It is currently Sun Mar 07, 2021 2:17 pm    

*

Romance Scam

Please report romance scams and dating scams here. We accept reports on Russian scammers and Nigerian scammers.

Disclaimer regarding pictures posted on the board: please understand that you are NOT looking at the pictures of people who are actually scamming you. The people portrayed on these photos are innocent men and women, NOT involved in scamming in any way and have nothing to do with scammers. The scammers are using their images without their knowledge or permission to deceive their victims and steal their money.



Join our SCAM FREE DATING SITE
Readnotify - trace your emails, get IPs
RESEARCH SCAMMERS BY NAME
Forum rules:

** PLEASE READ BEFORE POSTING!

RESEARCH SCAMMERS BY EMAIL

Password phishing emails originating from West Africa

419 Scams, Lottery scams & Other African Dangers to Beware Of
User avatar
FrumpyBB
Site Admin
Posts: 63714
Joined: Sun Apr 06, 2008 7:35 pm
Location: Central Europe


Bookmark and Share

Re: Password phishing emails originating from West Africa

Postby FrumpyBB » Mon Aug 01, 2016 7:30 am

Limit/Storage
F-web system <johnwilson255@btinternet.com>
Your Mail Box has exceeded the storage limit is 1 GB, which is defined by the administrator, you are running at 99.8 gigabytes and you can not send or receive new messages until you re-validate your mailbox.
To renew the mailbox Confirm Now and login tinyurl.com/z46bkvp <= evil linky. No clicky NO!
Thank you!
Web-mail system administrator!



Return-Path: <johnwilson255@btinternet.com>
Received: from rgout0607.bt.lon5.cpcloud.co.uk (rgout0607.bt.lon5.cpcloud.co.uk [65.20.0.134])
by mx5.messagingengine.com (Postfix) with ESMTP;
Sun, 31 Jul 2016 20:55:19 -0400 (EDT)
X-OWM-Source-IP: 10.110.13.1 ()
X-OWM-Env-Sender: johnwilson255@btinternet.com
X-Junkmail-Premium-Raw: score=86/50,refid=2.7.2:2016.7.31.203917:17:86.796,ip=,rules=__HAS_FROM,
__FRAUD_WEBMAIL_FROM, __HAS_REPLYTO, __PHISH_NO_REPLY, __HAS_MSGID,
__SANE_MSGID, INVALID_MSGID_NO_FQDN, __MIME_VERSION, __CT,
__CTYPE_HAS_BOUNDARY, __CTYPE_MULTIPART, __CTYPE_MULTIPART_MIXED,
__HAS_X_PRIORITY, MISSING_HEADERS, __KNOWN_FREEWEB_URI2[http://tinyurl.com/z46bkvp
[tinyurl.com] [tinyurl.com]], __ANY_URI, __PHISH_SPEAR_URI, __URI_WITH_PATH,
__MAL_TELEKOM_URI, __URI_NO_MAILTO, __URI_NO_WWW, __PHISH_SPEAR_DETAILS,
__PHISH_SPEAR_CONSEQUENCES_A, __PHISH_SPEAR_STORAGE_LIMIT_XGIG,
__URI_IN_BODY, __HTML_AHREF_TAG, __HAS_HTML, BODY_SIZE_4000_4999,
BODYTEXTP_SIZE_400_LESS, BODYTEXTP_SIZE_3000_LESS, BODYTEXTH_SIZE_3000_MORE,
BODYTEXTH_SIZE_10000_LESS, __MIME_HTML, __URI_NS, HTML_90_100,
HTML_FONT_INVISIBLE, PHISH_SPEAR_CONTENT_X3, BODY_SIZE_5000_LESS,
__FRAUD_WEBMAIL, PHISH_SPEAR_CONTENT_X4, __PHISH_SPEAR_STRUCTURE_1,
PHISH_SPEAR1_X3, PHISH_SPEAR1_X4, KNOWN_FREEWEB_URI, PRIORITY_NO_NAME,
__PHISH_SPEAR_STRUCTURE_2, REPLYTO_FROM_DIFF_ADDY, BODY_SIZE_7000_LESS,
TO_MALFORMED, NO_URI_HTTPS, PHISH_SPEAR2_X3, PHISH_SPEAR2_X4
Received: from webmail35.bt.ext.cpcloud.co.uk (10.110.13.1) by rgout06.bt.lon5.cpcloud.co.uk (8.6.122.06) (authenticated as johnwilson255@btinternet.com)
From: F-web system <johnwilson255@btinternet.com>
Reply-To: no-reply@inc.com
X-Client-IP: IPv4[154.118.75.22]

^^
IP: 154.118.75.22
Continent: Africa
Country: Nigeria
State/Region: Ogun State
City: Iseri-Oke
Please try your best to block ALL your scammer´s still incoming messages and calls!

