: <>
Received-SPF: none (domain of imb-m01.mx.aol.com does not designate permitted sender hosts) AQEBAQ–
X-YMailISG: fG83VQIWLDuwe8ej5n0IaROXvxrlzu18BJ2irW7rRnkNUMiR 0Ctsgto2LNAskyV2Q6ixNssLOsmnFDVOBVCrL.Ma4HX.zvoh5.y.Me6a47y1 Y.s4vBi98z.8nCoiFrNhF8AthsY6JNRIP0mO3NwL6he8knCzy63JqA9qhhqY FQRl4qMLiHM902WJNFvAOn.XvAyS6gBl90P7phn5AwFtzDAnWp7SjQKS8yd9 2cqKCaMlnKRjdDDXjb2Q70KZ_PcWA5mIrPPIPxX4lk8JBJe._gcgSX6kzAYp 4YvvqU7x6K6snhfvbJKtaMeaXIjmTDn.pLJ6GEKwthBTc3K6CzQF1pPdkRRD yra8kG4Jxtlb_RaSjcjAXw5qpiHxnBAx3Oek1rLM84NqcWLvSV3nRFriYeYV nhI5BWjm8wwT3AcOsJUwm97do1.YsTka4wRMCVD6cqiCuU2jAKvwx1uDI2.b RoFUQReDBAjwqAAHPZLlkdarxo05P1Uwq5jHR99zLNJlOjaSRiMEUe0PS9zs QDsD3ljuWathFexCSe6PKWbyt3x4XQhQYjJ8mtq3elH0LdNeIuahbPv6S4G8 hueVJ.bJ9cI2b2jYCsk1qnouy2MQDdlL5VbiPxDCWp7AsBes8Nb4BepjQsVR w2UcWs9.Sy1V065valQ1_avr4y87pRQOmtt5dWEaxIAO8bWhK4iCTfcE1cJY 20x8ZehazHdzyZAVwjK95yH6Y0LghsrH75EbuSGscuYeXfnXpPOU0lHJOYpM Smn8XIi4jgWio99h4HL5hAKWRirLVLu_X5PDmHnYDie5ONFtGejBROGsblcC rl9jhZH6AJlOWZyqVTRM5Ppp3S6YCnbXEAxRydb6MzVMCUdDrES1gAdSYuc_ i5b5UqWEyedgNzG5O1cUaG9VQQWVQd26QYIhUn1LH8p5cF1d4w9e3Y7VQQ8N MYYqmESf9lsGNdZFCRFIMXXUdD5OQpzT7199rPh0OAQ6e5FssdlgeHW5u8Oe Qm9rwYEstTmh6VWIAnHdJLj59EuoMNynb0YBxAks2F6YXhwIzblZ4az3IDAf 3UW5o76BBwQ424rwxaewfRAxh33BT18DwtTa_1U0vcIPi7ooZSfLIzHxatMM tdMmB1yNMhgNeqj41iMGVgytMBZI7HV5OTRdtnMQsAoEFr2MQitM8bjxFQ4k VUhdeQ30xHi1UVWyJwl9l8xmrHA-
X-Originating-IP: [64.12.227.42]
Authentication-Results: mta1395.mail.mud.yahoo.com from=aol.com; domainkeys=neutral (no sig); from=aol.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO imb-m01.mx.aol.com) (64.12.227.42) by mta1395.mail.mud.yahoo.com with SMTP; Mon, 17 Dec 2012 23:38:11 -0800
Received: from mtain-mf12.r1000.mx.aol.com (mtain-mf12.r1000.mx.aol.com [172.29.96.160]) by imb-m01.mx.aol.com (AOL Mail Bouncer) with ESMTP id B186A382B708 for _______ Tue, 18 Dec 2012 02:35:08 -0500 (EST)
Received: from core-mic004a.r1000.mail.aol.com (core-mic004.r1000.mail.aol.com [172.29.104.4]) by mtain-mf12.r1000.mx.aol.com (Partner Internet Inbound) with ESMTP id 9ADBB3800008A for _______ Tue, 18 Dec 2012 02:35:08 -0500 (EST)
Date: Tue, 18 Dec 2012 02:35:08 -0500 (EST)
From: vikhadd068@aol.com
Message-ID: <52151792.8536.1355816108626.JavaMail.zimbra@core-mic004.r1000.mail.aol.com>
In-Reply-To: <1355816106.93122.YahooMailClassic@web161004.mail.bf1.yahoo.com>
Subject: Re: DEAR BENEFICIARY———— YOUR FUNDS HAS BEEN RELEASED BY THE FBI TODAY CONTACT US NOW!
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Auto-Submitted: auto-replied (aol; away)
Precedence: bulk
x-aol-global-disposition: G
X-AOL-SCOLL-SCORE: 0:2:335928000:93952408
X-AOL-SCOLL-URL_COUNT: 0
x-aol-sid: 3039ac1d60a050d01cac1b64
X-AOL-IP: 172.29.104.4

64.12.227.42 — 172.29.96.160 — 172.29.104.4

 

Julian Thomas

Phishing Attack – MALWARE

 

EMAIL: http://theglobalviews.com/wp-content/plugins/akismet/ugoogle.html

HEADER:

Return-Path: <jthomas299@gmail.com>
Received-SPF: pass (domain of gmail.com designates 209.85.210.173 as permitted sender) dWdpbnMvYWtpc21ldC91Z29vZ2xlLmh0bWwgATABAQEB
X-YMailISG: _QbkUa4WLDtDDImGzxIRh._8UctX7E_yEakMVKzPQVFgOxU2 f8BXgO9XOACNn18iN8QwyZUxCQjglxaLxh4l1dHKsh377v_gydQ1_Y9OFsPj 0k8K9DADiuebd2j.rmz9EnAaSwF2jdtNGDrTEPGS_EZilciswFOJti5hGzmy uPfoF.AJlwdTa9vYWnC.ijOt7dkRDUrJ6cPYFkuGK9Fa7Vy6.WWkGdmAlvxp mum7F6q6e6nOeCwHLK5Hi56e2QqN3TNT3M92wT5X9GDKvxGhTR1D5JebAs0D Ta_K6z1CLwIcycuHy81fSgDvcGZjMDMdBn6TlMal02B7KUXXEjZbKSdGMbCg p9_qnbQqoKeybTscfuwT.DeaW5AhOgxNxSMJQjuQlTzbdz0oyeQDVS.NrGdY aAXwBp8.oSejmBXdtuPWsPSo1QqhkvE4xOAH0JWR4Ffdc3aMV86DzbLZ5xgb k6OmZZq.LkWDm7WlSGboqNQZcjyHFIvZHHTArW_mv4OBklvqb04bzyxSsAFY mRbtLcROkVI0MupzMJPwSQY4uqXTvfAfD2cyV2Omx6udS23Zbi5BEJZV6VZr lFsiUFuddVHiDZYzOTgYaTQYUJuxzL0pLS9XQtIMwbFBZ7HzZ9PCxx0MpvEE p5EEdb5gDPidUiFjPEd8A7seTb0bft2VCgaWgybRiBYGyvTb5mAGXw3CrxHi 5pSRqwQdVr3_YSKPxD7ziKVD6yTHRI9n8cWJ_WYwF3XJRFvyOqq7.rM5gmlN Z1LMh8k8x_wTcVKMSYdlz1ELt_4H5CWL6IQM.juI_Ag59GSfmOThO40utvLr eth5EljfPr0IhUMOChtpZnsEbGXbrCe2bQRcr.u2LVQ2NoOX_g6nb_yX_ChG UAHULyY4IvpPsG9PpQol1gfSKVp_LSXF0dxzem4Wf6jKdRkswKe3yZpFrXmF o2kEOJtCqwCrk05Z0naHjZiQ4IOHWT7nzM3oNiW1eaobvAyip1W7bZvG6chd HGiLQ8JEarox2qFrPCzTj8RDVl66byTZ4v0XN8MrkIcq7MxM1oZRibWXniOQ wn1Zj03LkieeflXlhgZNUi566Ced5zol9ousQfqUVBQeH46.5038.6aWFmv4 iM1tBAPuh9SxdV5FcHr_rCGgQ1CUYvOcWwhWHnIHACk_tvpIyXZLXSDBd5Tv 4P.FV6_D
X-Originating-IP: [209.85.210.173]
Authentication-Results: mta1259.mail.bf1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO mail-ia0-f173.google.com) (209.85.210.173) by mta1259.mail.bf1.yahoo.com with SMTP; Sat, 10 Nov 2012 02:23:05 -0800
Received: by mail-ia0-f173.google.com with SMTP id m10so3261400iam.4 for <deleted@yahoo.com>; Sat, 10 Nov 2012 02:23:05 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=X/EcyHI7fCzBVRIZx1ZLHDvk8NTmX3HJwBi5boQXb1Q=; b=oYfe6tprlmGl4KQGlch5xN9W/sfJdTSxywTJ0RPlOyKp92uoBSeDrC7gi6Cju6EujQ VdKZO205dG3h2pX64Wt+vQiAjwONADSwU0jZ4NGFie+TzVWM9Hfs5RTrpgSDHrRr+E93 ElhMjrYS1fpk3P4LxqPgSzZQFWZV8XGwMUE24Hz16+0AAu0w7cd11I5h7d//s8sIY7MA wmKpBHSg7wxoBMdQ0gik6WGNcTFb5RTY/YF8rYv/6hQY1geA6XGjIRW0iBeUWALv9TBH G6aLZyUkbNeiqwRBsWou2dNAljQgW1UDYlDrPpu6fvSDVhDGhrPZsOjT1xHgFeLuO3xK k1dQ==
MIME-Version: 1.0
Received: by 10.50.16.144 with SMTP id g16mr3131462igd.23.1352542985776; Sat, 10 Nov 2012 02:23:05 -0800 (PST)
Received: by 10.231.11.67 with HTTP; Sat, 10 Nov 2012 02:23:05 -0800 (PST)
Date: Sat, 10 Nov 2012 11:23:05 +0100
Message-ID: <CACYsU7yNrJqyaoLs1pASkUTWyk-biOmk+-b79chG_LMtGjwWDA@mail.gmail.com>
From: Julian Thomas <jthomas299@gmail.com> Add sender to Contacts
To: julianthomas@facebook.com, mmdavis6@gmail.com, mzwx4-3270719590@sale.craigslist.org, deleted@yahoo.com, theenvycorps@gmail.com

“Julian Thomas” <jthomas299@gmail.com> 209.85.210.173

 

“Yahoo!” (Hacker)

Yahoo Phishing Attack – Account Theft

EMAIL: Dear User,

Your E-mail account has exceeded its limit and needs to be verified, if not verified within 24 hours, we shall suspend your account

Click Here for a quick update.

Yahoo Team.

