RSS

Tag Archives: Nigerian Scam 2012

“Rev, Mark Hill” “DR. PETER CHEQUE”

CHARITY SCAM – COUNTERFEIT CHECK – FRAUD

THIS IS A NIGERIAN 419 SCAMMER

UPDATED I’VE POSTED SEVERAL EMAILS THAT I’VE RECEIVED BY PETER CHEQUE (ALSO KNOWN AS) MARK HILL

check-fraud

EMAIL: Hello: My Dear:

I wish to inform you that I concluded this transaction successful last year
with a lady in London and I am currently in St Thomas Hospital in London
waiting for the right time of God.

I dropped the (cheque in bank draft) for Your compensation, by trying to
assist me but it did not work out between
Us. The amount is US $ 5,500,000.00.
now contact my secretary Dr,Peter Cheque he will help you process.

I did this out of sympathy and good desire, I want you to make very good use
of this fund to assist the less privilege as I have few months to stay alive,
I have a kidney cancer and I know that am going to die soon.

God will bless you for your efforts and I hope you will be Satisfied with this little compensation, I will advise you to contact him

Immediately through his e-mail address 😦 secretarydrpetercheque@live.com ) for the Delivery of the bank draft to you, I hope you will have a nice life with My token of compensation for your efforts and God bless you.

Sincerely yours

Rev, Mark Hill

HEADER:

Return-Path: <revmark.hill@yahoo.com>
X-YahooFilteredBulk: 93.180.20.164
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: pwvmn3QWLDtkn6kYY_YMNtA2mo2KVOO1jpnUxR_xqcd3L6Za tTjpQHR2NMrvDpI9Ie8mJSa8nJCF_JaK1curhsIxxrCXDh963xR72_M5ZEXq 2USwVCxvOlVYGFDtvt4yCgh380X8rrXpmCzfp_YdjH.urQ7xEvzHoHWBEecK JKgFiXHwnNha7dOH3JIsYOstf5QTjAcP1MS.c0zev280tHGT_qQfiEeytuAl JQKyqrcQ5UMJipgnONdkhb0vCOBaVjon0rdOcJ7Eq2UTnR.gQz61YopdQgcD EBpxtDG.Hh6QyT40tRmgNytNt5Y3icvs2ahBMJd3eerdtTFpH9A3_845D28R f5OBFW_INRSPXlBsdjP1QR4EJ3cuqMsXRxsAGXiLr7As.YBVUG9leL6Vb0SL jK2tz_8sN4.8dysipI.PpCLxtzG2sasSzzPwT9yGe7ybfprmyCJh213lHNq0 P3VGFFv6pHN0_gd8o4uYcoVWhrsHa2Dpd7407MCOFdo4TkpZPFi.XiIJudH. PNhZcMfIY6p2miXudToKgKASedTZZfNUHD8TnDg6F0Oz7J9dkgje1DuH_LcU tzAF1g_gMYGBRXndY5gRracjt83LlDmsCj4Nq..cly_fI3HhCTbEPCsfDCWS VmODBLTxT595IxuVppGWhEHkSnPpOmq_qJz.AaDiNHKOCuB77SKbfb4pn4u4 1C7EOU9cmiaDTdwlrLY9qaZty6vHSgEOgmrRfc8JGzHCi9rSjeRKJyPVRKeA 1uP1T0j2GM1eOJYyX8n0gIvVj6oQ8wMzRWF7LR4fLjm49D7.JLch46acVP4y geKejT5nm05MkyoD2iLYS0iXTeWXPFkLTxmDuul8YhjuX2bvr9Q19MV21hZF edU0xZg1KTTvMGFBvKgz5juU.ikCl1tIuXkcY2MXmK6thLxA4D3R2liFEuV3 OAd.v4BkOu6Og_5wGOfDSK2vcxXE2hGhL5G88M.OFzn0FkuVky0_Kti_GGwU FyRKA0ZudYx6MPIP5by7EfyRu.KmOe_EClbMoNtqt7dIokp87gwQxwUjzJIg h4fQG_kDSEhZlEs1GtdwHmxo1J.qZlZeZqKoi1GQfSvYRlk0IOFYd7SiPtP. G56xaMfm2O50wWasX7vFDzR2NwqlZZjlq_81XnD2JRl0Y3GykV6HaBm.9olz lPQBTIA6yCi.n7yFLkQnejEjq.4seWdDdsm4A4M8fL.arU5m9IG9hfgRwR2M jVvhkuHykVtOyeeW7qL.G3NHK43MhpquRtuQD07HqWptUaTsU6qIv..D02yS hOjvpgYqd9NtER1ki4ibyeUinmLbv03czD7Ovk2gJhC8ue.rrV6UMznuTPBs dfqeR5_xLD378tEXNTto4Uj5vj9ZkmZ4QcpT1ULIJmVEu_1FDHlTVpsfy2RW V8FbAzp9NKN4tjbpRsLjI_9PgxD3dXSXyYFS8.jvokd9ySTPJZnE9EW2repn q_kZSqDOwKz7Mi47jxaJeA4XEPm.n7TvP4zskyT9TKxDgnbx5XamL4jekcbn 00WRYhYNCqbzs7VUjBy_tF_akjdlXSuLlK7L9U4awS3WnM2LW4KLQybRgH6a zNcZJVPFzg–
X-Originating-IP: [93.180.20.164]
Authentication-Results: mta1492.mail.mud.yahoo.com from=yahoo.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO mainframe.localhost) (93.180.20.164) by mta1492.mail.mud.yahoo.com with SMTP; Mon, 17 Dec 2012 19:07:42 -0800
Received: from User (unknown [41.211.201.178]) by mainframe.localhost (Postfix) with ESMTPA id 3A91433EEDB9; Sun, 16 Dec 2012 20:21:06 +0400 (MSK)
Reply-To: <secretarydrpetercheque@live.com>
From: “Rev, Mark Hill”<revmark.hill@yahoo.com>
Date: Sun, 16 Dec 2012 18:30:11 +0100

Rev Mark Hill <revmark.hill@yahoo.com> RETURN-PATH: revmark.hill@yahoo.com REPLY-ADDRESS: secretarydrpetercheque@live.com

X-YahooFilteredBulk: 93.180.20.164 RECEIVED-IP: 41.211.201.178 LOCATION OF IP: LAGOS NIGERIA Dr Peter Cheque secretarydrpetercheque@live.com

________________________________________________-

RESPONSE EMAIL:

EMAIL: Mr __________,

i have receive your message, yes i am Dr.Peter .O. Cheque the secretary to Rev,Mark Hill and am so happy to hear from you because your cheek has been long with me and am waiting to receive your mail since my boss kept this cheek with me.now i want to know how do you want to receive your cheek is bank to bank or do you want it through courier service.

i want you to make everything fast because we are about to enter Christmas before the date we will celebrate Christmas.

do not fail to call me immediately you receive this mail.

Dr. Peter
+2348035762383

NOTE: AN ATTACHED FILE WAS ALSO SENT WITH THIS RESPONSE EMAIL. I DIDN’T CLICK THE FILE BUT THE TITLE WAS ID_CARD1.JPG

HEADER:

Return-Path: <secretarydrpetercheque@live.com>
Received-SPF: pass (domain of live.com designates 65.54.190.101 as permitted sender) IG1lc3NhZ2UsIHllcyBpIGFtIERyLlBldGVyIC5PLiBDaGVxdWUgdGhlIHNl Y3JldGFyeSB0byBSZXYsTWFyayBIaWxsIGFuZCBhbSBzbyBoYXBweSB0byBo ZWFyIGZyb20geW91IGJlY2F1c2UgeW91ciBjaGVlayBoYXMgYmVlbiBsb25n IHdpdGggbWUgYW5kIGFtIHdhaXRpbmcgdG8gcmVjZWl2ZSB5b3VyIG1haWwg c2luY2UgbXkgYm9zcyBrZXB0IHRoaXMgY2hlZWsgd2l0aCBtZQEwAQEBAQNt dWx0aXBhcnQvYWx0ZXJuYXRpdmUDAzMCA3RleHQvcGxhaW4DAzACA3RleHQv aHRtbAMDMgJJRF9DQVJEMS5KUEcDaW1hZ2UvanBlZwMDMTM1
X-YMailISG: RUSkN6gWLDtVRR2I.osOnZooN6mof1tzTkJBSELxSzvipL2U wlBMz4XHvtip6BJimPiY3ANJpiunpS_P4t7.2UBBu67Afnlkq.PVu8k2.mbW maprp2gMR8v.iOe5sx8uj746OaF4yWi7XIT6j6MY.9iHB85lozYudtyn3MTR d4hfTWMNA1or45531SO7UrO7YC7AXu8BSAxlQfuZikUF_sjf0m4wAqJyzHeX iUWCLP.7RNA5YrCp8GGULn_5m4vXN.Qe1NR25UPRXtrMHhqsldFv5SHdpYI9 3bMw53Ry6Koa__vfO6GmqPpQkU2qiPNSJoX6.mBXDZHj_PjQohyZZ.NGeFny _2FMUJq1Eebewrq6yjHUVCAGitlH70HPTWsH5axyEaStXjlMJufOcOF2VBoY A6qEu3WI5ud2bp2jAWm3JFLniLjQWl1_scqj_lZGK.ojL.372ajYAq2ibxZK 9fD_iulppvkxLfziYl84ZCHYcHhnzD7aLh2C5veXJhAU1r.zEzkgI3qLTYD8 Dnsk9u547G4XMLgcpzOd6IuZXV9Yk4SiC9mlzHR2E4aq.PnQ3y24eVy9WMNk 9cHnUC4GIuq7hBqcK1agWzWj4WvEz4rHQ2k_FGCgdtq9nJTKkopxr1fly.Tq ktyAucn3XVU3R_8HHbaya_3BZdTQ7CloOAImnHAEKgcNKvVyXmr0lWZJmcek GXeQIfUzGSJ_LCQXoE2SyhY8MuiXW.y_bG1zZzp1Gfnh8GRDPWTjc4WQ_1bi uIBSdhjH5e9hXfFNPdASN8YeLYj7SCqzM14hLe.u277C6p..x3Fc5HDO8RPi OOxKex2UCvKl8x2QmMvcRIOBJOoLn3.ddvbQ7FjEcTY3MJWhsKZ4WZ1wIiMZ 1gIo0DzXU4Jmqv_JwKvhfh_E5AVfGFYbg50XotCg_lFJwyCq.wpolxuuVH3u nlc1AbVE99vR7UuBBbpIRsGBivT2K2Fiid.fwUZ8lyf9RF.asdeS62y7ntUn BFThAsAWLAKpDNy6YMw4RBou_kPTk1aBdldafhI2W12s9iHKsbnxW87LPKaj lGMjlHvA9_UT1nqVSLdzL8EmTXX2RoaBBmAU.PI1vLpDrbQP4C0iWaBe_xF. XP1MnJ382xCgWS37RdTUZifGQ3ZAKssK8Ip6FKH8SRqtU7HlUvhO1E02y0Tb CYixL7UcirFuTOabQf.GX5xZCtHbWr_swjJ2FeTVGkYKyOs.N_fr_rR4P0BV RqGPee3YabHAYEsmk6Q6BWCqbfnzno_hFre0itCMOdkyzCGqvlnPiNUbNpbP kh0h1EcKAvhS1k5xCmO1yh3O88Y3oXW0Jw8-
X-Originating-IP: [65.54.190.101]
Authentication-Results: mta1151.mail.mud.yahoo.com from=live.com; domainkeys=neutral (no sig); from=live.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO bay0-omc2-s26.bay0.hotmail.com) (65.54.190.101) by mta1151.mail.mud.yahoo.com with SMTP; Tue, 18 Dec 2012 13:14:57 -0800
Received: from BAY155-W28 ([65.54.190.123]) by bay0-omc2-s26.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Tue, 18 Dec 2012 13:14:29 -0800
X-EIP: [NvgX5uvdCFPPz2bU+U8E9Qs+5Fla2BpP]
X-Originating-Email: [secretarydrpetercheque@live.com]
Message-ID: <BAY155-W28E7CCA29165639E797CC5B0310@phx.gbl>
Return-Path: secretarydrpetercheque@live.com
Content-Type: multipart/mixed; boundary=”_6622ba1a-8445-4dd5-8cb6-c35ba5e65254_”
Reply-To: <secretarydrpeterchequ@hotmail.com>
From: “DR. PETER CHEQUE” <secretarydrpetercheque@live.com>
To: deleted@yahoo.com
Subject: RE: Hello Mr (fake name)
Date: Tue, 18 Dec 2012 22:14:28 +0100
In-Reply-To: <1355814088.88125.YahooMailClassic@web161002.mail.bf1.yahoo.com>
References: <1355814088.88125.YahooMailClassic@web161002.mail.bf1.yahoo.com>
X-OriginalArrivalTime: 18 Dec 2012 21:14:29.0111 (UTC) FILETIME=[AA87D870:01CDDD64]

FROM: DR. PETER CHEQUE secretarydrpetercheque@live.com REPLY-ADDRESS: secretarydrpeterchequ@hotmail.com RETURN-PATH: secretarydrpetercheque@live.com X-ORIGINATING-EMAIL: secretarydrpetercheque@live.com

X-ORIGINATING-IP/X-YAHOO-FILTER-BULK: 65.54.190.101 RECEIVED-IP: 65.54.190.123 — +234-8035762383

__________________________________________

DO NOT TRUST ANYONE WITH CHECKS IF THEY CANNOT EVEN SPELL IT CORRECTLY!

MOST RECENT EMAIL RECEIVED ON DECEMBER 24, 2012 —

FROM: DR PETER CHEQUE secretarydrpetercheque@live.com REPLY-ADDRESS: secretarydrpeterchequ@hotmail.com (NOTE: BOTH EMAIL’S LOOK THE SAME BUT THE LAST LETTER OF ‘CHEQUE’ ISN’T ON THE RETURN-ADDRESS AND DIFFERENT EMAIL SERVERS (LIVE AND HOTMAIL). SCAMMERS TRY TO BE SNEAKY, HOPING THE DIFFERENCE WONT BE NOTICED.)

EMAIL: Mr (fake name used) ,

i have receive your message, yes i am Dr.Peter .O. Cheque the secretary to Rev,Mark Hill, i sent you an E-mail and since then i did not hear from you and am so happy to hear from you because your cheek has been long with me and am waiting to receive your mail since my boss kept this cheek with me.now i want to know how do you wish to receive your cheek is bank to bank or do you want it through courier delivering service.

i waiting to hear from you as soon as possible.

do not fail to call me immediately you receive this mail. here is my official ID Card.

Dr. Peter
+2348035762383

A LINKED FILE TITLED ID_CARD1.JPG WAS ALSO ATTACHED TO THIS SPAM EMAIL

HEADER:

Return-Path: <secretarydrpetercheque@live.com>
Received-SPF: pass (domain of live.com designates 65.54.190.101 as permitted sender) IG1lc3NhZ2UsIHllcyBpIGFtIERyLlBldGVyIC5PLiBDaGVxdWUgdGhlIHNl Y3JldGFyeSB0byBSZXYsTWFyayBIaWxsLCBpIHNlbnQgeW91IGFuIEUtbWFp bCBhbmQgc2luY2UgdGhlbiBpIGRpZCBub3QgaGVhciBmcm9tIHlvdSBhbmQg YW0gc28gaGFwcHkgdG8gaGVhciBmcm9tIHlvdSBiZWNhdXNlIHlvdXIgY2hl ZWsgaGFzIGJlZW4gbG9uZyB3aXRoIG1lIGFuZCBhbSB3YWl0aQEwAQEBAQNt dWx0aXBhcnQvYWx0ZXJuYXRpdmUDAzMCA3RleHQvcGxhaW4DAzACA3RleHQv aHRtbAMDMgJJRF9DQVJEMS5KUEcDaW1hZ2UvanBlZwMDMTM1
X-YMailISG: u7Xw5CgWLDskNbn_vf28.6TFtwB8ZjMwD3Tr9g7mPToJbbmb qMLKMUH9Q3aUWOMruqQtUyeZT3qb70PQLUefoD5lm1jWzAawy5lgU4LJYTy3 1118IDtbWA8MAiAa6IYDI_JTW9rJqZPYcOjqWvfyAnM2aDs4_a15FWyzMsql .LvKJ6IV_HYq9uddIgSvKDZAolhSD7PIj.4b4G2f5R5r3OlrDTcFke0iLDBN AT8AI5_gh_XDBOdW9VGLf7S6ROvcCuxRwL9vy9V0LSWuptXfX6NIrNwlKnNG kC5kU7zMB63.t0bd4ZlB9Bh1fISYZzwXaxwDKMYp8NigkCruFZC0e_wsjruX X4ubJmnvqY4NN2e7UleQdF3TS0ntxX9lobcH7NkzqPOGIE1di9X5MnG2yMc9 I_AqDqmuY_neshsenroHWAUiunfWWaj6.xrv0PRcsfRnSt6Yi0O_cGYFZAQ7 4chcyWUgHi8_I4G1jGAmbYbRph5bLpOTxKRKbXs6nWkl7ZLZvbNmRfY1N14c CM3uKpPGErwMJrP4z3JDavBlz8K1P5fGcJjwvxS9ZRsqgB8j8YBLHSH3wRFd yuM8P7aIKKlEJZ8Gqw3fwett8rquubrlDvd.xF5kCGS1cWNbDHmlwKnSKZkk E_w8lcHe3BEEutUwqyY4aAC1Uqi4kU56wQgHeBHf1zO1VNKPlKaIhm7ubDul HZYXxmntR93qMGrclxIueQWvk_FnJpnozLrgjMV9BdD7X8agF9nS5ZI4IeCz rfueY5q5auoteKHQx9RUyTJ6Qsi7NVIdCqsAQJc7677ftOAb1Z_NNKQgSua. DUoLqO_.tVqz3vWPEJJSbOlFIihLHpazSLUbfT5FXfA7a1RZf548tB.4t9zY ZfbZUqVhfkZQfMus2Aj8HUljvBcfnAaBH_1vyQMewExzsULYNZZ2zK.jJxem 1Nmw_.tGS_YrCAK5A1Jp3TxedgUYThYTTBFWXiuV.gUEfBLjmzIopdrsh82l rLJh5acYoaliKMHuRn6XF3XFSOFgI03R7NdKEXVElP_CyzRlpJkUP_BjJgux BNwsgOqAAo3ocEHzmMMwEMjNCPcI50uMwsOxhr9WS6StZIp2xBkhVFObLsx9 uwRviUfvGVx1NU3fIqB0lCtqj3j5HR7d9Gvzjj_11dM5pRoAoIZ2e25n2n8W xYdRRlV28Jbawfj4mXyolDt9I8QfH9aZuFQ6hHZzA6uF.SZfIzyAdZUc8aaL GCee_WkMwEZiO4JvdIgqndkS5poxhvxbQ0m7LJXrthUUjPWHSP0ERxKLDqHE NI1UU65OnE1DSwyK97w24w3uhAzf.IOl0Q0B7w–
X-Originating-IP: [65.54.190.101]
Authentication-Results: mta1263.mail.ac4.yahoo.com from=live.com; domainkeys=neutral (no sig); from=live.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO bay0-omc2-s26.bay0.hotmail.com) (65.54.190.101) by mta1263.mail.ac4.yahoo.com with SMTP; Mon, 24 Dec 2012 02:02:38 -0800
Received: from BAY155-W49 ([65.54.190.124]) by bay0-omc2-s26.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Mon, 24 Dec 2012 02:02:37 -0800
X-EIP: [BeN0YL2exaSamhdrCnicMrY51kryhvHh]
X-Originating-Email: [secretarydrpetercheque@live.com]
Message-ID: <BAY155-W4968A3A75E3CF4E33A318AB03B0@phx.gbl>
Return-Path: secretarydrpetercheque@live.com
Content-Type: multipart/mixed; boundary=”_053f2ce7-b584-4572-aae5-f7de5b457928_”
Reply-To: <secretarydrpeterchequ@hotmail.com>
From: “DR. PETER CHEQUE” <secretarydrpetercheque@live.com>