What is all this? => The FAQ

The scammers vs. Why is "he" still doing it?

Why is alerting the man in the pictures DANGEROUS?

Please click why confronting my scammer is terribly wrong :)

Re: Password phishing emails originating from West Africa

Sponsor

verispy.com
Sponsor
 

User avatar
FrumpyBB
Site Admin
Posts: 63714
Joined: Sun Apr 06, 2008 7:35 pm
Location: Central Europe


Bookmark and Share

Re: Password phishing emails originating from West Africa

Postby FrumpyBB » Wed Aug 10, 2016 11:52 am

Return-Path: <anthonycampling@btinternet.com>
X-Junkmail-Premium-Raw: score=15/50,refid=2.7.2:2016.8.10.95716:17:15.882,ip=,rules=__HAS_FROM,
__FRAUD_WEBMAIL_FROM, __HAS_REPLYTO, __FRAUD_WEBMAIL_REPLYTO, __HAS_MSGID,
__SANE_MSGID, INVALID_MSGID_NO_FQDN, __SUBJ_ALPHA_END, __MIME_VERSION, __CT,
__CTYPE_HAS_BOUNDARY, __CTYPE_MULTIPART, __CTYPE_MULTIPART_MIXED,
__HAS_X_PRIORITY, MISSING_HEADERS, __KNOWN_FREEWEB_URI2[http://bit.ly/2baLxxe
[bit.ly] [bit.ly]], __ANY_URI, __HTTPS_URI, __URI_WITH_PATH,
URI_ENDS_IN_HTML, BITLY_URI, __MAL_TELEKOM_URI, __URI_NO_MAILTO,
__FRAUD_MONEY_DENOMINATION, __URI_IN_BODY, __HTML_BOLD, __HTML_AHREF_TAG,
__HAS_HTML, BODYTEXTP_SIZE_3000_LESS, BODY_SIZE_5000_5999,
BODYTEXTH_SIZE_3000_MORE, BODYTEXTH_SIZE_10000_LESS, __MIME_HTML, __URI_NS,
HTML_90_100, __FRAUD_WEBMAIL, FRAUD_WEBMAIL_R_NOT_F,
__PHISH_SPEAR_STRUCTURE_1, KNOWN_FREEWEB_URI, PRIORITY_NO_NAME,
REPLYTO_FROM_DIFF_ADDY, BODY_SIZE_7000_LESS, TO_MALFORMED,
FRAUD_WEBMAIL_R_NOT_F2
Received: from webmail43.bt.ext.cpcloud.co.uk (10.110.12.1) by rgout03.bt.lon5.cpcloud.co.uk (8.6.122.06) (authenticated as anthonycampling@btinternet.com)
From: "F.M assist" <anthonycampling@btinternet.com>
Reply-To: mspa.shopper016@gmail.com
Subject: System problems
X-Client-IP: IPv4[41.217.114.155] Epoch[1470825645275]


Getting Started

Welcome to FastMail, the email choice of over 100,000 individuals,
families and business. We've made it simple to have your existing emails
more secured.

You can have this done with our help Quicklinks Using your own domain bit.ly/2baLxxe << ee-ecky linky. No touchy no!

Please do not ignore

Regards,

The FastMail Team

^^


IP: 41.217.114.155
ISP: ZOOM Mobile Nigeria Ltd
Type: Wireless Broadband
Continent: Africa
Country: Nigeria
Please try your best to block ALL your scammer´s still incoming messages and calls!

What is all this? => The FAQ

The scammers vs. Why is "he" still doing it?

Why is alerting the man in the pictures DANGEROUS?

Please click why confronting my scammer is terribly wrong :)

User avatar
FrumpyBB
Site Admin
Posts: 63714
Joined: Sun Apr 06, 2008 7:35 pm
Location: Central Europe


Bookmark and Share

Re: Password phishing emails originating from West Africa

Postby FrumpyBB » Thu Aug 11, 2016 8:49 pm

Return-Path: <noreply@servicermail.com>
Received: from smtprelay.hostedemail.com (smtprelay0200.hostedemail.com [216.40.44.200])
Received: from [10.30.1.10] (unknown [108.61.68.152])
(Authenticated sender: bjurmain@Xplornet.ca)
Subject: E-mail Deactivation Notification: Action Required
To: Recipients <noreply@servicermail.com>
From: "Chase Online" <noreply@servicermail.com>
=

Dear Customer, =


Our record indicates that you recently made a request to deactivate email
and this request will be processed shortly. =


If this request was made accidentally and you have no knowledge of it, you
are advised to cancel the request now

Click here to cancel de-activation now =BB =


Keeping your account and personal information secure is our priority, and =

together we can team up to fight fraud

Note: Your account will be suspended if you do not Cancel De-activation. =

Suspended accounts will not be able to receive payments, send payments or =

withdraw funds Online =

^^
IP: 108.61.68.152
ISP: Choopa, LLC
Services: Network sharing device or proxy server

bad IP, used in scams before.
Please try your best to block ALL your scammer´s still incoming messages and calls!

What is all this? => The FAQ

The scammers vs. Why is "he" still doing it?

Why is alerting the man in the pictures DANGEROUS?

Please click why confronting my scammer is terribly wrong :)

User avatar
FrumpyBB
Site Admin
Posts: 63714
Joined: Sun Apr 06, 2008 7:35 pm
Location: Central Europe


Bookmark and Share

michellechen1218@gmail.com

Postby FrumpyBB » Mon Aug 29, 2016 8:48 pm

From: noreply <michellechen1218@gmail.com>
Subject: NEWS
To: undisclosed-recipients:;

Dear Valued Customer,

Due to recent upgrades on our servers; Your 5 ( Five ) incoming mails are
on hold. Please validate below to retrieve your email.

Please Get *Connect <j.gs/8FE3>* <<= evil linky. no clicky no!


We are sorry for the inconvenient.


Regard

Fast mail
Please try your best to block ALL your scammer´s still incoming messages and calls!

What is all this? => The FAQ

The scammers vs. Why is "he" still doing it?

Why is alerting the man in the pictures DANGEROUS?

Please click why confronting my scammer is terribly wrong :)

User avatar
FrumpyBB
Site Admin
Posts: 63714
Joined: Sun Apr 06, 2008 7:35 pm
Location: Central Europe


Bookmark and Share

Re: Password phishing emails originating from West Africa

Postby FrumpyBB » Wed Sep 07, 2016 2:20 pm

Return-Path: <raz@purdue.edu>
Received: from compute6.internal (compute6.nyi.internal [10.202.2.46])
by sloti29t02 (Cyrus 3.0.0-beta3-git-fastmail-13653) with LMTPA;
X-Mail-from: raz@purdue.edu
Received: from [154.120.94.119] (port=61277 helo=[192.168.8.101])
by ns.sudan-embassy.co.uk with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) Ouch!
(Exim 4.87)
(envelope-from <raz@purdue.edu>)
id 1bfchJ-0005rz-2v
From: "Mail Service" <raz@purdue.edu>
X-AntiAbuse: Primary Hostname - ns.sudan-embassy.co.uk
X-AntiAbuse: Original Domain - fastmail.fm
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - purdue.edu
X-Get-Message-Sender-Via: ns.sudan-embassy.co.uk: authenticated_id: info@sudan-embassy.co.uk
X-Authenticated-Sender: ns.sudan-embassy.co.uk: info@sudan-embassy.co.uk

Please note we temporarily locked your account due to some certain updates =
with your server. =

Click here to unlock and continue your free usage by verifying you are t=
he owner of this account. =

No further action is necessary; this is just a notification for your accoun=
t safety, just follow the above link to verify you are the owner of this ac=
count and Continue your free usage. =

Have a great day! =

Mail Notification Team.

=============================================

IP: 154.120.94.119
ISP: Spectranet Limited
Continent: Africa
Country: Nigeria
State/Region: Lagos
City: Lagos

baddie link is vermelhonovo.cam.mg.gov.br/language/fastm1.html
Please try your best to block ALL your scammer´s still incoming messages and calls!

What is all this? => The FAQ

The scammers vs. Why is "he" still doing it?

Why is alerting the man in the pictures DANGEROUS?

Please click why confronting my scammer is terribly wrong :)

User avatar
FrumpyBB
Site Admin
Posts: 63714
Joined: Sun Apr 06, 2008 7:35 pm
Location: Central Europe


Bookmark and Share

Re: Password phishing emails originating from West Africa

Postby FrumpyBB » Wed Sep 07, 2016 2:34 pm

Return-Path: <fastmail.inc@xplornet.com>
Received: from smtprelay.hostedemail.com (smtprelay0084.hostedemail.com [216.40.44.84])
Received: from filter.hostedemail.com (unknown [216.40.38.60])
Received: from ww w.tecnisul.com (web1123.kinghost.net [177.12.161.123])
(Authenticated sender: thebear1@xplornet.ca)
From: fastmail.Inc@xplornet.com
Subject: Verify Now
Message-ID: <6cd2e0e13aa27239bff842cf9a0e8479@www.tecnisul.com>

<p>Hi,=A0User</p>
<p>Due to recent upgrades on our servers; Your 2 (two) incoming mails are o=
n hold. Please validate below to retrieve your email...</p>
<p><a href=3D"http://http://adf.ly/1dkfgB">Please View</a> here to v=
alidate=A0<br>
</p>
<p>We are sorry for the inconvenient.<br>
</p>
<p>Sincerely,<br>
TheFast mail</p>
<p></p>


IP: 177.12.161.123 proxy
Please try your best to block ALL your scammer´s still incoming messages and calls!

What is all this? => The FAQ

The scammers vs. Why is "he" still doing it?

Why is alerting the man in the pictures DANGEROUS?

Please click why confronting my scammer is terribly wrong :)

User avatar
FrumpyBB
Site Admin
Posts: 63714
Joined: Sun Apr 06, 2008 7:35 pm
Location: Central Europe


Bookmark and Share

Re: Password phishing emails originating from West Africa

Postby FrumpyBB » Wed Oct 19, 2016 4:42 pm

: UPDATE YOU ACCOUNT WARNING!!!
ACCOUNT USERS <long.r66@yahoo.com>

: UPDATE YOU ACCOUNT WARNING!!!

All account owner,We are having congestion due to the anonymous registration of account so we are shutting down some accounts and your account was among those to be deleted.We are sending you this email so that you can verify and let us know if you still want to use this account.If you are still interested please confirm your account by filling the space below.Your User name,password,date of bith and your country information would be needed to verify your account....
Due to the congestion in all user and removal of all unused Account, Would be shutting down all unused Accounts, You will have to confirm your E-mail by filling out your Login Information below after clicking the reply button, or your account will be suspended within 48 hours for security reasons.

* Username: ........................... ....
* Password: .............................
* Date of Birth: .........................
* Country Or Territory: ....................

After following the instructions in the sheet, your account will not be interrupted and will continue as normal. Thanks for your attention to this request. We apologize for any inconveniences. Warning!!! Account owner that refuses to update his/her account after two days of receiving this warning stands the risk of losing his or her account permanently.
The administrator Management
Please try your best to block ALL your scammer´s still incoming messages and calls!

What is all this? => The FAQ

The scammers vs. Why is "he" still doing it?

Why is alerting the man in the pictures DANGEROUS?

Please click why confronting my scammer is terribly wrong :)

User avatar
FrumpyBB
Site Admin
Posts: 63714
Joined: Sun Apr 06, 2008 7:35 pm
Location: Central Europe


Bookmark and Share

Re: Password phishing emails originating from West Africa

Postby FrumpyBB » Wed Oct 19, 2016 5:39 pm

Return-Path: <jdace@fidnet.com>
X-Spam-known-sender: no ("From address has been forged"), forged-sender !!!!!
Received: from mx4.messagingengine.com (localhost [127.0.0.1])
by mailmx.nyi.internal (Postfix) with ESMTP id 3A2B6F6106;
Received-SPF: pass
(fidnet.com: Sender is authorized to use 'jdace@fidnet.com' in 'mfrom' identity (mechanism 'include:emailsrvr.com' matched))
Received: from smtp67.iad3a.emailsrvr.com (smtp67.iad3a.emailsrvr.com [173.203.187.67])
X-Sender-Id: jdace@fidnet.com
Received: from app19.wa-webapps.iad3a (relay-webapps.rsapps.net [172.27.255.140])
by 0.0.0.0:25 (trex/5.7.7);
Received: from fidnet.com (localhost [127.0.0.1])
by app19.wa-webapps.iad3a (Postfix) with ESMTP id 2617BC1C82;
(Authenticated sender: jdace@fidnet.com, from: support@fastmail.com)
with HTTP;
Subject: Fastmail New Info! This vital message is specifically for you
From: "Customer Protection" <support@fastmail.com>
X-Auth-ID: jdace@fidnet.com
Message-ID: <1476839476.13992516@webmail2.fidnet.com>
X-Mailer: webmail/12.5.5-RC
To: undisclosed-recipients:;


We received your request at 20.15PM yesterday to deactivate your hotmail account permanently. Please reconfirm your request by choosing either of the two options below but please note that if you fail to click on option1 we will have no other choice than to deactivate your account.

1. Click here to continue using our service (log in to continue) [cefcrc.com/jia/linkos.html]
2. Click here to discontinue using our service. [cefcrc.com/jia/linkos.html] Evil link!

Thank you,
Support
Please try your best to block ALL your scammer´s still incoming messages and calls!

What is all this? => The FAQ

The scammers vs. Why is "he" still doing it?

Why is alerting the man in the pictures DANGEROUS?

Please click why confronting my scammer is terribly wrong :)

User avatar
FrumpyBB
Site Admin
Posts: 63714
Joined: Sun Apr 06, 2008 7:35 pm
Location: Central Europe


Bookmark and Share

Re: Password phishing emails originating from West Africa

Postby FrumpyBB » Wed Oct 26, 2016 12:30 pm

Fastmail Advice ! Must open and read !
Info2016 <fast-mail@yl-comm.com>


Your account is among the more than 1000 subscribers that will be deactivated due to some technical reasons.

To continue using our service, Click here and update your data. [esherpatrek.com/jia/linkos.html]
Otherwise your apple account will be permanently closed down.

Thank You,
Support


Received: from smtp91.iad3a.emailsrvr.com (smtp91.iad3a.emailsrvr.com [173.203.187.91])
X-Sender-Id: dhahne@fidnet.com
Received: from dagashini (ten.emfme.net [77.234.42.143])
From: "Info2016" <fast-mail@yl-comm.com>
Subject: Fastmail Advice ! Must open and read !


IP: 77.234.42.143
Hostname: ten.emfme.net
ASN: 198605
ISP: AVAST Software s.r.o.
Continent: North America
Country: United States us flag
State/Region: Florida
City: Miami
Please try your best to block ALL your scammer´s still incoming messages and calls!

What is all this? => The FAQ

The scammers vs. Why is "he" still doing it?

Why is alerting the man in the pictures DANGEROUS?

Please click why confronting my scammer is terribly wrong :)

User avatar
FrumpyBB
Site Admin
Posts: 63714
Joined: Sun Apr 06, 2008 7:35 pm
Location: Central Europe


Bookmark and Share

Re: Password phishing emails originating from West Africa

Postby FrumpyBB » Wed Nov 16, 2016 3:24 pm

Return-Path: <relaytvnetworks@6848047.securefastserver.com>
X-Originating-IP: [89.32.40.15]
From: =?utf-8?Q?Yahoo=20Account=20Service?= <jane@aussieshoppers.net>
Subject: =?utf-8?Q?Email=20Alert?=
X-AntiAbuse: Sender Address Domain - 6848047.securefastserver.com
X-Get-Message-Sender-Via: 6848047.securefastserver.com: authenticated_id: relaytvnetworks/only user confirmed/virtual account not confirmed
X-Source-Dir: relaytvnetworks.com:/public_html/intelligence/resourcecontrol

<img id="yui_3_16_0_1_1413814960405_6114" src="http://iconizer.net/files/Web_social_ic ... o.png"><br>


Dear Customer,<br><br>we received a request to terminate your Account and the <br><br>process has started by our Mail Team, Please give us 12 working hours to close your Account.<br><br>To cancel the termination request click <a id="yui_3_16_0_1_1413814960405_5947" rel="nofollow" target="_blank" href=" ow.ly/rLG63066EXb">login.mail.com/cancel.php?account=cancel %40yahoo.com&cc=504e1eb49cb515</a><br></div>All files on your yahoo mail
including (Inbox, Sent, Spam, Trash, Draft) will be deleted and access to your Email address will be Denied.<br><br>Regards, Account Services<br><br>____________________________________________________<br>Please do not reply to this message. Mail sent to this address cannot be answered.
Please try your best to block ALL your scammer´s still incoming messages and calls!

What is all this? => The FAQ

The scammers vs. Why is "he" still doing it?

Why is alerting the man in the pictures DANGEROUS?

Please click why confronting my scammer is terribly wrong :)

User avatar
Igulinka
Moderator/Sponsor
Moderator/Sponsor
Posts: 26862
Joined: Sun Sep 29, 2013 3:12 am
Location: New York


Bookmark and Share

mark.silberman78@gmail.com

Postby Igulinka » Sun Nov 20, 2016 5:30 am

Your email xxxxx has been hacked and spam is sent to all your contacts!
If you don't have a lawyer, you may contact me at
mark.silberman78@gmail.com

Best Regards,
Mark
mark.silberman78@gmail.com

User avatar
FrumpyBB
Site Admin
Posts: 63714
Joined: Sun Apr 06, 2008 7:35 pm
Location: Central Europe


Bookmark and Share

Re: Password phishing emails originating from West Africa

Postby FrumpyBB » Mon Dec 12, 2016 12:09 am

From: Email Administrator <postmaster@mail.org>
To: Recipients <postmaster@mail.org>
Subject: Action required:- Incoming Mails on Hold

Dear Member,
You have 3 incoming mails on hold
Please click on Read Message to view all held mails. tinyurl.com/zb82zmo <<< = evil link!
Regards,
The FastMail Team.


Return-Path: <postmaster@mail.org>
Received: from compute4.internal (compute4.nyi.internal [10.202.2.44])
X-Spam-known-sender: no ("From == To and no DKIM or SPF for from domain, likely forged")
Received: from mx5 ([10.202.2.204])
spf=fail smtp.mailfrom=postmaster@mail.org smtp.helo=six.deepafrica.com
Received-SPF: fail
(mail.org ... mail.com: Sender is not authorized by default to use 'postmaster@mail.org' in 'mfrom' identity
Received: from six.deepafrica.com (six.deepafrica.com [69.16.238.189])
Received: from 74-115-1-226.anchorfree.com ([74.115.1.226]:63823 helo=hp-PC.localdomain) = bad IP
X-Get-Message-Sender-Via: six.deepafrica.com: authenticated_id: paul@autometrix.co.ke = Kenya ?
Please try your best to block ALL your scammer´s still incoming messages and calls!

What is all this? => The FAQ

The scammers vs. Why is "he" still doing it?

Why is alerting the man in the pictures DANGEROUS?

Please click why confronting my scammer is terribly wrong :)

User avatar
FrumpyBB
Site Admin
Posts: 63714
Joined: Sun Apr 06, 2008 7:35 pm
Location: Central Europe


Bookmark and Share

Re: Password phishing emails originating from West Africa

Postby FrumpyBB » Sat Dec 17, 2016 9:02 pm

Return-Path: <meri@karipian.net>
Received: from compute4.internal (compute4.nyi.internal [10.202.2.44])
X-Mail-from: meri@karipian.net
Received: from mx2 ([10.202.2.201])
spf=none smtp.mailfrom=meri@karipian.net smtp.helo=datamappimail1.datamappi.fi
envelope-from="meri@karipian.net";
helo=datamappimail1.datamappi.fi;
client-ip=77.240.25.50
Received: from datamappimail1.datamappi.fi (datamappimail1.datamappi.fi [77.240.25.50])
Received: from unknown (HELO QRJATYDI) (meri@karipian.net@188.162.37.96)
by datamappimail1.datamappi.fi with ESMTPA;
From: admin
To: client
Subject: Delivery. You will be contacted by telephone.
X-MSMail-Priority: Normal
X-Mailer: opera 9.0.08
Hello
Payment of the goods in the amount of 210 euro was successful.
Goods will be delivered within 24 hours. Courier will call your phone to confirm delivery.
We have attached a copy of the payment documents. We kindly request to read it.
Thank you for using our online store.

Sales Manager John Bell
Phone +44 (0) 20 7637 1051 | Fax +44 (0) 20 7636 5779


filename="INFO.html" <<= not downlaoded, not opened!!


IP: 188.162.37.96
Hostname: client.yota.ru
ISP: PJSC MegaFon
Continent: Europe
Country: Russia
State/Region: Samarskaya Oblast'
City: Samara
Please try your best to block ALL your scammer´s still incoming messages and calls!

What is all this? => The FAQ

The scammers vs. Why is "he" still doing it?

Why is alerting the man in the pictures DANGEROUS?

Please click why confronting my scammer is terribly wrong :)

User avatar
FrumpyBB
Site Admin
Posts: 63714
Joined: Sun Apr 06, 2008 7:35 pm
Location: Central Europe


Bookmark and Share

Re: Password phishing emails originating from West Africa

Postby FrumpyBB » Tue Dec 20, 2016 10:59 am

Return-Path: <jwilcox@2summit.org>
Received: from mail.2summit.org (mail.2summit.org [205.127.229.3])
Received: from client.yota.ru ([188.162.43.20]) by mail.2summit.org with Microsoft SMTPSVC(6.0.3790.3959);
From: "Jcpeney" <jwilcox>
Subject: Payment bank account. Thank you

Hello
Payment of the goods in the amount of 210 euro was successful.
Goods will be delivered within 24 hours. Courier will call your phone to =
confirm delivery.
We have attached a copy of the payment documents. We kindly request to re=
ad it.
Thank you for using our online store.

Sales Manager John Bell
Phone +44 (0) 20 7637 1051 | Fax +44 (0) 20 7636 5779

Content-Type: text/html; name="information.html"
Content-Disposition: attachment; filename="information.html" <= eee icky linky
Please try your best to block ALL your scammer´s still incoming messages and calls!

What is all this? => The FAQ

The scammers vs. Why is "he" still doing it?

Why is alerting the man in the pictures DANGEROUS?

Please click why confronting my scammer is terribly wrong :)

User avatar
IceFM
Moderator
Posts: 77225
Joined: Fri Nov 16, 2007 10:06 am


Bookmark and Share

accountowner71@yahoo.com

Postby IceFM » Tue Jan 31, 2017 8:43 pm

Dear Valued Member Account Owner!!!!,

This message comes from your (EMAIL SERVICE PROVIDER) messaging admin
center to All E-mail Account owners. We are currently improving our
Database and E-mail Account Center and creating more certainty for our
Legal Service clients. At this moment we are upgrading our data base
so that there will be more space for new customers and increasing the
surf on the Internet. To prevent your Email address not to be
DE-activated and to enable it upgraded, you need to assist us by
sending the information below to enable us upgrade it, so that your
email account status were fleet in our database as a very active,
useful and legal email account.Do send to us the below information to
enable us upgrade your Account, else your email account will lost in a
short time.

First Name:
Last Name:
Country:
City:
Date of Birth:
Email Address:
E-mail password
Alternative Email:
Secret Question:
Secret Answer:

WARNING!!! E-MAIL OWNERS who refuses to upgrade his or her account
within Five days after notification of this update will permanently be
deleted from our data base and can also lead to malfunctioning of the
client or user's account and we will not be responsible for loosing
our account.

Thanks for your understanding as it is geared towards serving you better.

Web-mail Support Team
Warning Code:
ID67565434.
------------------------------------------------------------------------------------------------------
+++ The FAQ / FAQ in deutsch +++

Return to “Other types of African scams”

Who is online

Users browsing this forum: No registered users and 1 guest