HEADER:

Return-Path: <raymond_chancellor@yahoo.com>
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts) ZWRlZCBpdHMgbGltaXQgYW5kIG5lZWRzIHRvIGJlIHZlcmlmaWVkLCBpZiBu b3QgdmVyaWZpZWQgd2l0aGluIDI0IGhvdXJzLCB3ZSBzaGFsbCBzdXNwZW5k IHlvdXIgYWNjb3VudCBDbGljayBIZXJlIGZvciBhIHF1aWNrIHVwZGF0ZS4g WWFob28gVGVhbS4gATABAQEBA3RleHQvcGxhaW4DAzACA3RleHQvaHRtbAMD Nw–
X-YMailISG: ru2PeeIWLDu_YswWAiBfr9a5GZz.BdoR6VyCENOUu3w.ASKp Dru5lsHhwvNANcn8tJyOQteokG.E8sFMLfS99UskAiYXkJAPuwh19HGOZSBh .Ic7ixmdRJiYlvFNS2fezC6H1IH.dtUzPqzYLayt1mV0icHXkflEqRXyfTYe WUa3VX7kfNeqgADK8DFzuoLRTvq95Z_S6TqkhdC6hyBT9R5FmXppWzKFdUBV V.4NyeQsXc6YmJjswLvv9L65b.nR.sV064voyoErzntj.X_viK6h1fR6E.vS oNJOLReVATt_l5XHDGhLhT3S2ImDss88WAv_kYy7I0wpppzs3BNu9LGtReRa PnNcNBK5EUYe0Ob3oop43cdiiXqRt0lvnk2GWkJeIL4A26UhuZJAGKy446fl pxaCtjuXv2LO1H2IdadjUKuC8RdaJF6THlAdrA8ObfYPqZyQfx1TZzWaVjQp 7GcsrQJc3.XZ4xpmVqLUotfishy5vwM1s7cTw39ipODEILCt57th52_do9hQ JhYbGqxL73jDvbEHyFp.hzxTGxQFy4MhBtWSEDDBTpHxnfyuri99d49.oNR0 G1vAj.Ej61z4AnFnN1XVPWZeD6UahLuqKYBPY6joPTWuKaUZXbaPJfW28CkC mWF0njzTvFo8UowKcP2s0nd.pK71EGuo3kD5RcCSSPHyU3XqGZrSYohoJ52M GHFR22.BWkJfxA5y9YMdRSvNYdjhtOa.HpERXaEQufjC62ikRPHHbUmxlawE PSpWmxlytHGcBHkXazvCYDeUT8qeiXKgSemAwAffVqR3aCqSYZdi5SCfB3bb b1_350YuEgd.WPb9Q7KF63onbXZGdNa2vsYoPT5qj6x0C_hg5lBSQWI6W8ed rI470SONkJW.1bDc4rlFCqM07Hofqv5ug0rj0ivWFq2qIzXzggKHeOBGzaz6 gvbDe0BLcMy67QaC1959wQvyvLSbQ36nXqO3AgeY8poI2aItRuX26yA5DG0W 09ngHcFu5u4sAgwaILI23MhQeCbrtWrbM_A0aU5AsenJIvHsb2AuoTcLgCMd ec4fyYpA0pToe0p5z0CgQFigIi8Ph114lgQfXJn7osXXbteS1VuBTOPm3JX8 .BHbDj_J8OTk1V0I_SH9PUg4IEGFNwenwdvdpY._0_Y1L6ChsgFqrGB4irkK LL_LWZMfwUZHEpsMc8PYv8_Cvc4h76q7cS64g0p1NpRwJxbLj83n0pRYLkzb TkudQ9vHJ4bqgwvNm23TK3WPQy2t2DqR_ubUl2xgHahqZEOcekrsYRBU0ynW Hz2.IB8rmP6980p9xfNHHts4PLv1Kj9NqxMt3pZ3w_gqAqjjgg429EHCac8k 5frxzhViUpB1
X-Originating-IP: [98.138.90.156]
Authentication-Results: mta1279.mail.mud.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm8-vm2.bullet.mail.ne1.yahoo.com) (98.138.90.156) by mta1279.mail.mud.yahoo.com with SMTP; Wed, 05 Sep 2012 02:08:36 -0700
Received: from [98.138.90.54] by nm8.bullet.mail.ne1.yahoo.com with NNFMP; 05 Sep 2012 09:08:36 -0000
Received: from [98.138.87.7] by tm7.bullet.mail.ne1.yahoo.com with NNFMP; 05 Sep 2012 09:08:36 -0000
Received: from [127.0.0.1] by omp1007.mail.ne1.yahoo.com with NNFMP; 05 Sep 2012 09:08:36 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 441391.85521.bm@omp1007.mail.ne1.yahoo.com
Received: (qmail 89641 invoked by uid 60001); 5 Sep 2012 09:08:36 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1346836116; bh=mUVSwmh+OwI/r/094+7ixMFwJBu1KngX3YTtxc8RWZ8=; h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=pX9EZqLfTrfDKXeV3sZhyBaWvAorYhBpTnHKM1+D6VYwCkKYKqr3PPVy3tL3iQ7Ys7xM4jGLF/+Z5tKRq+/0nl2kmwPaBAXDk/I76JFMZODVH8gUa9F0C67/UAaI5iOzMsyC/1MW989z5P8w9inxafV1+4BrU0BXjIPmqqVzTBg=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=U7LipwKwn/nTMDNCyo1YMoTLIr7az+KyYX3dDwZZZbEQEY++SukvCjTpko47pjk4kgM/+/G0VkwivuPKdN8tps8F1KjfLuFtJW6xgJTizzkp6TPt3rEcUTgCBfUydmRNrR/RzaQrUwUa/SzJ/Nli7mECQA1VSFmqrSMHT6vRGdM=;
X-YMail-OSG: Ves1zDMVM1lZR1BvyYpXNgJKuQDCjhh2MtsZId.LMXfFcQG p6037nqHMNo.wUgTMLdVO1tZNFB9s9UXmpAA544Jieg8Ha2bAOn1txO_eYm3 bem3rP4TroOmZDi1dYkmvDpCzvvjgnmHoutiuszsRsRvhQEgS4jWaHSoPQQy .JWYL4f8X8XtWszqsVLJJH0IJE.V9VSwIBlzzCj.x5nQh6fYGo_kmbQlhzU9 LXQnVd4W9EV2nht2ctZOM0OE7b4m2KdI4HHAyUSr8CeG1wj1.lbtNDi7p.pO xoFEpXycj5WU.Cn.B8OVBbjt4xLE7fMSu.esuNBCWrbfZxUWk81SR5wo3smI G7elPPBMbGgT1ivaV3p9tLEf.vMzfCuUJiZvFT5LY5dXr0wi1ZneR046fiHf 7ZEkKRvL3fJUO8tQSwbOb40eIbeJ.IxXy2Qkkf8QLhfMb1amCl5kCvlx7Qmr fv87DhtgtBu_hgdd54QUCQzCv60WJ7Su_znzjCCeVxf3z6f7K.q5.ONO2hUr .bbABtOlhwn2phu6DRWN8T.boB5olR1TT50PClfvlH4uSpb.mhVo-
Received: from [65.19.131.252] by web121806.mail.ne1.yahoo.com via HTTP; Wed, 05 Sep 2012 02:08:36 PDT
X-Mailer: YahooMailWebService/0.8.121.416
Message-ID: <1346836116.67251.YahooMailNeo@web121806.mail.ne1.yahoo.com>
Date: Wed, 5 Sep 2012 02:08:36 -0700 (PDT)
From: Yahoo! <raymond_chancellor@yahoo.com>
Reply-To: Yahoo! <raymond_chancellor@yahoo.com>
Subject: Verification Of Account

“Yahoo!” <raymond_chancellor@yahoo.com> RETURN-PATH: raymond_chancellor@yahoo.com Raymond Chancellor

RECEIVED IP: 65.19.131.252 ORIGINATING-IP: 98.138.90.156

 

“GINGER HARTMAN”

LOAN SCAM – ONLINE FRAUD

EMAIL:

Loan shark ::
Financial help.3% interest rate offer. Are you interested??

HEADER:

Return-Path: <ghartman@shaw.ca>
X-YahooFilteredBulk: 24.71.223.10
Received-SPF: pass (domain of shaw.ca designates 24.71.223.10 as permitted sender)
X-YMailISG: oOtW80gWLDuvf30mNUVlPTGz.gv6h9KnaOnh5_sKFcZdKIRb 7ilWmpoi3G.Go8nohkXAs9TkGwtz671hOHR6xp9zxboC8Z0UAABqLVscQ63o CtenVjV0L8wg548TBvoFL3IlA.20z.uoeWDDVYubTmuBC7uVRm_aJ.d5sEez M4dOQgQPXeSKg.bupRduDKMqsKmd4tSOHKyc2CjwfLIoOF9up0k7tfRvtJPV uzBWUBXK360we0BFtDAOjCgdfZYT1oeh0NzOHDcAocNjh8msWlIDal5_1bF1 V6Rs3bXt3MDdMhGp9ithQvgqy_aj5gg1sXs9M9YbdkOzhrnyp7NfKAWxkqom qJGusmCVxe8FvwZlfmOd3r1uQAxwebcYoljDgZDFC3xAK73xJVoFzGn7R1v6 umgvdCQkVbHTN8hn08IwaFIVWe3nNHwx3HP1p2pslH7Y70d9vaR4vy_7aHJE PWYxEbBNU.30HfT9tIJHwI5rRnLEScQ42TBKVVdWmD6lbg9tIaTwQ1GSO3Mf nyRlBQzWSRE2Xi20uhCE_lWjt002q1qIZNlGOkZ0ZR2s_d0mQph5oW1MYUip XQ60nCpdqOj2eULqm1v8Id71tOVpAcg7HhT8BdO_QiKJwQHRh9gyOQ4UwqZg enC_oW1lYJWxh_yo0mMXTyqXzSs8TUeJ18CaIspN8lB_xX49q6N5_JOK2QQm IwPlquLRYAtp.ix0FnlQZXVa6_G65ffb9UMe1HBd3H8WzFiI1FBGtzygor49 nWTb4rtpcc7rYyQleBWa99wRuekgRPdrJQK_3Bq6xs54k8xUxyTj3QBrYZnV HfECsRMvV0KtNCM5f91u557WzmuIJ99O5JjU5f2lt6rBzxdMedIPbwwoJEbY quuG_IMwE.8k7FQNuRUzJkPUsPwKCCaQDdmUOf3MyyMqgeNo5F.3t9z_ol73 ZOmWqTcK42H5M6mup3kpQmbdAJKBWEUWLUf5eC6igZQm1lZb15YV_ZDAV.PN oCaojse2IgHb26hjYBvv66SD7KbO0B5bO4qNod5RMrNDntLSb7QOCRJXidIz tf_JIj9cnG4Nr1QAueXYeQnJWquVeY7OdY5t64yy852Whx1CJx8h8.dknt6X DYXPYm2BDWKD8V2w.OOFYeaoEZxJAc1L4XQHiDrEWA1.dzuTI87YpYFKkr5G 1zWLYZYgb9zbEKoIOrzFs0jm94c6P.W_1I0rT3ltx945l9SnAppFTSzPOD5X n5QzkYHcChU.29CXhskPlSwqOrlzGWYEGndSAFTlypk8l8BCvpblkcjIQNuq 4FhCdKeeQWOAduWxIPHesGbwCVQse.B1wOre81qp44klCtWkBowDUQI6k3.c AgYYG96dcBM.80KiKVgRYNL5cSTxIzYPHpDp1VK3.bC2FFrz.LOqHOWKCHze fCoTOU.G2iZ9j8cVTI0tq.da
X-Originating-IP: [24.71.223.10]
Authentication-Results: mta1334.mail.mud.yahoo.com from=shaw.ca; domainkeys=neutral (no sig); from=shaw.ca; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO idcmail-mo1so.shaw.ca) (24.71.223.10) by mta1334.mail.mud.yahoo.com with SMTP; Fri, 23 Nov 2012 15:10:14 -0800
Received: from pd2mr2so-ssvc.prod.shaw.ca ([10.0.141.109]) by pd4mo1so-svcs.prod.shaw.ca with ESMTP; 23 Nov 2012 16:09:36 -0700
X-Cloudmark-SP-Filtered: true
X-Cloudmark-SP-Result: v=1.1 cv=p8mEu/h7xBu65g78qEtj06i6I9WeWSE3NzSxFOrkIsU= c=1 sm=1 a=D_27H3ZsApoA:10 a=FKkrIqjQGGEA:10 a=kHoLyJ82vuQA:10 a=BLceEmwcHowA:10 a=IkcTkHD0fZMA:10 a=I-0yktAoqaXidEw0GgwA:9 a=QEXdDO2ut3YA:10 a=HpAAvcLHHh0Zw7uRqdWCyQ==:117
Received: from unknown (HELO cds047.dcs.int.inet) ([10.0.141.22]) by pd2mr2so-svcs.prod.shaw.ca with ESMTP; 23 Nov 2012 16:09:32 -0700
Date: Fri, 23 Nov 2012 16:09:33 -0700 (MST)
From: GINGER HARTMAN <ghartman@shaw.ca>
Reply-To: pihlli@excite.com
Message-ID: <307633308.18993878.1353712173120.JavaMail.root@cds047>
Subject: re:
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-Originating-IP: [41.71.142.70]
X-Mailer: Zimbra 7.1.4_GA_2555 (zclient/7.1.4_GA_2555)

“GINGER HARTMAN” <ghartman@shaw.ca> REPLY-ADDRESS: pihlli@excite.com

41.71.142.70 >> 24.71.223.10 >> 10.0.141.109

 

“raman sule”

INVESTMENT – SCAM – MONEY TRANSACTION – FRAUD –

From Raman Sule.
This sum amount. ($18.4 M.US) deposited in the bank by my late father before his sudden Death by the rebels, I would like you assist me transfer this money into your account as my late father foreign partner & invest wisely by you,

I will compensate with 16% of the total money for your asistance. feel free and send me your details, Full Name, Home Address, direct cell number, Occupation,I will update with more details about this money and all the related document regarding this money,

Awaiting your prompt response,
Raman Sule,

Contact me in this emails (raman2sule@mysinamail.com)for good cooperation in this transaction,

HEADER:

Return-Path: <ramansule121@yahoo.fr>
X-YahooFilteredBulk: 217.117.146.165
Received-SPF: none (domain of yahoo.fr does not designate permitted sender hosts)
X-YMailISG: osgj1wMWLDv4pdBGtCaPCqAQ4VJAmywivJTBQVDnYwEZumIU HwX9Vo5UdrsI9RrLBllB8aal0XLU20U76gRqcBpob1hYz6O09Y8jk.Dy041j s5JHIHb5Tn9zZ3GQKJ0SVDHQIawqwxk3XP6ZrGbVaY3_UboJgY7Vmoc2EVtf Ap_3wNWdrGigZ937OCgXBCIwwyz_rRKeGffpNMRN8a0ovcTk9Ts6w3SrppNN VesGom1orMIrqZ0WRm9zbf5Mu4bM7VKrlayKoumYv3qBrOImmCklHnvewH76 Mf4Sx7rOw5Q5liOlQzy1H64bXJlTOeni8NfVfgzKyoT.h2CJqSUzYMW8ad6n ut.XuMWoDr9EoARmVohQ.iloswCKlSZXZoBjQSXDvp7J4PavU0jb4iUnod1M HvyUDUtQ0Dmn9U0QOqGOXHw8m4QHQ3Q1hEOe22My0G946GZneWvAD5TDq82M 6jSsSb2IcIUXMV32Dc_fWwcclnYjFhTEVp8OKkwXZtvuhBLzIGbyDxzq6fWU ZMaIPafJfsdbHuB9lQnyLUUH5hQz6IFlxpwcWIP64421_RKAFJVpR2cW6YAz LHXSpqByP53.R5Q9Yovfs6XBJAoX6b1HRIZotRIPrS4FJnWpskY6Z1n088vS XHdmhtuIogVSyu5OZVIyqwkoox5gW66BH51jJOxAEklmWY6p94ZZoCVDrLBi 2k0DuhaJdVbHOCv1kxOz4W0XC8lZQdbEyD70LWFVN7VqR_9oqDGr85M_3.LH 35pI7YiNkQ2mI1E4B0o5xLjMv7icR_8RBi1A6pwvi22tiHkhaQP1wAvnakct E2tvs7C18EQ3OK6zotO4cA5l.DGKPHoXwPrCUpLUsY0bG4XCZIwLtYjj35F6 M0cKohDU5cjyJEniABz_eIy0SBRNvl9VMwnmb3i9a7.ul.MT0mljnPysaAkv DOPUv3epgqXsbRgodJw4CP_7Q593dXFqa7_psmwMgqBv_lJ0EzrxVD4R_SdK vmNNuFt0vMB0CgbdvZgFOG754Q5TazpZT2EFEfIZ456eBKItgpQb1RMX07F. zr29mclNx_eB9z5HB092OsF.xBNleRDVaowXpYISiC7qmbB8U2pgM_1.OYL. 9qr2SlH3NKiVyk92zkhODtHdlzhf8krkSFPjWHjchLKz8xzXrQ.C64N.aw26 0ILG7rb1VfLVv0ZBfY1fs6H1CzCp1D90XWYbzJOVEidkLzrBNDVortMztP3y LPQOOlEmyZibw6shIYk3mRdmmH1P1.pkPTy3DLg82B6EjU1dX2cTuizjCvvI nBWJxt29Kg3iaTjWh5HmMBwQJrwKjK.aSjoaByR9tx0LSI3dUwxLbgGltEyn HDDkaEEi6VfV57QnPLU1Mp31bf_BayxyuovC.Kjs0CK07OzNi2mdMVS6w0Kg j8KM9JXCGjgrj86EytgivLz0ULwia5i50c7yl4yEsbzp3CKhbOOkeSdsV96r MfgaZ8Yua2Z7iPif1D344ewKA6W23HOjOtIPZOccZDzfY1VdkgcHBddVNkcr M0Dp7ZCvF7H1YdiVhZCSwmpvJGtIr70T98RKbTshwwKdWJtqSz2PaaBzMVXv 1YBsjdUj_6cd7_gc_KMPsfl7.UKU5iJojASV1GxobVDS6OLeWuQKGsDBlf0S juxkMN0TQFM_YEuC76pSGg9im_xVEjWdZom70mDDxAddbRgd6fnsoOvxLFzp VuVYObvxNzkwxbiCfRNeQhzfEgZGI_nIng69cAooKXgEh2GpBMYT4iEVK.CO Agm7dBgFy2kuLkMBdRtOcWFX.d_5KKe_u4uQyo37gH7eSJ.Z0a9dHQvFYrux mA–
X-Originating-IP: [217.117.146.165]
Authentication-Results: mta1179.mail.bf1.yahoo.com from=yahoo.fr; domainkeys=neutral (no sig); from=yahoo.fr; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO bewoopi.com) (217.117.146.165) by mta1179.mail.bf1.yahoo.com with SMTP; Wed, 12 Dec 2012 07:45:04 -0800
Received: from bewoopi.com (ns352848.ovh.net [91.121.87.202]) by bewoopi.com (Postfix) with ESMTP id 97956A00548; Wed, 12 Dec 2012 07:49:46 +0100 (CET)
Date: Wed, 12 Dec 2012 06:49:46 +0000
Message-Id: <MEWOAY$F7D22E9FD849DDA9B9BFEE3282E8DD6C@bewoopi.com>
Subject: From Raman Sule
Content-Transfer-Encoding: quoted-printable
From: “raman sule” <ramansule121@yahoo.fr>
X-XaM3-API-Version: V3(R2)
X-SenderIP: 91.121.87.202

“raman sule” <ramansule121@yahoo.fr>

217.117.146.165 ramansule121@yahoo.fr

 

David George

SCAM – BUSINESS PROPOSAL PARTNER – FRAUD

12/17/12 – UPDATE: Below the first email and header is another email/header from the same scammer. The second header shows “David George” using different information including different email addresses and IPs

EMAIL #1

SUBJECT: View This Attach File And Get Back To Me.

EMAIL: There was an attached file in the email titled “Open Attach”

HEADER:

Return-Path: <dtito4539@gmail.com>
X-YahooFilteredBulk: 98.138.91.101
Received-SPF: neutral (98.138.91.101 is neither permitted nor denied by domain of gmail.com)
X-YMailISG: 7_YIhlkWLDu90wKhHyyxw6zpHyxycgdiAAa4YwuNukVVetoh J_IC5bWWEgUUtuhkKfPFe.tMo1UbGmenMhF03EOzfaw7eIqqmetRMEZ4oGzb VHndlb9o.U94PesgTXj0QFOJCMffAurCH346kPPPTRxPpLhWIvTbXtLQmcLU BJRJ7U.Y2xNjjaxrdUgitDHDq9IqyHsyg4GUmdsg3DViiS7ug05icIpm6zZY 15TpdzMEk.dloUVHX4X5colstMK9o8cj3S6Dy9pG7og_pb6ByLAZIAqEHLpo Qrt.EOlrMjtuxj6DMzYzX6qi7YUmXO6vp_kcU1yMNz_itYP0LPLIngyQJ9NR F9BtNikASLmNJUDU2gyctMSy57nj9hjVmDozpZ4SlaFLigd6460ujdc9AfVi hcf493q5bq_ZcAvKBRSCYoY6H17gmiybGwA1Khd9zAXSHVK8F75gmOwlsEZV IBiRI7_8cwpOzDmLinvmzXZXyhS74F1IGrQL0JL_g_B8yk_DdeAIVgtpmkWT SOyia.1O5nayDgWlpWgkc9xwpbznXoUZvHcnTtjc2XYTLmnJQ8S4hVt0qTTZ crIyoxAQagIeC25yzg0JCFsY59rQIKfAQyzBB_dFL25lOA0qsaMem1h_o9zk ZBPXQLLazUI7iFCdePeIve0r3vADC3LxQNzSlOPqJh0rTb1eB5fupXG2v1Ix xZBev0wEsghKQ9aPi.hlpyfq7HOUj8KFbB08w1Tjncfn0ptfICfi7514.4Fg TSdWVFftXF3MEp7ZEs9kbkHD3vSv2kpBtB2MerhvoZ7YA3ofF7.OWStPDNVB OrPE.u0Q.U0tEEAQ8iTF6050DJCFNZnDYnIILvXWIGEAkunQxqF9kKM_xXI8 3KlZFhO3_00Tk3sekKyuw0XPQg60zPVbwwgTRlRdwn7UvN8kpoULxNaPA_Ld gDblLsidCE_opoBENVrcfvBmbF5_klg.e.4FELw9x92L8QUsYR_vOJp7DL6N XIRfvT6BnyWcmwHQIPhFrTi_ajCRjhKzLrE5_z7dzThVKmD0TVht07F1osXa iHFcLu8f6Uu.hDz8iEGyJ09KaC8RRVoFS8f4nm_MkxSu9bk0k1Lu3fvkNQfx L847swtQsIiC4wlsRCHwYrj6piDtl8GyRQ9uCPivXpH2ifGbXg.e2f71TCaa PIrQGY7xCDbzDq7OYaYggzfEcgPgqPR_7YCNsmbez_LC5eUKq9b13OTQWCzo 50lAe__6EAfKTnwSImZds2a6pw–
X-Originating-IP: [98.138.91.101]
Authentication-Results: mta1209.mail.ac4.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm8-vm6.bullet.mail.ne1.yahoo.com) (98.138.91.101) by mta1209.mail.ac4.yahoo.com with SMTP; Mon, 03 Dec 2012 14:34:36 +0000
Received: from [98.138.226.180] by nm8.bullet.mail.ne1.yahoo.com with NNFMP; 03 Dec 2012 14:34:29 -0000
Received: from [66.94.237.109] by tm15.bullet.mail.ne1.yahoo.com with NNFMP; 03 Dec 2012 14:34:29 -0000
Received: from [127.0.0.1] by omp1014.access.mail.mud.yahoo.com with NNFMP; 03 Dec 2012 14:34:29 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: 280493.47606.bm@omp1014.access.mail.mud.yahoo.com
Received: (qmail 25551 invoked by uid 60001); 3 Dec 2012 14:34:28 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1354545268; bh=o0AZy5NFBNZAPup6KgDmVQaETpPB/49bLptSj+IPDic=; h=X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=32q637yHtI3YkIIUG0C9gxQUCjXIvqiWJRRigd35qEzsDn9zlFniWa3HMPoBUfjKydfgoK4wuW2mGqPnVVijEQGQCtwPbhawwF8cwcoiHruJB/v+H3KOd5+9A3/t46tBgFI0hvqee/6n9jY3cr4P3JAeAwmfDyQv0qlkeJ/z+/o=
X-YMail-OSG: oYLOaBAVM1nTTiR5riPoVSq50.JwVtNy0eFdRApEKzvilWE UKgXcXt.fJt6NELENVzUePzHgeoyn.jo2uoDWFq1MobkNjWJynQ8rz9gFdE3 3b6Ty2cyiU.Wh5LRVuJclL2GuLEuHeBlPXgbqmxZ94K4wNVfZJKMHaHVLvA5 hCOhKDclOO.Sv5qigihI9Ia4kFYnCQM5ABMh5fyj8fxU8IHc_ba4Gy.fxUn5 Od6ndKsyQeCR_ATVtgZYfQ_BuLBFJHZFbCNu2HiwU7gMRTPYva.qn7F0Q1eD _3yFpW8Fz2g_M5AuyffKQxssk9QhnThpttFJt7OU15ixxdNgL9lMiNZvq5.Z 2vZh_hlZvmgPi1GOY_XIELkH16uG_YOYgSQYmOW8Ai0Jix96FT4x9FFvl0aG gZzkNI1cD4engrONgudP_kyUY.oNSoxqQcheo1_WoO.KMUloBwuab2GXbqBB 3280I_3PrRVaBGGd6onJrDq4AgDhVBX._XtCWGr3RpOEtyTWV6yZqGKc-
Received: from [69.163.96.25] by web5703.biz.mail.ne1.yahoo.com via HTTP; Mon, 03 Dec 2012 06:34:28 PST
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.128.478
Message-ID: <1354545268.64346.YahooMailClassic@web5703.biz.mail.ne1.yahoo.com>
Date: Mon, 3 Dec 2012 06:34:28 -0800 (PST)
From: David George <dtito4539@gmail.com>
Reply-To: gdavid484@gmail.com
Subject: View This Attach File And Get Back To Me.

______________________________________________________________________-

EMAIL #2

SUBJECT: PROCEDURE

EMAIL: Dear Partner,

I thank you for showing your interest to assist me in transferring
this money to your overseas account, which i expect you to keep
absolutely confidential at all times in order to avoid eyebrows in the
course of transfer.

May it please you to know that all about the transfer is legal and
bank to bank transfer, vital clearance certificates that authenticates
international remittance of funds shall be secured in the course of
transfer. Which will prove authenticity of our transfer to any country
we wish to transfer the money without any questioning.

In order to proceed, an attorney will be appointed for you here who
will open non resident account for you and act on your behalf in
signing vital transfer documents in the bank. Please provide your
overseas account as listed below in order for me to secure needed
documentation and submit to transferring bank.

BENEFICIARY NAME:

BANK NAME:

ACCOUNT NUMBER:

OCCUPATION:

ROUTING CODE:

AGE AND MARITAL STATUS:

DIRECT MOBILE NUMBER:

As soon as i have above details the process of transfer will commence
immediately. Soon the money is transferred to your overseas account, i
will fly with my wife and three children to start our new life in your
country and for investment purposes.

My kind regards.

Mr David George

HEADER:

Return-Path: <gdavid484@gmail.com>
X-YahooFilteredBulk: 209.85.216.43
Received-SPF: pass (domain of gmail.com designates 209.85.216.43 as permitted sender)
X-YMailISG: Naz6iTcWLDtPafJG3frokkXc3ukEHhTq3qYpgF4eNnaak8._ lMhg6dmlYkLbunyfJ2F_ScLNOHbc.0PforP346SREmeFE8IvdMZBPKTsIGXx CbQDb8lVKkwl.kO43q3gpPWPohkmyy8ID.rGWIMGOWKgYrqKEaO9EgvfFYiZ Qu4GT7I8XH9drvzgQci_ZjQjIFABMS_wDvrLwYlm6pL31xkYfGV4KtQ45Q17 6g6HkfRXCIp4JDr7XnpdtH2Czvj4zj9znDFQ3x6P8SqMrz8x5TqQ_iS7iE0C 9IJK0laSaCncr702mWVPBm9ZII2OBFnib.tYKZd6AIdxEprwdaIN_Alsb5aw uxoIpUVTUmqOLvwmBLWCNCTAzcLpzc6Xa7lDBKyte9RANBJsS.JX1G74pVBe c2jCIR4MVCSaq0ki0Ymx6HnD01j3yBAWdZBr6QIjrl9BmO_YxU0ZpI8KHg8v g4MGA6yZq7RUZnuxbg0BDtYLGxZ8pWu4fSC_FjT6_ozHRaNjrLhjHryfj764 GM0WodRCK.ymMN9l_auWKrOyvg0d1FIjW_ZHST.QiHFdAjai1PRQfdfOkplg cPL.hs.6qugujGYT_9Y3cog2d0Bf.6neEArkKtqTi4DXSEJAaqbIGI6DMfBA 74O1YUYtMNgG6uBS1FhLoQ2Zo4mLCfbfXgzie63M71RjS1BQBX4VQubxWRJ6 QNLNoMVq3Yt9799SxL9fcwO18ShYH_.eJi10eLcNOCIh29StJXS_N1QlThEu QDraPzGmksoQdRhUZUblTH9j7neXT_718NX4pTZ_143xkGaDN6S5U4XjGE_R TahgKTyjL_UYjTwC7Ie0xbAWDVShPe.Eh_fHWUqIC4BEr2k3QLzzLeBIPgIq NzDejCpoF8AmkidTUBQ3zqy5vHDAG_3o8qDzOJSP3O4PEIWSLbd9VxNMF5SP 9DAHxJNQKmm1db9h5VS.ZHSur7394iWoRwpnvc3rv0fgKGdWi7_iC8j2j04U UUfSWS8XnHRp2Ov7OLVRIyY4bD1bGfSc8qBd6lCZ_EveqsWvp8J4QfJ_4qu6 zHBUmHXdb7m3JvsqoP4YBA8bR2XATJ_G4yX7iYX2BDmVs9EDKlFY43timvNb f4QS3R.8ADY1LdCdHLgVa2k2nRYwvAwHKpsJlEIH3hHKc_gWVI.jCc0VyYsb ARtIvjvHW7gexxEknP99axWYdJqBDM8lKBZZMnj_h5pFfs3fWjqsajaFygl1 sX9m.16Q97x71A3RLSMND3Xs1x4cT_4nY.ZbYipkvK2MHXCUC1_TZ4VDoVKV HJe2vrRB60r_osW1Bi5PBvDgV_56kvoYhWpbiDH1Jn5l3Bz1Ok95wI34bsAn lo1dhmFylFc-
X-Originating-IP: [209.85.216.43]
Authentication-Results: mta1359.mail.bf1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO mail-qa0-f43.google.com) (209.85.216.43) by mta1359.mail.bf1.yahoo.com with SMTP; Mon, 17 Dec 2012 06:45:58 -0800
Received: by mail-qa0-f43.google.com with SMTP id cr7so2408219qab.16 for ________ Mon, 17 Dec 2012 06:45:58 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=2d2+rDEpHVoIcbezyBoHjZjajUgVJN0jJTtW6tVL+8M=; b=c9F0p9ivfWP9MIx23K2tt92FCTeKFDYw/DHZCWSSwamsLNrPItTa9A+/XlZ6H0ninC e/zmvrCMhba/vyLt3wZtRX9O+1Zjl3DpOJNXmLmIaGdr0Bmznfk2OAHMeqYPs8rG5X2M GNTj1lLfg81srKJESlVsvYeR9RegXlcxhHC4pulkwAdQKWf8LbL93dDyMJRlNsXWu0EY 00aqZe4GuS0H0IdEKYeTmiI1DqeBSLcaXXLSl2uueSyb8nWpe6O/k6eoqJx6HfeoISxn myvnAy1y2tyLK8ZoppV8hV7IDGOF5tfNt66/9v13A95R7A8RrYYI9JZwLvXaZraPD5uN mglw==
MIME-Version: 1.0
Received: by 10.229.195.81 with SMTP id eb17mr1446091qcb.93.1355755238484; Mon, 17 Dec 2012 06:40:38 -0800 (PST)
Received: by 10.49.86.10 with HTTP; Mon, 17 Dec 2012 06:40:38 -0800 (PST)
Date: Mon, 17 Dec 2012 16:40:38 +0200
Message-ID: <CAOsNjvqCda1OyXrR7PZPsHz61bqgzO=W=_uOc2NTp8KsQXZGJA@mail.gmail.com>
Subject: PROCEDURE.
From: david george <gdavid484@gmail.com>

david george gdavid484@gmail.com 209.85.216.43

“David George” dtito4539@gmail.com RETURN-PATH: dtito4539@gmail.com REPLY-TO-ADDRESS:  gdavid484@gmail.com

X-YahooFilteredBulk: 98.138.91.101

RECEIVED IP: 69.163.96.25

ASSOCIATED IP: 41.137.20.4

Most recent scammer addresses who’ve sent spam under the same received IP (69.163.96.25) as the above scammer include: 

11-Dec-12 06:42 69.163.96.25 Robcsz14 whywenti@gmail.com
11-Dec-12 06:08 69.163.96.25 barobertoswifta9291 retireasw@gmail.com
11-Dec-12 05:34 69.163.96.25 dfrhihmcn retireasw@gmail.com
11-Dec-12 05:28 69.163.96.25 bbobbyshtolzeay2369 swaytyh7@gmail.com
11-Dec-12 04:18 69.163.96.25 baangelastexxd3595 shiqyxr12t@126.com
11-Dec-12 03:45 69.163.96.25 bbobyshulze7823 pefexafeGat@xe6mxun.mil.pl
11-Dec-12 03:39 69.163.96.25 bajanesstivnov2066 redeassenry@xe6mxun.mil.pl
11-Dec-12 03:27 69.163.96.25 velesyttsa1943 ajlovedoratheexplorer@gmail.com
11-Dec-12 03:18 69.163.96.25 bjanessmaareyy333 lilin206@mailondandan.com
11-Dec-12 03:13 69.163.96.25 pitytop8408 adalia0130@new-purse.com
11-Dec-12 03:13 69.163.96.25 bjanssdarky5157 adalia0130@new-purse.com
11-Dec-12 03:08 69.163.96.25 baannatunior1266 adalia0130@new-purse.com
11-Dec-12 02:59 69.163.96.25 aolautivanovy3790 adalia0130@new-purse.com
11-Dec-12 02:55 69.163.96.25 anatjunior1022 adalia0130@new-purse.com
11-Dec-12 02:53 69.163.96.25 avelesygoglety3513 adalia0130@new-purse.com
11-Dec-12 02:48 69.163.96.25 Irraphfrarelp adalia0130@new-purse.com
11-Dec-12 02:44 69.163.96.25 bobbysulzeay4833 adalia0130@new-purse.com
11-Dec-12 02:39 69.163.96.25 bradadaka6821 adalia0131@new-purse.com
11-Dec-12 00:00 69.163.96.25 brianiup ugugoo100@gmail.com
10-Dec-12 23:55 69.163.96.25 bbbbyshulzeay3925 superpogirl@gmail.com
10-Dec-12 22:26 69.163.96.25 aImmilajenanew29 Immilajenanew2@gmail.com
10-Dec-12 20:30 69.163.96.25 anntaecahvs787 adalia0127@new-purse.com
10-Dec-12 20:01 69.163.96.25 Keycleotherce adalia0127@new-purse.com
10-Dec-12 19:53 69.163.96.25 baanatyandexta8617 adalia0127@new-purse.com
10-Dec-12 19:50 69.163.96.25 gregorasmaarlyay4510 babala752@new-purse.com
10-Dec-12 18:13 69.163.96.25 prodvizheniesaytov prodvizheniesaytovpt@gmail.com
10-Dec-12 18:12 69.163.96.25 adizzyclttle8389 prodvizheniesaytovpt@gmail.com
10-Dec-12 18:12 69.163.96.25 prodvizheniesaytov prodvizheniesaytovpt@gmail.com
10-Dec-12 18:12 69.163.96.25 prodvizheniesaytov prodvizheniesaytovpt@gmail.com
10-Dec-12 17:57 69.163.96.25 bbbbypetrovy649 prodvizheniesaytovpt@gmail.com
10-Dec-12 17:57 69.163.96.25 prodvizheniesaytov prodvizheniesaytovpt@gmail.com
10-Dec-12 17:48 69.163.96.25 prodvizheniesaytov prodvizheniesaytovpt@gmail.com
10-Dec-12 17:47 69.163.96.25 beveasdark1744 prodvizheniesaytovpt@gmail.com
10-Dec-12 17:45 69.163.96.25 prodvizheniesaytov prodvizheniesaytovpt@gmail.com
10-Dec-12 17:45 69.163.96.25 bangelasunior1313 prodvizheniesaytovpt@gmail.com
10-Dec-12 17:44 69.163.96.25 aaleeytopy3312 prodvizheniesaytovpt@gmail.com
10-Dec-12 17:44 69.163.96.25 bptrickmshtolzea688 prodvizheniesaytovpt@gmail.com
10-Dec-12 17:42 69.163.96.25 prodvizheniesaytov prodvizheniesaytovpt@gmail.com
10-Dec-12 17:34 69.163.96.25 prodvizheniesaytov prodvizheniesaytovpt@gmail.com
10-Dec-12 17:29 69.163.96.25 prodvizheniesaytov prodvizheniesaytovpt@gmail.com
10-Dec-12 17:00 69.163.96.25 Babimatty ktgz846@new-purse.com
10-Dec-12 16:50 69.163.96.25 asemCoemyJex67 semCoemyJex2@gmail.com
10-Dec-12 16:45 69.163.96.25 prodvizheniesaytov prodvizheniesaytovpt@gmail.com
10-Dec-12 16:22 69.163.96.25 adaasjnr3096 newoktosanz12@gmail.com lasufuv@weboka.info

For more spammer addresses sent from 69.163.96.25 please click: Stop Forum Scam

SCAM MESSAGES SENT FROM 98.138.91.101
From: Mr George LUis <0000officedesk769@att.net>
Subject: URGENT REPLY NEEDED
From: heesoen_21@yahoo.com
Subject: Curs Engleza fara profesor
From: Microsoft Office <web.microffices01@att.net>
Subject: You have been selected as a potential winner of Mi
From: sefolo <sefoloedward@gmail.com>
Subject: PLEASE VIEW YOUR ATTACHED LETTER AND READ CAREFU
From: popularipehi5@yahoo.com
Subject: Trusa de machiaj profesionala – Reducere 30%
From: popularipehi5@yahoo.com
Subject: Tigaia magica Dry Cooker
From: YAHOO MAIL LOTTERY <webde_0012@hotmail.com>
Subject: Congratulations : Congratulations ; Open An Attach
From: =?iso-8859-1?Q=?=
Subject: ProV – Erectii pana la 72 de ore
From: Popa Maria <sylviu28@yahoo.com>
Subject: Scapa de negi, alunite si oricealt semn al pielii
From: CANADA UK LOTTERY PROMOTION <drjohnpatrickagt5@gma
Subject: Congratulation,[Kindly Open The Attach File
From: “xcvbcfsdfss@yahoo.com” <xcvbcfsdfss@yahoo.com>
Subject: Your Criminal Record may have been updated recentl
From: Popescu Maria <relisword_99@yahoo.com>
Subject: Ochelari de soare Ray-Ban !
From: popescu <andreea16thebest@yahoo.com>
Subject: Ochelari de soare Ray-Ban !
From: “Department of Minerals & Energy, South Africa” <w
Subject: CONTRACT AGREEMENT/ $14.5M
From:
Subject: From: Mrs. Bridget Hills & Francis Hills (Son) OPE
From: YAHOO AWARD PROMOTION <mrsmartins66@gmail.com>
Subject: congratulations,kindly open the attachment
From: FREE LOTTO EMAIL PROMO OFFICE <freelottery03@redif
Subject: Fw: Congratulations!! Please Kindly Read In Good F
From: SJPUB <pjmom1@yahoo.com>
Subject: PUBLISH RESEARCH STUDIES ARTIC
From: James Kunta <jamkzm1@gmail.com>
Subject: KUNTA INVEST.ASSISTANCE
From: “FROM: MUSA AHMED” <ahmdmsa@rediffmail.com>
Subject: URGENT REPLY, PLEASE I NEED HELP!!!
From: MICROSOFT AWARD LOTTERY 2012 <drjohnpatrickglo@gma
Subject: CONGRATULATIONS, {Kindly View The Attach File For
From: Australian International Lottery Program <web90901
Subject: Congratulations Check Your Attachment
From: MSCLARA <msclaraglory2004@gmail.com>
Subject: YOUR EMAIL HAVE WON $1,000,000MUSD
From: MRS GRACE MANDA <gracemanda147@gmail.com>
Subject: I NEED YOUR ASSISTANCE ON THIS TRANSITION

 

Monica Glover

WARNING: CITY AD CAR SCAM – FRAUD

NOTE: Another scam email sent to my spam filter and then posted on Scammer419 September 30th, shares some of the same information as Monica Glover, including the proxy IP address – – for more information on this fraudster, click: JOB SCAM – Hiring:~Data Axis Virtual

 

 

SUBJECT: City Ads on your Car $1,200 paid

EMAIL: City Ads on your Car $1,200 paid

m<href=”http://bit.ly/TPNZug”&gt; </a>
vUse our Car with an Ad on it Or we pay u to put an Ad on your Car
$600 paid every 2-weeks

Monica Glover /hr
remove in subjectline

HEADER:

Return-Path: <monicaglover@excite.com>
X-YahooFilteredBulk: 208.89.132.141
Received-SPF: pass (domain of excite.com designates 208.89.132.141 as permitted sender)
X-YMailISG: 9Nwzyr0WLDv0OQ3Ui7B8D7xm7lzSa_NSFGGWM3G8_0.y_.f6 81ZQ58.NmyaYb9_flb12Sunx9Wp7ah8812lMg1pnsf8vdb2fyK3jVxHN4lPC QsGz_xk6_T30hsXVDhDTeb8Wx9_YK_xn1ego9wp2mMEm5aj6UpgHkLJYLw8A xFpPKHxhJQd26F5ze6NE84CwwD2UfEhxbVIvh4UZzgnr19y3wo3HVV30ZMeG LIRNPuL7gLpxT6J1Z_XHQRtjreqh6YjuC3wNHw5pACrqgSqfGPmuaEWXpQRC j9sk7_IAGgRK17x8SrdsKqOfrS7GD7VU2JRh2DQdDlsBycISjfFaruWX_ucZ ojSkmNQM0WQjKuCyLtjVIJ5yLIr.9U09Hwol2OyQF1i7rnsiBES8w34D8e3f fxt2XJkn5gj8QaYtmvAjgGZ77cWas5cjZi1rU9HnpJ_ItWU42gq1_EvTM3RK m3xjo7xkVEnaJCDjhgvTPi_d6VvvDK1YmmArBGRnHEOMzXlTd_MHDa1sYr3p BMhYQxr.EoIrvE3lH_XQ7B2RG9d1yin9U2NQYWrZ.XKKl.rPc9HdYdsT6J7l BgEdk9QbK_q3RQIG2.4aGMupxpDehgwlx0YO0_AXgnRq1U1JaZIX0O.86Se6 i5y_5oASVKVZEV05M359IGokbgluYUW0HF.iJv9bbczv4ZXVb44LVuIlwJZW kUey65UGwY5ixWZ2i6ZOsYOJ03SuAwrsITr2Hc7uZTaHAby_wQ7cugyCqvhG 4D1edndG08htdTHmvnJDLaT3dUZGW5bA7TVx8pMFZezkA4KAHve9EjqxsVTS kRDexqqyK3.bqtV3bt2lfwBOeGxSUx90tORKKa.wxBqzSMbhNh73pzevIUu7 2zumDt5H3m0gegC96sIdcWI0e1wClhWCAXZwyRDrQ.4cZ9BTXSpbGMEdbVpM 1iFsOZxrq0xOSusC2Q2ktLL9r4GZjqxYYW3eC85W0w0LhiaFFLzNpHcWrtHN E.0.q8jpN25H2YgjudlLJYZdrzuRwbAGL0iDHggTogKspVwWUggvWyI6km9M rJ38shxTp74mms.CK.Xkx0f80BBKV_6o0nBLP0Qi1s5kBa7I.ecGl1c9CkUo MI5R_zEw5h98TbN04RXufj_qFyy.hYYHwjzpoOBcgMzqrjVg9l2AP4UHpO5y Yv0yDKPxsMVrvUZ.GNVu0X6ffzW2epJUg_WliJO6Q2EdgYjlF_z6_ltI1YB8 YYN5XCOyKr6hjwkrRz.MzQL30y2.u9xwzqABdQgkNtqnv_nGjuRDnJMqJO.K nzt9FGzs3mUYyULddB4_
X-Originating-IP: [208.89.132.141]
Authentication-Results: mta1376.mail.bf1.yahoo.com from=excite.com; domainkeys=neutral (no sig); from=excite.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO outbound001.roc2.bluetie.com) (208.89.132.141) by mta1376.mail.bf1.yahoo.com with SMTP; Sun, 09 Dec 2012 17:46:23 -0800
Received: from web007.roc2.bluetie.com ([10.200.2.101]) by outbound001.roc2.bluetie.com with outbound001 id ZdmP1k0062Alkky01dmPZg; Sun, 09 Dec 2012 20:46:23 -0500
X-CMAE-OUT-Analysis: v=2.0 cv=UejTuduN c=1 sm=1 a=dQoNIrimAEwA:10 a=i-wQWBNYtOgA:10 a=FmX3VfpdAAAA:8 a=QoHJ8kPOAAAA:8 a=H-gxlunUoGwA:10 a=ObCx71v0AAAA:20 a=k1jASxCPtPb7Rh8cyAgA:9 a=QEXdDO2ut3YA:10 a=eXSbejlkubQA:10 a=IawXvI9lP1MA:10 a=bIZyQ9ZLpJ03m6HMhOEA:9 a=tXsnliwV7b4A:10 a=JWhqF-O9MfO5SqHS:21 a=7X69+Egs4aEeFnNAy6RSag==:117
X-CMAE-OUT-Score: 0.00
Received: from web007.roc2.bluetie.com (localhost.localdomain [127.0.0.1]) by web007.roc2.bluetie.com (Postfix) with ESMTP id 97A0B160125 Sun, 9 Dec 2012 20:46:23 -0500 (EST)
Message-ID: <20121209204619.8539@web007.roc2.bluetie.com>
X-HTTP-Received: from monicaglover.excite [78.129.250.121] by web007.roc2.bluetie.com (BlueTie WebMail ); Sun, 09 Dec 2012 20:46:19 -0500
X-Mailer: BlueTie MTA
Date: Sun, 09 Dec 2012 20:46:19 -0500
Reply-Path: prettybull909@aol.com
From: “Monica Glover” <monicaglover@excite.com>
Subject: City Ads on your Car $1,200 paid

“Monica Glover” <monicaglover@excite.com> RETURN-PATH: monicaglover@excite.com REPLY-TO: prettybull909@aol.com

RECEIVED IP – 78.129.250.121 ORIGINATING IP – 208.89.132.141

Another email/forum scammer who shares the same IP (78.129.250.121) – 10-Dec-12 02:51 78.129.250.121 diegofotch diegofotch@hotmail.co.uk

 

Blacksea Cruises Line

WARNING: EMPLOYMENT (JOB) SCAM – FRAUD

SUBJECT: JOB ID: AU/BSCA/HTL/375-033/12/13

EMAIL: BLACK SEA CRUISES LINE
Australia Office
15 Bay Street, North Canberra, NSW 2060
PO Box 2006, North Canberra NWS 2059
http://www.blackseacruise.com (fraud site)
bscspecialist@anaustralian.com

JOB ID: AU/BSCA/HTL/375-033/12/13

Black Sea Cruises Line United State of America (USA) urgently needs the services of devoted and hardworking people who are ready to work after undergoing enlistment training in Australia and representatives all over the world.
Qualified applicant should contact us immediately for job placement here at Black Sea Cruises Line United State of America (USA). The management intends to increase its manpower base due to increasing number of customers in our Cruise Linear in Australia. The company needs Three hundred and twenty (320) workers to sum up with the already registered staffs and you can apply for our representatives all over the world like Africa, Dubai, North America, Canada, South America, Asia and Europe, and any other designated geographical area.

PLEASE NOTE THE FOLLOWING:

Employment Type: Full-Time/Part-Time
Base Pay: $45,000 – $125,000 /Year
Preferred Language of Resume/Application: English
Type of work: Permanent
Status: All Vacancies
Job Location: Canberra Australia
Visa Type: 3 (Three) Years working permit

BENEFITS, PACKAGES AND ENTITLEMENT:

These are the Entitlements, Benefits and Packages from the Company.
Paid Airfares, Transportation, Quality single or family housing accommodation in company community, free medical/dental care, Excellent educational assistance benefits, Life Insurance and Paid vacation and Maximum security in work environment and housing community.
The management will secure a visa/working permit for any qualified person. VISA FEE, ACCOMMODATION & FLIGHT TICKET will be paid by the company

THESE ARE THE AVAILABLE POSITIONS:

Accountant Deck Hand Musician
Activities Director Disc Jockey Naturalist
Activities Staff Cleaner Security
Administration Engineering Photographer
Online Reservation Agent Engine Room Staff Printer
Bar Staff Entertainer Production Manger
Bar Steward Expedition Leader Purser
Bartender Fitness Instructor Purse staff
Beautician/ Aesthetician Food and Beverage Staff Public Relation Staff
Bedroom Steward Gentleman Host Restaurant Staff
Casino Staff Gift Shop Staff Reservation Staff
Chef Host SCUBA Instructor
Child Care Worker Hostess Shore Instructor
Comedian Housekeeping Staff Singer
Computer Specialist Lecturer Reservation Staff
Cruise Director Magician Youth Counselor
Cruise Staff Maitre d? Water Sport Instructor
Dancer Massage Therapist Waitress
Dance Instructor Medical Staff (Doctor/Nurse) Guest Speaker
Male Nurse Female Nurse Representative(mandate)

And there are many other positions that are available which were not listed.

Interested applicants should forward their CV/RESUME or application letter via email to Black Sea Cruise Specialist (BSCS) Mrs. Natalie Moore for processing of application

Regards,BSC ManagementEmail: bscspecialist@anaustralian.com (SPOOFED EMAIL – URL SHOWS BSCSPECIALIST@GMAIL.COM)

HEADER:

Return-Path: <cruises02@wp.pl>
Received-SPF: pass (domain of wp.pl designates 212.77.101.8 as permitted sender) IDE1IEJheSBTdHJlZXQsIE5vcnRoIENhbmJlcnJhLCBOU1cgMjA2MCBQTyBC b3ggMjAwNiwgTm9ydGggQ2FuYmVycmEgTldTIDIwNTkgaHR0cDovL3d3dy5i bGFja3NlYWNydWlzZS5jb20gYnNjc3BlY2lhbGlzdEBhbmF1c3RyYWxpYW4u Y29tIEpPQiBJRDogQVUvQlNDQS9IVEwvMzc1LTAzMy8xMi8xMyBCbGFjayBT ZWEgQ3J1aXNlcyBMaW5lIFVuaXRlZCBTdGF0ZSBvZiBBbWVyaQEwAQEBAQ–
X-YMailISG: 2BkPeo8WLDsDTH6tlBSQFipKUTpAOtAZwk8dDN9oS3OhelvW Y.AKeJDpy17Z.JBwQlgOx7qi2C4sLSWgPGs5EKAa60l.03l1zOL8eOcddTma DOWifMZEjZA6s_SoKqTEN6lVVTTTO0UD86Uv02O06VClZZiXlrjGnCiqu0O9 ZcPlwm4xn.LfTJdfZEkiX6kFm7lleRJ6TUv0p.AY6e9s20nNHETXdsebkpte rqLOVuz6ofFxfjy_NwX2icNoYP64znoSdO3gfq5DIzYsFLavzG_SBJW1lsiQ siaZYa2JFdZMaKGP8rgZAYnJQlAv.qwrcM9Y3PDLs7ts_GdKp4SlWFzWq4Nz yqFejSqAiRqt.g2XwQr6GAqnT7_Mrsss3Mr77DZdjVPofAIs.izC_Dj0tL2U TP6e.LWiqPJPZAfJZ_HRBZkogKpNUJVnXbVWeNofREPYWzr7uKw4j7qIY6pR MXNg0zjOAeLh9llmY5QodB8gELKdPSJNLYW4mlAR7fL84pLVnZRIFSLjLxk5 7J1TE_oT4c7ZuVZFNbKGBO0mq_hLw71fXhywhqDu9qFOyttsZbKaZuCcMWyd eopa8fzrxPktgxwWFXQAG5zWgEhSAHd1gO0TmMdy1gq6X_wgV.LWui93Aig4 58qxWsXhqvsZN4wtA849qi0Qn365aZkgXXB1S7MRzT8rSz63MYDvmZb6pUFZ FIU3I_TE4ig_.Bd6BvdaNXRzyHHmzbHnE8OVI9_TpuUC8pPtuKBL4kNKBBOn 5KHWh2vAIcXhRgFxWJsPvQe2b7U.MSaeJ.p7SdEBZ4JU96L63GV.kZI8kA6v WtlmkAqqiwmZ3N8mg8x1MjEr0tgQGxXcgmSU4pemKrApensqPn282rU93esS DaxhKdA4qbI.jnEspd9Dl6Eow9Y1vPQ6ClWq_JhIufQueyFmJZ5N4J8OkN11 IzbhNtp5g3dOiYBoNKiRXaPdrysZQMupVzXkjJSVNBJuqxhlYrkzwLWrM.TY iNSo89Ojl5icMsvbkmg29Hk.Hkx7a7XfDrZij.hln2o7dINGpw7FuRvu4sxP 2jzFBvFUT9rxmoXpBZOOEWPGXwzbwSpwXN9InSCfoSumauro0bpF_hkT9r0s OcH5.C7hAwr8dwq2RpVxVvhis07R8IuN6AHjy3ENjN4UgmBC7EJPRWMSa1hF PmRak1Lxwze2CkmZe4.RluTYkSjsXgh5jmxq1Dr8D8rmQ3fNHIQ6StDrHTKM k0hxe38EB_3z51nMc9khF7aSeTUilp4d0xnnmp9z2TXBwxdvvxzMdwwOWt0o 8CHnheeRXN_7Im9UL1rtJPccga2vBy46I4qa_6c1FSe3PUtxWPS16A3MfxFQ _Uh5VMshVmJMR7MrZY6thQMbZCY2po.BP324R1uP0z5gypCAUzP31h6CpY53 73tJHM4c
X-Originating-IP: [212.77.101.8]
Authentication-Results: mta1240.mail.sk1.yahoo.com from=wp.pl; domainkeys=neutral (no sig); from=wp.pl; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO mx4.wp.pl) (212.77.101.8) by mta1240.mail.sk1.yahoo.com with SMTP; Wed, 05 Dec 2012 03:06:35 -0800
Received: (wp-smtpd smtp.wp.pl 12092 invoked from network); 5 Dec 2012 12:06:30 +0100
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wp.pl; s=1024a; t=1354705590; bh=zrwdaZvVaCcumiSRBeH3vq5Tkc00JIlmONZvekWltnM=; h=From:To:Subject; b=Cef4gr4oc4zwOIQFX+eYVy9ywXwWDX1a8dLOODj3iBgMVxXKHWEQg1q9cpVVRRxcD 0+if5eMTWBU0lU+dLA5fcwWCmJJSotQULLV+ViZvE3Oy6NqhwMT7QsJodysfmcWn3I QUuoa2/iPfUrnDzbQ9mTgRT6ZMDBZ/8WvtX3Cc1s=
Received: from out.poczta.wp.pl ([212.77.101.240]) (envelope-sender <cruises02@wp.pl>) by smtp.wp.pl (WP-SMTPD) with SMTP for <sammcgowan67@Gmail.com>; 5 Dec 2012 12:06:30 +0100
Date: Wed, 05 Dec 2012 12:06:30 +0100
From: “Blacksea crusies” <cruises02@wp.pl>
To:
Subject: JOB ID: AU/BSCA/HTL/375-033/12/13
Message-ID: <50bf2ab63350d8.66294698@wp.pl>
MIME-Version: 1.0
Content-Type: text/html; charset=iso-8859-2
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
X-Mailer: Interfejs WWW nowej poczty Wirtualnej Polski
X-User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.28) Gecko/20120306 BRI/1 Firefox/3.6.28
Organization: Poznaj Poczte WP http://poczta.wp.pl/info-start.html
X-WP-IP: 173.242.117.146, 41.79.201.11

Blacksea crusies – cruises02@wp.pl – sammcgowan67@Gmail.com – bscspecialist@gmail.com

IP: 41.79.201.11 <– Africa location — 173.242.117.146 ORIGINATING-IP: 212.77.101.8 RECEIVED IP: 212.77.101.240

Recent scam / spam addresses who’ve posted under the same IP (173.242.117.146) are:

kobe@gmail.com
evangelineiyr+abc040@gmail.com
aguedaglynnix@gmail.com
to.mgl.ewgdsfawetghhty@gmail.com
itercentareek@gmail.com

2012-12-07 08:55 AM GayleProco styell@sina.com
2012-12-07 08:35 AM bapatrickmhtolzey5397 marcussah@gmail.com
2012-12-07 07:25 AM ngelastexaxdy5273 lv163@lvtimeshow.com
2012-12-07 07:05 AM xpznxuhxm marve.lpaw@gmail.com
2012-12-07 06:35 AM SyuzanaRoi syuzanaroiii@gmail.com
2012-12-07 06:05 AM annamaarley4373 Immulpaxoma1@gmail.com
2012-12-07 05:15 AM Jistmifetes greathewatsab@gmail.com
2012-12-07 03:15 AM bjanesstivnova1875 48hjyvzn@mail.ru
2012-12-07 01:55 AM bittyjunioray8616 aubor1701393@mail.ru
2012-12-07 01:05 AM bvelesjuniory919 johnny.wu@gmx.com
2012-12-07 01:05 AM adult chat Monteforte4980@yahoo.com
2012-12-06 11:05 PM todyday gfjfdskllo@gmail.com
2012-12-06 10:15 PM Karlescatte sdf3eth5f35d4it@gmail.com
2012-12-06 07:15 PM bannatsifty6212 fjptly013+abc016@gmail.com
2012-12-06 07:05 PM amilsqswifta7826 glotkihab@mail.ru
2012-12-06 04:35 PM Nikaswees nikamtnp@gmail.com
2012-12-06 04:35 PM Nikagraft nikamtnp@gmail.com
2012-12-06 04:05 PM Nikakile nikamtnp@gmail.com
2012-12-06 04:05 PM Nikafurn nikamtnp@gmail.com
2012-12-06 04:05 PM velesyunior7744 zybignief@772630.com
2012-12-06 03:55 PM unuganype lh3438900@gmail.com
2012-12-06 03:55 PM NikaEmedly nikamtnp@gmail.com
2012-12-06 02:05 PM bgregorasfrancesy1683 martindumler@aol.com
2012-12-06 11:25 AM incomradeff incomradeff@mail.ru
2012-12-06 08:25 AM amaxmuscahvsy5167 teyudrew@nokiamail.com
2012-12-06 08:05 AM bibeboofs rysiek.ronczka@aol.com
2012-12-06 07:55 AM jehnzswft1420 teyudrew@nokiamail.com
2012-12-06 06:25 AM encaggeva sandyh.ouse561@gmail.com
2012-12-06 06:25 AM Cyjmwmcx diamondisand@aol.com
2012-12-06 03:25 AM robertspetrov8551 evangelineiyr+abc009@gmail.com
2012-12-06 01:45 AM apittylitle5076 proboptoniani@gmail.com
2012-12-06 01:35 AM monviagra monviagrami@gmail.com
2012-12-06 01:15 AM hecegrairee asakura.madoka@aol.com
2012-12-06 12:05 AM bpatricmttsay1568 cha.rlessyr.m@gmail.com

 “Mr. Dauda Seasay” <dauda.seasay00@sify.com> REPLY-ADDRESS: dauda.seasay00@gmail.com SUBJECT: BUSINESS OFFER FROM DESK OF DAUDA  SEASAY URGENT RESPONED NEEDED IP USED: 41.79.201.11 by web193304.mail.sg3.yahoo.com

 

 

 

“RS LLC”

WARNING – EMPLOYMENT (JOB) SCAM

EMAIL: Hello,

I have Local Shipping and Dispatcher Position to offer you (A Local Forwarder is an intermediary who acts on behalf of companies or persons, organizing the safe, efficient and cost-effective transportation of goods to the final destinations). I came across your e-mail address through your posting online. I’m Rachel Stafford, I own a small rising shipping business and I tend to operate a high cost of operation and I want to cut down my expenses by employing shipping, receiving and dispatching agents in each state.

For instance the cost of sending each mail is around $23 by United Parcel Service and if we want to send out 100 mails, that would cost us $2,300 but we have a solution whereby, we will ship the whole 100 mails in one package at the rate of $180 to you in your state and when you get it, you will open it and send the mail individually through USPS which will be between $2 to $3.50 for each and by doing this we would be saving a large amount of money. I need a reliable individual that will be committed and enthusiastic about the job. You will be paid $500 every week and this is a long time position.

You will be provided with funds to pay freight forwarder, you will be provided with funds to pay for USPS to dispatch the mails upfront, you will be provided with up to $3,400.00 to $4,000.00 as a running fund for dispatching the mails, sometimes, it may be packages of goods that you will be receiving and sometimes you may be required to pay for shipping and freight fees out of the funds we will provide to pay another freight forwarder when we need the service of another freight forwarder. The items you will be re-mailing or shipping will include letters, office materials, office equipment’s, home theatre, electronics and some other general consumer goods.

I want to assure you that you will never use your own money for any expenses and you are not require to buy anything to begin the job, the job will only take around 10-15 hours of your time in a week and you can work whatever hours you want. The job is very simple once you have an address where you can accept the goods, you can put those packages in your room or in your garage and if you did not have enough space we can arrange a storage unit. You will have to present an ID either driver’s license or any other personal ID to show to the delivery man when packages will be delivered to you and you have to show some sense of sincerity as you will be entrusted with client’s mails, packages and funds to utilize for re-mailing expenses. Can you let me know when you are ready to start and requirements needed for this job, you will need to provide your information as well in order to proceed further.

Full Names:
Full Address:
Zip Code:
Cell Number:
Present Job:

Reason for taking up this job, and please note, you must be above 18 years of age to be eligible for this job. You are going to be employed as Shipping and Dispatcher and your first weekly wages $500 will be paid by check and the re-mailing funds will be provided constantly which will never finish in order to avoid you spending your own money so when the re-mailing funds are low additional re-mailing funds will be provided, and you are not require to buy anything to begin the job. It is a straight forward job opportunity. Please do let me know how we should proceed so you can get started immediately.

Regards,
Rachel Stafford

HEADER:

Return-Path: <careers@rachelstafltd.com>
X-YahooFilteredBulk: 31.196.133.5
Received-SPF: none (domain of rachelstafltd.com does not designate permitted sender hosts)
X-YMailISG: sBDXy2EWLDuK3XOK1Cztxtp2saj0RYPW9jeFUITWp9wn2RwI ic3Cf4kwVivgJKZ_wtxypY5blAwffINjLCcHZ7mikvVcS3UHwJqTOAowwBUn Hj87AG0wZlmC4gi_ipMPdYwMvCD6riDwHqL2IXR.qui.O.FEm5rDB0t_E166 S5.n5vwf0I6yCxSAvQfF3wFUYfxPB0RRmcFUngJdeDcEU.MYnYvISSYAyzaU 1ry0r9wD6yKgv.krftF2O_kIrsZotoMw.il9hDyCxvmOQAejkyFz.Ixr6pFv nUsF9PpgFgWdmgi8C9BkxCXgH.xkKuNk6eIIhqho0m4QLSaSFDvgpj7vkdL5 BbRMzbNquuU2GI6SImiEAuy4Z60cLpoAoaKosDAsw81_gFdtIY49D6Ycz2cC mPMq309Sy8D4_CN8AuV6sxQumkZyvCmgZHnNbRavxtZELjBceQrSYOTt1Sie 1a43aFp.rj4ysYw_UTBzi8vLR5TzA9kMkn_fIwek6opNu5aqPuOzho_TRR6a tmFmfstZmaw_bxuRGyoWspQLzc2fVKUBvHptnxeV6IXCPH_.as7KvSmzMZPP JF1dLkVZmoffeIK973BytYv4RIRFpZKmi6HxGA0I0IDEoZ5iXqie5VHVrAXn DA9d.Vt6NL.KsY7UqagtmjYSOU8GR.GMi8EdjHqXeIsf4vIOZjcoc3z9JhIh BvZvnhOi3YZdtMQZ0BiG8XCniu.oFur_XDSmlsp5jhYsAMDdRbyxBCliMi9R 9XXzyJ8uoPSdmWKPm7G24X6CpIQqoVFUP2B7NXQrVa3lRNxftG25r7FqttSZ ej7ZVzmVtIP2TH0ODZa9oDaIsqxvlS10sNQk3qePDRU9kuNn7jtL5cM9nBIv fdcjWIwSuWTJr.VnbMof2_grjs8kaf8T4y.rDZxWxu3K5qabjrjgpATjWZO2 AE7T2vOEgsbDOWdeiaqToO9VptceYAhIHLO_TMFjpzOUQu_0mYG7lxIL6P8a 8x60fJYV9rc6G0Y9O6G6yAdffEzo2l._uWj7KmtB.9fakQsFcmzUBQ67LLhh I.jcMUAFPS0hRzB5SZolwZDqysq7vzUpLpmZkx299th6xfKj7Oyh1LRiEvlx 0P.Mdy.sysX_DXmtnxVS14NPl39..m.FChUJ0WXfy61weRLK9LJLfFOnSPtt xDQ_1.Br6msdyfhF6GVRpxFg2XsZtwnx2Fku5xY7CdgvxDFv.hg6F0p__v0t SshQzsOjKpeCIp5Q6ZtEhRhVKwRoCIYNbYS2qveLZ2lPs._mJtwKgx_z9OY3 OqlxV6OVIuZADeLx3KoO78pzbkjZA76nwF8ywds9XJBJl65WE8909QLvNhKV ofBKBHx9H86YwhtGhqKpMCaTjtyerf1NpB7FeT5nwG_PMIXNVVgKW_qOSQn8 shDSwzDFPCeYWPM.mGXnTranv70dg0m1U4vgGu5wvcntNHatHz3PCHrNNskG ER5ejrzWV7ZCihNiKZzLQM5.qWuusF0ByYRxxSS.hwIwgXOZWDh00l5Qxv.T FIKWiZKV6CDaHtWahZQArrk.SWS_mgZjq9wuj1xvdbANkErcOPiJU_y_ht6D 8PYSOPAFImubTACl_UIyWg0S.NhwXzxczZDJhjTOsWqwDa9h2fqsXRmwf0Fg tw9yO3UI_Clw1NMxkEudV.CreLcXasy3T627QtuWoIoFP9iIwtaMJ8aIEINB .YzsrXsGpkPDVD42ov6pmJataBBQCQ–
X-Originating-IP: [31.196.133.5]
Authentication-Results: mta1460.mail.mud.yahoo.com from=rachelstafltd.com; domainkeys=neutral (no sig); from=rachelstafltd.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO zimbra.abros.it) (31.196.133.5) by mta1460.mail.mud.yahoo.com with SMTP; Thu, 27 Sep 2012 08:13:05 -0700
Received: from localhost (localhost.localdomain [127.0.0.1]) by zimbra.abros.it (Postfix) with ESMTP id A798F1F3051; Thu, 27 Sep 2012 02:06:11 +0200 (CEST)
Received: from zimbra.abros.it ([127.0.0.1]) by localhost (zimbra.abros.it [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bgi7sLpKAsyS; Thu, 27 Sep 2012 02:06:11 +0200 (CEST)
Received: from tri-sbs.TriangleInk.local (h-67-100-170-42.nycmny83.static.covad.net [67.100.170.42]) by zimbra.abros.it (Postfix) with ESMTPA id 8641C1F303F; Thu, 27 Sep 2012 02:06:05 +0200 (CEST)
Content-Type: text/plain; charset=”utf-8″
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Part/Time Local Shipper Position Available…
To: Recipients <careers@rachelstafltd.com>
From: “RS LLC” <careers@rachelstafltd.com>
Date: Wed, 26 Sep 2012 19:54:45 -0400
Reply-To: rachelstaf1i@yahoo.com
Message-Id: <20120927000605.8641C1F303F@zimbra.abros.it>

“RS LLC” <careers@rachelstafltd.com> rachelstaf1i@yahoo.com

Associated Email: test@iblink.com.cn
Associated User: Zuofu
IP: 31.196.133.5
The ip address 31.196.133.5 has been recorded as a spammers ip. If you have had a member sign up with this address you may want to consider contacting them, and possibly banning them from your site.

 

AFRICAN UNION FUND RECOVERY

WARNING: RECOVERY SCAM – NIGERIAN 419 SCAMMER

For the record, I’ve never been scammed but do get these recovery scams from time to time which makes me believe these africans aren’t too organized. I also receive more then one spam email sent at different times by the same scammer under different reply-addresses. 

EMAIL: AFRICAN UNION RECOVERY,

DEPARTMENT OF INT’L AFFAIRS
1 Horse Guards Road,London,SW1A 2HQ.

Respected Beneficiary,

I am the Director of International Affairs in the African Union
Recovery office in London, Britain.Recently, the British government
has received series of complaints regarding the Existence of huge sums
of money that are trapped and left unclaimed in Most African Banks and
Financial organizations, especially in Nigeria.The African Union
External Affairs department (My Office) was mandated by the British
government to go to Africa to investigate and recover all Funds
belonging to United States, European, Asian and Australian
Nationals that are trapped in African Banks and finance houses.

On our investigation in Nigeria, we discovered a file NO;
234/98GT/UB/OT22/01 with the total sum of Five Million US Dollars
(USD5, 000,000.00) with your name as the Beneficiary. It was further
Discovered that some unknown officials of the Bank have fraudulently
Diverted some part of your total sum to unknown accounts in the past
leaving only USD5Million in the account.

My office has recovered this amount (USD5M) and we want you to receive
it Without any waste of time while we further continue our
investigation to get those fraudulent officials who were involved in
diverting some part of the funds.Because of the problems associated
with Bank wire transfers, we have Decided that all the recovered funds
will be delivered to the Beneficiaries in cash to avoid the issues of
fund transfer requirements. Under this arrange, we have secretly
packed and sealed all the recovered funds in Galvanized Trunk boxes
and we shall engage the services of a Diplomatic Courier Firm that
will handle the delivery of the trunks to your area of destination.

The Courier Firm uses Diplomats to deliver vital consignments for
safety purposes. Though, for security reasons, we will want neither
the courier company nor the Diplomat to know the content of the trunk
boxes.With this arrangement, you will receive your fund under a
hitch-free claim process as you will not be subjected to Bank
requirements.We will request you to reconfirm your FULL NAMES, ADDRESS
AND PHONE NUMBERS to us and then we shall give you further details on
the delivery.

Thanks, Mr.Robert Scott. Email:afriurecovery@yahoo.com.ph

(Director of Int’l Affairs)

HEADER:

Return-Path: <robertscott32@yahoo.co.uk>
X-YahooFilteredBulk: 77.238.189.91
Received-SPF: none (domain of yahoo.co.uk does not designate permitted sender hosts)
X-YMailISG: MYo48LIWLDs9MXaRflw_jGy8S606INkKh8LamoBPbgoNa9eL HRF19NCvzxZMHiWRCjAPCBnY2qEOCIW9BHUTlNuzn87DqYcZpmaJo5IiLKkP sIefbZQMj0A9mvVcwws_34PXeWWPJdKUNMvdvkw5HcJB72uwJh2CgX_ZOS_Y 4WVtS1VmyXB3pEBPaxD37YXeo30feG68bOfrIeQ9oxDCz8LYy_0xVkDyZF0V GlAdRwNeVJq2BzIlJe6mvnpEYk9YF2OgPi3uIwjoLWW2um9gDtYFqhR5HuRk E9.Mq9kB60f55oS67hyzvavkFh.N6rhLv4ErartnbRKHVn39cKn1AzPNNYc3 3gUdZPcd3ZWdPkFsDDUeL0ttZ86PAA0B14MMYErPIyBQ06m6u8evrRqyuvAR 80RcUFIbkyl014MoCBV_5b6ps3n47VzAsfFPibGr1EXmQsVPDdYQwlCE1g_3 n8pghqABfBbmWr8fJk38MO0F_h7xzjxIvfWIYgN9rLLk9UhL85RpwO5k9x8k jekhMClLbw_tWCM6InnMhyeawBh.EuxQLvvKx6Vkh.ufMwigHebWQpibVlCw KErkmIUsu513OBEBCgoEyTHcT1jjcbvry7D8gVEJNkd7095fjhxXALpa0_t1 pLjQ9irJVQm2tVoNAz7minGMvr.SW6CN824MXDuQFdab9bp5Kmt_1BXSMlX1 olYs22jrojfcPQ7j1psoYmuPS_3XkzA9U8dYJF0CKVCrY85LhWGH8O_pTHWz luAToerBfJ6iTrb.vkefC8Qv2iF1ofATK3dEvcmUuAaVUiIzD3wMNqNyRlX4 YbjqFMU_n6EawBRjPN2aUf1nLHyKA5iVOz7dY_b_bGJZD5Ojd1hEHpes29hw gzI7zJLTYwP5ePJ34n84fnhoCVTsB7kXCSl3UzLkWFNgMcfob.tuvyfXXsj7 GGUxeLwO0ZUFy_lUudYQ2ZhSuchqS4GnT89X3_G6lxWNzFExLZ.gNRLGVpc6 pBvLuOlsHM2edmbFcWXW4CJCTX0ugSYwu65oDPtA76b2rMMGT29PYAH.V7U6 h5QGDtI01hd3K0Ftbbm5H_i1h4Wbb.h92GeXRixa_Fe9bxInxfum2glUD9V. J5ccDKubkT9MYFZH6tveQrKdK6Bnat7WAvZilm3IsUTr6f33dOmPQxWjKFLY HzIrQn0f
X-Originating-IP: [77.238.189.91]
Authentication-Results: mta1174.mail.mud.yahoo.com from=yahoo.co.uk; domainkeys=pass (ok); from=yahoo.co.uk; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm14-vm1.bullet.mail.ird.yahoo.com) (77.238.189.91) by mta1174.mail.mud.yahoo.com with SMTP; Wed, 26 Sep 2012 07:13:56 -0700
Received: from [77.238.189.230] by nm14.bullet.mail.ird.yahoo.com with NNFMP; 26 Sep 2012 14:13:53 -0000
Received: from [212.82.108.121] by tm11.bullet.mail.ird.yahoo.com with NNFMP; 26 Sep 2012 14:13:53 -0000
Received: from [127.0.0.1] by omp1030.mail.ird.yahoo.com with NNFMP; 26 Sep 2012 14:13:53 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: 826425.75846.bm@omp1030.mail.ird.yahoo.com
Received: (qmail 42900 invoked by uid 60001); 26 Sep 2012 14:13:53 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.co.uk; s=s1024; t=1348668833; bh=e0NfH6jU7jCYbuxPXM5NP/YYsv+RVXg9boK5pDbHeCs=; h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=0JYkwYv4VlggSV6N/tOKwNZmxt+asIV32bZVz7GBYHtFtvpwI4hjm6LRCT96kD9uc9bNOKnOaASQ0Gd1Q/rSIe5w5GmutrhPW9/Z6Mgd+dNp5OHiFk1WEQRJjI3/2ioYJq8Pi/9h5MwnOwe+jC9mWGJF51Z2mSYyZr3IDQapxpw=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.co.uk; h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=pIUvXSlEEWrWq85A8Uxxg3TgNITZEudfN1M9IUrrUG3obLuqqExD6xfga0+jDJUTiCFk3gmttI62J7bgdVNksOuVEqLo8YLCBlmJATbQcVvmjyoQtFzDbAiHjT42Ln+cd9UCYppjJd5YLUwnZmXex5mJESnuQ7ji/CDfrzmFBnU=;
X-YMail-OSG: YWZBuMkVM1m.2QSPRUg65aT6OxacMry8V3Rjz4kAsNAyTqq GXaCRGaem58CvvdqJn5i0XnipRJTdd.PlWSud5ZFK.JFXR6KZCUv5jB29Fap 0O04y1Vqo5pfYeHZlZupv_044nx5jacVSSpXVB2p55.N9MR.9oIC5ffX30Gh 32ONq0xjoVLCnTzOBtmukuU__2pUau2JkRLCUgvnLWt5So.GZaOfyXk6BQCG GvQjFu7WvBzkZEHanrC1IvBp498fMFMoRhPlBPMc6g1Kak0E19mAJq5_Ma3C ORoCHgBczIHrtZPse2OJU7JvI8S25Unee0RxbCtgd9SLXl.uyMbT5geRUVUl GQ88VxM_wIrj6TwkD62LcRaaaM0X1bE3oQEuzbZQB2omRq.qZsU2r__UK0yS i5H_rVN90Viua7YBEiUwvTQHdA2uG494Mp7zPBppcZ67B5ezsVRzFVz8tNPn UZjWrI_YaKQS.9isaoG_hYhgyjgER0uvvT1oIoc2w5Qo5n0.CVEz1H4qJGFa S
Received: from [41.155.110.170] by web132304.mail.ird.yahoo.com via HTTP; Wed, 26 Sep 2012 15:13:53 BST
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.121.434
Message-ID: <1348668833.40775.YahooMailClassic@web132304.mail.ird.yahoo.com>
Date: Wed, 26 Sep 2012 15:13:53 +0100 (BST)
From: AFRICAN UNION FUND RECOVERY <robertscott32@yahoo.co.uk>
Reply-To: afriunrecovery1@gmail.com
Subject: YOUR STOLEN FUND:

“AFRICAN UNION FUND RECOVERY” <robertscott32@yahoo.co.uk> 41.155.110.170 – Location: South Africa Reply-to address: afriunrecovery1@gmail.com