ORIGINATING IP: 65.54.190.101 RECEIVED-IP: 65.54.190.124

 
 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , ,

“jennywender@yahoo.com” Jenny Wender

LOTTERY SCAM – FAKE ATM CARD – FRAUD – 419 SCAMMER

EMAIL: I VE JUST COME FROM WESTERN UNION AND HERE IS A SCANNED PHOTO FROM THE TRANSFER MTCN

MTCN : 6255579485
THE AMOUNT IS 500 $
HOPE YOU ARE NOW SATISFIED AND MY BEST WISES AND GOOD GREETINGS.
GOOD LUCK

HEADER:

Return-Path: <jennywender@yahoo.com>
X-YahooFilteredBulk: 98.138.89.167
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: mlalYTsWLDtNvozz7TbM4xCyyr6UkuZsJriIkILxnVG85KaZ V5INEyEdyeSqqJUzVZWRKhD.FvYjohGsvSy8rAa3Ew.Q0EbmqVd1odmIfCRX BLUGzrykfmV7edqO3asZ5qGPOzSccax1BR8nY5X6TnZgZM7zb4sSnUVNdiLi sEpp6U3UsJDelS1v9vJRAFOjFMgpZIA3saObCwn2Yg9stNR_fvmYWECr9Gbb RkwiEWCSKlRiCPYpuipRFUIzIJw2JL1Pam85CRy1udhfPCXjQij4lPCp_pSJ nteIHm6JgLNKY8yCYtTHYV792NAcESSdcuTsQRLPNs4DXmOACbbJf_34pMFJ 6CgAB5mz80kmnQCAa6IVjK3k.3ep31PaU39FlGF5bkVq9sFqaqTI12Y.8Z5G lR70b7xZRfevmNfL8HjsN8W6YplyXx2MOOAGHK0YhUSQ2AMIjnn7AHVcMpOt zV9tCojw8Sc4ZT8d15mA2bsjYMv9lJFXFvm1dc4WPdffmI7VlNSX9pYHJKVl xoR6xdRqCg44CkB0Iz03strIxx8AtP4BWtVYCk6TmINc0tH9FC2_y2xmf3Cr k4G7Ozva8v0nwAXtYoic_A8ikV2SWLm8T8nDQpgiQzlLTl8ZNt4nb03AhAfU dugWw6ojOvrxwaSXI7gau1ypAEufuzAqxKuHo3htqlfupTmAbMGpglq1xlbp qjHNFkfOZJtkaLZKr2E7RURHdkA08IfFccwwGtBH_aM6LkmNy08Fhgp1Fp7e Fj1iQ4snz3zhyEfsd_a2xtkCdatfSbF6Q6KdPwwNQnSA4Vx5H7CC4Kh.m4A. utNMz_DpSKRF3lHeEaW8CKtS4OZN8PpwFPJcCyREYlvVpZiLyVECptDwf3Y9 KL9lOgwN8PcIYmGI7idlqv_4u0Tlzn6QB0KtWXSYJShXO_yEls2V2OU1.UT6 bhisvGKj2WCh4vbF6KYh_5_XgRm5RfCSlRkXF_.nTkO19aPN4iR55y8VAfRz vjKZDao3N8cKEn_mbKL8fGY-
X-Originating-IP: [98.138.89.167]
Authentication-Results: mta1363.mail.bf1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO omp1023.mail.ne1.yahoo.com) (98.138.89.167) by mta1363.mail.bf1.yahoo.com with SMTP; Wed, 28 Nov 2012 03:37:05 -0800
Received: (qmail 52858 invoked by uid 1000); 28 Nov 2012 11:37:01 -0000
Received: (qmail 83184 invoked by uid 60001); 28 Nov 2012 11:37:00 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1354102619; bh=tx45uRVk1edqQQxFPm/a8LhiKa6qR4QqZKTGg/3sEQU=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=EbWDUXcPY//p+LKWG8DVk7ITsd+V644mrsTaA35B/H+gt7PFQb1I54W3idPU1s8t04p8WSCp1WpqHU8zQBl5PeRwJRsfs1ZbYBJO03gqSIb8R8DteoJXtr8Z8WXdxEYw0FOUt4Jl6CBrUTo3CCglOkArxqFdeTCpCFJ+yjzCP2g=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=l2nzQFRK9aAW+eSn6/5WaBWcXh80sSFioPa84qIONgl69o793/DfeFUTBleiPnt5C6HSwrT34bXJeUPCnGvItT2SIm0zEOhnlJuGwyZmQRSi4AYXURv7CKp/y1lrujBEUC9AaVkB78PrA/mlk5DDChJ1qRzBE53e1zrrMK4i1v4=;
X-YMail-OSG: zVoErpcVM1nHIF1fQUvAfnmiolFOSdJO7psWhBJnines_2U g4ZJWb2U1NK_sZePJqHo0zbW2A3ewxuzi0vlGzDzrZeHElqTDGOlANTw7gDX 72inroBp2thnf2rzzOFHyuH_ucn7zCDETcYBy.WMWELRjwC187EbEb2DFxy5 .HH0XUARUvjHPMM_XD1EZdC4c1bS9MuADlKoN6xwbJ4GxCuJxLX1ghZdLGW2 h4hp6Jm7XpGBDI4SceILatqnBWQmRsyKF7XZnDjkyhoffsCjApBAe4FpoTk2 bauVgXZbwNMpYhOWMm9wknenVVqxGkJ.qwcmCyiZQVu6ERIZE_e9ubehdKPZ z_T4Ey2PuCKFqY5lIXmMJ9qLoFSGmSvQHMRToSzBizZjrD84S6sOjeAtLRzb KlAnKzElgiosgmI5Y8K5jKKT3J5kUIGIwzaE.LQ_Q6n7kJu8gbPRaICE9WkS xtjCvUN1hlx.XyWF7_jOKxDfxda9ZJSraJ5Kfk8S1hGGbrO9onDTcGQ–
Received: from [41.138.190.209] by web122205.mail.ne1.yahoo.com via HTTP; Wed, 28 Nov 2012 03:36:59 PST
X-Mailer: YahooMailWebService/0.8.127.475
References: <1354053615.47305.YahooMailNeo@web122204.mail.ne1.yahoo.com>
Message-ID: <1354102619.82958.YahooMailNeo@web122205.mail.ne1.yahoo.com>
Date: Wed, 28 Nov 2012 03:36:59 -0800 (PST)
From: jennywender@yahoo.com
Reply-To: jennywender@yahoo.com
Subject: THE WESTERN UNION TRANSFER
Reply-To: “MusicalTechlimited@yahoo.com” <MusicalTechlimited@yahoo.com>
In-Reply-To: <1354053615.47305.YahooMailNeo@web122204.mail.ne1.yahoo.com>

“jennywender@yahoo.com” <jennywender@yahoo.com> MusicalTechlimited@yahoo.com

Jenny Wender

41.138.190.209 – LOCATION – AFRICA (NIGERIA)

 
Leave a comment

Posted by on 12/16/2012 in Lottery Scam

 

Tags: , , , , , , , , , , , , , , , ,

“Dr.Pere Hart”

WARNING: NIGERIAN SCAMMER – LOTTERY SCAM – ADVANCE FEE FRAUD

This Nigerian scammer has sent multiple emails which have all ended in my spam filter. I’ve posted many on Scammer419 if you would like to view please click: Pere Hart Lottery Scam

SUBJECT: Open The Attached File From Dr.Pere Hart Deputy Governor CBN .

EMAIL: An attached file that said Central Bank of Nigeria txt 
NOTE: Pere Hart has sent me numerous spam with alot of the same scams but also alot of different scams. Each email is ALWAYS under different email addresses and IP addressess.

HEADER:

Return-Path: <dr.perehartoffice@gmail.com>
X-YahooFilteredBulk: 77.238.189.207
Received-SPF: neutral (77.238.189.207 is neither permitted nor denied by domain of gmail.com)
X-YMailISG: aFvgY08WLDsdt5GEWB08iqN25WjppamFxrHT0t6_0N2fkOBF FzidCIQIlbcPvcyAoh0AWBdtiRPiNMrcplz6CR1xvf0tawY7M_z3kfTPpt_8 Rnz7K3MFuq2x1513KdvJCE7VrrVu4jzXzkJEnSBPbEcRVQrjsskSQzuk4xpa 3Tqr4rGJDM9H03XoyCBuOPFUHEhTc8aaRckhUnlUQjtFCLZ2qkuU34Whp0_w tDbnpSmCf8ildUEOOoqomaJSQMyaewKE2dQIHrxtOQDSj7OOlbyZ3f2jWzyj z3EqhmRPl6uNgLfQ41waAc_9SNR0cRUiul06bobLUz2z4.ikD7GF0wR4vk3M aIY96_Ff0MOJPTdBQiyWQe.j8aVPW1kIABfUw9lqrr7B4qLG66QuDM8tOk0c WBWFD.TGelcRBQaKhvrZW5Xlo_0sGSJBWID7WsM3GKjSviKtuuuC7.FJEp4y TH1qObGdqeBqMki8m48h4Ab_Q_kzvnR4NaMK_QEQktrZCu0Z9nOz3qdxu8rr HTHza7FmLmbawWaOUpHGSb18aGC71mXZLHzhmVjl3nYUMCK99mi4P.NgPYkB rgNek.fUdQdBdNiLkc62oRfadQdtmaoi2tZG9ERIZnpTCQIYai71_JQSztz5 KkOUBfhYnjxrdKg.Pw.m8i652qSF2lAjAueIlsqboml2Mi4APzEeosB_Y5eZ oZNZppZ7njL5Y2CtfnNj7bC3WlEq9wOXZaC1PBAtqpTMdfkGpHieE.X_MC5y 0g9ObiHaxveGvb1WMGs6zkv3PburNhdxxg7fGXHu5DMWhVwv1ymrreIFU_qz HOkqvtQGNAX5vE1F49lARyzJoc8NXgk7i1CQzjfabioalciPRsLBF3fzFGUE DsaNqXkuw7RgahBRUqMHducqbGKl2WLdvr9nJGe8ZaxetJaBLtAgK0pGZwMS 3Bhb14Uo8a_q3YYdz_cIonE5F.zTbYV6hoE5kC4IYa6h0umQJ_SrkUg.YTxw ss94Tb6hXsFQB05hSugL6uelLhMsaalKka0rN5syvNMxuv_fwsZ1W0ebqz0Q kZcCZ.nHt4O4A0_coPlS0RAB3TMB_dTwETt4qDuXvbxGwa6JnUpw1Ujm3FtX mQk5M68mDH4ol4L_zxTM0PCe2o_4mrGb6yvZd4.meO4EscwQDbQR.ddCOan7 cSrYWOW36HFfEEyzKKmOSlZYHs5FKx0DpQ–
X-Originating-IP: [77.238.189.207]
Authentication-Results: mta1308.mail.bf1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO nm5-vm0.bullet.mail.ird.yahoo.com) (77.238.189.207) by mta1308.mail.bf1.yahoo.com with SMTP; Wed, 17 Oct 2012 09:51:58 -0700
Received: from [77.238.189.230] by nm5.bullet.mail.ird.yahoo.com with NNFMP; 17 Oct 2012 16:51:55 -0000
Received: from [217.146.188.160] by tm11.bullet.mail.ird.yahoo.com with NNFMP; 17 Oct 2012 16:51:55 -0000
Received: from [127.0.0.1] by smtp128.mail.ird.yahoo.com with NNFMP; 17 Oct 2012 16:51:55 -0000
X-Yahoo-Newman-Id: 51876.17474.bm@smtp128.mail.ird.yahoo.com
Message-ID: <51876.17474.bm@smtp128.mail.ird.yahoo.com>
X-Yahoo-Newman-Property: ymail-3
X-YMail-OSG: qwmBW6kVM1nms64QgbWA5bp2sqd6.mO.E2LD93nho6QZV5b 7PkJoQhPYQ9IzelN_ePvcEmyy2ky0yYMt4XNOXvDOv6kfTmDyp7xzMxgk63u 15wu8pSGklKRYSQfsoFfSII_hGfIW2lxSkdXqOXoNT9LRd8p.ZorUY4b4rlO gPnLLwlUP5DsHwaSJbgHk8EnOy9QtzLibG0iwdnB7.wbq0i2FRouCYeG18F6 QIG.NVESEK5UImRV7LeUJEuFPR0wrLK061AA0WiUI_8FcH4fpawrYlbROxPy .10YEtwJdEP_47_eeFa7sgYhCTZP3iMVandZisYDOWPev5H8lSzUO1uyCAj3 gBZnS_LyNy8cJMPuMqXtPQ3A_OoW13nHW9NW5_rNY99sC4.qyVnr.tkc4KXd zKlpU3yY42WL8Go9pbOvvhifnx5zJP9IVbdZ6lsh2QlSWZgHRrI7M1BqczRF CyHbYtvlaZiIuUuab2kcB9_odigpUPutpAT1UNgE-
X-Yahoo-SMTP: 3PKY2KeswBCOaex1k5NL_UpUxzw.w_JM.rvihsImDOhymg–
Received: from User (dr.perehartoffice@125.88.125.201 with login) by smtp128.mail.ird.yahoo.com with SMTP; 17 Oct 2012 09:51:54 -0700 PDT
Reply-To: <dr.perehart@yahoo.com.ph>
From: “Dr.Pere Hart”<dr.perehartoffice@gmail.com> Add sender to Contacts
Subject: Open The Attached File From Dr.Pere Hart Deputy Governor CBN.
Date: Wed, 17 Oct 2012 17:51:40 +0100

FROM: Dr Pere Hart dr.perehartoffice@gmail.com REPLY-TO: <dr.perehart@yahoo.com.ph> RETURN-PATH: <drperehartoffice@gmail.com>

RECEIVED-IP: 125.88.125.201 ORIGINATING-IP: 77.238.189.207

 

Tags: , , , , , , , , , , , , , , , , , , , , , , ,

“DR FRANK COLLINS” – DR COLLINS PETER

LOTTERY SCAM – ADVANCE FEE FRAUD

ATTENTION: Below will show two email headers sent to two different people (including myself) – It’s the same scammer, same scam as well. The header information is different however so check both for the different IP’s and addresses the scammer is currently using.

UPDATE: Dr Frank Collins is also going by “Dr Collins Peter” and “Collins Peter E” under the email addresses / IP’s – “Collins, Peter E” <collinsp@newtrier.k12.il.us> <info@notice.com>  YAHOO-FILTERBULK: 157.55.116.165 RECEIVED: by 192.168.194.152 — X-ORIGINATING-IP: 41.71.173.93 Also,  Dr Collins Peter web52644778980000x@att.net REPLY-ADDRESS: collinpeterclaim1@yahoo.com RECEIVED IP: 172.163.86.61 – X-ORIGINATING-IP: 98.136.218.126 onlineme20@gmail.com – Scammers number: +2347030115459 X-YAHOOFILTERBULK: 98.136.218.126 — For more information click: Dr Collins Peter

UPDATE EMAIL FROM DR FRANK COLLINS A.K.A DR COLLINS PETER (I dont even think he realizes who he has emailed because he emails me with different, similar names on a daily basis.)

EMAIL: Attn: ,
This is to officially inform you that (ATM Card number:4083-0521-0032-0293) has been accredited in your favor. Your Personal Identification Number is 822. The ATM Card Value is US$1,500,000.00. You are advice to contact me with the following information: Name, Address,Phone, Age, Sex, and Occupation. You can also call out hot line +234-703-011-5459- to confirm.

Thank you,
Dr Collins Peter
ATM Logistics Unit,
Tel: +234-703-011-5459

_______________________________________

SUBJECT: PAYMENT VIA ATM CARD.

EMAIL: Reconfirm your Address,mobile for delivery of your ATM card $10.M

HEADER:

Return-Path: <webxx120999xxxxxxx@att.net>
X-YahooFilteredBulk: 98.138.91.88
Received-SPF: none (domain of att.net does not designate permitted sender hosts)
X-YMailISG: FaLTslcWLDv_37lDMJwvUepYgmnqCzD2WWiLYIVYEvzWiVdj yeMdZg1sVqQZNMLZIrI8jrEhVaMXPsJIY6kRf0cbjnqQCPsaLbBdN2aERrfI RwOChZVFmKW9DzDxir.njJLHD.QY8j_y83jLRI4.AuI7k8QKdHjPvXXJYEFV 3YQAPmqS_78yqhLNbejZcKD5irk7feyqBo.GgWWRjUtr0XeJzJNqaql0h8sA e8RvUpWShCVHN2SyD1tuM0Deb4D1Ji8Vbh6LO0l1rw9cI0_sIz.vHpe_EiGP kHJSq4cVZ_zI24xSaJVH2nairx_S7dPagQ15pHcUhTSBMqGEgXXNeB1Y2oeP 3JU6qx6vSLkN2q.zt9EL5Vwas.VQ3VnnTXDqHLBdVcKU94hP0GlXAupk.DHM obtlUYCC1aCFRuuf3fyqc0LusjLnspK7JnjoOa4trRGPkJ_SlfDp0ggLrEaT v9a7lqaWeBT9EICtLA0FkLq3C2n40JFv19b2vJ8kTWkPK9_CQXXHvPmE9PZ3 kFs1luoQlTk_lzaBG6mXtSkUeA_7vvUTiNlT90e4_xcWHLkMi_qHUB6.MOXY KpjgBBptr6h8HH8BTrub.bb.IWuBN9wzFL2saNzKwsyxCm4lKMw9.xwDm5uJ Gq5wsKY8oAk.ZAm83V.RXXdQZhrYHzq2HI4TEsDuXnxCeBPNS3yCscgHGdua .5bviyYzefeg3tnvzHHkzRlzxSKw4QvlmuuqcChqscR9kCPiJLD.cgAs4kGP VstUFHd.bksAH552CD3i0lwkON5VfmeiESgRCGTPFvptnIKly2v3rZiX6esg GPPtVuH2VF9JGdJc2Ymbkp7azmUteBWNDdU3UBhVs441.EpCaWrI_sm_fe57 OiQyUOywnO1yRAtKJ_SFta4rGiPKLZ0KmWOm2iWxo40gyrpOgSF7vvvDlD.8 TTvxrpElU4SLFTn.GO1zFIFIOghPlKF4MTDaE1.cfSBA7OvaqPPhZB7CbD_P PbifHGwGIUcvjwXFo2GX_MJ9efyRaqwJ8RNv5bv_PmOjBSyxnqzPybf5N4_3 8R6NtlZnqM1b4Enrf9rnVdKOJneQ2FJhZVcYPrtDlcrfum9mFoOorxfoQHmz TE17GM57C0B.ILT43WlnmpnQdle96RtuSiqxmvsRzRStRdaGzDZuic8L7wei rjZENREYOwxD5PakTFL_xFmWBDMWOtezwqcs9j2HaBsIHEPGCa_w1BQb4H7T Rhg.rsLZhUpnUmz3kwbcPdV9Pc8UNCPtAWRE0QCMgwjeBn0ZXdINEcVudxSA YTcOMC4k95wVfJ8oF7eiOod5Qae2n5Ov7WwjD_lXqOtSBIc3J87zhs.HmSjX 7WlsWTwwXn.I_l4fa3NQ.mKYBKo-
X-Originating-IP: [98.138.91.88]
Authentication-Results: mta1228.mail.sk1.yahoo.com from=att.net; domainkeys=pass (ok); from=att.net; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm12-vm2.bullet.mail.ne1.yahoo.com) (98.138.91.88) by mta1228.mail.sk1.yahoo.com with SMTP; Wed, 05 Dec 2012 09:33:37 -0800
Received: from [98.138.226.178] by nm12.bullet.mail.ne1.yahoo.com with NNFMP; 05 Dec 2012 17:33:36 -0000
Received: from [98.139.44.92] by tm13.bullet.mail.ne1.yahoo.com with NNFMP; 05 Dec 2012 17:33:36 -0000
Received: from [127.0.0.1] by omp1029.access.mail.sp2.yahoo.com with NNFMP; 05 Dec 2012 17:33:36 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 198054.18868.bm@omp1029.access.mail.sp2.yahoo.com
Received: (qmail 22514 invoked by uid 60001); 5 Dec 2012 17:33:35 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1354728815; bh=2E+CXVEN1MfcfJaq2e/eZV5TviX4n2QY/x1KeAa5kws=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=f9JOS/YO8YXlmc9hJrpoWT06BSgD+eIddQyPZn984pugXI47aiHJ+HigDAW5KKMMOSqrOWONnAJiCoEyKoSjzteAYzjouKnJuSd9FFAPV7YDDY5OHZP5iSipgSUv3aNEhW/Rsnl4Ln0GS2YFkeMhoGRqYTKiUP5YtCqljvaDNow=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=att.net; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=TW9B75gLmG8YEH2Fs0wWUR6quUgNgKf4vKcOC0lU58OuZZxvfbAEilc6hFgOyOvoldI//PR2xiJZNGeYJsT5o76o0CJS8W8mbj8ANAI1PafbE8IT034u3iHRas9fZymmyVV0ARoaM4Pmz0UzVZK0Jim/YrB1484O5fKsUOiyGTM=;
X-YMail-OSG: WdGt0KwVM1lOyB0NVRZY5rrxYN4NyBpT08THjv3T0blrAYl g.fSaOnJGDgT6qOWJLehIImpPX16weUxpsraTUfiislliLwCl2K7v8Pp.iJQ a9TSaK3Cg8mAMGQLpgboaXsnY0P.gbcdPD9a2TYU3MLMz9.msdkdNVne7srD CGKrYap1ePNIkrvsumj.6_CYvw30FkImKkDHHf5IXtzUrxF4x8.QVPZL.F5P 1sCi9c6SjI1P.GeZm2DnWTw.VoPokMuHr44zOJyF208V.uJqcKGplN1blft8 NRD73m_UrMPrQXsfdMEk9IKg0jGHRledxyRP7NbPnmUmTJk5sWb6g7mibQcN lZBmrszbkEqY7Gci4Eh5lmEYhM0EH9ITd3rAkZfbRlBlo5s8MbxSVEa73EvH muyMHoTdJMpwvibAS8LsfWhBVw4Fzpyj.JdfnQdukkFQX5QRnWlt3FtcARkq hyy26DJRYTbzGN4Eyk0EL9EDXp1SGqp9Lk4FU_Cz6Hw4qjqgVzWqnIza_ijq nvI9omJY1Dw0WycuWs.OkVnfl
Received: from [108.174.51.231] by web184901.mail.gq1.yahoo.com via HTTP; Wed, 05 Dec 2012 09:33:35 PST
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.128.478
Message-ID: <1354728815.12889.YahooMailClassic@web184901.mail.gq1.yahoo.com>
Date: Wed, 5 Dec 2012 09:33:35 -0800 (PST)
From: DR FRANK COLLINS <webxx120999xxxxxxx@att.net>
Reply-To: drfranklcollin@kimo.com
Subject: PAYMENT VIA ATM CARD

FIRST EMAIL – “DR FRANK COLLINS” <webxx120999xxxxxxx@att.net> REPLY-TO: drfranklcollin@kimo.com RETURN-PATH: webxx120999xxxxxxx@att.net

SECOND EMAIL – Dr Collins Peter <webxixxxxx266xxxxx@att.net> REPLY-TO: collinpeterclaim1@yahoo.com RETURN-PATH: webxixxxxx266xxxxx@att.net

BELOW HEADER FROM COLLIN PETER EMAIL:

Return-Path: <webxixxxxx266xxxxx@att.net>
X-YahooFilteredBulk: 98.136.217.214
Received-SPF: none (domain of att.net does not designate permitted sender hosts)
X-YMailISG: 2lU7wkQWLDvBCg5Cg1wZtIwDNUzuGrZVVXK9H6ZxiRnCF9q8 3T_Z2xZXeKmdhjE03ZY1nNRa1P6Zz09tc3Suud6PVBq3vexxPmov8AXjPV9n h21FBi8fEfSTSwVFhhvzk7V6R63Puryrkha1Mb3jaVwNputKdVPkDPhjUMeo RVMMb4_9ds7LkdO1tAhp2nowUz6sKBD4buJmSanxkzHUpRwUVtPLKq8B09eN Rl25hxMaIQHn74TwJlEJoWwVxtvh8Jkr9b8xgoPVsHTD4d3rIEAmrBO8jRyd GelLKjDpe6gEZSWQukIvbii_.zMj02LUFMIXNqSXg2JTLp15U5_jUlo0usw3 1Q9ij8R.SuZ80..F80EMLcQO1SXMjqWDf6xkVHWwRChYckM8P0zLXQwmLzCh cXZIqLnw6xfz6lcwu0_mQkN.aX.hIIycQN9E431bkyzpAK8Sh0ATdnfKruuc hDUY3uEtvred._LLnnYkhYpxqfc_nSy4oYmmhRytYX5eJDo3.jrNS61KZPV6 YQ56CR6JtF_A6Hafi5rSLv5qgM4p8VJZi7448tERIhykcwaijsPjcAOenatn YK3BKAuoLWZ0KHPHNvGKAWVEbv9QWSQF39Q.EEP1LmrPyvSdcGkLUJurop.B aYWv4YFGCdGxSazNRDxvtgoiaK6SIwQ.bpgk7uq2vF3rcb50kF6JNxWrLg.n 7Tth7XBQ.W0dZ6SeRl5BddGt0PedKs6csdJXP3rAEuRx9HhVbiFWVgdNijR3 _dNog5Qebj0UNBN3_ZYEN_KnDptPkNdpsJ8OGplwzrinpWeXcnwHVgAbUTdo 18VmNYVRbtilZoPybybViqmTdRB30nDou7y.RzfJPpp93GHAGPmJapCeotd7 c17h.xTgmXwnesQYx8oH1A8HMZj9YMgj2Hn78UbjDz5iO3dLZZQwGJc37EEe Irpsy5SaXtVD8MbmmPkhMrhk8K30Dviwqq4hDE5WgxBlGVonuDQoGK3aEt2T nvWx.JhFmNOhCyTBWuANJwIBh0YVHlt7UHVip3l.jut4onQ9R4CDyP6sbX2c lfshiCRIJ9lEvHbvGo40N55AdITysTVwpsKYdhO1zKO2KEhE2HbINU3NSVAp mVO8xztcsAawulFbZ5PKA.HviU.utyPlT0yMvzwTHn_QINVPcYodx0NOT_5q eROgjgZ35jOw55jeTpgP2qOvmDNkeadY.RrCfkVM_h_Ewvbns5N8m8wKWn4F 71xz.y4o8QBLLz0jb4jMAFmUekk5PrMNZ0E-
X-Originating-IP: [98.136.217.214]
Authentication-Results: mta1191.mail.bf1.yahoo.com from=att.net; domainkeys=pass (ok); from=att.net; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm19-vm9.bullet.mail.gq1.yahoo.com) (98.136.217.214) by mta1191.mail.bf1.yahoo.com with SMTP; Fri, 14 Dec 2012 03:36:45 -0800
Received: from [98.137.12.58] by nm19.bullet.mail.gq1.yahoo.com with NNFMP; 14 Dec 2012 11:36:43 -0000
Received: from [98.139.44.70] by tm3.bullet.mail.gq1.yahoo.com with NNFMP; 14 Dec 2012 11:36:43 -0000
Received: from [127.0.0.1] by omp1007.access.mail.sp2.yahoo.com with NNFMP; 14 Dec 2012 11:36:43 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: 191480.20265.bm@omp1007.access.mail.sp2.yahoo.com
Received: (qmail 75889 invoked by uid 60001); 14 Dec 2012 11:36:42 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1355485002; bh=2TQXuFSDKzJQh2ItoNfMPDU7xRHv3E+CGrBMw/1Ns0g=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=MdiZ1jC0egJ3jeK8x+wAmlqoZyMp98AiD2wzzG+et6zE3r4jYBfuYUoMttuA+gtIjRNvWXQLaTtg0u215rggtB9Wpx8OQWJMI3iQKHU+C0WdAONnnis/01rbGL8rLVp8QUEopIB3M6ep93e/l0o2GTcA+2tm8NmXdnIzOrTvHgs=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=att.net; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=tLrXvMlZ1AfWS1oRs/q6h6HUMYi/LUcbnjbU0+wRSPWQr/1rUxJ+mPFD5IS+2J+xhqTW8fnpv0P89+O46Kg0ZaIi52L7OqBpBWUtxGIOrGGuRKY65NxHoyuM/9fcPmg6OxN2t9IVr/IQmo5FIYMQAlTgtLYGxzIx8tus9kjh4UE=;
X-YMail-OSG: 3ICaliMVM1ngoXiqNpguRRh2iYwL78sXplySeVxex0hGQX. 9amYG0XA4OBV26LpGFUMshO4W2d_k7Z_a2Ijy9UC4MhQCts27.mEJf9MSo4o gLC1yrqEZW2qVfkENJcHqLvP6x22811UE_jYQp539eFIcLW5RWUDAU4t9CGn OdkUZ.I3db4Y0_pc3qHbfrO34x9zDWKUFRwLqnQ.wNCnHD8dS3WSTofCFWm8 DRISKdISfGE2ytoF4IzvXsFuyje2c_qd6tqdnmTw5Z9mBhssXb94A4biy5CF qnxB_1TEOjTWqKHDrBY4BU1EdgOFfYQNqvwQ4XtGhinDlu0jMGic.YAmQBDt z00_WMAOIdc6llHVKxJwh0yh_xgWL5D6rgLOTnmN2Mo2vI.t3Ls.zQwRBRhe SaGInzRlMMto6OJd7AVEbCSpnmZYicQHhMCbjMxGPX2KPd4Tv0fL_cU_plDm egb7i9XYQocNBXLDzdzIfmk9Um9FTZk5b6spv87aUQEG.1MjrCbB7UdYQ0uO JpvS8DhYL5XyxrsNNIFxmRpV2b8I07Jm9LTn8wKS_hqGegIf5feMr.9cGJzH 7hgKyGs0sihPG_k5JCSaI1yCjgZYK79b_xhXuvMQeLOYyQDygzxrr8813RrH cC8L9RfM7BsB3QMN75qyv.pCG1ZbybDazG.TyLuGLgdSNZ6KwYSh_mQ–
Received: from [172.162.63.104] by web185004.mail.gq1.yahoo.com via HTTP; Fri, 14 Dec 2012 03:36:42 PST
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.128.478
Message-ID: <1355485002.70723.YahooMailClassic@web185004.mail.gq1.yahoo.com>
Date: Fri, 14 Dec 2012 03:36:42 -0800 (PST)
From: Dr Collins Peter <webxixxxxx266xxxxx@att.net>
Reply-To: collinpeterclaim1@yahoo.com
Subject: ATTN:BENEFICIARY

108.174.51.231 << 98.138.91.88 <<

________________________________________

Click SCAMWARNERS for email to below header which was sent by the same scammer as above.

Return-Path: <web1xxxxx12000bvvv@att.net>
Received: from nm12-vm4.bullet.mail.gq1.yahoo.com (nm12-vm4.bullet.mail.gq1.yahoo.com [98.136.218.191])
(8.14.4/8.14.4) with ESMTP id qBAFqXcC024177
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
(envelope-from web1xxxxx12000bvvv@att.net)
Received: from [98.137.12.190] by nm12.bullet.mail.gq1.yahoo.com with NNFMP; 10 Dec 2012 15:52:33 -0000
Received: from [98.139.44.75] by tm11.bullet.mail.gq1.yahoo.com with NNFMP; 10 Dec 2012 15:52:33 -0000
Received: from [127.0.0.1] by omp1012.access.mail.sp2.yahoo.com with NNFMP; 10 Dec 2012 15:52:33 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 169461.26588.bm@omp1012.access.mail.sp2.yahoo.com
Received: (qmail 11627 invoked by uid 60001); 10 Dec 2012 15:52:32 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1355154752; bh=6IEXAnuDHUzPM2GG6BZxFSMMGXUzzTJH/x0iCKn3gNM=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=ZNpQDXqA6YKLygx/Mgp0kaQY3hShe48iYfThTEb8Iru1MOJkFmAxYG7WRpbG0vEzb8sVOXBWUD70FlpkHY32sc3lcnQRUH9EWyjF33/6bxeK6Wl/Hf7syjgMKen3IrPrVrQM7QP70aIkEYevI/L1VoeaKi0X05zrl/mkFKlZJB8=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=att.net;
h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b=C3u05KWRUG4yec6yjYc58jVUZqKqPra/xpCRYFkhi2pi73G7p5xYJt3avwhjC1pd5gHT2g6XMST7DkGiaRchRZYYa/jODcoZt4R+AhzCt86vNfdJ8r54ZScNvyU4Y+I8mpF49mKbuYWh9Qw+6o/yW3f8qclaMsyNAu3ATH2SDAs=;
X-YMail-OSG: p5tUyUsVM1nSNbno0XpFEzLZade1sG0k1LIN6NkNDDbP4ts
LfsdXeXxUn6OgEkvAzJFUKDvuIBVeFzZtgkksCNzN7YM7NYxZZELCIFArcbu
_mj1sx3mmaRRFlhLnDPO0Ud9acKn6RdXUuy0Z2D2THjsSnJnY9sU7qqlRMsY
RFxlusC6GZdc5g0kSlEJ9Q6m1NFt621vubnU3dlWx9BHYYswZA3GlYEoIQOZ
znu.EmXiL_e6NkgO6Xi3U8TlgxDHH.J2V.gjmQeJjgeleOz.cmjSiQf65.01
pFSPJQ.uJV2ZQQDmhoA_f4DIGHOLzIEM54oMAKodxlcGehFjRCB.Otx7qJ99
LLzSejt_DN_c3T7KOCmzn30gBLvM4NW04V6Q7K4N69QA7XOIUNPQflttOcPQ
QUh_J5vkppPwzXQ7X5ZwbRUsdfsHhuaz1XhXMvrY6vOWGj_WLL3kyxKoNNTD
o2PEbuViIVuMH9ocliCObq_Z7Olxp0coTXqA6vhkTd_030aE_Rclf5k8sFU.
neOYXj1nWJo0ZcsSoOLW7
Received: from [64.72.78.27] by web181404.mail.ne1.yahoo.com via HTTP; Mon, 10 Dec 2012 07:52:32 PST
X-Rocket-MIMEInfo: 001.001,DQoNClJlY29uZmlybSB5b3VyIEFkZHJlc3MsbW9iaWxlIGZvciBkZWxpdmVyeSBvZiB5b3VyIEFUTSBjYXJkICQxMC5NATABAQEB
X-Mailer: YahooMailClassic/15.1.1 YahooMailWebService/0.8.128.478
Message-ID: <1355154752.62957.YahooMailClassic@web181404.mail.ne1.yahoo.com>
Date: Mon, 10 Dec 2012 07:52:32 -0800 (PST)
From: DR FRANK COLLINS <web1xxxxx12000bvvv@att.net>
Reply-To: dcollins@kimo.com
Subject: PAYMENT VIA ATM CARD.

 
1 Comment

Posted by on 12/11/2012 in Lottery Scam

 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

“MR.BARRY GRANT”

WARNING: NIGERIAN SCAMMER – 419 SCAM – Also known as “Advance Fee Fraud”

EMAIL: Attention:My dear:
I am Mr.Barry G. Diplomatic Agent Dhl Courier delivery company Benin Republic, Please I miss placed your original address I had due to CUSTOMS /FBI/ CIA and POLICE searching and scanning on the Box as if I am a terrorist.

They have confirmed that my movement is clear and with out any suspicious intentions to this country only to deliver this Box to you and the documents are updated.

I have just cleared the Box from the Customs and they are now demanding for the certificate of ownership and the international consignment delivery permit (ICDP) from country of Fund origin and I told them that it will be forwarded to them as soon as possible to enable complete your delivery today, so please call me with my number so that you will direct me on how to reach your destination today.
Here is my direct number +229-986-782-98 , do not fail to call me Asap!
and also, Please,I want you to call my director in Benin Republic and forward your name and your address to him and to enable him secure the requested certificate in your name and send to me immediately for immediate release of your consignment box, So I will proceed to your house today.

Dhl: OFFICE
BENIN REPUBLIC
PLOT 56 RIVER LANE B
COTONOU
+229-98678298
+229-98729299
(imfoffice746@rocketmail.com)

DR. SABASTIN BENSON (director)
REGARDS
MR.BARRY GRANT (diplomatic agent)

HEADER:

X-Apparently-To: deleted@yahoo.com* Thu, 29 Nov 2012
Return-Path: <uchchiprofiter@yahoo.fr>
X-YahooFilteredBulk: 77.238.189.62
Received-SPF: none (domain of yahoo.fr does not designate permitted sender hosts)
X-YMailISG: NTGtSB8WLDtYe65NR4uqunNnNs1MnyQjJouu19QOPQiUCKBV iSNFmgSYwDxkZDphFkZ8qTPjtfQsE.VTghXgxkJi9sVSPaY4TRbGj65rRLPS GXdig1MgB2wt8lAGvYD10SHAVkoz2MIqVNfKTBWX9.KJ.DXO4G2QNi34Gpbb bgIgx0pD1iVSopgEHsS44.bm8jy_chVSueCF8covE_k1YiuqGB9d8D_LdyDW mLvIDUABg8b6AboLq5XL.d7EDJfoRmIx0VaAxbL5E4Nc4XJB343st782HvfI tbiiwSMOWQpcIwavggsnBVrw.umkpEEGqtaXh6rgnW5A3UjR4wcAAF1AUCcF sAqovRtP41UJGd6uWB5Gdady8xYCItaRxxNyzTPtkNo7Mt0.L69HwHkpJP8y Et2sy8TWoRdou1TyW3AtzuaAQEmugOXJAdxwKygqBA24byinS5hNH_.CbkdF Nz0Tfc7aZxxQpHNmxCBqNDxkAjefLiX9mOaB34dozt_XM_82Muy1YalbrE8T PauKbjCZyMgwxf2zmA_xrnvWIK.xlUOQV3EFQKzhEl4eyHJgK7.eLLmgoLcX eErytdN1RTfIesVJHBbwZ9jgBZGpm5Mj6S5ZwtHabECmhPOp0vCOcvvbaxap DMSVZQ4uXFj6il.ss7GBfQZl4OGCibUqjZ8KncgbjxrkHRxu_qK5LndNgbp2 1.xH8UVF7MR.Zkcd5m6a1fC2DlmlwIXeR2K04N4iAGmQyMsFWd0dbk6.3NN4 JZ1tpQcpE8YOrKS1vyIrPVXMOPX8WzVRBCqrfkD_XvEynVx99cpMslValOfP 7My9yCQLJC_YIxdhB_YS3zhFlKAAEp8vtBcILbBoSC5LxOnYnrnChUmnw9dQ USsvP0On4.UFMV_LBHJmHl6VwzQpwlNr.7D0z8o8gpK1K7vtapaSabT9eyNt zcrDkhSF76oo51L0czJTXehdLDHt3uvVYg_f3TUsI7t2xgw.9mmHI2pE3GvI B.qzf.4if9jt2WZhqtas6MDs3yaxmixXpCBChDMHVUq_PC4fl1ouSCjwbkFK vr4RtPvkq4vRQlbofJmfuBr9FXPF5q7AypwnGF9jJVbzC._gHOtv87hiTuV4 Oh_RgZ7PUx6ZSfjPqQbjhPveL5mWS1v.wGxCjxsPT7tnOI3ZY6lbPrpMNaAW 2npS1KJA56P.wvXsPGKESpzCzSPBl62qs6IHB0t_XVUh8BLNHzTFWOMfbYUT YwkP9qT6i9w1vgJUB1ego_WTUlgShxLQVURZmw3ydr6pQSyCfoE6cvQqtHbG ABAFdkn61M2uadHeObpjtSNtzit8NXzx_pNlNBmGN1MjJZo-
X-Originating-IP: [77.238.189.62]
Authentication-Results: mta1038.mail.gq1.yahoo.com from=live.com; domainkeys=fail (bad syntax); from=yahoo.fr; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm5.bullet.mail.ird.yahoo.com) (77.238.189.62) by mta1038.mail.gq1.yahoo.com with SMTP; Thu, 29 Nov 2012 09:26:27 -0800
Received: from [212.82.105.224] by nm5.bullet.mail.ird.yahoo.com with NNFMP; 29 Nov 2012 17:26:22 -0000
Received: from [212.82.108.125] by tm20.bullet.mail.ird.yahoo.com with NNFMP; 29 Nov 2012 17:26:22 -0000
Received: from [127.0.0.1] by omp1034.mail.ird.yahoo.com with NNFMP; 29 Nov 2012 17:26:22 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 534566.19832.bm@omp1034.mail.ird.yahoo.com
Received: (qmail 10255 invoked by uid 60001); 29 Nov 2012 17:26:22 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.fr; s=s1024; t=1354209982; bh=41J/k28ahEQMiiBQfZyiXVElzLvnyuotQtahBg+PFuY=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=0sV8pjAIQVcACX3lou9apROdVhzBGBVgh4kwk6YHFS7Zvql0JZ0gxBckRKyNXHKl4TciLv2phdOrGvURRhCYvOkU6ZmWunYfnJGKnW4iYBDnEP/Mpf2SFIJoyq1ymyW2da3Qiab+WFyy7B396OnMmwesUwcJI8+KWjARl6bNUfg=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.fr; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=42Co41ucafGl9HGkAWmgaORIvVGA38VT0Z8wrglrvdfGHQvoONCTMVE3h6sqTIFGf9MhLy58sEOE4NN5RXMHSQnqJm28UcvBsjI4Etmru9vB50o9/tri0E91bpzFvrI6yaEHz/Z0OFx/aUg6NzX2jy/3Peu1Ij+TZ/DvQpRonnY=;
X-YMail-OSG: n0667UEVM1lXGt1BS21iUoxCrxGgxkC6Pvo2gK.xHi32qcI kYMr.dZSLbV.Xkx0-
Received: from [41.216.63.171] by web171302.mail.ir2.yahoo.com via HTTP; Thu, 29 Nov 2012 17:26:22 GMT
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.127.475
Message-ID: <1354209982.35602.YahooMailClassic@web171302.mail.ir2.yahoo.com>
Date: Thu, 29 Nov 2012 17:26:22 +0000 (GMT)
From:
“MR.BARRY GRANT” <western786union00money1transfer@live.com>
Reply-To: imfoffice746@rocketmail.com
Subject: I am Mr.Barry G. Diplomatic Agent Dhl Courier delivery company Benin Republic
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=”1670751155-715523683-1354209982=:35602″
Content-Length: 3482

 

IP – 41.216.63.171 – Location: Nigeria – NOTE: According to Spam IP, this IP address has already been Recorded along with the email western2union1money0transfer@live.com under the name barry grant — as well as: johneric777777@yahoo.com.ph — under the name Mr. john eric.

MR BARRY GRANT – western786union00money1transfer@live.com – uchchiprofiter@yahoo.fr – imfoffice746@rocketmail.com – 

Felicia Aime <felicia_aime@yahoo.co.uk> — Blaise Samake <blaise.samake1@gmail.com> — joyceawuse@yahoo.fr — barr_roger55@superposta.com — maria_ruben@voila.fr — 

 
Leave a comment

Posted by on 11/30/2012 in Other

 

Tags: , , , , , , , , , , , ,

“Aminata Bangali”

Inheritance Scam – Nigerian (419) Scammer

12/13/12 UPDATE: Aminata Bangali who also goes by Fred Williams and Western Union Money Transfer sent me another email only this time she is pretending to be her own lawyer. Click Barrister Mendy Samba for more information.

Subject: Greetings From GHANA!!

Email: ATTENION:

I am writing you from Ghana and my name is Miss Aminata Bangali. Can you be my trustee to help me transfer my inherited financial estate($10.5 million dollars)  deposited by my late father in a company in Spain? I live in Ghana as a refugee. I am required by Spanish Law to provide some legal documents to claim the money, but as a refugee I am not able to cover the fee. I need your assistance to settle the charges to have the money released to me and I will compensate you.

Kindly let me know if you can help me and I will give you full details about the money. PLEASE CONSIDER VERY LEGAL AND CHEATING.

I WILL NEED YOUR CONTACT PHONE NUMBER TO SPEAK WITH YOU FOR MORE DETAILS.

Thank you,
Aminata.

International Flags Divider

(Originating) IP-ADDRESS: 41.138.172.76 is originating from Lagos, Nigeria a.k.a Scamville – Some other reports include Dr. Kelvin Blair with the e-mail address info@eaglegroup.com and dr.kelvinblair@live.com

Another scammer using the same IP 41.138.172.76 is COMPENSATIONAL SETTLEMENT OF ESCROW ACCOUNTS who is using the e-mail address  <imf@uniplac.net> with the Reply-To-Email: greyhound.courier@rocketmail.com
IP-ADDRESS: 64.98.42.56 is also associated with this email and has been reported and blacklisted on various sites as well. Anyone getting an email that lists any of the information i’ve reported on here, its a scam.
HEADER INFORMATION:
Return-Path: <mendy12@sambachambers.com>
Received-SPF: temperror (encountered temporary error during SPF processing of domain of sambachambers.com) bmQgbXkgbmFtZSBpcyBNaXNzIEFtaW5hdGEgQmFuZ2FsaS4gQ2FuIHlvdSBi ZSBteSB0cnVzdGVlIHRvIGhlbHAgbWUgdHJhbnNmZXIgbXkgaW5oZXJpdGVk IGZpbmFuY2lhbCBlc3RhdGUoJDEwLjUgbWlsbGlvbiBkb2xsYXJzKSBkZXBv c2l0ZWQgYnkgbXkgbGF0ZSBmYXRoZXIgaW4gYSBjb21wYW55IGluIFNwYWlu PyBJIGxpdmUgaW4gR2hhbmEgYXMgYSByZWZ1Z2VlLiBJIGFtIAEwAQEBAQ–
X-YMailISG: 79tmGeIWLDvLfm2sx.MNzAoj_Bqa7Yqkk9armaH.D_LVVwit .byJ.hpSW75eC82GC.D9ykrTubuPmeUUGkZQnvW40ySl6PN.csEgp0GTtUct 0AvQBwYH0HAOGrNY.Jiix95U3JMObWOVAQF..TlX114N0XvcukY1V7L1uMJj SkoxVP8SqTu_z4zgGYhsPYaKRlsEKiUqvcoSZZ.Vv3IJUeHoq1.PTGkBB3Ns vL6srYOtmwjTjB1NzgzreuGn.IIJjPNpCl8jc.ZKRgJODtlPvWaVsAHZ_9Xp lNMjQkFECr.QxMafpRk7oeY01GnuknDpa4AP5lFzplvur1txRQE9Uy5_b_m2 SavhpdXHnjM6IghUjzQ4CVuNTgB7dYOZqV6gUnrTD1vxuS5JH23tZgWpcAE7 eShJ3QXHrwo4K6zSzNrSlKxe.AIXpOmoHfGRJpRXGDLZ5.L6lxx_OktBrMLA RR9vvcJKJiNrwBil6RUGCynyW1mdSblB00QaWNm6h6AiJ5VttJGnk1g8.LqC VavXOibbWGyV3HsSRQA9GINsXgHtDGaSNDe9bRgF4n4Et41v8swG2l4YbHip 9_RpDY3J3IjaxdYz0TE8AkYrpLsL26vFVuABDqY_.fsgyrbTAdX8zQjANDAu aBhfkAuV6QgG9x7.9AG2B2MTX4WM6v0RCl2mqBXGu7fmJWLeozlIT2qtfRPY YZ8lFV8lDxke2VdnqDeGcIYaHKI_2VemZz3bA0kHtotVLOGKaKB92WUldD2C nGhjxqdDtavZpEuyYx_lvLRku7gbLX7MF4UUQ9eH3jzJCf7zwru3fo13lMer Zj_58kENGE5M5Q_ltIqAgFWkk8THzn4XpGbciBNL5MH0UsGb4VWXSomhvfno fnGIQnAJYcRaHbS5.jLnc2h0EUnFhm9DtQ0IV7Vltz84aIYLkf_eRfxEOvLT _ABwi0GHcIrpKgG7XOtn29hmFvXm48mM7tYYFnxXbPsjgJHlb7tPjV6nnQeR _54VbTG5CdYET6cuLcsZUdAd32QQTUyP5sx17kX.02KQrMJ447ICmqFbWOYT b4BuJcWAWRaocS_3vFq1E1orwp5uNIaxCsoUJMMzJSeA.4ZC7s4EHhaw4mCx NnsBHf5Mhl.Sf68vpBreS5UdC6jMO8hfSHDgRKdCHVQviVRyxJziUBHL_mZO XfWEkJTcbfmW1JIvM0WGRuXtjpxP.MdgD.xzcG5WLaeo4WeRMfrs0ZIGQHV1 yokjjXQqvA–
X-Originating-IP: [64.98.42.56]
Authentication-Results: mta1035.mail.bf1.yahoo.com from=sambachambers.com; domainkeys=neutral (no sig); from=sambachambers.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO smtprelay.b.hostedemail.com) (64.98.42.56) by mta1035.mail.bf1.yahoo.com with SMTP; Thu, 01 Nov 2012 14:00:24 -0700
Received: from filter.hostedemail.com (b-bigip1 [10.5.19.254]) by smtprelay02.b.hostedemail.com (Postfix) with SMTP id 82C1D6F53; Thu, 1 Nov 2012 21:00:04 +0000 (UTC)
X-Panda: scanned!
X-Spam-Summary: 2,0,0,,d41d8cd98f00b204,mendy12@sambachambers.com,::::::::::::::::::::::::::::::www.::::::::::livelovelomf01|2271098624|66D5B93
X-Session-Marker: 6D656E647931324073616D62616368616D626572732E636F6D
X-Filterd-Recvd-Size: 1514
Received: from webmail10 (imap-ext [64.98.36.5]) (Authenticated sender: mendy12@sambachambers.com) by omf01.b.hostedemail.com (Postfix) with ESMTPA; Thu, 1 Nov 2012 20:59:54 +0000 (UTC)
Received: from 41.138.172.76 ([41.138.172.76]) by webmail10 (Webmail) with HTTP; Thu, 1 Nov 2012 20:59:54 +0000 (GMT)
Date: Thu, 1 Nov 2012 20:59:54 +0000 (GMT)
From:
Aminata Bangali <mendy12@sambachambers.com>
Reply-To: aminatabangali2@gmail.com
Message-ID: <1292028862.178387.1351803594865.JavaMail.mail@webmail10>
Subject: Greetings From GHANA!!
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
X-Mailer: Webmail
X-Originating-IP: [41.138.172.76]
Content-Length: 812

Name/Email-Address: Aminata Bangali <> mendy12@sambachambers.com <> aminatabangali2@gmail.com

This scammer is also going under the below IP’s and addresses:

Aminata Bangali has many email addresses. A few handful include <> aminata2@mendyschambers.com <> aminatabangali@africamail.com <> aminatabangali@mendychambers.com <> aminatabangali@yahoo.com <> aminatabangali@msn.com <> aminatabangali@gmail.com <> info@guarantytrustsec.com <> info@guarantytrustsec.com <> aminatabangali7@gmail.co <> <aminatabangali7@gmail.com>

>< Aminata Bangali >< mendy12@sambachambers.com >< aminatabangali2@gmail.com >< aminata22@infonets.info >< aminatabangali6@gmail.com >< info@guarantytrustsec.com >< SeferiaB@trumbullps.org >< go@win.com >< SeferiaB@trumbullps.org ><

Previous IP’s used:

Originating IP:  41.71.177.75 Location: Lagos, Nigeria

Originating IP: 64.98.42.177 Location: Toronto, Canada – smtprelay.b.hostedemail.com – mta1196.mail.mud.yahoo.com

10.5.19.254 >< by smtprelay06.b.hostedemail.com

Mendy Samba also known as Aminata Bangali also pretends to be Western Union Money Transfer – And Fred Williams

Fred Williams >< fredwilliams3@rediffmail.com ><  www_western_uniontransfer276@superposta.com

Some more IP’s used by the above scammer:

Some IPs to avoid –  41.216.50.79 ( web92415.mail.cnh.yahoo.com ) >< 41.218.238.107 >< 41.216.50.209 >< 41.138.172.76 >< 74.125.83.67 ( mail-ee0-f67.google.com ) >< 10.14.193.136 >< 10.14.175.68 >< 64.98.42.56 >< 10.5.19.254 >< 64.98.36.5 >< 64.251.52.6 >< 203.188.201.85 >< 203.188.200.143 >< 119.42.242.156 >< 74.125.83.67
 
 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

”Secret Shoppers SCAM – ”Mr. John Peters”

Scammer’s Details:

Name: Mr John Peters Email Address: Shoppersresults@yahoo.com IP Address: 98.139.212.164 – Recieved from: [98.139.212.144] and [98.139.212.212]

Subject: ATTN: Read and act fast

From: Shoppers Results

EMAIL: (This is the second or third email from the scammer. I’m just baiting him. I didn’t really send information and made up a address. His other email’s are somewhere in my filtered (made-up) folder. I’ll add once I find them.)

This is MR. John Peters from the secret shoppers , would like you to please confirm the receipt of the package on 1st survey assignment .. The package got delivered by FEDEX to the name and address you provided us ..  Would also like to know when you will be able to get the survey completed via WESTERN UNION as the instruction in the package indicates ..                                           You can call or leave a Message on  310-742-6596 .TEXT MESSAGE: (213) 537-3204 PLEASE MAKE SURE YOU EMAIL DETAILS ON : shoppersresults@yahoo.com Regards, JOHN PETERS Secret Shopper®

  Read the rest of this entry »

 
 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

 
%d bloggers like this: