RSS

Tag Archives: Project Honey Pot

“HOUSE OF LORD’S ORGANIZATION UK LONDON”

INHERITANCE / LOTTERY SCAM – COUNTERFEIT CHECK

ATTENTION: This scammer had previously sent me a similar email on November 13, 2012 under the same email-address of info@lordsdept.org but the reply-address was managementfile1@gmail.com IP 41.216.50.32 (location: Nigeria) and 213.154.64.102 – For more information click: HOUSE OF LORD’S ORGANIZATION UK LONDON 11/13/12

EMAIL: ATTN PLEASE
The HOUSE OF LORD’S ORGANIZATION UK LONDON Have just concluded the meeting
with the board of Trustees of United Nations Organization and
Representative of all the financial institutions, The meeting that has
been for the past eight months on financial matters, It has been agreed to
release all long terms debt, These are the classes we are looking into:
those whom has been one way or the other denied their Inheritance or
Contract payment/award payment due to corrupt official services,

After our mutual investigation in the recent schedule for payment of
outstanding debts incurred since 1999 to 2012 according to your file
record where we got your email address; your payment is categorized under
section {B}: Contract type: Lottery/inheritance/ unpaid contract funds/
Undelivered Lottery fund, Attn: Beneficiary, We have decided to bring to
your attention, that you were listed as one of the beneficiary, The
executive council Have decided to pay as many they have their file record
on their desk on a direct wired transfer, The total sum of $5.5usd has
been approved under your file according to elect,

Contact the processing/paying manager for your direct payment of US$5.5M
(five Million Five Hundred Thousand United States Dollars), you are
directed to contact the International Remittance Department of Benin
Republic who is In-charge of the payment
via E-mail:
E-mail: olusegunoniwon@ymail.com
E-mail: consultationdept@yahoo.com
Phone: +229 674 067 42.
CONTACT PERSON: MRS. ANDRIANA U. OLUSEG
INTERNATIONAL FUND REMITTING DIRECTOR.
HOUSE OF LORDS BENIN REPUBLIC.
Also provide the following detail to her for immediate release of your fund,
Also it is very necessary and important that you send us an e-mail
containing your vital information?? As requested below so that you will be
given an immediate response and directives on what to do next:

Full Names:
Address:
City:
Zip/Postal Code:
State:
Country:
Present Occupation:
Company Owner:
Company Name:
Gender:
Age:
Reachable Tel#/Mob:…………..*No Voice Mail Service*
Fax:

THIS REQUIREMENT MUST BE PROVIDED TO HER COMPLETELY,
As soon as the International Remittance Department in your file location
receives your information, your US$5.5M will be Transfer to your nominated
Bank account. this payment terms is to keep a clean slate of all debts
owned by the government and company to individuals either by contract or
award fund, we hereby plead for any inconvenient that you might have
received by any of this corrupt officials, The United Nations Organization
will not be interested in your story of not receiving your payment if you
fail to abide to this Instruction.
Yours Faithful,
Mr. Anderson Paul
Public Relation Officer
Strand Bridge House 138-142 Strand,
City of London,
E-mail: com.unit@net.hr
Hot line +44 020 8759 9090
OUR REF: H/L/UNN/APXB/TF/08
IMMEDIATE PAYMENT
#:WB/PC/FMF/MIN/UN/APXB/08.
HOUSE OF LORDS LIAISON HEADQUARTERS UK LONDON OFFICE.

SORRY IF YOU RECEIVED THIS MESSAGE IN JUNK BOX IS DUE TO OUR SLOW NETWORK

HEADER:

Return-Path: <info@lordsdept.org>
X-YahooFilteredBulk: 213.154.64.102
Received-SPF: none (domain of lordsdept.org does not designate permitted sender hosts)
X-YMailISG: n17TtrcWLDsdDEuSkY_HSkT51L21bPdZBMwxi6AQhYevQE6n 5AHJGUMCXxFcQWA_8b.NyHFBqZMcO.UjZ8FCertxLymBdRPX5yB160N2TGnm qwaPHWExX39Nk3fcXAu.PafkPhJjSLuBXZu9PORr5C.y390tBzQRaxX_Ajeo 7Hur_RtoMBNsEKEcS1NY_jJ7MVItgwhEdNv6BMjqx_b1MlG92f5bS_CtuAVd .oh_JKiqCucKnJdR_vA8__9UE.1fwuLwZ2jBdATHKGRXWA9jdgOwV3Ib69fT EOd7eaFTWdb_5Z16_.TYe.j7ArE3IJKpEKIk4E3slNCtWmGIRFmTka.H7YVU kHIFWlOe90o2tvuCYr8RvUv71WE0TgPgVl6Khq6RD5q1jIaXuAGNiZL303nP R7TIfXxur5a8ZC_2oHyszcv9WRLQjWFSCzGvGQYUJrk_g_Fa1qrpUjRjeM2i l0G7FO2XeR9HCwaTT2znjIqPkdy2KwzEIIjCz.N4kogQKc2kG9n6xWFpcpLo 74MXi2XlqMqfjw4Cj80wiP3jwE0ktGXxBGMSU_2n3YAQ21o2uVONL1mXGIl5 4bMmhVshiHKswZJfj1BN.SBP2D3c53qVkVjkIDCET06u1nIveivDP4Y_oe4g Gp0bTWt5y_R1RqFMmD.AIwh_MS5N2hQgXY2q7xk1_gsgMw2uKxCqk5wcw1df NMnauhxNQjJs0_tgmkT.nJ.KTOhA_qgdK986CusmuMctpQOH_ihBK.jvNTSK btYCtI0byx3BytVo7snXt8QYK6E5Jx9k3ZzauOFpR59.AeWK_EuKrJxb5kp_ 3EZ1tBGHB.ss6mypa8vfMvhb8TINeip6CZPnWI2wlXwUR.ZEKIJrohmFVHFm KFYVmymAMCOdWOLWh2A.dyJSUrjLje2_aZ.DSuRVGpoAtJLHe0QsBF20RzyD 7dC25DeBhkcO8UHLsvng7wFO2coQ2XMhsp.ayEqCe4X2lpjsh2lah9Xo7V7L pPiABw_yasLUGHztyfOUYJ9OSusCqxN.k2MPixuf1vKCB7pq65Iyc4p2uGVC K6bnKMICrei.rxdj1vvTYbKEmvHVsmn.tfhS5B0nTlah3FmibbEpZKHX7Upe wqrzGbwYMdD9LSIDpmkIqF3bRJMX91BdA08UsLs4_E931bhwDffu1ERuYjIw WyEwbhIfjONgETEO8gEzvb42sZbk90Wsxo5b2y1F4ypAzD7R2VyYuQIFQHpb _kcoyrCgQZolEt10hXFRxy0X5MWOAFCOxnDTvDjoJuR2m5Q4DJk8Ic5xuXp8 QCyFyE5lHJPSNnKZ9A15ErmDah0X_ZcVtz5Ri2C_TQNylkHidCSUd8sG0SJb Mg567n3VzIfX6JYHtqlSY9NbCE.G8GC_kNiS.WMe0oeKI7OGev6vbuV8Hzjf yRICVnPIJjSU56vQ91Rk6elLYGnonbkMLw–
X-Originating-IP: [213.154.64.102]
Authentication-Results: mta1349.mail.mud.yahoo.com from=lordsdept.org; domainkeys=neutral (no sig); from=lordsdept.org; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO smtpgp.orange.sn) (213.154.64.102) by mta1349.mail.mud.yahoo.com with SMTP; Sat, 01 Dec 2012 01:51:12 -0800
Received: from sunumail.sn (HELO srv1-smtfree-msg.orange.sn) ([213.154.64.61]) by smtpgp.orange.sn with ESMTP; 01 Dec 2012 09:17:34 +0000
Received: from [213.154.64.43] (helo=www.sunumail.sn) by srv-smtfree.orange.sn with smtp (Exim 4.43) id 1Tejj5-000827-EM; Sat, 01 Dec 2012 09:51:11 +0000
Received: from 41.203.79.249 (SquirrelMail authenticated user fletcherdavid) by http://www.sunumail.sn with HTTP; Sat, 1 Dec 2012 09:51:11 -0000 (GMT)
Message-ID: <55073.41.203.79.249.1354355471.sunumail@www.sunumail.sn>
Date: Sat, 1 Dec 2012 09:51:11 -0000 (GMT)
Subject: NOW CONTACT THE GLOBAL FUND REMITTING OFFICE FOR YOUR APPROVED CHEQUE.
From: HOUSE OF =?iso-8859-1?Q?LORD=92S_ORGANIZATION_UK_LONDON?= <info@lordsdept.org>
Reply-To: consultationdept@yahoo.com
User-Agent: SUNUMAIL/1.4.2
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3
Importance: Normal
X-SA-Exim-Connect-IP: 213.154.64.43
X-SA-Exim-Mail-From: info@lordsdept.org
X-SA-Exim-Scanned: No (on srv-smtfree.orange.sn); SAEximRunCond expanded to false
Content-Length: 3749

HOUSE OF LORD’S ORGANIZATION UK LONDON

Some other email addresses and IP’s used by HOUSE OF LORD’S ORGANIZATION UK LONDON SCAM – info@lordsdept.org <> com.unit@net.hr <> managementfile1@gmail.com <>  olusegunoniwon@ymail.com <>  freshtools@wanadoo.fr <> hackk@smtp.com <> 213.154.64.102 <> 213.154.64.43 <> from 41.216.50.32 (SquirrelMail authenticated user david_fletcher) by http://www.sunumail.sn <>

RECEIVED: from 41.203.79.249 (SquirrelMail authenticated user fletcherdavid) by http://www.sunumail.sn with HTTP; Sat, 1 Dec 2012 09:51:11 -0000 (GMT)

MESSAGE-ID: <55073.41.203.79.249.1354355471.sunumail@www.sunumail.sn>

More scammers who’ve sent out email spam under 41.203.79.249 are:

From: <sales1@home.fanwrestling.com>
Subject: Fwd: Re: Wire Transfer Confirmation
From: Tagged<Tagged@taggedmail.com>
Subject: Re: Fwd: Wire Transfer Confirmation (FED REFERENCE
From: <hien_u_spine@hhp.sugarmotor.net>
Subject: hien_u_spine@hhp.sugarmotor.net � ROLEX Inc � Disc
From: <kathytessendorf@mailfront.cbulock.com>
Subject: kathytessendorf@mailfront.cbulock.com � ROLEX Inc
From: LinkedIn Password <password@linkedin.com>
Subject: Reset Your LinkedIn Password
From: <Harrietjeancy@gmail.com>
Subject: Fwd: Re: Your Flight US 66-56833
From: “Purchase Vigara” <EAF01C7@tennlandforsale.com>
Subject: Weekend sale

western_uniontransfer121@hotmail.com — Received: from col0-omc4-s16.col0.hotmail.com ([unknown] [65.55.34.218]) by vms172065.mailsrvcs.net

From: Western Union Payment Center western_uniontransfer121@hotmail.com
Subject: FROM WESTERN UNION AGENT MR.PAUL EZE
X-Originating-IP: [65.55.34.218]
X-Originating-IP: [41.203.79.249]

From: Office Ups Courier
Subject: Urgent Delivery of your ATM Card Payment Through UPS Company Delivery.
X-Originating-IP: [77.238.189.61]
To: undisclosed recipients: ;
Reply-to: upsofficecourier@yahoo.com.hk

Received: from [41.203.79.249] by web29301.mail.ird.yahoo.com

From: Money Gram
Subject: Dear Customer.
X-Originating-IP: [77.238.189.216]

Received: from [41.203.79.249] by web132219.mail.ird.yahoo.com

Received: from nm25-vm8.bullet.mail.ukl.yahoo.com ([unknown] [217.146.177.154])
by vms169119.mailsrvcs.net
(Sun Java(tm) System Messaging Server
Received: from [127.0.0.1] by omp1016.mail.ukl.yahoo.com with NNFMP; Tue,
29 Nov 2011 19:54:16 +0000
Received: (qmail 69819 invoked by uid 60001); Tue, 29 Nov 2011 19:54:16 +0000
Received: from [41.203.79.249] by web26303.mail.ukl.yahoo.com
Date: Tue, 29 Nov 2011 19:54:15 +0000 (GMT)
From: “Mr.Edwin Aja”
Subject: CONTACT DIPLOMATIC AGENT IMMEDIATELY
X-Originating-IP: [217.146.177.154]
Reply-to: adamsvictor14@yahoo.fr

IP 209.239.47.191 as relay: IP: 41.203.79.249

YOUR BANK DRAFT DELIVERY NOTIFICATION!!!
Contact Person: REV.TEDDY HARRIS
UPS Courier Company.
E-mail: upscompainy1133@hotmail.com

419 from above IP, using 3 Yahoo IP addresses, including 98.138.91.34, as relays:

YOUR WESTERN UNION PAYMENT CALL TO CONFIRM @ +229-98679197
Vital Finance Bank Western Union Department.
Location Address; Plot 1261, Adeola Hopewell Street CO/B/REP,
Contact Person: Mr Chris Mike.
Tele phone Number: +229-98679197
Email Address: ( westernuniontransfe6@globomail.com )

“Western Union” Spam from above IP (Lagos, Nigeria), using IP 196.1.218.76 as relay:

Call Mr Kevin Anthony For Your Mtcn.
webmail address:( western_union001@qatar.io)
tele phone.+229-984-168-39
Contact person Mr Kevin Anthony.
November 17 2010 03:11 PM
H.User7043 commented…
“Western Union” SpamScam from above IP (Lagos, Nigeria), using IP 211.55.29.156 as relay:

MESSAGE FROM WESTERN UNION
Director; Tuker Hans
E-Mail :(cbbj@ymail.co)
Direct line: +229-66-614-055
October 09 2010 09:39 AM
H.User7043 commented…
From “Tony Chris,” purporting to be a poatmaster in Ghana, as a follow-up to an email from a “Barrister Paule Eze,” offering me an ATM card worth 2.4 million Euros.

“Attention Beneficiary,
From: TONY CHRIS ”

 

 
 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

“brenda484@gmail.com”

PHISHING ATTACK / SCAM

Don’t click on any email links by unknown people. I received an email from brenda484@gmail.com on Nov 27, 2012 with a phishing attack email and now received another email sent in a different language from this same scammer under different email-addresses and IP’s – the return-path is still brenda484@gmail.com –

12/16/12 UPDATE: Scammer under email Brenda484@gmail.com sent me yet another phishing scam under a different language. The new information is under  “บีซี อีเว้นท์” bc_events@game.co.uk AND bc_event@truemail.co.th

RETURN PATH – “บีซี อีเว้นท์” <brenda484@gmail.com

EMAIL: สนใจสอบถามรายละเอียดได้ที่ 085-1109502 คุณฝน, 086-6030111 คุณปิงปอง, 081-5640074 คุณเกด

หรือคลิกดูรายละเอียดได้ที่ http://www.bceventrentals.com
ขออภัย หากอีเมล์นี้ รบกวนท่าน

HEADER:

Return-Path: <bc_events@game.co.uk>
X-YahooFilteredBulk: 203.144.222.231
Received-SPF: fail (domain of game.co.uk does not designate 203.144.222.231 as permitted sender)
X-YMailISG: V8iKDiEWLDukIvEUd07T.eU6cbY7Donq1ujwuoabD2tkLpCF WneV9d84VRTikW_lln6bXvguS4EQ3tP2YEvi7iyAj81ypCtWrTIfaSy8dcqk AmLfhr1HzbjRrh2HlRvtRDTe433HsjHwxmhdNy6CQT5zMZPblrZT7h_bD9FP MaTAUq9pknWtGlsBGymfofpvDntKMpLs4pNF.NKOBYs1jyMHMdp4oRksYdfH jYRQxLPOkCbtHVm4OMTIUB.C4ROsxDSsoljaVeBeKJJX0kgO3N0inEy1i9Bg s0jpFnnRMcU.4i1psAN9N7jbWN9WuuOjCzpDsv2S6uFq0FrM6INJ8V.OcaQE OJsvzRxSKy8tj77uf28g9AJp9bDPykwbuYeiEbIPkDfTjytPWyTck.uwIP.P XijywEjp4H_KbDgLcaBFcWQf6Le_nqLxAh7N.I98WcCF6oQ.9jH.VPVEbJ98 8ykioC1woM27FUdz2sdoc8XJa.ygZWxcwowYPbwA7UXibZT6kIA3yPh6Xvqr pqG7FVcw0V4luAtD5J5d.mynWJ9dk3dBAiP853zmrPjWpeIXKtW2oHlqEwTV IMwTSWywf6u_oWggVJa3ZzYxnkP6dDPfW9TIGtrgXd6W6WMm21xzrEOpCQ4m yGDnGTjb8qhYRRLSIreIi91Xhmgrzz9Fx3..dEnrH3vQmm3ehNJPwzxMMtjf bDW_f0n.Jt02kRmkQPiZ0A3wRMqs1uOUHiwwgMxU3XdFdjfJZ3Kx1MyK0S8o wPWBxB3VSOJFpXMrQXN2UEdFIzZEnQz0_IDQUciv34qLQn2NwZsUBFp13OA2 QKcYuNdziGwUWOnvx3yx1vk9X8n2fnIOHE5tSg7ZVdsfHDCY1kIhB.4MOk2u hIHzV6JI4Cr3g7PlD8ewmEM3afqncmiY3Ocp7d8jCfdfZWD7XU1QiHu8Nz7d MZYUjTVoSb6ujsZBATEb.EikW1fDPaZQM6tGqL57TSG9MPQMuxnsI3nx4vFI VIVl222nBiYIWOtDEVJyUcT7MnnWQrVaWNd72oAJkkmQvcjw9VyKfSrIxl0o .m8ljnYURbG4Ki2S1noxU5q9.9X8yal8Sfx2xOw_bvcvYyil8XdgxA990ES. 55Iu_hdq.SsK05ey1kWBBW3SsA6k2IyhZuP2UhiH.r6HXUk8WllMgev4c3D8 ifhEoFkyioe.F_DFvS_y1Rm_0RtCFsC3VtW.36JHewSySpFrQS9ToJeY6I.n X3FbmH_E_8SGD1Jxld7DtufocNbyQsI.3Yb6ngTCr1gyeq.S6ssFPmIHsRKs Re2.qKBLIGqCLgeRWMOLLu1Ilj371FFF_8hj.ApDASz5HHSMeLkPDjkgIOfu JYeL4AfhkyoeXV1yQUS2qDebvYeSCrcnUmNLgukMncdLaR0w3vfonQFL4tW5 V4JAoe.RttiA3ZBh.1DK8St98.Q9thTCtjhI0Qz8Xk10HZA-
X-Originating-IP: [203.144.222.231]
Authentication-Results: mta1235.mail.mud.yahoo.com from=game.co.uk; domainkeys=neutral (no sig); from=game.co.uk; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO mail.asianet.co.th) (203.144.222.231) by mta1235.mail.mud.yahoo.com with SMTP; Sun, 16 Dec 2012 04:17:43 +0000
Received: from irgb6.truemail.co.th ([203.144.173.222]) (envelope-sender <bc_events@game.co.uk>) by mail3.asianet.co.th (qmail-ldap-1.03) with SMTP for <dhl_compay@yahoo.com>; 16 Dec 2012 11:17:41 +0700
Message-Id: <1f5e00$ktqc5s@irp3auth.truemail.co.th>
X-Auth-ID: bc_event@truemail.co.th
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: At8PAGZKzVBuqH3V/2dsb2JhbABFgkkJAoNnpWWRORpfF3OCLRsDAQYcDSYKCwEGCzMCBBcgExEeiAcNjhuMJI5RkXUCjFWDMA2BBgMEiFuOR4QkiwiCfw
X-IronPort-AV: E=Sophos;i=”4.84,291,1355072400″; d=”scan’208,217″;a=”702361794″
Received: from ppp-110-168-125-213.revip5.asianet.co.th (HELO Automail04-PC) ([110.168.125.213]) by irp3auth.truemail.co.th with ESMTP; 16 Dec 2012 11:17:40 +0700
MIME-Version: 1.0
Errors-To: notification+zj4ocjc=oycyha@facebookmail.com
X-Mailer: Microsoft Office Outlook 12.0
From: =?utf-8?B?4Lia4Li14LiL4Li1IOC4reC4teC5gOC4p+C5ieC4meC4l+C5jA==?= <bc_events@game.co.uk>
To: =?utf-8?B?4Lia4Li14LiL4Li1IOC4reC4teC5gOC4p+C5ieC4meC4l+C5jA==?= <brenda484@gmail.com>
Date: 16 Dec 2012 11:17:45 +0700
Subject: =?utf-8?B?4LmD4Lir4Lih4LmI4LiW4Li54LiB4LiB4Lin4LmI4LiyIOC5gOC4geC4oeC4quC5jOC4leC4ueC5ieC4q+C4ouC4reC4lOC5gOC4q+C4o+C4teC4ouC4jS4uLi4u?=

203.144.173.222 << 110.168.125.213

From =?utf-8?B?4Lia4Li14LiL4Li1IOC4reC4teC5gOC4p+C5ieC4meC4l+C5jA==?= Sat Dec 15 20:17:45 2012

___________________________________________-

FIRST EMAIL (BELOW) SENT ON NOV. 27, 2012

the email says:

SUBJECT: Hey sexy

EMAIL: hiya sweety im on live in 2 mins hurry

A link which says ”Check it out” is also posted in the email but when I put the arrow over the link, the URL says 44744(dot)MOORI.com pop’s up in the left hand corner.

HEADER:

Return-Path: <brenda484@gmail.com>
X-YahooFilteredBulk: 80.146.246.58
Received-SPF: neutral (80.146.246.58 is neither permitted nor denied by domain of gmail.com)
X-YMailISG: fFqwGLYWLDuJvRbrqBfwSp47W8ESHVWUjVx6HsFhxNt1VSa3 nmxYA2jh7MwbWq3Y8ECj9mbQA._5LMTfVfJOuEcmgVllmPCSxfdf1iWXkX00 nORqxpnulVoo6r2SS5uTuLWQ46QGbyxQVBLom_mS5OE5mGQeLZDA0xvKML2f ApIzl6I.FTwV1DV.Hi0bWIrlYNeOfAjLP6v4k8oaF3aL7A6Jml96Hqd7.jXe jbBdUG.cvdCOTZIog_SxaQYXn0p.q_0RsnPLhJ9i_DFtWDztnYgE8YztIm3r aVhXCuPZPo2FW5wVqtoTUb.wYIIIynIx8v_4p4P.OQaNsFbP5Z3jUyKi9Bhr Sgt2bvoJy8UVJ_ZS84l6ermlo2pQ7DVq8KL9gx5Y01c7eTzR8fuxSUF8cZcy RCfTj7Mca4Am_.runc_zQolKgZjR6fnXKYWwSMNUcuHnpHVy7d1ajGpTFnjb 4J2m6GKzjCtHk9hNrelEN0kzHLtWawhzjgOLreVQcHJ1oO5YQ_1.BpSXmE6g RHvrvKug4DaSCW18Q0RIb5WuGlgZMl4mw2z0Kj1Nxyjm69ASuInOpuMQ_QkN mvb2_gmhHmV1C1crkvEEvUH53HRxZeJmsJVw39HN6ZZi8qM_DEqPEuh3ifBd 5KDbk5ePSnak9vOfw2tXfwwHhWBlluY9Hesmb1BHfGfdmeU2wj193T7VWDeo 3TXbBMVuJNdknHJoK4Q9XbYglmqVbnQy24RBJ6aMpnH4.vgQc3gLZ1XaLCLV s_Jmcagp1ofn2Iy22NYeVCcbiXZu.Yfk6196pJPEVkHU2A27vzT5E2OWjM7O 4YsVfYmzSF.TSbhpxkM4Ht2lFuOZdM6PTJ293jit71tuKSm_v6deLJK_8Q9R GTum5hYP1KFhnV4vttpI12u6IRuPVSkuhmyEInh4G1qI343mgOV0ufytd9FS foxataiUDQMIq0A.RbCSglcom5NoBP6ezbkpm9dLHKdaQgXKKOmdh5t_2J_s ks3NqU1_xK4bDvCl96vUgUB65m9QXsahrJncxCeDSl6WqOSrp6unFiv1wqDu b8Vv7bQVdtfrAX3MhyL5CqIHjzdDAopC
X-Originating-IP: [80.146.246.58]
Authentication-Results: mta1006.mail.bf1.yahoo.com from=; domainkeys=neutral (no sig); from=gmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO rstbarracuda.rst.de) (80.146.246.58) by mta1006.mail.bf1.yahoo.com with SMTP; Mon, 26 Nov 2012 20:45:43 -0800
X-ASG-Debug-ID: 1353990575-0cf27fad0001-SjFj3c
Received: from web7.rst.de (barracuda.rst.de [80.146.246.58]) by rstbarracuda.rst.de with ESMTP id 3fwwmGkzjEJ9rLCW for <porkyexposed@yahoo.com>; Tue, 27 Nov 2012 05:29:35 +0100 (CET)
X-Barracuda-Envelope-From: brenda484@gmail.com
X-Barracuda-Apparent-Source-IP: 80.146.246.58
Received: from localhost (localhost [127.0.0.1]) by web7.rst.de (8.14.3/8.14.3/SuSE Linux 0.8) with ESMTP id qAR4TcVd010064 for <porkyexposed@yahoo.com>; Tue, 27 Nov 2012 05:29:38 +0100
MIME-Version: 1.0
X-Mailer: AtMail PHP 5.06
Message-ID: <65131.1353990578@hochrhein.de>
To: deleted@yahoo.com
Reply-To: brenda484@gmail.com
Content-Type: text/html; charset=”utf-8″
X-Origin: 108.46.239.206
Date: Tue, 27 Nov 2012 05:29:38 +0100
Subject: hey sexy
From:
brenda484@gmail.com
X-ASG-Orig-Subj: hey sexy
Content-Transfer-Encoding: quoted-printable
X-Barracuda-Connect: barracuda.rst.de[80.146.246.58]
X-Barracuda-Start-Time: 1353990575
X-Barracuda-URL: http://192.168.217.58:8000/cgi-mod/mark.cgi
Example Messages Sent From 80.146.246.58
From: maria92@gmail.com
Subject: re: you are welcome
From: betty556@gmail.com
Subject: my new email addy add it
From: lisa829@yahoo.com
Subject: re: cam?
From: Kimora325@netzero.net
Subject: finally im here
From: sarah65@aim.com
Subject: re: dont lie!!!
From: alice446@aol.com
Subject: re: roflz is that real?
From: Angela485@gmail.com
Subject: i msg you before but i guess you didnt get it
From: sharon133@aim.com
Subject: re: your profile

192.168.217.58 – PROXY SERVER IP ADDRESS – LOCATION: JAPAN

 

Tags: , , ,

“Mr. Gordon Chen”

INHERITANCE SCAM – ADVANCE FEE FRAUD

EMAIL: I want you to come in as the Next of Kin/Beneficiary to this account (Attached file also came with this email titled Legal Inheritance)

 

HEADER:

Return-Path:   <offfice@live.com>
X-YahooFilteredBulk:   106.10.148.151
Received-SPF:   softfail (transitioning domain of live.com does not designate 106.10.148.151 as permitted sender)
X-YMailISG:   27h5RaIWLDtcfEfxeOWcB.UWqQCwRUZ.QTFz7C4wIIcpIIYs Yev6iT1dSSHaJZFeF68fgj0QO2UhtMK9T9eNQWLRRPyvrJqw3zNo95hpWKPX aV4fSQFs.MM9vVO4fGexiKzUhGl5oXCAY.34zMf_PZTEuVrsoWCGnAu5Pfwe sUdqJg9wdi1wIZZlhOwoakLt0OGjXrBmzFR831FWB_7ZhO7Drme1PUiXxoD1 5dyCr5KvD_j0QEiPP.My_V1Wie5ODTBCNcEQbHoAxhdC1b0GxPT9OCvY_Xrf koMFO5KQy4ExAfBQ5j7NErnakQEzmf1aK9kA52zsk9xHNlk15t2g9tNMRphY StaHTTcY1j6UlIadfAdBw89D8o7slUNvBn4vRX5aCw4HQ1H5E2uTUtLO1Nbx 7Erj9VpkYR4WNZictqzvHFm992d3oo6eNV.MJyU5d0LCV.wp3AWlMpEqmYyB 1vWsBbnOpN4qGlL8pRdZaSnPZRPGe.hzNX__bzyp9Q3I7NJ2ALeBBxNE62Ox tXHrqQDM4ViFHaEBtaI19GKxwUj5y4FHGHgqx0TsUx1Hll2lCYZ27HYvIcX0 9BIjqQU38YPEAp3ozTQfHFAZh9pKmVxc9fGOUFJq1za8C_6VqJTdFK1uxeco qVlgmmjTwljDH_1b7EPsM_24eDpybuGd0Z6z3r.hRV3nCofV9myLZ5R1U4CN 61EbYwJp_RUD41EPHKWxSfV8mEZvhNKxQr.oEv.Ssz8fOeDIca23WvIAeqqW 2zRkCmVBvY39_0.XTyEgLhq.0E93w33QR4rroJoWxGXSjp5LJ9TAeBoyyvWU 7WcLnkeoyIsW8h7lUXVcJp_YXTAG8eYyNRsZxoZXM1eC2zOp1wBE3gXRpoLQ gQqcyl_fOZj45RoPwLdSsDVdXsRzcoFp6V3r.U4gYh2qPhYhqOlsjVx9oLdr vQwkiE7K61ggat79bsM9vNJNpBTmoGNrflksDnkwokRjmXTlaKBfDtKubnA7 YuBWx2ZHXbbyXIPq_g3kLw2OPTOw4cb2E3nPTVZ09ozz_HfqLXPbClUtihB1 fD1KHRXPFhT1QuBsWlY0CQUkSQGJmzSegKmrP382d8NM5M1lpfy6YtoUZBku VzyYKWNhQZ70tmx8f9UmHjEZgiMlc2xk9yfzx5IrQ_z1jqFJ.Kk_hgKevv4s 0zuDFrNThmG6R6yTTCoNJ2fpYof1vJwasKYb9CGis4egtJXhTwqnCAj0I37G kfGyt8hAjgWSlOasSg6aHRjXzsdhGLhG4Bw-
X-Originating-IP:   [106.10.148.151]
Authentication-Results:   mta1132.mail.bf1.yahoo.com from=live.com; domainkeys=neutral (no sig); from=live.com; dkim=neutral (no sig)
Received:   from 127.0.0.1 (EHLO nm5-vm8.bullet.mail.sg3.yahoo.com) (106.10.148.151) by mta1132.mail.bf1.yahoo.com with SMTP; Thu, 22 Nov 2012 08:17:21 -0800
Received:   from [106.10.166.112] by nm5.bullet.mail.sg3.yahoo.com with NNFMP; 22 Nov 2012 16:17:16 -0000
Received:   from [106.10.167.207] by tm1.bullet.mail.sg3.yahoo.com with NNFMP; 22 Nov 2012 16:17:16 -0000
Received:   from [127.0.0.1] by smtp180.mail.sg3.yahoo.com with NNFMP; 22 Nov 2012 16:17:16 -0000
X-Yahoo-Newman-Id:   360831.74249.bm@smtp180.mail.sg3.yahoo.com
Message-ID:   <360831.74249.bm@smtp180.mail.sg3.yahoo.com>
X-Yahoo-Newman-Property:   ymail-3
X-YMail-OSG:   o2T42rMVM1mEeIi6Ts2rnNQznaWoZEnnkcvHMQIhGgb1eRL ToyMC5B6aOkVi.BFLhgll_D7k.wwZnaFAqkXgSEjhyqOAI_B0AQqvqZyPYbN hzrV1o.Any0HeHdQUKcth6J9TEqHokT012QmC3YWqdnIynVaTUVYslqVG8rV bovPlTWEA_VH7wygGuxKTY4ygC9k2SV3GlquGSqJvq.QjBG_EG_Q1v4l4SGF BWvE5NK_PJPNQy_J1YPtJnS.iVKlpBHFi9jA7bDjNu2Go96uCQCGe4lMiLXw djgMRUQiEn7j2z4ni9BVyTzeNCPQN0EsPduIAsGqLPI49JUJ30pA.K5ucoNV zRBp30IJCCQazLcSbSGPpHvUW0lUmz4YqDmPQ77SaoOWrK8B41PSplqDHD9j 2MppiogeuP_lg9TEZmrXwzh6.tuwjf89_JyuZBTjgCqERwTbUQmcvt7H0wZs U0d_srT8lhcYh.NMtPire1dDKrp76U3wHQUtfwkmM.XKLcO_JNRBQwNbD7A- –
X-Yahoo-SMTP:   vS68oJaswBB0pb532Km3RRaYrwG2nnlHW00rxq2r
Received:   from User (offfice@121.14.155.106 with login) by smtp180.mail.sg3.yahoo.com with SMTP; 22 Nov 2012 08:17:16 -0800 PST
Reply-To:   <gordon-chen00@live.com>
From:  
“Mr. Gordon Chen”<offfice@live.com>
Subject:   My purpose of contacting you
Date:   Fri, 23 Nov 2012 16:18:36 -0000
MIME-Version:   1.0
Content-Type:   multipart/mixed; boundary=”—-=_NextPart_000_012A_01C2A9A6.768566C0″
X-Priority:   3
X-MSMail-Priority:   Normal
X-Mailer:   Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE:   Produced By Microsoft MimeOLE V6.00.2600.0000
Content-Length:   4706

Mr Gordon Chen <> offfice@live.com <> gordon-chen00@live.com

Project Honey Pot has detected behavior from the IP address consistent with that of a mail server, dictionary attacker and comment spammer. Below we’ve reported some other data associated with this IP. This interrelated data helps map spammers’ networks and aids in law enforcement efforts. If you know something about this IP, please leave a comment

Spam URLs & Keywords Posted From 121.14.155.106
Domainanoxic.funhost.org.ua
URLhttp://anoxic.funhost.org.ua/test.html
Keywordsready
Domainwww.ortho.ohio-state.edu
URLhttp://www.ortho.ohio-state.edu/search.cfm?q=http%3A%2F%2Fwww.pujckaponetu.cz%2F%3Fp%3D90%2F+p%C5%AF …
Keywordsbowdle
Domainweb.commicro.com
URLhttp://web.commicro.com/post/teto-casti-muzete-popsat-historii-vaseho-projektu-co-vas-2
Keywordschimneys
Domainweb.commicro.com
URLhttp://web.commicro.com/post/kvalitni-znacka-oboje-je-zcela-nove-nenosene-vcetne
Keywordscydfs
Domaintwitter.com
URLhttp://twitter.com/statuses/user_timeline/culcelriXXU_.rss
Keywordsswords
Domainweb.commicro.com
URLhttp://web.commicro.com/post/pujcky-kterych-strong-neni-potreba-dokazovat
Keywordsbookmarked
Domainweb.commicro.com
URLhttp://web.commicro.com/post/air-tech-air-conditioning-heating-2
Keywordsr?publique
Domainweb.commicro.com
URLhttp://web.commicro.com/post/zaroven-budete-zapsani-do-insolvencniho-rejstriku-coz-vede-zastaveni
Keywordsolrf
Domainwww.miclab.org
URLhttps://www.miclab.org/node/703381
Keywordsbcp soma
Domainwww.miclab.org
URLhttps://www.miclab.org/node/703372
Keywordsbcp soma
Domainwww.miclab.org
URLhttps://www.miclab.org/node/703392
Keywordsbcp soma
Domainwww.miclab.org
URLhttps://www.miclab.org/node/703367
Keywordsbcp soma
Domainwww.miclab.org
URLhttps://www.miclab.org/node/703378
Keywordsbcp soma
Domainwww.miclab.org
URLhttps://www.miclab.org/node/703382
Keywordsbcp soma
Domainwww.miclab.org
URLhttps://www.miclab.org/node/703374
Keywordsbcp soma

Other email addresses used by this ip address include, but are not limited too:

mbaecsszw@softbank.ne.jp <>  baku-nyuI17@softbank.ne.j <> y“c Œ‹”üŒb — hu61gdo4i6@hotmail.com <>    oqqqymiksvrr@softbank.ne.j <> ulsiizraq@i.softbank.jp <> disbp@docomo.ne.jp <>

For additional email addresses and information, please click: Project Honey Pot

 

 
Leave a comment

Posted by on 11/23/2012 in Inheritance Scam

 

Tags: , , , , , , , , , , , , , , , ,

“FBI OFFICE”

WARNING – INHERITANCE SCAM – ATM CARD FRAUD – NIGERIAN SCAMMER

ATTENTION: THIS SCAMMER’S IP IS BLACKLISTED AND IS CONSIDERED 100% MALICIOUS ON A SCALE FROM 1-100 – – If you’ve received a email/contact and put their IP, email address, host, etc and got brought to this post then you’re dealing with a scammer/phisher One of the anti-spam websites warning against this IP address is Spamhaus

EMAIL: Show Details
Attn please,
This message is coming to you from FBI office here, We are writing this mail to inform you that your (Inheritance winning awarded funds of $1.5million) has been totally converted into a ATM Master card and it’s to be delivered to your address via courier service, Be inform that the courier delivery company will deliver the card with all the manual and instruction both with PIN code to access the Card upon receipt. It’s the best option to receive this amount since every attempt failed, therefore you will need to contact the Barrister that helped in re-claiming the check back and converted it into an ATM visa card with his address below:

Barrister Necter Polimars
Email: barristernecter@yahoo.fr
Phone: +229-98651731

Send him your current address where the check should be delivered to and remember to indicate the Reg:code of ATM-0034 to him when making contact with him. Please also choose the courier service you would like to deliver the Card Post office is also working but could take the card much time to get to you.

Please endeavor to inform us once you have received the ATM Card.

Sincere regards
Robert S. Mueller
FBI Monitoring Team Service

HEADER:

Return-Path: <offilcefile1905@superposta.com>
X-YahooFilteredBulk: 203.188.201.151
Received-SPF: fail (domain of superposta.com does not designate 203.188.201.151 as permitted sender)
X-YMailISG: ezBF7kAWLDtzu.6WTiJebVEzmQUIcG_PNd1CwpI.7FK_4hEN Zny7zbsYgSrvRNEkKNAHyjYIgbXGVFrTSy5c9pyJLJT.I2rbeu56O.55aNRc EQ4OjPa65stTyuXMWPdmbc2Jchn20MKDdUhbt5XnuXvouwATkklv.if4Srwf PhgPk6NBUSLZVJfqBHUhuwGMHUb_GfrNTpQsO.6RIv6rP_BimD0cQ0sROi15 H3py5nbXAc.b_y9E7OCFREZrAT3GEMeHuzInLPwjPODQ7PFjnt8wP97VPfLP C3D6i4CW_Q9zsBV5HRucchEEUqIWMBzzTuLi6zi_ltdXIdLGccljYIUkibmP Ed6kSsw6JvdOn8x62zffgS3BLW6CK4UJ2WrxTzHnGsLVxdxZBcThqC8CcB.n 3tmyMvUm028RDYEH6y5spoHom3ZCQydyZ8aZ6a2CdE5op4jpI2fdBhU7ZyZN Dqdib4ZxEPlV37MS9RCDeUqBndpsXjq39haZEpSj.pWiwS_jeQggSyiCfzLA Du8yPKoCdbgkqs4xpA6z1bLRYqSSeiMETFaBAYVfqIhhHnCuGnRdSjKKcRfa QSyPrDLSrtpTgCxTxf8Wmlv5r9qoSzqTBs8y3639xGJz_TaqCvv2WGK2d0eL _2p6QjsaA6XBRYyI1olJHaBZnBshmo67FuoNCPeg2JBFZC9bJuLhNahvSF4K d9N2c5ipVC9pAsSeyKG_PiKl4ql1Y7q3l7f5IfZhlPgbTIJmn2Yxc78Fs.7b MF1ui8Dgn7t3rQehQiKwWpFk0q7WCC0IWZAAoZgM1h6Q.FP6orLyiR.Exv8D RiD.Oc4IbsY5WKoCy8ZMH.q.4LpS2Pyom.ERBABavo2ov5JSoNDBVWW6ss0t ySPJiqvMCEULgheeKtHOlWD1UGNWn5g77TqNnx8dnYwLT_Y2ONb0zrgj4.Qe TLuVJ7nQYutC4IN2EKxquWdtY9lDDBNt3EYmZ0jwRErSqsr1dKjHBzBUdu_s _0O.oK5IqEYhs8zBOHcckO_uJSRW.SQmfbTZF069RPGOwEu5ckgWIGwo
X-Originating-IP: [203.188.201.151]
Authentication-Results: mta1091.mail.ac4.yahoo.com from=superposta.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm13-vm5.bullet.mail.tp2.yahoo.com) (203.188.201.151) by mta1091.mail.ac4.yahoo.com with SMTP; Sat, 17 Nov 2012 02:43:59 -0800
Received: from [203.188.200.142] by nm13.bullet.mail.tp2.yahoo.com with NNFMP; 17 Nov 2012 10:43:55 -0000
Received: from [202.165.102.48] by tm4.bullet.mail.tp2.yahoo.com with NNFMP; 17 Nov 2012 10:43:55 -0000
Received: from [127.0.0.1] by omp102.mail.cnb.yahoo.com with NNFMP; 17 Nov 2012 10:43:54 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 977911.45325.bm@omp102.mail.cnb.yahoo.com
Received: (qmail 39060 invoked by uid 60001); 17 Nov 2012 10:43:54 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1353149034; bh=4NHRjGox1llxlGTpuwwzaXz2wAEyMSFQlVe/RepWfVQ=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=P0DhZFg9Mjj05/vqaDc0igv+GPAlNxBBckhxEzU4PJ/OEqkdNXv8cHYOGIrX06GRSxiYBDEXksxF+7O6itMLQryiu63e3X/TBdnGMXPpsJmwW89Nu0b5IpbVDCyBNfuzLVNzU62iHNFjxppWoL8m/2ohhLEweTQDE86CwjMFUjc=
X-YMail-OSG: UNddAlUVM1kvGGStE1FY34uiMeKn2clDYRgV8R.tDHiC3Gd LJa0arT0C
Received: from [41.223.248.96] by web92408.mail.cnh.yahoo.com via HTTP; Sat, 17 Nov 2012 18:43:53 CST
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.123.460
Message-ID: <1353149033.34956.YahooMailClassic@web92408.mail.cnh.yahoo.com>
Date: Sat, 17 Nov 2012 18:43:53 +0800 (CST)
From:
FBI OFFICE <offilcefile1905@superposta.com>
Reply-To: barristernecter@yahoo.fr
Subject: YOUR ATM MASTER CARD OF 1.5MILLION
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=”176961417-1892065883-1353149033=:34956″
Content-Length: 14962

This list below shows many bad IP addresses (sending out spam, virsus, scam, phishing, fraud, etc) that are being used by web92408.mail.cnh.yahoo.com 41.223.248.98 <– The IP/Host at this IP is being used by scammers sending out 419 scams

210.169.153.71 SOFTBANK TELECO ODN.NE.JP JP 5% 95% 2% 98%
200.13.169.3 AMNET DATOS EL AMNETSAL.C SV 49% 51% 46% 54%
203.115.0.14 INTERNET SERVIC RADIUS1.SL LK 13% 87% 25% 75%
202.147.75.21 POWERLAN LIMITE DOT.NET.AU AU 18% 82% 38% 62%
202.147.75.25 POWERLAN LIMITE DOT.NET.AU AU 18% 82% 39% 61%
116.50.64.53 WAN NETWORK FOR IN 59% 41% 61% 39%
213.210.218.169 SERVICES COMPAN NESMA.NET. SA 65% 35% 68% 32%
85.95.235.101 INETMAR INTERNE TR 6% 94% 4% 96%
124.74.42.242 CHINANET SHANGH JWS.COM CN 51% 49% 63% 37%
217.146.183.251 YAHOO! EUROPE YAHOO.COM UK 37% 63% 60% 40%
217.146.183.227 YAHOO! EUROPE YAHOO.COM UK 36% 64% 58% 42%
217.146.183.253 YAHOO! EUROPE YAHOO.COM UK 37% 63% 60% 40%
217.146.183.233 YAHOO! EUROPE YAHOO.COM UK 36% 64% 59% 41%
217.146.183.88 YAHOO! EUROPE YAHOO.COM UK 36% 64% 58% 42%
217.146.183.114 YAHOO! EUROPE YAHOO.COM UK 36% 64% 59% 41%
217.146.183.225 YAHOO! EUROPE YAHOO.COM UK 36% 64% 60% 40%
217.146.183.243 YAHOO! EUROPE YAHOO.COM UK 36% 64% 59% 41%
217.146.183.235 YAHOO! EUROPE YAHOO.COM UK 36% 64% 61% 39%
217.146.183.92 YAHOO! EUROPE YAHOO.COM UK 37% 63% 60% 40%
217.146.183.229 YAHOO! EUROPE YAHOO.COM UK 35% 65% 58% 42%
217.146.183.112 YAHOO! EUROPE YAHOO.COM UK 36% 64% 59% 41%
217.146.183.247 YAHOO! EUROPE YAHOO.COM UK 35% 65% 59% 41%
217.146.183.239 YAHOO! EUROPE YAHOO.COM UK 36% 64% 57% 43%
217.146.183.249 YAHOO! EUROPE YAHOO.COM UK 36% 64% 59% 41%
217.146.183.231 YAHOO! EUROPE YAHOO.COM UK 35% 65% 59% 41%

barristernecter@yahoo.fr

From  41.223.248.96 – web92408.mail.cnh.yahoo.com — Cotonou – BENIN – BJ — 

Reverse DNS: 203.209.250.172 – web92408.mail.cnh.yahoo.com  — IP address originates from China and has a score of 50/100 which means approx half of the activity is BAD

From: Jonathon Finn <mooretudepo33@livedoor.net>
Subject: Ermaessigte Preise fuer Top Armbanduhkopien
From: Kelvin Richardson <pricesajebi29@lunatico.it>
Subject: Genaue Kopien von Schweizer Armbanduhren
From: Leo Grady <bakerlixiru48@cerviaambiente.it>
Subject: Top Chronometer zum ermaessigten Preis
From: Adrian Childers <perezbuxuva66@hotelclocchiatti.it
Subject: Ideale Kopien von Schweizer Zeitmessern
From: Shirley Stroud <robertssacoly93@texsaca.it>
Subject: Dieselbe hohe Qualitaet vom Edelzubehoer guenstige
From: Amy Christopher <hughesbumoco27@cooparche.com>
Subject: Sommerpreise fuers edel aussehendes Zubehoer
From: Sophia Walden <phillipsjimome53@pgelettroimpianti.
Subject: Teuer aussehendes Zubehoer zum ermaessigten Preis
Associated Harvesters for IP – 41.223.248.48
75.125.18.178 | H
70.85.113.242 | H
208.66.195.2 | H
70.85.172.170 | H
74.53.249.34 | HW
74.86.249.98 | H
74.53.243.18 | HC
74.86.209.74 | H
218.186.13.1 | H
75.125.47.162 | HSDW
67.19.250.26 | H
91.190.94.246 | HSD
216.40.222.98 | H
81.195.121.253 | HSDC
Sent From 41.223.248.96 – SOURCE: Project Honey Pot
From:  Customer Service – upsaccountservices@ups.com
Subject: Re: FW: End of Aug. Statement Reqiured
From: Logistics UPS  accountservices@ups.com
Subject: Re: FW: End of Aug. Statement Reqiured
From:  Express – upsdelivercompanyb@ups.com
Subject: Re: End of Aug. Statmeent required
From: WendyDillahunt@mailusers.make-tracks.com
Subject: Re: End of Aug. Statmeent required
From: LinkedIn Email Confirmation – emailconfirm@linkedin
Subject: Re: FW: End of Aug. Statement Required
From: Customer Support ups  upsdeliveryservices@ups.com
Subject: Re: FW: End of Aug. Stat. required
From:  accounting@graco.dhbit.ca
Subject: Re: FW: End of Aug. Stat. required
From: Sook Ritchie via LinkedIn – member@linkedin.com
Subject: Re: changelog UPD.
From:  accounting@mail420.minnesotageeks.com
Subject: RE: MAYRA – Copies of Policies.
From: Marisol Friend via LinkedIn – member@linkedin.com
Subject: RE: CARMAN – Copies of Policies.
From:  raccounting@mail2.mounted.net
Subject: RE: MEGHANN – Copies of Policies.
From: DarwinZarling@hotmail.com
Subject: Re: Security update for banking accounts.
From:  DIONNE ROBERTSON – ROBERTSONpmjgDIONNE@hotmail.co
Subject: Your tax return appeal is declined.
From:  IsmaelLAKEEQFFK2B@aol.com
Subject: IRS notification of your tax appeal status.
From: “MYUPS” <ups-shippingagency@ups.com>
Subject: Re: Fwd: Scan from a Hewlett-Packard ScanJet #575
From: UPS <customerdesk_upsdeliveryservices@ups.com>
Subject: Don’t forget about meeting tomorrow
From: Kathlene Donaldson – MiraDinehart@w-link.net
Subject: Don’t forget about meeting tomorrow
From: Milford Hinkle – RamonGriebling@heale.net
Subject: Don’t forget about meeting tomorrow
From:  Amazon.com – account-update@amazon.com
Subject: Re: Your Flight A189-45644
From:  JabariKinnon@mail.igretec.net
Subject: Re: Your Flight A07-8295
From:  LEON Doherty – DohertyLEON@hotmail.com
Subject: Re: Fwd: Your Flight A268-625505
From: Badoo – noreply@badoo.com
Subject: Fwd: Re: Your Flight A18-77208
From: “craigslist – automated message, do not reply” <ro
Subject: Fwd: Wire Transfer (30331FY38)
Example Messages Sent From 203.209.250.172 – SOURCE: Project Honey Pot
From: Mrs Purity Qaume – mrs.purityqaume2011@terra.com
Subject: From: Madam Purity Qaume
From: Mrs Purity Qaume – mrs.purityqaume2011@terra.com
Subject: From: Madam Purity Qaume.
From: jxdguq – caolaeuva@yahoo.cn
Subject: 9税4

FBI OFFICE <> offilcefile1905@superposta.com <> barristernecter@yahoo.fr <>

41.223.248.96 by web92402.mail.cnh.yahoo.com <> bobwilliamson@superposta.com <> wunion617@superposta.com <> Received: from [41.223.248.96] by web92402.mail.cnh.yahoo.com via HTTP;
X-RocketYMMF: redwoodcapitalbank@yahoo.cn
Date: Thu, 15 Nov 2012 18:51:29 +0800 (CST)
From: “Rev. Robert Williamson, ESQ.” <offilcefile1905@superposta.com>
Reply-To: wunion617@superposta.com
Subject: TRANSFER MTCN

Attention Beneficiary,

I am contacting you because I’ve sent you the first payment of $5,000 this morning from your winning funds total amount of $1.5Million USD, Therefore you need to contact a Western Union agent Mr. Jerry Young, and ask him to give you the transfer payment information and MTCN.

Agent: Mr. Jerry Young
Email: wunion617@superposta.com
Phone: +229 98644349

Please try to contact him today request him to forward the payment information to you, Remember to Indicate the registration code of EB-2520 to him when E-mailing or calling him, Also he will be sending you $5,000.00 daily as per our office discussion with him.

Do get in touch with me once you have received the transfer. Please copy this email: wunion617@superposta.com, and paste before replying to him or simply call him at his number: +229 98644349

Sincerely

Rev. Robert Williamson, ESQ.

IMF MANAGING DIRECTOR

BENIN REPUBLIC

E-mail: bobwilliamson@superposta.com
+22998644349

________________________________________

Fraudster is also pretending to be Yahoo Member Services <carecustomer625@yahoo.com> Reply-to: carecustomer625@yahoo.com — YFB – 98.139.91.80 Received from: 41.223.248.96 – web182201.mail.bf1.yahoo.com

An FBI agent would contact you by phone or atleast by your name. They also have there own domain and wouldn’t use ‘superposta’ as an email-server.

 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , ,

“HOUSE OF LORD’S ORGANIZATION UK LONDON”

NIGERIAN 419 SCAM – COUNTERFEIT CHECK – FRAUD

UPDATE: This Nigerian scammer has emailed once again with a similar email but different IP and header information. He is still going under the email address of info@lordsdept.org but with the reply to address: consultationdept@yahoo.com – [213.154.64.102] –  41.203.79.249 – For more information on the updated email please click: HOUSE OF LORD’S ORGANIZATION UK LONDON 12/01/12

EMAIL: ATTN PLEASE

The HOUSE OF LORD’S ORGANIZATION UK LONDON Have just concluded the meeting with the board of Trustees of United Nations Organization and
Representative of all the financial institutions, The meeting that has
been for the past eight months on financial matters, It has been agreed to
release all long terms debt, These are the classes we are looking into:
those whom has been one way or the other denied their Inheritance or
Contract payment/award payment due to corrupt official services,

After our mutual investigation in the recent schedule for payment of
outstanding debts incurred since 1999 to 2012 according to your file
record where we got your email address; your payment is categorized under
section {B}: Contract type: Lottery, inheritance, unpaid contract funds
Undelivered Lottery fund, Attn: Beneficiary, We have decided to bring to
your attention, that you were listed as one of the beneficiary, The
executive council Have decided to pay as many they have their file record
on their desk on a direct wired transfer, The total sum of $5.5usd has
been approved under your file according to elect,

Contact the processing/paying manager for your direct payment of US$5.5M
(five Million Five Hundred Thousand United States Dollars), you are
directed to contact the International Remittance Department of Benin
Republic who is In-charge of the payment
via E-mail:
E-mail: managementfile1@gmail.com
E-mail: olusegunoniwon@ymail.com
Phone: +229-67406742
CONTACT PERSON: MRS. ANDRIANA U OLUSEG
INTERNATIONAL FUND REMITTING DIRECTOR
HOUSE OF LORDS BENIN REPUBLIC
Also provide the following detail to her for immediate release of your fund,
================================================================
Also it is very necessary and important that you send us an e-mail
containing your vital information?? As requested below so that you will be
given an immediate response and directives on what to do next:

Full Names:
Address:
City:
Zip/Postal Code:
State:
Country:
Present Occupation:
Company Owner:
Company Name:
Gender:
Age:
Reachable Tel#/Mob:…………..*No Voice Mail Service*
Fax:

THIS REQUIREMENT MUST BE PROVIDED TO HER COMPLETELY,
================================================================
As soon as the International Remittance Department in your file location
receives your information, your US$5.5M will be Transfer to your nominated
Bank account. this payment terms is to keep a clean slate of all debts
owned by the government and company to individuals either by contract or
award fund, we hereby plead for any inconvenient that you might have
received by any of this corrupt officials, The United Nations Organization
will not be interested in your story of not receiving your payment if you
fail to abide to this Instruction.

Yours Faithful,
Mr. Anderson Paul
Public Relation Officer
Strand Bridge House 138-142 Strand,
City of London,
E-mail: com.unit@net.hr
Hot line +440-2087599090
OUR REF: H/L/UNN/APXB/TF/08
IMMEDIATE PAYMENT
#:WB/PC/FMF/MIN/UN/APXB/08
HOUSE OF LORDS LIAISON HEADQUARTERS UK LONDON OFFICE

SORRY IF YOU RECEIVED THIS MESSAGE IN JUNK BOX IS DUE TO OUR SLOW NETWORK.

HEADER:
Return-Path: <info@lordsdept.org>
X-YahooFilteredBulk: 213.154.64.102
Received-SPF: none (domain of lordsdept.org does not designate permitted sender hosts)
X-YMailISG: 5SdGaNQWLDvvYHp8wyYLuM2f3bwOEdaSUKV6XBBVe6hWpcz0 mFuo8Y2oaNrqDj22Ohzu0oL9_xUAUGpVAT9WTkrNfXpfhRZhAzaCMjFQLZSZ l9VFNPyEtPWan6MvVjrQ3ovhzmJHN_1SHU9AVi3jpqKvS2wEdVTlvyfMK8KR jksTXAKUE6Sf_5IfpN0xy9ui5SAV6IU5HKJsLFDw3Z.dBMout_YpKyucZmaB AO2wv.9CZjpQRw.VjOZWwN35uNWrk3TMozf51DdpKZ1OB4eKabo2WddedkBH TzgtRYd0FWnyKtcvDybxiULHFetbGZdL74D0tCktUsIVKWdpPwfkpXrItOIp zqhg_wl3_nNK2oKL7.24CKdBAuNMBd1bZAvYKGykECCpUPFKVWPWYInEY8sp hjGiu7iZL2ezBTU34qSjLbwrvzINuGB0HXwR7sXDMku0XaFl8AxSvgtqK5jz iyroR6IZtROq8oQo_G0S0WtcxQJqBq_tqYfuU1yL5Q1y9Vv8gBYfO2ZKQIsn 4tp78g9ek5p_ldZjrH0H3pb8VSFzwgb1YlPWdfwjz3V4eUdQ8Wc6LvdV1Bk3 Ebo9LOewB28iJlr3vRdbuEP7jJYkRurMtiENPZ4OpAWrsgtTHRjh4.K9ZGW. YbbOacCIzO5V3F7GGXiZ3ScdhF3XWt9pIfdx7b_Wf72rsHQbLIGERr2OtDWc HC.sJVS7KnS13B5ZG9Kw9r3fAwduJ756DJIokZ6T02UQ4BV94Boh4HVm2nE1 rLLM202..KURsn2Y56xHwWZkl2OJ5KeL_KOdbw0T2xg59OQbkPJ4U7p2px0P wrE_MqHYmHnNPEeeGkdQMoHrpfTvX_VA5sN9gyuiEvFEQH3SeHLl1bujoh2q JPDhnCU8MyU1VNw0mglmQU8ukdVaXyvmw6iCU.ExiST2nU7sAVrTpyZD3T74 mHMQIzhhccOtUfYNdc5ieCMjdeiFYrtiWSn1M7C.1.5FZl3UHh557It28nRc kyO9hTQahnXehBhBIBLgX0SeUbuX1c2xyPeHZ0hS1KWadku2Btw_i7MM7d8u lRdz9hQK9tvzJ0e3THNbwaRLGKGDi0dDufeH0dm.f8aUYH6DOHAMk4d_Q62o E0TcNsdP3qstS7isosqDtZ6nzZ5d.0O.RyEx.YQGNuz6ij7ZXKtqAMzjU6il qqd3oatNO8mZOrrt345Mymz1hOG36kPJm4xF1uV9VYG8TCUv_bpceIPN_PZa L1npBNUz14RSXUwVtzWamCoGiX7lkXvz9mcWS5fmuXatiSF3kJrFJrjScfz9 xVNjcF3S4JFC6hBkQvZng1YkHWIo5Q52g0ZaHBNKayYrFvDGZ_umEobzZyMU wdXaZlsiAHL3Squ1Mzqo3pWml0BcKp5SpZVuIvRTSVTPSJ0nSfrQkKTUNn1L 7QIg9MknXIB5xWPBPFih6H6mqsgWZXdyEEHeMVvDDqQqrOymGLlnkSeQyTjT ku6cuXmXNnnj41LaKoxjWbx0mNJ4PijZaELLzJfDnAoEuiDFi6PNesR4vUe3 rg–
X-Originating-IP: [213.154.64.102]
Authentication-Results: mta1132.mail.bf1.yahoo.com from=lordsdept.org; domainkeys=neutral (no sig); from=lordsdept.org; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO smtpgp.orange.sn) (213.154.64.102) by mta1132.mail.bf1.yahoo.com with SMTP; Tue, 13 Nov 2012 08:46:37 -0800
Received: from sunumail.sn (HELO srv1-smtfree-msg.orange.sn) ([213.154.64.61]) by smtpgp.orange.sn with ESMTP; 13 Nov 2012 00:17:42 +0000
Received: from [213.154.64.43] (helo=www.sunumail.sn) by srv-smtfree.orange.sn with smtp (Exim 4.43) id 1TY4iV-0006iG-FO; Tue, 13 Nov 2012 00:51:03 +0000
Received: from 41.216.50.32 (SquirrelMail authenticated user david_fletcher) by http://www.sunumail.sn with HTTP; Tue, 13 Nov 2012 00:51:03 -0000 (GMT)
Message-ID: <55106.41.216.50.32.1352767863.sunumail@www.sunumail.sn>
Date: Tue, 13 Nov 2012 00:51:03 -0000 (GMT)
Subject: NOW CONTACT THE GLOBAL FUND REMITTING OFFICE FOR YOUR APPROVED CHEQUE.
From:
HOUSE OF =?iso-8859-1?Q?LORD=92S_ORGANIZATION_UK_LONDON?= <info@lordsdept.org>
Reply-To: managementfile1@gmail.com
User-Agent: SUNUMAIL/1.4.2
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3
Importance: Normal
X-SA-Exim-Connect-IP: 213.154.64.43
X-SA-Exim-Mail-From: info@lordsdept.org
X-SA-Exim-Scanned: No (on srv-smtfree.orange.sn); SAEximRunCond expanded to false
Content-Length: 3748
702034464
9291969056
Below is a list of other email headers which were sent by this same scammer.

Return-path: freshtools@wanadoo.fr
Received: from smtpgp.orange.sn ([unknown] [213.154.64.102])
by vms172061.mailsrvcs.net
(Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009))
with ESMTP id 0M4M00FBGCMOLW80@vms172061.mailsrvcs.net for x;
Sat, 26 May 2012 02:25:37 -0500 (CDT)
Received: from sunumail.sn (HELO srv-smtfree.orange.sn) ([213.154.64.61])
by smtpgp.orange.sn with ESMTP; Fri, 25 May 2012 07:52:17 +0000
Received: from [213.154.64.43] (helo=sunumail.sn) by srv-smtfree.orange.sn with
smtp (Exim 4.43) id 1SXpo6-0007u1-1u; Fri, 25 May 2012 08:23:34 +0000
Received: from 197.251.184.232 (SquirrelMail authenticated user hackk)
by sunumail.sn with HTTP; Fri, 25 May 2012 08:23:34 +0000 (GMT)
Date: Fri, 25 May 2012 08:23:34 +0000 (GMT)
From: “HACK TOOLS FOR SALE” freshtools@wanadoo.fr
Subject: SELLING WORLD WIDE EMAILS, MAILER, SMTP, WEB MAIL, BANK LO GIN,
ATM TRACK 1&2, CC V, RD P, SHELL, CC,
ALIBABA HACKING SOFTWARE OF ID AND PASSWORD.
X-Originating-IP: [213.154.64.102]
Reply-to: hackk@smtp.com
Message-id: 28154.197.251.184.232.1337934214.sunumail@sunumail.sn
MIME-version: 1.0
Content-type: text/plain; CHARSET=US-ASCII
Content-transfer-encoding: 7BIT
Importance: Normal
X-Priority: 3
X-SA-Exim-Connect-IP: 213.154.64.43
X-SA-Exim-Mail-From: freshtools@wanadoo.fr
X-SA-Exim-Scanned: No (on srv-smtfree.orange.sn); SAEximRunCond expanded to
false
User-Agent: SUNUMAIL/1.4.2
Original-recipient: rfc822;x

Return-path: freshtools@wanadoo.fr
Received: from smtpgp.orange.sn ([unknown] [213.154.64.102])
by vms172075.mailsrvcs.net
(Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009))
with ESMTP id 0M4M000XKBUHW020@vms172075.mailsrvcs.net for x;
Sat, 26 May 2012 02:08:43 -0500 (CDT)
Received: from sunumail.sn (HELO srv-smtfree.orange.sn) ([213.154.64.61])
by smtpgp.orange.sn with ESMTP; Fri, 25 May 2012 07:52:17 +0000
Received: from [213.154.64.43] (helo=sunumail.sn) by srv-smtfree.orange.sn with
smtp (Exim 4.43) id 1SXpo6-0007u1-1u; Fri, 25 May 2012 08:23:34 +0000
Received: from 197.251.184.232 (SquirrelMail authenticated user hackk)
by sunumail.sn with HTTP; Fri, 25 May 2012 08:23:34 +0000 (GMT)
Date: Fri, 25 May 2012 08:23:34 +0000 (GMT)
From: “HACK TOOLS FOR SALE” freshtools@wanadoo.fr
Subject: SELLING WORLD WIDE EMAILS, MAILER, SMTP, WEB MAIL, BANK LO GIN,
ATM TRACK 1&2, CC V, RD P, SHELL, CC,
ALIBABA HACKING SOFTWARE OF ID AND PASSWORD.
X-Originating-IP: [213.154.64.102]
Reply-to: hackk@smtp.com
Message-id: 28154.197.251.184.232.1337934214.sunumail@sunumail.sn
MIME-version: 1.0
Content-type: text/plain; CHARSET=US-ASCII
Content-transfer-encoding: 7BIT
Importance: Normal
X-Priority: 3
X-SA-Exim-Connect-IP: 213.154.64.43
X-SA-Exim-Mail-From: freshtools@wanadoo.fr
X-SA-Exim-Scanned: No (on srv-smtfree.orange.sn); SAEximRunCond expanded to
false
User-Agent: SUNUMAIL/1.4.2
Original-recipient: rfc822;x

This Scammer has sent more then one email and according to ProjectHoneyPot this IP address is malicious and is considered a ”Dictionary Attacker”

Location: BENIN – NIGERIA (BJ)

Example User Names Used By 41.216.50.32 – AS28683
User-namebuh
User-namebuhg
User-namebuhgalter
User-namebuhgalteria
User-namenastya
User-namenatalya
User-namenatasha
User-namenataly
User-namenatah
User-namenaumov
User-nameburov
User-namenatash
User-namenazarov
User-namenataha
User-namenasty
User-namenaumovsvetlana
User-namenationalpf223
User-nameneddi
User-namendrey.lashenov
User-namendrew
User-namenationwidedk1
User-namenataly1
User-namenekol

NAME & EMAIL-ADDRESS: HOUSE OF LORD’S ORGANIZATION UK LONDON <> info@lordsdept.org <> com.unit@net.hr <> managementfile1@gmail.com <>  olusegunoniwon@ymail.com <>  freshtools@wanadoo.fr <> hackk@smtp.com <>

from 41.203.79.249 (SquirrelMail authenticated user fletcherdavid) by http://www.sunumail.sn with HTTP; Sat, 1 Dec 2012 09:51:11 -0000 (GMT)

 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , ,

 
%d bloggers like this: