RSS

Tag Archives: Frank Collins

“DR FRANK COLLINS” – DR COLLINS PETER

LOTTERY SCAM – ADVANCE FEE FRAUD

ATTENTION: Below will show two email headers sent to two different people (including myself) – It’s the same scammer, same scam as well. The header information is different however so check both for the different IP’s and addresses the scammer is currently using.

UPDATE: Dr Frank Collins is also going by “Dr Collins Peter” and “Collins Peter E” under the email addresses / IP’s – “Collins, Peter E” <collinsp@newtrier.k12.il.us> <info@notice.com>  YAHOO-FILTERBULK: 157.55.116.165 RECEIVED: by 192.168.194.152 — X-ORIGINATING-IP: 41.71.173.93 Also,  Dr Collins Peter web52644778980000x@att.net REPLY-ADDRESS: collinpeterclaim1@yahoo.com RECEIVED IP: 172.163.86.61 – X-ORIGINATING-IP: 98.136.218.126 onlineme20@gmail.com – Scammers number: +2347030115459 X-YAHOOFILTERBULK: 98.136.218.126 — For more information click: Dr Collins Peter

UPDATE EMAIL FROM DR FRANK COLLINS A.K.A DR COLLINS PETER (I dont even think he realizes who he has emailed because he emails me with different, similar names on a daily basis.)

EMAIL: Attn: ,
This is to officially inform you that (ATM Card number:4083-0521-0032-0293) has been accredited in your favor. Your Personal Identification Number is 822. The ATM Card Value is US$1,500,000.00. You are advice to contact me with the following information: Name, Address,Phone, Age, Sex, and Occupation. You can also call out hot line +234-703-011-5459- to confirm.

Thank you,
Dr Collins Peter
ATM Logistics Unit,
Tel: +234-703-011-5459

_______________________________________

SUBJECT: PAYMENT VIA ATM CARD.

EMAIL: Reconfirm your Address,mobile for delivery of your ATM card $10.M

HEADER:

Return-Path: <webxx120999xxxxxxx@att.net>
X-YahooFilteredBulk: 98.138.91.88
Received-SPF: none (domain of att.net does not designate permitted sender hosts)
X-YMailISG: FaLTslcWLDv_37lDMJwvUepYgmnqCzD2WWiLYIVYEvzWiVdj yeMdZg1sVqQZNMLZIrI8jrEhVaMXPsJIY6kRf0cbjnqQCPsaLbBdN2aERrfI RwOChZVFmKW9DzDxir.njJLHD.QY8j_y83jLRI4.AuI7k8QKdHjPvXXJYEFV 3YQAPmqS_78yqhLNbejZcKD5irk7feyqBo.GgWWRjUtr0XeJzJNqaql0h8sA e8RvUpWShCVHN2SyD1tuM0Deb4D1Ji8Vbh6LO0l1rw9cI0_sIz.vHpe_EiGP kHJSq4cVZ_zI24xSaJVH2nairx_S7dPagQ15pHcUhTSBMqGEgXXNeB1Y2oeP 3JU6qx6vSLkN2q.zt9EL5Vwas.VQ3VnnTXDqHLBdVcKU94hP0GlXAupk.DHM obtlUYCC1aCFRuuf3fyqc0LusjLnspK7JnjoOa4trRGPkJ_SlfDp0ggLrEaT v9a7lqaWeBT9EICtLA0FkLq3C2n40JFv19b2vJ8kTWkPK9_CQXXHvPmE9PZ3 kFs1luoQlTk_lzaBG6mXtSkUeA_7vvUTiNlT90e4_xcWHLkMi_qHUB6.MOXY KpjgBBptr6h8HH8BTrub.bb.IWuBN9wzFL2saNzKwsyxCm4lKMw9.xwDm5uJ Gq5wsKY8oAk.ZAm83V.RXXdQZhrYHzq2HI4TEsDuXnxCeBPNS3yCscgHGdua .5bviyYzefeg3tnvzHHkzRlzxSKw4QvlmuuqcChqscR9kCPiJLD.cgAs4kGP VstUFHd.bksAH552CD3i0lwkON5VfmeiESgRCGTPFvptnIKly2v3rZiX6esg GPPtVuH2VF9JGdJc2Ymbkp7azmUteBWNDdU3UBhVs441.EpCaWrI_sm_fe57 OiQyUOywnO1yRAtKJ_SFta4rGiPKLZ0KmWOm2iWxo40gyrpOgSF7vvvDlD.8 TTvxrpElU4SLFTn.GO1zFIFIOghPlKF4MTDaE1.cfSBA7OvaqPPhZB7CbD_P PbifHGwGIUcvjwXFo2GX_MJ9efyRaqwJ8RNv5bv_PmOjBSyxnqzPybf5N4_3 8R6NtlZnqM1b4Enrf9rnVdKOJneQ2FJhZVcYPrtDlcrfum9mFoOorxfoQHmz TE17GM57C0B.ILT43WlnmpnQdle96RtuSiqxmvsRzRStRdaGzDZuic8L7wei rjZENREYOwxD5PakTFL_xFmWBDMWOtezwqcs9j2HaBsIHEPGCa_w1BQb4H7T Rhg.rsLZhUpnUmz3kwbcPdV9Pc8UNCPtAWRE0QCMgwjeBn0ZXdINEcVudxSA YTcOMC4k95wVfJ8oF7eiOod5Qae2n5Ov7WwjD_lXqOtSBIc3J87zhs.HmSjX 7WlsWTwwXn.I_l4fa3NQ.mKYBKo-
X-Originating-IP: [98.138.91.88]
Authentication-Results: mta1228.mail.sk1.yahoo.com from=att.net; domainkeys=pass (ok); from=att.net; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm12-vm2.bullet.mail.ne1.yahoo.com) (98.138.91.88) by mta1228.mail.sk1.yahoo.com with SMTP; Wed, 05 Dec 2012 09:33:37 -0800
Received: from [98.138.226.178] by nm12.bullet.mail.ne1.yahoo.com with NNFMP; 05 Dec 2012 17:33:36 -0000
Received: from [98.139.44.92] by tm13.bullet.mail.ne1.yahoo.com with NNFMP; 05 Dec 2012 17:33:36 -0000
Received: from [127.0.0.1] by omp1029.access.mail.sp2.yahoo.com with NNFMP; 05 Dec 2012 17:33:36 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 198054.18868.bm@omp1029.access.mail.sp2.yahoo.com
Received: (qmail 22514 invoked by uid 60001); 5 Dec 2012 17:33:35 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1354728815; bh=2E+CXVEN1MfcfJaq2e/eZV5TviX4n2QY/x1KeAa5kws=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=f9JOS/YO8YXlmc9hJrpoWT06BSgD+eIddQyPZn984pugXI47aiHJ+HigDAW5KKMMOSqrOWONnAJiCoEyKoSjzteAYzjouKnJuSd9FFAPV7YDDY5OHZP5iSipgSUv3aNEhW/Rsnl4Ln0GS2YFkeMhoGRqYTKiUP5YtCqljvaDNow=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=att.net; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=TW9B75gLmG8YEH2Fs0wWUR6quUgNgKf4vKcOC0lU58OuZZxvfbAEilc6hFgOyOvoldI//PR2xiJZNGeYJsT5o76o0CJS8W8mbj8ANAI1PafbE8IT034u3iHRas9fZymmyVV0ARoaM4Pmz0UzVZK0Jim/YrB1484O5fKsUOiyGTM=;
X-YMail-OSG: WdGt0KwVM1lOyB0NVRZY5rrxYN4NyBpT08THjv3T0blrAYl g.fSaOnJGDgT6qOWJLehIImpPX16weUxpsraTUfiislliLwCl2K7v8Pp.iJQ a9TSaK3Cg8mAMGQLpgboaXsnY0P.gbcdPD9a2TYU3MLMz9.msdkdNVne7srD CGKrYap1ePNIkrvsumj.6_CYvw30FkImKkDHHf5IXtzUrxF4x8.QVPZL.F5P 1sCi9c6SjI1P.GeZm2DnWTw.VoPokMuHr44zOJyF208V.uJqcKGplN1blft8 NRD73m_UrMPrQXsfdMEk9IKg0jGHRledxyRP7NbPnmUmTJk5sWb6g7mibQcN lZBmrszbkEqY7Gci4Eh5lmEYhM0EH9ITd3rAkZfbRlBlo5s8MbxSVEa73EvH muyMHoTdJMpwvibAS8LsfWhBVw4Fzpyj.JdfnQdukkFQX5QRnWlt3FtcARkq hyy26DJRYTbzGN4Eyk0EL9EDXp1SGqp9Lk4FU_Cz6Hw4qjqgVzWqnIza_ijq nvI9omJY1Dw0WycuWs.OkVnfl
Received: from [108.174.51.231] by web184901.mail.gq1.yahoo.com via HTTP; Wed, 05 Dec 2012 09:33:35 PST
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.128.478
Message-ID: <1354728815.12889.YahooMailClassic@web184901.mail.gq1.yahoo.com>
Date: Wed, 5 Dec 2012 09:33:35 -0800 (PST)
From: DR FRANK COLLINS <webxx120999xxxxxxx@att.net>
Reply-To: drfranklcollin@kimo.com
Subject: PAYMENT VIA ATM CARD

FIRST EMAIL – “DR FRANK COLLINS” <webxx120999xxxxxxx@att.net> REPLY-TO: drfranklcollin@kimo.com RETURN-PATH: webxx120999xxxxxxx@att.net

SECOND EMAIL – Dr Collins Peter <webxixxxxx266xxxxx@att.net> REPLY-TO: collinpeterclaim1@yahoo.com RETURN-PATH: webxixxxxx266xxxxx@att.net

BELOW HEADER FROM COLLIN PETER EMAIL:

Return-Path: <webxixxxxx266xxxxx@att.net>
X-YahooFilteredBulk: 98.136.217.214
Received-SPF: none (domain of att.net does not designate permitted sender hosts)
X-YMailISG: 2lU7wkQWLDvBCg5Cg1wZtIwDNUzuGrZVVXK9H6ZxiRnCF9q8 3T_Z2xZXeKmdhjE03ZY1nNRa1P6Zz09tc3Suud6PVBq3vexxPmov8AXjPV9n h21FBi8fEfSTSwVFhhvzk7V6R63Puryrkha1Mb3jaVwNputKdVPkDPhjUMeo RVMMb4_9ds7LkdO1tAhp2nowUz6sKBD4buJmSanxkzHUpRwUVtPLKq8B09eN Rl25hxMaIQHn74TwJlEJoWwVxtvh8Jkr9b8xgoPVsHTD4d3rIEAmrBO8jRyd GelLKjDpe6gEZSWQukIvbii_.zMj02LUFMIXNqSXg2JTLp15U5_jUlo0usw3 1Q9ij8R.SuZ80..F80EMLcQO1SXMjqWDf6xkVHWwRChYckM8P0zLXQwmLzCh cXZIqLnw6xfz6lcwu0_mQkN.aX.hIIycQN9E431bkyzpAK8Sh0ATdnfKruuc hDUY3uEtvred._LLnnYkhYpxqfc_nSy4oYmmhRytYX5eJDo3.jrNS61KZPV6 YQ56CR6JtF_A6Hafi5rSLv5qgM4p8VJZi7448tERIhykcwaijsPjcAOenatn YK3BKAuoLWZ0KHPHNvGKAWVEbv9QWSQF39Q.EEP1LmrPyvSdcGkLUJurop.B aYWv4YFGCdGxSazNRDxvtgoiaK6SIwQ.bpgk7uq2vF3rcb50kF6JNxWrLg.n 7Tth7XBQ.W0dZ6SeRl5BddGt0PedKs6csdJXP3rAEuRx9HhVbiFWVgdNijR3 _dNog5Qebj0UNBN3_ZYEN_KnDptPkNdpsJ8OGplwzrinpWeXcnwHVgAbUTdo 18VmNYVRbtilZoPybybViqmTdRB30nDou7y.RzfJPpp93GHAGPmJapCeotd7 c17h.xTgmXwnesQYx8oH1A8HMZj9YMgj2Hn78UbjDz5iO3dLZZQwGJc37EEe Irpsy5SaXtVD8MbmmPkhMrhk8K30Dviwqq4hDE5WgxBlGVonuDQoGK3aEt2T nvWx.JhFmNOhCyTBWuANJwIBh0YVHlt7UHVip3l.jut4onQ9R4CDyP6sbX2c lfshiCRIJ9lEvHbvGo40N55AdITysTVwpsKYdhO1zKO2KEhE2HbINU3NSVAp mVO8xztcsAawulFbZ5PKA.HviU.utyPlT0yMvzwTHn_QINVPcYodx0NOT_5q eROgjgZ35jOw55jeTpgP2qOvmDNkeadY.RrCfkVM_h_Ewvbns5N8m8wKWn4F 71xz.y4o8QBLLz0jb4jMAFmUekk5PrMNZ0E-
X-Originating-IP: [98.136.217.214]
Authentication-Results: mta1191.mail.bf1.yahoo.com from=att.net; domainkeys=pass (ok); from=att.net; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm19-vm9.bullet.mail.gq1.yahoo.com) (98.136.217.214) by mta1191.mail.bf1.yahoo.com with SMTP; Fri, 14 Dec 2012 03:36:45 -0800
Received: from [98.137.12.58] by nm19.bullet.mail.gq1.yahoo.com with NNFMP; 14 Dec 2012 11:36:43 -0000
Received: from [98.139.44.70] by tm3.bullet.mail.gq1.yahoo.com with NNFMP; 14 Dec 2012 11:36:43 -0000
Received: from [127.0.0.1] by omp1007.access.mail.sp2.yahoo.com with NNFMP; 14 Dec 2012 11:36:43 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: 191480.20265.bm@omp1007.access.mail.sp2.yahoo.com
Received: (qmail 75889 invoked by uid 60001); 14 Dec 2012 11:36:42 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1355485002; bh=2TQXuFSDKzJQh2ItoNfMPDU7xRHv3E+CGrBMw/1Ns0g=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=MdiZ1jC0egJ3jeK8x+wAmlqoZyMp98AiD2wzzG+et6zE3r4jYBfuYUoMttuA+gtIjRNvWXQLaTtg0u215rggtB9Wpx8OQWJMI3iQKHU+C0WdAONnnis/01rbGL8rLVp8QUEopIB3M6ep93e/l0o2GTcA+2tm8NmXdnIzOrTvHgs=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=att.net; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=tLrXvMlZ1AfWS1oRs/q6h6HUMYi/LUcbnjbU0+wRSPWQr/1rUxJ+mPFD5IS+2J+xhqTW8fnpv0P89+O46Kg0ZaIi52L7OqBpBWUtxGIOrGGuRKY65NxHoyuM/9fcPmg6OxN2t9IVr/IQmo5FIYMQAlTgtLYGxzIx8tus9kjh4UE=;
X-YMail-OSG: 3ICaliMVM1ngoXiqNpguRRh2iYwL78sXplySeVxex0hGQX. 9amYG0XA4OBV26LpGFUMshO4W2d_k7Z_a2Ijy9UC4MhQCts27.mEJf9MSo4o gLC1yrqEZW2qVfkENJcHqLvP6x22811UE_jYQp539eFIcLW5RWUDAU4t9CGn OdkUZ.I3db4Y0_pc3qHbfrO34x9zDWKUFRwLqnQ.wNCnHD8dS3WSTofCFWm8 DRISKdISfGE2ytoF4IzvXsFuyje2c_qd6tqdnmTw5Z9mBhssXb94A4biy5CF qnxB_1TEOjTWqKHDrBY4BU1EdgOFfYQNqvwQ4XtGhinDlu0jMGic.YAmQBDt z00_WMAOIdc6llHVKxJwh0yh_xgWL5D6rgLOTnmN2Mo2vI.t3Ls.zQwRBRhe SaGInzRlMMto6OJd7AVEbCSpnmZYicQHhMCbjMxGPX2KPd4Tv0fL_cU_plDm egb7i9XYQocNBXLDzdzIfmk9Um9FTZk5b6spv87aUQEG.1MjrCbB7UdYQ0uO JpvS8DhYL5XyxrsNNIFxmRpV2b8I07Jm9LTn8wKS_hqGegIf5feMr.9cGJzH 7hgKyGs0sihPG_k5JCSaI1yCjgZYK79b_xhXuvMQeLOYyQDygzxrr8813RrH cC8L9RfM7BsB3QMN75qyv.pCG1ZbybDazG.TyLuGLgdSNZ6KwYSh_mQ–
Received: from [172.162.63.104] by web185004.mail.gq1.yahoo.com via HTTP; Fri, 14 Dec 2012 03:36:42 PST
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.128.478
Message-ID: <1355485002.70723.YahooMailClassic@web185004.mail.gq1.yahoo.com>
Date: Fri, 14 Dec 2012 03:36:42 -0800 (PST)
From: Dr Collins Peter <webxixxxxx266xxxxx@att.net>
Reply-To: collinpeterclaim1@yahoo.com
Subject: ATTN:BENEFICIARY

108.174.51.231 << 98.138.91.88 <<

________________________________________

Click SCAMWARNERS for email to below header which was sent by the same scammer as above.

Return-Path: <web1xxxxx12000bvvv@att.net>
Received: from nm12-vm4.bullet.mail.gq1.yahoo.com (nm12-vm4.bullet.mail.gq1.yahoo.com [98.136.218.191])
(8.14.4/8.14.4) with ESMTP id qBAFqXcC024177
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
(envelope-from web1xxxxx12000bvvv@att.net)
Received: from [98.137.12.190] by nm12.bullet.mail.gq1.yahoo.com with NNFMP; 10 Dec 2012 15:52:33 -0000
Received: from [98.139.44.75] by tm11.bullet.mail.gq1.yahoo.com with NNFMP; 10 Dec 2012 15:52:33 -0000
Received: from [127.0.0.1] by omp1012.access.mail.sp2.yahoo.com with NNFMP; 10 Dec 2012 15:52:33 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 169461.26588.bm@omp1012.access.mail.sp2.yahoo.com
Received: (qmail 11627 invoked by uid 60001); 10 Dec 2012 15:52:32 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1355154752; bh=6IEXAnuDHUzPM2GG6BZxFSMMGXUzzTJH/x0iCKn3gNM=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=ZNpQDXqA6YKLygx/Mgp0kaQY3hShe48iYfThTEb8Iru1MOJkFmAxYG7WRpbG0vEzb8sVOXBWUD70FlpkHY32sc3lcnQRUH9EWyjF33/6bxeK6Wl/Hf7syjgMKen3IrPrVrQM7QP70aIkEYevI/L1VoeaKi0X05zrl/mkFKlZJB8=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=att.net;
h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b=C3u05KWRUG4yec6yjYc58jVUZqKqPra/xpCRYFkhi2pi73G7p5xYJt3avwhjC1pd5gHT2g6XMST7DkGiaRchRZYYa/jODcoZt4R+AhzCt86vNfdJ8r54ZScNvyU4Y+I8mpF49mKbuYWh9Qw+6o/yW3f8qclaMsyNAu3ATH2SDAs=;
X-YMail-OSG: p5tUyUsVM1nSNbno0XpFEzLZade1sG0k1LIN6NkNDDbP4ts
LfsdXeXxUn6OgEkvAzJFUKDvuIBVeFzZtgkksCNzN7YM7NYxZZELCIFArcbu
_mj1sx3mmaRRFlhLnDPO0Ud9acKn6RdXUuy0Z2D2THjsSnJnY9sU7qqlRMsY
RFxlusC6GZdc5g0kSlEJ9Q6m1NFt621vubnU3dlWx9BHYYswZA3GlYEoIQOZ
znu.EmXiL_e6NkgO6Xi3U8TlgxDHH.J2V.gjmQeJjgeleOz.cmjSiQf65.01
pFSPJQ.uJV2ZQQDmhoA_f4DIGHOLzIEM54oMAKodxlcGehFjRCB.Otx7qJ99
LLzSejt_DN_c3T7KOCmzn30gBLvM4NW04V6Q7K4N69QA7XOIUNPQflttOcPQ
QUh_J5vkppPwzXQ7X5ZwbRUsdfsHhuaz1XhXMvrY6vOWGj_WLL3kyxKoNNTD
o2PEbuViIVuMH9ocliCObq_Z7Olxp0coTXqA6vhkTd_030aE_Rclf5k8sFU.
neOYXj1nWJo0ZcsSoOLW7
Received: from [64.72.78.27] by web181404.mail.ne1.yahoo.com via HTTP; Mon, 10 Dec 2012 07:52:32 PST
X-Rocket-MIMEInfo: 001.001,DQoNClJlY29uZmlybSB5b3VyIEFkZHJlc3MsbW9iaWxlIGZvciBkZWxpdmVyeSBvZiB5b3VyIEFUTSBjYXJkICQxMC5NATABAQEB
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.128.478
Message-ID: <1355154752.62957.YahooMailClassic@web181404.mail.ne1.yahoo.com>
Date: Mon, 10 Dec 2012 07:52:32 -0800 (PST)
From: DR FRANK COLLINS <web1xxxxx12000bvvv@att.net>
Reply-To: dcollins@kimo.com
Subject: PAYMENT VIA ATM CARD.

 
1 Comment

Posted by on 12/11/2012 in Lottery Scam

 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

“Collins, Peter E”

FRAUD – ATM CARD – INHERITANCE SCAM – NIGERIAN 419 SCAMMER

UPDATE FROM DR COLLINS PETER Also known as DR FRANK COLLINS Note: each time ‘Collins’ email’s me he has different addresses and IP’s so make sure you check both headers posted below. (the second email/header sent by Mr. Collins is below the first email and header.)

 

FIRST NAME USED: Collin Peter E

FIRST EMAIL: I am Mrs. Priscillia Thomas,i need your help to transfer 20,142,728.00 Million Dollars I inherited from my husband for more information, Please reply to me: priscitomas@hotmail.com

FIRST EMAIL HEADER:

Return-Path: <>
X-YahooFilteredBulk: 157.55.116.165
Received-SPF: none (domain of CH1EHSNDR002.bigfish.com does not designate permitted sender hosts)
X-YMailISG: A8zSEdIWLDtDE2pBn2j7Mg7kVH0A9HcFcs_CGir7I3SWxOc5 gWFUT56g4PVV_fYdmJLC_HKbSpMU7ZlnMSp.RDhVee.MNOhihGcSxyRoIl.s h6nlC5NSrJjmy7eLGgAsow5X9spU6qzeZp4jCw1j3fbQxUky6z3TDnF3Dt2U UDb0p6z2p81lNt9OqcaMss3JjSEU.6BtleBgn6A23X8_c3ZWGemeyqoFU2EG DZEtBOrrP2.kZTxusR8pGzCgaGz6q9wgn6yXwDNXrIwautUdkAqT8tjZL7Xh PWlBIZGZlvrAUg7Klkkpr1mE9Ewz7fvRydyT_qFe88ODYOzOUd_7K9r7rIFw WNnxXF6Emx9IT9YaVn_Da1TA9wSp.yW_dQ65dI4zKxZlU16lFNXqlFLRB2pL yMKLBNdHCwSFBMbBGHokSoGoPF17OwMCOhPCtq.j37SCgPcELPvXhSWwolvt 7bqlQi3Hw8YbvwYLf9.zqlOAeUpXnUrUdAi6QN8PZqiaX1n4iMdn4FtBljbj YLTi3zClm5roQl.nb8sQYt6aZk3NoByYY9cQh7.TQMPvxElS8Yu7_FjvLiu9 rt0yTGDn2Zf1TPJQPK0YQRKI8C7gkdptWgQWMf_F32RQ9TerVELP1viC02UZ H2S1A9tQbqx.Z2sn_mk09Y6uhE7I3SX4KQSN0wHuo1WQZnGEEKRNtsQFXvN4 cmL5hzjvvcWBA0EAle2sWoL.uCChUKZEPOVxjVmXm.R9k8zBTaqEYY2im5uT .MXfm1SafJFJsUchPRU87v4Yj1uVOwOj3lAOJqPdvJbYZo2TmbdWHoXt51oT QqxYcXFOdmoXGKxmi.8bVyfeMpVt36US39BF6DazGDGHgaZedgZSxBfmvglX pH4lP8oFyu6XLLGxYXmvt5xdANUgDfOtVOrIuwvLsFqYyM.paTffw_ETh1vH 1R5hDKC1QEK1NJ2p1DqEZeyZsg6HF5lX6_I2aRVUz7S4s1RA9J_BEl51Ogcj z.MK6mBQ5.hjrEOQX6ODF6FB03iGcl7OwUriiBtlLl8v3OEf2EAPAYrCil.R QVP8AtsL.clvE0E6NmhAb9fL9etnCiDSfhDjbsD8vMfqOQ2s6tVJuuPU.qT7 vO2B2ICarig2UYK3AbG4oBlxDLHrUoUIA0hv_CvvqfDKCGD7gS4DJSLGEWJV 2A.dFV.0A.4emCoABS.0Qv1o1n9sDqGO5ADD2aloIkWc.WLwcw–
X-Originating-IP: [157.55.116.165]
Authentication-Results: mta1217.mail.mud.yahoo.com from=newtrier.k12.il.us; domainkeys=neutral (no sig); from=newtrier.k12.il.us; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO CH1EHSNDR002.bigfish.com) (157.55.116.165) by mta1217.mail.mud.yahoo.com with SMTP; Tue, 20 Nov 2012 12:09:47 +0000
Received: from ch1outboundpool.messaging.microsoft.com (10.43.68.240) by CH1EHSNDR002.bigfish.com (10.43.69.241) with Microsoft SMTP Server (TLS) id 14.1.225.23; Tue, 20 Nov 2012 12:08:35 +0000
Received: from mail131-ch1-R.bigfish.com (10.43.68.242) by CH1EHSOBE001.bigfish.com (10.43.70.51) with Microsoft SMTP Server id 14.1.225.23; Tue, 20 Nov 2012 12:08:35 +0000
Received: from mail131-ch1 (localhost [127.0.0.1]) by mail131-ch1-R.bigfish.com (Postfix) with ESMTP id 147B0401A6; Tue, 20 Nov 2012 12:08:35 +0000 (UTC)
X-Forefront-Antispam-Report: CIP:50.201.16.151;KIP:(null);UIP:(null);IPV:NLI;H:NTMAIL01.nths.net;RD:ntexch01.nths.net;EFVD:NLI
X-BigFish: VPS48(zzc85dha398ivzz1de0h1d18h1202h1d1ah1d2ahzz8275bh17b1eeiz2dh2a8h443h668h839hd25hf0ah1288h12a5h12bdh137ah1441h14ddh1504h1537h153bh162dh1631hbe3k15d0l15cma02m)
X-FB-OUTBOUND-SPAM: yes
X-SpamScore: 48
Received: from mail131-ch1 (localhost.localdomain [127.0.0.1]) by mail131-ch1 (MessageSwitch) id 1353413312648742_16690; Tue, 20 Nov 2012 12:08:32 +0000 (UTC)
Received: from CH1EHSMHS016.bigfish.com (snatpool1.int.messaging.microsoft.com [10.43.68.244]) by mail131-ch1.bigfish.com (Postfix) with ESMTP id 57645260079; Tue, 20 Nov 2012 12:08:32 +0000 (UTC)
Received: from NTMAIL01.nths.net (50.201.16.151) by CH1EHSMHS016.bigfish.com (10.43.70.16) with Microsoft SMTP Server (TLS) id 14.1.225.23; Tue, 20 Nov 2012 12:08:32 +0000
Received: from NTMAIL02.nths.net ([192.168.194.152]) by NTMAIL01.nths.net ([192.168.194.150]) with mapi id 14.02.0309.002; Tue, 20 Nov 2012 06:08:31 -0600
From:
“Collins, Peter E” <collinsp@newtrier.k12.il.us>
To: “info@notice.com” <info@notice.com>
Subject:
Thread-Index: Ac3HF8EFf0hwi3SMRaeT/rgft5INsA==
Date: Tue, 20 Nov 2012 12:08:30 +0000
Message-ID: <38A096FD7555034E86C81153095D831B015C15A5@NTMAIL02.nths.net>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [41.71.173.93]
Content-Type: multipart/alternative; boundary=”_000_38A096FD7555034E86C81153095D831B015C15A5NTMAIL02nthsnet_”
MIME-Version: 1.0
Return-Path: collinsp@newtrier.k12.il.us
Reply-To: <collinsp@newtrier.k12.il.us>
X-OriginatorOrg: newtrier.k12.il.us
Content-Length: 1152

NAME USED: Dr Collins Peter

SECOND EMAIL: Attn: This is to officially inform you that (ATM Card number:4083-0521-0032-0293) has been accredited in your favor. Your Personal Identification Number is 822. The ATM Card Value is US$1,500,000.00. You are advice to contact me with the following information: Name, Address,Phone, Age, Sex, and Occupation. You can also call out hot line +234-703-011-5459- to confirm.

Thank you,
Dr Collins Peter
ATM Logistics Unit,
Tel: +234-7030115459 ,

HEADER:

Return-Path: <web52644778980000x@att.net>
X-YahooFilteredBulk: 98.136.218.126
Received-SPF: none (domain of att.net does not designate permitted sender hosts)
X-YMailISG: YxwxuscWLDtYRBlEuwlWrBw_0ByFAfeYeEaKlhKmf_Pqo3oQ VZ4RzgKvia0dbtrf82vD2MygMgJipAOcg0xhghxyhvviIGLdwL7O9HeA_MVd CTYGLOwuYMZNFxvjFm62VKjODYvnptlR8EP2Eq4bl7k5b40vuAKQlN.VEPv6 Jj6Hv94NjiaoP1DqZkJ9niVr4amHA2Krz7hUiu7nb4dKm5FksoBvOjLiu5c6 LHxAgL_1HwQC1Kj94cY6qI2QeZMVbZE8q4fnq1zWg.nXZRhqSr2Z3IE99Vfw wZ56W_kHMqjve3BFqLHqrBq8RKFRrEA0LIWoTxzT.SXuavzNzee4EgDmzQFG Azw55EUT4_L8CQh3Yvuo2mQqsL5b0DvfvtZgLcOjD60.rbyLf51x.t.t1fsa 1oEjZhoHjxxQ_bG_Ud44UCim9Aad_eUMKDNhKnRDHkyuvhq6981x7wC3Wrki zhD6OWa.KVTqY6RVBWhX6fgWm.qUZFTXpIDTFRgSjZTcIVgOmcPtIsNbPbks gayTqPf4rqmt_33Dez5Oe0dBUM.TJUwDanFeN7Az8x9JN5pNWjxybYOZ6mu0 1EzAgiuYd0zc_wF1bS1fDmTpxrbXcalKzBvT_GAZ1Rge1P.T9Ju5Z.wvtoRi wqzLdIQR.OJ4R4ADjlXDt_6MY.sWxwWbrsh62pdNCgNpoAJM9IcaoldrE6Wy xAeVMkTvdzh0OLi.r2AWk71jpv78aC7kn_vonZ1YHhV0armnTXgZAHbnbO6F ms6.bhBcpysOsOdkJuQ8l0llDNW0anfgunue24vR2UyAsfvxa5D_2e7D5Vuz dyXvxJC9q2wxkkR17TCc1eWwmBV2WC0OGQA0lPnYwXC9.yEVofWQKNjgsss7 0wjyMZ7LN98TSaNp_4JnxMT0HF2Fhhpbh7YY80jc5n_FyXP0AAt26MYs6aBK T.qEDebCeFuzB40HJcGbnJO.J4a8XjwVoysy3i5nTd6ax3p1fCHqMU3tR9jh b.i8Qr4pUCBGxaNBhT1_dQ3b1sYVNd7pMi9b6dvEmmGH9dTOtRewwZvd2nvn 8oDpVXiYIzqx6Rq9ZSZIkJxb9HOhpjhN8mq3Guaq.mQ2YUN_.q2034AQmjzY 8YOUg8CZFXzXJY38jakTJIjuiXD8BOagQvhFHUIiK07F7luKu0vFisMrqAvg oNshOmGpcxznwZ9u.c9DnN2tcjL0OgzDpvg3Unkg3p29sDV6CMFXqf2v1QpQ sKcLP7oQKRmcKvaXxNN6.tyYsNUkH1Bksqg-
X-Originating-IP: [98.136.218.126]
Authentication-Results: mta1033.mail.bf1.yahoo.com from=att.net; domainkeys=pass (ok); from=att.net; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm11-vm9.bullet.mail.gq1.yahoo.com) (98.136.218.126) by mta1033.mail.bf1.yahoo.com with SMTP; Tue, 11 Dec 2012 06:46:42 -0800
Received: from [98.137.12.55] by nm11.bullet.mail.gq1.yahoo.com with NNFMP; 11 Dec 2012 14:46:41 -0000
Received: from [98.139.44.74] by tm15.bullet.mail.gq1.yahoo.com with NNFMP; 11 Dec 2012 14:46:41 -0000
Received: from [127.0.0.1] by omp1011.access.mail.sp2.yahoo.com with NNFMP; 11 Dec 2012 14:46:41 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: 713612.98465.bm@omp1011.access.mail.sp2.yahoo.com
Received: (qmail 53233 invoked by uid 60001); 11 Dec 2012 14:46:41 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1355237201; bh=1Tsupv5caskqf9mge0R5RXi2qnrZiMm1Aq74YLv1THA=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=d0RbFWDQ2rV8/8EXXlMR7i2VOjKilYeOBFydV1IW16ocBNPVQMUNHFzIM6L3A2h4gqL3Grzh8MgbGkhwqhOlWMu7My6F8FKiIf+Pg5ye5iuwah/8G6S1Ado8CChFMhmECHbzGAwLDbrxPlRFKvz5joLrsKMtRzKRtcE5eXphoGA=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=att.net; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=vjMzxQxarqcqmShOCLgE0HDBbv9eGBiPHgQKKYF4O5TCYrCvNT3eU9W0hvngieNBEGMbuiR2/ZoXPq873PanQzZD0By1gxA2Fmf/8Sthuei1fyBqDwvcd6nl3Dvv7uynmy0Ya+st1wQ6JH/BShU88SffXHjTLkjLkt6lxEEktr0=;
X-YMail-OSG: pgvQF3QVM1mLxZmT73VMfxmEGdzXaRnQRMYeQPC63iaQjwW 4K__5URLbF_yynhsaAouwFbc08adA0R4mnNqiV7YHyxU0tr11LXo4Ta_0KiQ TxVS..r_9SsgbyOZjhMSXrjXbXJ0GHf47ktIl028sBsTjWbcxtPXSQqbPyMQ F4QNhvxM.BVDpOh5T5oFYwuoORrB1NLSM3csjYOg8LvqCtdnvTTwoYkxokns 9xiHNLl83SO2R2DHSayC.6oNQLjvYMPxh8Aeym4t_6ajnBr4DfRGx1TPrs23 gQrSqww3hv.xnu5ggtpJ3j15R6o.gHcdWPsXslYVUJHwh0WtHcK7MkQZw7gc 8sBseuqMwUeoGZ113dC7howF0iEEmrCoduq8mPsfH7mFEZz7g4oJrkl0w_n6 kX1dWfnuQ3LPbUf1PgsoqlP7nCEQ3ZEpKGet6VglOMgncopioOk8Z_fVN5Hw lmdaAPfS91ze0AWfaLqWRth2qUVz8sPz.TjOgloZYT28Sq1yGuMg5uezQIzD OZBs0oZs_Pza2bTonu1swUyBd3jlvdll5CUc-
Received: from [172.163.86.61] by web180804.mail.gq1.yahoo.com via HTTP; Tue, 11 Dec 2012 06:46:41 PST
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.128.478
Message-ID: <1355237201.98816.YahooMailClassic@web180804.mail.gq1.yahoo.com>
Date: Tue, 11 Dec 2012 06:46:41 -0800 (PST)
From: Dr Collins Peter <web52644778980000x@att.net>

SECOND EMAIL FROM: “Dr Collins Peter” <web52644778980000x@att.net> REPLY-ADDRESS: collinpeterclaim1@yahoo.com RECEIVED IP: 172.163.86.61 – X-ORIGINATING-IP: 98.136.218.126 onlineme20@gmail.com

Scammers number – +2347030115459 (prepaid throwaway phone most likely)
info@notice.com — 41.71.173.93 Location: NIGERIA – RIVERS – PORT HARCOURT (LAGOS) Scammer using fake IP with the location: United States (not scammers REAL location) 157.55.116.165
Example Messages Sent From 157.55.116.165
From: “Parekh, Hardik M” <hardik.parekh@mavs.uta.edu>
Subjectnone/blank
From: “Gordon, Anne Catherine” <anne.c.gordon@Vanderbilt
Subjectnone/blank
From: “Mr. Adams Mensah” <adams37mensah@hotmail.com>
Subject: IN GOOD FAITH…
From: “Stobbs, James, R (Jim)” <JStobbs@azdes.gov>
Subject: Your mailbox has exceeded the storage limit
From: SWISS LOTTO <swisslotto1978@gmail.com>
Subject: FINAL NOTIFICATION!! YOUR SWISS LOTTO WINNING NOTI
From: “Gritzmacher, Linda” <GritL@wawm.k12.wi.us>
Subject: Mailbox quota limit exceeded
From: Shankar Pant <srp0005@tigermail.auburn.edu>
Subject: System Administrator.
From: hlb.com.my <access.services@hlb.com.my>
Subject: 1 urgent alert
From: “Tutkowski, Elisabeth” <tutke@wawm.k12.wi.us>
Subject: PC-HELP
From: Hong Leong Connect <alamb@bsu.edu>
Subject: Important Security Message From Hong Leong Connect
From: cj1eufv6ql <volunteers@delautism.org>
Subject: 销N售8主
From: 侯绚丽
Subject: =?utf-8?B?Yjky5YiG6Kej5o6=?
From: “Hall, Carole” <CaroleHall@azdes.gov>
Subject: Mailbox Quota Storage Limit
From: Shankar Pant <srp0005@tigermail.auburn.edu>
Subject: Thanks System Administrator.
From: Chase Bank Alert <info@chase.org>
Subject: YOUR ONLINE ACCESS HAS BEEN SUSPENDED
From: “Ender, Allison” <EnderA@wawm.k12.wi.us>
Subject: Mailbox quota limit exceeded
From: <postmaster@go.local>
Subject: Undeliverable: Разработка инв
From: “Ender, Allison” <EnderA@wawm.k12.wi.us>
Subject: Mailbox quota limit exceeded?
From: =?utf-8?B?QWxlc=?=
Subject: segera
From: “Van Deusen, James” <VanDeusenJ@wawm.k12.wi.us> onlineme20@gmail.com
Subject: Mailbox Folder

 

 
Leave a comment

Posted by on 11/21/2012 in Inheritance Scam

 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

 
%d bloggers like this: