RSS

Tag Archives: MoneyGram

“DHL COSTUMER CARE”

WARNING – NIGERIAN 419 SCAM – ONLINE FRAUD

THIS SCAMMER IS AT IT AGAIN!! UNDER YET ANOTHER NAME AND USERNAME.. OVER THE PAST COUPLE MONTHS, I HAVE POSTED OVER A DOZEN EMAILS ON SCAMMER419 SENT BY THIS NIGERIAN SCAMMER — EACH EMAIL I RECEIVED HAD A DIFFERENT IP ADDRESS AND EMAIL-ADDRESS.   

SPOOFED LINKS WERE ALSO ATTACHED TO THIS EMAIL, PRETENDING TO BE ‘WESTERN UNION CUSTOMER CARE’ — THE ACTUAL URL OF THE LINKS WERE GOOGLE.BJ/IMGRES/YADIG.COM/UPLOADS/BIZLOGO/DHL_EXPRESS_ALGARHOUD-ETCETCETC

EMAIL: DEAR CUSTOMER,

THIS EMAIL IS COMING TO YOU AS A REMINDER CONCERNING YOUR PENDING, PACKAGE THAT HAS BEEN WITH US FOR A LONG TIME. AS YOU ALREADY KNOW THAT THIS PACKAGE IS CONTAINING AN ATM CARD IN THE AMOUNT OF $1.5 MILLION USD.

THIS EMAIL IS TO LET YOU KNOW THAT OUR DELIVERY TEAM HAS FINALLY CARRIED OUT DELIVERY OF YOUR PACKAGE. THE PACKAGE LEFT COTONU BENIN ON WEDNESDAY, NOVEMBER 21, 2012 AND SINCE THEN ATM CARD HAS BEEN IN CINCINNATI HUB, OH – USA , UNITED STATES AWAITING CUSTOM CLEARANCE.

TO TRACK YOUR PACKAGE, GO TO HTTP://WWW.DHL.COM AND INSERT THE TRACKING NUMBER BELOW TO VIEW DELIVERY STATUS.

HTTP://WWW.DHL.COM
TRACKING NUMBER: 1736996225

ON THE TRACKING PAGE YOU WILL SEE THAT THIS PACKAGE IS GOING TO A WRONG ADDRESS. THIS IS BECAUSE YOU HAVE REFUSED TO GIVE US YOUR COOPERATION. YOU ARE HEREBY ADVISED TO PROVIDE US WITH THE BELOW DETAILS SO WE CAN IMMEDIATELY HAVE IT SEND OUT TO OUR DELIVERYMEN IN CINCINNATI HUB, OH – USA .

YOU’RE NAME (IN FULL):
YOU’RE DELIVERY ADDRESS:
YOUR DIRECT TELEPHONE NUMBER:

PLEASE NOTE THAT YOU ARE REQUIRED TO PROVIDE A REDIRECTION FEE OF $65 WHEN REPLYING THIS EMAIL WITH THE MTCN NUMBER WHICH YOU ARE TO MAKE AVAILABLE TO THIS OFFICE VIA WESTERN UNION MONEY TRANSFER OR MONEY GRAM IN THE NAME OF OUR RECEIVING ACCOUNTING OFFICER STATED BELOW.

RECEIVERS NAME: MR. Mike Osita
COUNTRY: BENIN REPUBLIC
CITY: COTONOU
AMOUNT: $65 .00
TEXT QUESTION: URGENT
TEXT ANSWER: TODAY
MTCN…….
SENDER’S NAME…….

UPON RECEIVING YOUR CORRECT DETAILS AND THE PAYMENT MTCN FROM YOU, WE WILL IMMEDIATELY NOTIFY THE AIRPORT AUTHORITIES IN USA AND THE PACKAGE WILL BE REDIRECTED TO YOUR CORRECT ADDRESS IMMEDIATELY. EMAIL ME ONLY ON THIS EMAIL ADDRESS: (dhl2@superposta.com) THIS IS IMPORTANT AND AS SUCH YOUR IMMEDIATE RESPONSE WILL DO YOU GOOD.

MANAGEMENT,
MR. WILLIAMS FORSTER
THE DHL MANAGER BENIN REPUBLIC
ADDRESS: 455 AGBOKOU ANKPA ROAD COTONOU

HEADER:

Return-Path: <webtzzzz.office@att.net>
X-YahooFilteredBulk: 98.136.217.70
Received-SPF: none (domain of att.net does not designate permitted sender hosts)
X-YMailISG: p8lVcL4WLDvewhzIrylP8xI3a9LPPhDBhDME1lzPGGvQontc ktbWdxpu_gs6JvDnQScDSWwl56kzWHusRAx2Ds_pdgSzG9Qe04L2o21e8_33 wUq2MqkyNEx3NWbeKyr3FpnTLQfAwBWI71cd7utjFjL.A3xFMZ9DtZdd3UEU ekjqbavtNkSGPy17ayqcXYXFzXhtJ6z9igt8f98FmG4Iou1.caQ8bTP64g24 3VffbJI0URmoUkaMy45c_9hdEee.Abk1kXU.QJdCFbmvEuy1JRNl6ZrRPxOA AutA0VeLSsTanI5L4EcjxGG05bvrIUMNLGi.mrjRkZctW1DW7DSkfvbYZqZ6 tG9wvfA2YLxIdIUcpNu2IF_LnReU_5g7ltkMJt43H5.rMm5V5dsb_nL.D_Jq _MRVXp5JNGwNDvxmeSpK9_XTGiq45o5UiRG5dCWpQGCkeTFz5q0sbbPw_mR2 97MAsA0lSc30BuGg_nmZ02Zu.kogPIf9.i26DQ.Q4ghuvRXbQ4sc8TdNTsq6 5FJEydJCkX.3ERwsGZBCHEv94bxh77acpC3.Pb0iCCYgEPcDGzGJHNwFZvA4 caVPp81ffhDY0vIoV03.eQ_rOSwXToPiu_U_IjpLDp2iVn6Nz.bCHHw6zjVz KnzWiD5Bk6oQI3BQZNAR_ZJAAmyWpRMCc.js4hRh8lbFpW.jCESgm6iGyaQD w6BuEQrnBd70DRv2iEnTyTWBKuuUnZIHFoq2JwHGktXkIUFvB3DbgNUIAqnQ gu_oJnjFdEp3F7diZo.5HZgi_UannfhTI1EJLtRWoaPAZxMizPkKl8_5cp_h .YCe.LH1Ygvl3S2FMktaLvvciuhuarxlw_fYfjVX8Ve1LjDzL9WVBf9evyt5 880sRXKXNBUG5PgxcRID6GynXX0mVwdkd09X1ypVCDK28e7pjnzoqwuMHpn. jV3a7Njk9OcYeeHu9GnmTbSIKrhvUV73WYth8geL0xmT45cVlwQl6L4HzLrh kXhpWUuQJXhUO44K9dZIPqg2Ca7RNsqpQV9eVW3L.XxLmj99CvbaAX.oJeub kxkq.VYo33MlLbo1q.JQGFIIGAYfkO7pRfZEFjbIJ4D38NYL55jgyIeRCUDw Cr_zDxDX1LBlGy9cmQHMQWf4Jg9.f_xh95HWujLyQce6hVJ4z8PoY1ChEYRp aKlgoRxtBn7DkH256xF3QI55u1JZfy9Hg.atUmcIsq91wp2ky_pdpD0wtsVQ RAVN2CCt7_CgdV.TG8cbizBTOX.JawUCRcj_nWQeQ5c7KG81hMoQtPydgoYs PLnEOFNgyGQaHeKYmrQUr9b00tdgdGGyBuNfP5r5jFujaTMIl9F8dj6ZCJGi hB_YsBJ0_4dphtAG7w.rvToXz93tmmanQsk9ACdm_N.1OEETOtYUtZKZI1if lMj.aCK8RaPrX3zyBnqxHFBkT4lTZBv3.7tsJcMX0UwjqfmkMEkcnCfqZIWc Fzb6F1kKphS6VCk5D3x.55eRTt_1e5GnkpMWuA–
X-Originating-IP: [98.136.217.70]
Authentication-Results: mta1019.mail.gq1.yahoo.com from=superposta.com; domainkeys=fail (bad syntax); from=att.net; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm22-vm7.bullet.mail.gq1.yahoo.com) (98.136.217.70) by mta1019.mail.gq1.yahoo.com with SMTP; Thu, 03 Jan 2013 02:27:26 -0800
Received: from [98.137.12.63] by nm22.bullet.mail.gq1.yahoo.com with NNFMP; 03 Jan 2013 10:27:26 -0000
Received: from [98.139.44.82] by tm8.bullet.mail.gq1.yahoo.com with NNFMP; 03 Jan 2013 10:27:26 -0000
Received: from [127.0.0.1] by omp1019.access.mail.sp2.yahoo.com with NNFMP; 03 Jan 2013 10:27:26 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 72063.61201.bm@omp1019.access.mail.sp2.yahoo.com
Received: (qmail 22369 invoked by uid 60001); 3 Jan 2013 10:27:25 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1357208845; bh=lmIBzo8pehjJsD539T9RFIDhRXWzlDcc3BSQ0Igdr2w=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=l/M9cJxrlpIXZpNBdM1sj/yVjEflcd/UJzeIGcUPojiLE7DY0UnFDztt1kD0gVw7Q1EhV+xvpnonQnPGIOIR7ix4Of4kBityUsjL65NuLb0bAIK7ARGY9FVuBDui+wJA+PcgpytkrxLXPPlcb/I58hCmlZhvumPUUKYJEPRwprM=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=att.net; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=WpuFi53revO4dlTGjmLXeGSXpTg5q7twxkK4tWto5mJzy2lW+XcZLfrd22TMs/evyh/HS0iT9suPjqthzByLcn3eaH/Svo9KOt03y8KibBn9ComYtN54hkjgjClRIPlnB6ujaucXL8O/ilqfRh0w5ZfqM8Hw+S5K8oPLxaDu99U=;
X-YMail-OSG: X94oLdAVM1m3RFepMGMdx7qyT2Jc7tIr3A9LR8KPGHJW1GV phobi8N5t3h84tC6e.f1qyRXMUJtrPu5VPhp7pb7gMMGA21NwAdKb66PmBas 4UCb1R3JFaI48Id46IPLscQH_i_q88UY9_Z7o._SoDBnfMKqBawzo6a6c_IY 3pWsPFCvcjyopXUwjZhQN4DxhWMXVmEHJbKCv5F26akn7VGzfeyx9bgeHVsT w7ooyrJiFWIVcXOWCTI8pk1BVlTP4j.r_WCUsWbIeRWsbt4C95hThw4Ol7S3 JqQVe1iXz8cmWn3ftbA6Z52Xb7UlQI_QGO5dYeU8bFsOT3tfikU2AxI7ex5C Cpy1K4MSV_9Z.rKmBf5wiXdJQWfvs_LWugO54wwph9CFvLuKnniUd5f0..A4 Fr_23dyFIJ6QokMJ8Mve5dM9ovEAG9YY1z9LgXkreXJS88oIAQtE_KkVKVU0 gWFoKAbYkt35HaPUYUmlN4zGwfKweMqQUxEmy4ptw67JlVv67qvnZvUwWsKA RwJfyCwx9h.SVITFhM7DRx.O8zzjMzLixz2DDNKk_8mL_VWx0j3q1TsA7FE2 ytLMjsiuly1.Di2.3YqFGRNAHUwhktYRY3IOyl0eTeGsUEEiD07RW1Kcdcxo 3VFkSCLQ9y7DX84iRiiAhV54qkyiVqg2CfSSe5uoZYmvzzig5Udn_pPo16dX 428XiGVli01fNur44l.DejLkila7cCZhQB150XLi7Vl3SuTgQ5gXR5WG4P9s yJCBRRF7NmxiBzr5uaNr9tadVYQWUdv9QKM6pOZqbY3.SIdMCxcHSzvPbyMN NXvDTQZDY0DcD3wNyVBYPwwsuZMlNs6EPEpPB.GGCPyeESv1PBlNXSRfhY6u kuAaz0FrOt588U_D1DnKbeMKqtST5p6qNbzMxIYEuncmXn10pEXKs2xEWV9x pKo3l71HmCFiNuI3Ld3wnSFPKeu2oBJEEi7vtqGPQWVAUbrWI1vl0V.O6B8N akSZIyzpkQPmibzAAFNXDyn7r1mmOeZHeDRw1Me3ivMm6jlx3T5qZ6E4EIhj y1yPHgLwcgMWExjz3rUAHUXE20NVpipk6mrKdiQnVAbamcYnTwXr30vti372 w_tlPlNlEsEzGhuiSRXHA2de7xApjoyrRouwpkkBGdGxN5jcOh2Bcm1L50Po gTPn6njfBxnHuzLfXxkLChhv4zRej8FyTIxwOTmUmUDQPZMun8Zk4njcVeY7 aPEnUTyk19.Viob5P.M4.wC1JRvqPI9a47Gux6m3Be28C1xTjk0PR9sP5eNX b1jZstUa5LUyKtkRPkOaQ.RMyDYhbZpHye7RnyI65T5UZ9yvh2GGAj6wb02I IeuaekkQcOipGGmykNcXcyC45tRaMp6FHUj6uCcTwMhixIEhC8w9iH1qBM96 GsD5rVlXiLvwI6F8D6durYVBgsh9KuWAGlMhVwED_P8Jet.U9cbWyubFwehp xnyOJE3jp4cztVwV5UWA43qTPTTwQQb5BTXf8Yc3Wk68MG_sYLAvrDrHnYjq c3NV1ESe49OSQrV7goXKLwa.rHHX61y8EaI0gOP9kVrJnkKLfuXa7S5GOA8Y cztYklpTNxq9fZmA0XtMQuzfQGnLKZeCoCJlNjmg4zrV2SBW0d8D14x1LAyT ccfz4E3ew4mPJXPK1IzZRAxwjtvL_.NeTiK2.vgL2oDJgl25.YkqB5cilOLt Oy_qy.6uwFEf00zP4TVLfV9vLSoQSDKNk0VY.zAn29lE6ERR_pPa1uYU64yU eXuqZEwB0.BLV2kAeWWw1FDtacrwAq9x5GoCBHtYaGCd65Q8KxmTVib6BNnt og6uqfVwLY7OIYdSXZ6OtPuCNXtBHLZ2WVK8uGguXuoeBDlnySbiUMey9CBI vZjMvlKF8Z.KLCM.AJQLOljzfUf1xXmjVbbRiA6cUiYS6c37wirwGDy8gM3Q gwdUdOlP0wRwXEKQbePmN9IM7Uqr9ThtUnd7oFWDQs2jkLA_XXco_EdWPUyx x8Nx6QFKBtp_LKzQCxKrT2bgAr4am.c3WrmkhXBNecGDFhuA3npM0P4jAj93 RZ9wM_FKrhb1jZ0g_utpMzjo1wfmvHOuZ4a9Ky9vBw6_gjhptbH5lxXChwj1 9Ik.apCbmh6FheKDuFyxL30K3ocRkfkX7_gTNyY_NhDPa1bEhTLmyZi7OYbl LHLanewYFIU8QnJ0ai8TKLU5SDS66ba0_K8EbfwFnaYPGCzs9hBaVuz7rfz_ ITxJyTORuOmUu_3iMg6rpO8Ld1ljXko7_baLHZYxsm41aISCNe9i5bZMEK9a 1bbnQKptpjurAYbNct4LXnNR.4U8HwI7cmxbKRkyzJObqKHmDEh63c7a28Tj 6rCqpJkf017cEFjeZ9JVerHgfnnaNeDypbqoyrpZXknyMYMfPv6sKdn2dQCT FogwMPiW1HT2lEveJVs0ZRkKsb.KmCGelImLgCnVUmsnvH7E.N_clj.Du2i8 58xoGAlimQLf6XyorSU22o2AzVaO2TyVRrxE5yOGZuZCkTJ8Jp0Znj_eXfrp oVmdqgptN9BZ92.p.6T0Keprim5vvTAuebyqrSHxmTFLVnt72cGaEADfQ1yX eUt89x1QjLONr6VnUEsH_pabnd_Iby2AfY9PKyG7mm4jBOUWkoe0u2KS.6Mc e.g58lXFrRrPH_zaJNMr3BMrEszqPAa9VE1tHGCKqtWkrQvxuqrQOhpECkXH c1.wybhocLijGr9LkOJYbM58_dL_awf.VtORuO5qT_Dvag93V2.ngMf145EN jfRnuTSMLWQ4VbAilC1r5WCxzGlyKM5GnUz8HsEkO6JOSRFNZF1v5dRLDwVv q9hH7QxSGTqNQHG5lNWyEM_.h8t3gWBrJuY6j8BLV038OdDDfUPTSpO.TPRW 95RVlFFHcHrxvIoT6jm7SaQ–
Received: from [173.13.200.181] by web185005.mail.gq1.yahoo.com via HTTP; Thu, 03 Jan 2013 02:27:25 PST
X-Mailer: YahooMailClassic/15.1.2 YahooMailWebService/0.8.129.483
Message-ID: <1357208845.7111.YahooMailClassic@web185005.mail.gq1.yahoo.com>
Date: Thu, 3 Jan 2013 02:27:25 -0800 (PST)
From: DHL COSTUMER CARE <goodwservices@superposta.com>
Reply-To: dhl2@superposta.com
Subject: Your Atm Package Tracking Number Is 1736996225

DHL COSTUMER CARE goodwservices@superposta.com REPLY-ADDRESS: dhl2@superposta.com RETURN-ADDRESS: webtzzzz.office@att.net

ORIGINATING-IP: 98.136.217.70 RECEIVED-IP: 173.13.200.181

 
Leave a comment

Posted by on 01/05/2013 in Lottery Scam

 

Tags: , , , , , , , , , , , , , , , , , ,

“Mr. Gordon Chen”

INHERITANCE SCAM – ADVANCE FEE FRAUD

EMAIL: I want you to come in as the Next of Kin/Beneficiary to this account (Attached file also came with this email titled Legal Inheritance)

 

HEADER:

Return-Path:   <offfice@live.com>
X-YahooFilteredBulk:   106.10.148.151
Received-SPF:   softfail (transitioning domain of live.com does not designate 106.10.148.151 as permitted sender)
X-YMailISG:   27h5RaIWLDtcfEfxeOWcB.UWqQCwRUZ.QTFz7C4wIIcpIIYs Yev6iT1dSSHaJZFeF68fgj0QO2UhtMK9T9eNQWLRRPyvrJqw3zNo95hpWKPX aV4fSQFs.MM9vVO4fGexiKzUhGl5oXCAY.34zMf_PZTEuVrsoWCGnAu5Pfwe sUdqJg9wdi1wIZZlhOwoakLt0OGjXrBmzFR831FWB_7ZhO7Drme1PUiXxoD1 5dyCr5KvD_j0QEiPP.My_V1Wie5ODTBCNcEQbHoAxhdC1b0GxPT9OCvY_Xrf koMFO5KQy4ExAfBQ5j7NErnakQEzmf1aK9kA52zsk9xHNlk15t2g9tNMRphY StaHTTcY1j6UlIadfAdBw89D8o7slUNvBn4vRX5aCw4HQ1H5E2uTUtLO1Nbx 7Erj9VpkYR4WNZictqzvHFm992d3oo6eNV.MJyU5d0LCV.wp3AWlMpEqmYyB 1vWsBbnOpN4qGlL8pRdZaSnPZRPGe.hzNX__bzyp9Q3I7NJ2ALeBBxNE62Ox tXHrqQDM4ViFHaEBtaI19GKxwUj5y4FHGHgqx0TsUx1Hll2lCYZ27HYvIcX0 9BIjqQU38YPEAp3ozTQfHFAZh9pKmVxc9fGOUFJq1za8C_6VqJTdFK1uxeco qVlgmmjTwljDH_1b7EPsM_24eDpybuGd0Z6z3r.hRV3nCofV9myLZ5R1U4CN 61EbYwJp_RUD41EPHKWxSfV8mEZvhNKxQr.oEv.Ssz8fOeDIca23WvIAeqqW 2zRkCmVBvY39_0.XTyEgLhq.0E93w33QR4rroJoWxGXSjp5LJ9TAeBoyyvWU 7WcLnkeoyIsW8h7lUXVcJp_YXTAG8eYyNRsZxoZXM1eC2zOp1wBE3gXRpoLQ gQqcyl_fOZj45RoPwLdSsDVdXsRzcoFp6V3r.U4gYh2qPhYhqOlsjVx9oLdr vQwkiE7K61ggat79bsM9vNJNpBTmoGNrflksDnkwokRjmXTlaKBfDtKubnA7 YuBWx2ZHXbbyXIPq_g3kLw2OPTOw4cb2E3nPTVZ09ozz_HfqLXPbClUtihB1 fD1KHRXPFhT1QuBsWlY0CQUkSQGJmzSegKmrP382d8NM5M1lpfy6YtoUZBku VzyYKWNhQZ70tmx8f9UmHjEZgiMlc2xk9yfzx5IrQ_z1jqFJ.Kk_hgKevv4s 0zuDFrNThmG6R6yTTCoNJ2fpYof1vJwasKYb9CGis4egtJXhTwqnCAj0I37G kfGyt8hAjgWSlOasSg6aHRjXzsdhGLhG4Bw-
X-Originating-IP:   [106.10.148.151]
Authentication-Results:   mta1132.mail.bf1.yahoo.com from=live.com; domainkeys=neutral (no sig); from=live.com; dkim=neutral (no sig)
Received:   from 127.0.0.1 (EHLO nm5-vm8.bullet.mail.sg3.yahoo.com) (106.10.148.151) by mta1132.mail.bf1.yahoo.com with SMTP; Thu, 22 Nov 2012 08:17:21 -0800
Received:   from [106.10.166.112] by nm5.bullet.mail.sg3.yahoo.com with NNFMP; 22 Nov 2012 16:17:16 -0000
Received:   from [106.10.167.207] by tm1.bullet.mail.sg3.yahoo.com with NNFMP; 22 Nov 2012 16:17:16 -0000
Received:   from [127.0.0.1] by smtp180.mail.sg3.yahoo.com with NNFMP; 22 Nov 2012 16:17:16 -0000
X-Yahoo-Newman-Id:   360831.74249.bm@smtp180.mail.sg3.yahoo.com
Message-ID:   <360831.74249.bm@smtp180.mail.sg3.yahoo.com>
X-Yahoo-Newman-Property:   ymail-3
X-YMail-OSG:   o2T42rMVM1mEeIi6Ts2rnNQznaWoZEnnkcvHMQIhGgb1eRL ToyMC5B6aOkVi.BFLhgll_D7k.wwZnaFAqkXgSEjhyqOAI_B0AQqvqZyPYbN hzrV1o.Any0HeHdQUKcth6J9TEqHokT012QmC3YWqdnIynVaTUVYslqVG8rV bovPlTWEA_VH7wygGuxKTY4ygC9k2SV3GlquGSqJvq.QjBG_EG_Q1v4l4SGF BWvE5NK_PJPNQy_J1YPtJnS.iVKlpBHFi9jA7bDjNu2Go96uCQCGe4lMiLXw djgMRUQiEn7j2z4ni9BVyTzeNCPQN0EsPduIAsGqLPI49JUJ30pA.K5ucoNV zRBp30IJCCQazLcSbSGPpHvUW0lUmz4YqDmPQ77SaoOWrK8B41PSplqDHD9j 2MppiogeuP_lg9TEZmrXwzh6.tuwjf89_JyuZBTjgCqERwTbUQmcvt7H0wZs U0d_srT8lhcYh.NMtPire1dDKrp76U3wHQUtfwkmM.XKLcO_JNRBQwNbD7A- –
X-Yahoo-SMTP:   vS68oJaswBB0pb532Km3RRaYrwG2nnlHW00rxq2r
Received:   from User (offfice@121.14.155.106 with login) by smtp180.mail.sg3.yahoo.com with SMTP; 22 Nov 2012 08:17:16 -0800 PST
Reply-To:   <gordon-chen00@live.com>
From:  
“Mr. Gordon Chen”<offfice@live.com>
Subject:   My purpose of contacting you
Date:   Fri, 23 Nov 2012 16:18:36 -0000
MIME-Version:   1.0
Content-Type:   multipart/mixed; boundary=”—-=_NextPart_000_012A_01C2A9A6.768566C0″
X-Priority:   3
X-MSMail-Priority:   Normal
X-Mailer:   Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE:   Produced By Microsoft MimeOLE V6.00.2600.0000
Content-Length:   4706

Mr Gordon Chen <> offfice@live.com <> gordon-chen00@live.com

Project Honey Pot has detected behavior from the IP address consistent with that of a mail server, dictionary attacker and comment spammer. Below we’ve reported some other data associated with this IP. This interrelated data helps map spammers’ networks and aids in law enforcement efforts. If you know something about this IP, please leave a comment

Spam URLs & Keywords Posted From 121.14.155.106
Domainanoxic.funhost.org.ua
URLhttp://anoxic.funhost.org.ua/test.html
Keywordsready
Domainwww.ortho.ohio-state.edu
URLhttp://www.ortho.ohio-state.edu/search.cfm?q=http%3A%2F%2Fwww.pujckaponetu.cz%2F%3Fp%3D90%2F+p%C5%AF …
Keywordsbowdle
Domainweb.commicro.com
URLhttp://web.commicro.com/post/teto-casti-muzete-popsat-historii-vaseho-projektu-co-vas-2
Keywordschimneys
Domainweb.commicro.com
URLhttp://web.commicro.com/post/kvalitni-znacka-oboje-je-zcela-nove-nenosene-vcetne
Keywordscydfs
Domaintwitter.com
URLhttp://twitter.com/statuses/user_timeline/culcelriXXU_.rss
Keywordsswords
Domainweb.commicro.com
URLhttp://web.commicro.com/post/pujcky-kterych-strong-neni-potreba-dokazovat
Keywordsbookmarked
Domainweb.commicro.com
URLhttp://web.commicro.com/post/air-tech-air-conditioning-heating-2
Keywordsr?publique
Domainweb.commicro.com
URLhttp://web.commicro.com/post/zaroven-budete-zapsani-do-insolvencniho-rejstriku-coz-vede-zastaveni
Keywordsolrf
Domainwww.miclab.org
URLhttps://www.miclab.org/node/703381
Keywordsbcp soma
Domainwww.miclab.org
URLhttps://www.miclab.org/node/703372
Keywordsbcp soma
Domainwww.miclab.org
URLhttps://www.miclab.org/node/703392
Keywordsbcp soma
Domainwww.miclab.org
URLhttps://www.miclab.org/node/703367
Keywordsbcp soma
Domainwww.miclab.org
URLhttps://www.miclab.org/node/703378
Keywordsbcp soma
Domainwww.miclab.org
URLhttps://www.miclab.org/node/703382
Keywordsbcp soma
Domainwww.miclab.org
URLhttps://www.miclab.org/node/703374
Keywordsbcp soma

Other email addresses used by this ip address include, but are not limited too:

mbaecsszw@softbank.ne.jp <>  baku-nyuI17@softbank.ne.j <> y“c Œ‹”üŒb — hu61gdo4i6@hotmail.com <>    oqqqymiksvrr@softbank.ne.j <> ulsiizraq@i.softbank.jp <> disbp@docomo.ne.jp <>

For additional email addresses and information, please click: Project Honey Pot

 

 
Leave a comment

Posted by on 11/23/2012 in Inheritance Scam

 

Tags: , , , , , , , , , , , , , , , ,

“Mr PAUL JOHNSON”

LOTTERY SCAM – NIGERIAN 419 SCAMMER – ADVANCE FEE FRAUD

UPDATE: SAME SCAMMER – DR.CHINEYE NWACHUKWU <office_dooog@yahoo.cn> [203.188.201.73] “Office Customerscare” <officecustomerscare@yahoo.com> [98.139.212.160] RECEIVED: From from [41.216.44.199] by web161602.mail.bf1.yahoo.com via HTTP; Sun, 02 Dec 2012 22:54:16 PST

Hello my dear you can go ahead and the send the one that you have at hand ok waiting for your urgent reply with the payment information, good luck?

More IPs and information at the bottom of this post.

EMAIL: FROM DESK OF MONEYGRAM OFFICE TRANSFER  BENIN REPUBLIC

CONTACT: Mr PAUL JOHNSON.
ADDRESS; AVENUE STERMETZ  RUE 8812
E-MAI :  (officepost466@yahoo.fr)
TEL: +229 98677751

ATTENETION: BENEFICIARY,
Honestly iam just dissapointed at your behaviour because you know that i am a man of God and cannot deceive you. just pay the $139 and leave me and my God because God is watching me if i am telling you lies.

I know it is because of your past exprience that make you not to believe me but i told you before my God who is my withness that i cannot deceive you because my bible says what shall it profit a man to gain material things and loose your soul. i told you ealier just drop your old exprience and follow my intruction a man of God and you will know what it means to follow somebody that fear God.

I swear to God almight  Father. if i fail to TRANFER you fund through MoneyGram Office within 48hours after you send the $139 as i promise let God Take my life, i cannot fail you,i promise you. dont fear as soon as you sent the $139 today  please leave the rest to me and see if i am lie to you or not because i can not use my life swear because of $139

How can i swear against my life because of thistransfer of your $6000.00 per Day,but is to show you that i am telling you the truth. so please try to understand me this $139 is big amount but is too small for the amount you have to receive within 48hours okey.
Here is the informations to use send the money so that we will complete the matter once and for all.$139 only no more payment i swear to God and your your first payment will leave here immediately i receive the payment here okey. I here by giving you 100% Assurance that your  fund  is valid and you can start receing  it once you send the fee,
Here is the informations to make the payment through  moneyGram  transfer below:
RECEIVE NAME::::::::::::::::::::Anthony O IKWUNNE
COUNTRY:::::::::::::::::::::::::::::::BENIN REPUBLIC
CITY::::::::::::::::::::::::::::::::::::::COTONOU
TEXT QUESTION:::::::::::::::::::::: Almight
ANSWER::::::::::::::::::::::::::::::::::God
Amount::::::::::::::::::::::::::::::::::::::::::$139
MTCN::::::::::::::::::::::::::::::::::::::::
I am looking forward to hear from you right now and know what is holding not to make the payment as you said because i hate any thing promise and fail .
I am waiting to hear from you now.
Mr PAUL JOHNSON 
MoneyGram
COTONOU BENIN REPUBLIC: NO: 192 AKIL ROAD
TELEPHONE NUMBER +229-98677751

HEADER:

Return-Path: <westernu749@gmail.com>
X-YahooFilteredBulk: 212.82.109.207
Received-SPF: neutral (212.82.109.207 is neither permitted nor denied by domain of gmail.com)
X-YMailISG: mAPd.zUWLDsRpeHBoGVp39xaBbCEO531WL0nnksrVHuTorC1 mHvNt1jnBO5VbOOflZxW11t5JXU8oRgD5y.Ek6z.AyRS7mQfuGPo8IjmIGR0 ohIn3_sLE_Pq68kScnHc1KZYU5UXn6B.yM2Ihxog426HDgyiTcbGG_9sjA71 f6K8ZejXSg95rtRTMvv7ZGJqYfZkjTCzWH3BhZTC3_5kWyzCnH4firB8ygWx T7Qu6_RCwUhme44PRRWA4wSJuKWOjdt02D9zfR72OjHLWZ8q34ahd6ZaytwZ SLC7UeD1TZrKFzF.ac4CUDKxdukkPu9K9bOurdcioZl8oO2KycOKnadXRAQV Y69vmBLy8vNW71oebupTdxOHYGAmYobPE0LD.3miWSIlUUjLHCYwSD8P9IQL q5.evioqyABcll0P7iJEPW3dtf5cmIG25r4U5bZc0yGW8Bxvdu6XeGBOQW7d MPnHs_2banHcLu87VJm04tIojLHMtZtAuj9oDw6ltYZd_nVP80zshGtZ9xnK .VkhkDqqlCM.WYznVnmnC5ry6p_vQsj54RNqWGVkTWiuRRjpu4RqWBuA01p. AI6aNLm4oLSoJwH3or0crtKG.bb_Qvazm5KGToT2mSkwinx6LKXWY9UnxjrS I9Fi8jIgtuOyszcjZK4F99AGOWyzksDrnBcgTUEHqbZWPBW0PQkPOZxP2vIg fVlTC0DJK0jQ3E21EhA8SSVSV5SOmVSyY42piupYs0Cd346txlWlnYSTdD1t 1ax0KHJ_LxZKndjq_deTZ4OU5KcLguYbxNwNr.NBOA.j.yYAG7pyxTis02IO 1pn0sBicFuH2pqKFG9Jdg9Qr.qigDD20if3tT1XkzzuD8_kqqBrwWFrB9oXJ L7JIpg5L5WmZr6D5K_eCWC6ws4DttkwQFMITgNRj.s_teM3IVa271lSGdhUS rYOEgg5VQy38E3wFWWAVP8ExN9GjoVA.STjq2B0oed37fRo5lRUDhKAm9NCh MmpuP0OdSKyjcSBuMWVDsCvqkmULNm277yauVgHaqPGeoWfTahUuBphuEkCf p7RuBRtDnFaiSozZSCpSyYU0o84HDT5UsdupJ7CQ3uI0AMVywoc9Qof2NVYZ ikdQvaJVP4otpZlEhnlKYrI4MFnQhmd3Y6DsNf17EnQVmOUA_7jNx6xiLkK5 RJx0ZWZTgMQb.XqhdG.NvAmbEreDqEib58rZXi7sqP4vfp65O2cX973dN6EC Me3UQOvhpqcVuTuJiYrphZ45i2vkh9YY3.pectoIkQ–
X-Originating-IP: [212.82.109.207]
Authentication-Results: mta1179.mail.bf1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm25-vm6.bullet.mail.ird.yahoo.com) (212.82.109.207) by mta1179.mail.bf1.yahoo.com with SMTP; Mon, 19 Nov 2012 10:08:27 -0800
Received: from [77.238.189.57] by nm25.bullet.mail.ird.yahoo.com with NNFMP; 19 Nov 2012 18:08:23 -0000
Received: from [212.82.108.243] by tm10.bullet.mail.ird.yahoo.com with NNFMP; 19 Nov 2012 18:08:23 -0000
Received: from [127.0.0.1] by omp1008.mail.ird.yahoo.com with NNFMP; 19 Nov 2012 18:08:23 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 353950.72023.bm@omp1008.mail.ird.yahoo.com
Received: (qmail 89519 invoked by uid 60001); 19 Nov 2012 18:08:22 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1353348502; bh=VtTxWO99qmgFXC+U9mZGcc8fJuIFk1rs7b48t39FXvs=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=Q3wJNOT7jZyDuKNEONPsW5buywODWICBLkHQu3kBitYXpk4LKXjWK0KLfw0EUkfWMVhOwWdy+5nlGbdhqLLlltc+K/TdeIXjLcsc7fGaqDx1IjBcjqJ3zemO/dFRnU7YCAnVCE3QfPjB6NnKGRRjZQavB5Ww6ngF0E21ln+VDOI=
X-YMail-OSG: gKJenGAVM1m5yvXDjYGZq6FKSO3LQ6WOe9EyxxlKdIobrTi x7eRybZPH
Received: from [41.216.44.199] by web171303.mail.ir2.yahoo.com via HTTP; Mon, 19 Nov 2012 18:08:22 GMT
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.123.460
Message-ID: <1353348502.84732.YahooMailClassic@web171303.mail.ir2.yahoo.com>
Date: Mon, 19 Nov 2012 18:08:22 +0000 (GMT)
From:
Mr PAUL JOHNSON <westernu749@gmail.com>
Reply-To: officepost466@yahoo.fr
Subject: CONTACT: Mr PAUL JOHNSON.
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=”-1953309981-1231263434-1353348502=:84732″
Content-Length: 7829

Mr PAUL JOHNSON <> westernu749@gmail.com <> Reply-to: officepost466@yahoo.fr <>

41.216.44.199 – Nigerian Scammer’s IP address has a ‘BAD’ reputation according to Reputation Authority – The IP location is in Cotonou – Atlantique – Benin – Nigerian — between Lagos & Lome — IP points nexts to Benin Marina Hotel

The number of this IP address is 41.216.44.199. This IP address is related to Benin, and registered in Cotonou, Littoral. IP Country code is BJ. IP address is assigned to “Benin Telecom SA”. In organization “Benin Telecom SA”. IP address longitude is 2.4333 and latitude is 6.35.

Some other names and email addresses used in scams under the IP 41.216.44.199 – emb.asty@yahoo.co.uk <> 77.238.189.59 – Nigerian Immigration Service <> Mr Joshua Alexander emb.asty@yahoo.co.uk <> nigeriaimmigration_services@yahoo.com <> 98.139.91.100 <> western_ubb@yahoo.fr <> 41.216.44.199 – web164610.mail.gq1.yahoo.com <> 41.216.44.199 – web29904.mail.ird.yahoo.com <> 41.216.44.199 – web164610.mail.gq1.yahoo.com <> 98.139.91.100 <> western_ubb@yahoo.fr <> 106.10.151.198 – vms172055.mailsrvcs.net <>  41.216.44.199 –  web190602.mail.sg3.yahoo.com <> 106.10.151.198 – post1369@yahoo.com.hk <>nm7.bullet.mail.ird.yahoo.com <> 77.238.189.21 – vms169127.mailsrvcs.net <> 77.238.189.21 <> peterusman8@yahoo.fr <> Rev Tony Johnson <> [115.178.12.209 <> plcuu3@yahoo.fr <> 41.216.44.199 – web190606.mail.sg3.yahoo.com <> 41.216.44.199 – web190805.mail.sg3.yahoo.com <> DR JIM LOWRENCE
RE: IRREVOCABLE RELEASE OF YOUR PAYMENT – 115.178.12.209 – wstrnnnoffice79@gmail.com <> 41.216.44.199 –  web171512.mail.ir2.yahoo.com — REV FRANK EZE — Subject: Re : WEB SITE.WWW.WESTERNUNION.COM – 77.238.189.35 — Reply-to: w.iont_ernunion2011@yahoo.com.hk <> 41.216.44.199 – web29104.mail.ird.yahoo.com — 77.238.189.196 — post1369@yahoo.com.hk <> Mr Allen Bells – 41.216.44.199 – web27506.mail.ukl.yahoo.com — 
217.146.182.249 — atmmasterdepartmentoffice@yahoo.com <> 41.216.44.199 – web95215.mail.in2.yahoo.com – WESTERN UNION OFFICE – 121.101.151.239 – www.western40@yahoo.fr <> 41.216.44.199 – web29305.mail.ird.yahoo.com – MR MIKE OBI  – Money Gram International Bank Transfer – 77.238.189.196 – moneygramofficebenin45@yahoo.fr <>  41.216.44.199 – web65804.mail.ac4.yahoo.com – DIPLOMATIC MR ERICI BROWN – 98.139.52.215 – diplomatericb@ymail.com <>

web171303.mail.ir2.yahoo.com –  – 188.125.83.118

[203.188.201.73] mta1299.mail.sk1.yahoo.com RECEIVED: from [41.216.44.199] by web92416.mail.cnh.yahoo.com

 
 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , ,

 
%d bloggers like this: