Worldwide Economy Meltdown Scam
[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]
VERY IMPORTANT INFORMATION, READ THIS FIRST: The example and associated information published on this page are subject to the SHPAMEE Terms Of Use. Please familiarise yourself with these terms before viewing or using any information on this page.
Header:
From - Fri Jul 13 02:55:07 2012
X-Account-Key: account8
X-UIDL: x
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Apparently-To: x
X-YahooFilteredBulk: 196.25.211.121
Received-SPF: none (domain of telkomsa.net does not designate permitted sender hosts)
X-YMailISG: x
X-Originating-IP: [196.25.211.121]
Authentication-Results: mta1098.mail.ukl.yahoo.com from=telkomsa.net; domainkeys=neutral (no sig); from=telkomsa.net;
dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO scorpius.telkomsa.net) (196.25.211.121)
by mta1098.mail.ukl.yahoo.com with SMTP; Thu, 12 Jul 2012 00:35:22 +0000
Received: from localhost (localhost.localdomain [127.0.0.1])
by scorpius.telkomsa.net (Postfix) with ESMTP id 51D5BF9125;
Thu, 12 Jul 2012 02:34:00 +0200 (SAST)
X-Virus-Scanned: amavisd-new at scorpius.telkomsa.net
Received: from scorpius.telkomsa.net ([127.0.0.1])
by localhost (scorpius.telkomsa.net [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id OMgo0W+2oplV; Thu, 12 Jul 2012 02:34:00 +0200 (SAST)
Received: from mail2.telkomsa.net (unknown [196.25.211.112])
by scorpius.telkomsa.net (Postfix) with ESMTP id 3EFD7F8D98;
Thu, 12 Jul 2012 02:33:55 +0200 (SAST)
Date: Thu, 12 Jul 2012 02:33:55 +0200 (SAST)
From: Western Union Money Transfer <online1037734@telkomsa.net>
Reply-To: Western Union Money Transfer <wumt_12@9.cn>
Message-ID: <x@zimbra2-vm1.telkomsa.net>
Subject: RECEIPT
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Originating-IP: [41.138.181.254]
X-Mailer: Zimbra 6.0.16_GA_2998 (ZimbraWebClient - OPERA (Win)/6.0.16_GA_2998)
To: undisclosed-recipients:;
X-Account-Key: account8
X-UIDL: x
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Apparently-To: x
X-YahooFilteredBulk: 196.25.211.121
Received-SPF: none (domain of telkomsa.net does not designate permitted sender hosts)
X-YMailISG: x
X-Originating-IP: [196.25.211.121]
Authentication-Results: mta1098.mail.ukl.yahoo.com from=telkomsa.net; domainkeys=neutral (no sig); from=telkomsa.net;
dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO scorpius.telkomsa.net) (196.25.211.121)
by mta1098.mail.ukl.yahoo.com with SMTP; Thu, 12 Jul 2012 00:35:22 +0000
Received: from localhost (localhost.localdomain [127.0.0.1])
by scorpius.telkomsa.net (Postfix) with ESMTP id 51D5BF9125;
Thu, 12 Jul 2012 02:34:00 +0200 (SAST)
X-Virus-Scanned: amavisd-new at scorpius.telkomsa.net
Received: from scorpius.telkomsa.net ([127.0.0.1])
by localhost (scorpius.telkomsa.net [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id OMgo0W+2oplV; Thu, 12 Jul 2012 02:34:00 +0200 (SAST)
Received: from mail2.telkomsa.net (unknown [196.25.211.112])
by scorpius.telkomsa.net (Postfix) with ESMTP id 3EFD7F8D98;
Thu, 12 Jul 2012 02:33:55 +0200 (SAST)
Date: Thu, 12 Jul 2012 02:33:55 +0200 (SAST)
From: Western Union Money Transfer <online1037734@telkomsa.net>
Reply-To: Western Union Money Transfer <wumt_12@9.cn>
Message-ID: <x@zimbra2-vm1.telkomsa.net>
Subject: RECEIPT
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Originating-IP: [41.138.181.254]
X-Mailer: Zimbra 6.0.16_GA_2998 (ZimbraWebClient - OPERA (Win)/6.0.16_GA_2998)
To: undisclosed-recipients:;
Body:
We wish to inform you that we have processed your first payment of £5,000GBP.This funds was given to you by the United Nations in conjunction with the BANK OF ENGLAND to support individual's due to the worldwide economy meltdown.Sender Name: Mark Mario, MTCN 0534-12-(4 digit code).To track payment use www.westernunion.com before going to pick it up
Your email was luckily picked among others from an electronic ballot just conducted,though we have provided you with only Six digits of the MTCN because of security reasons so please contact me as soon as possible for the last 4 digit code.We have been mandated to send you the total sum of £300,000GBP through Western Union. so therefore, you are Required to send Us Your Name,Address, Phone number for more information.
Congratulations once again.
Frank Amos.
wumt_12@9.cn
+(44) 7045 721 601
Your email was luckily picked among others from an electronic ballot just conducted,though we have provided you with only Six digits of the MTCN because of security reasons so please contact me as soon as possible for the last 4 digit code.We have been mandated to send you the total sum of £300,000GBP through Western Union. so therefore, you are Required to send Us Your Name,Address, Phone number for more information.
Congratulations once again.
Frank Amos.
wumt_12@9.cn
+(44) 7045 721 601
Comments:
Related Cyber Criminal Profiles:
No related profiles found.Similar Spam Examples:
Lottery Scam - PICKUP OF YOUR $6,500 USD VIA WESTERN UNION OFFICELottery Scam - NOT SPAM ! FIRST PAYMENT,OPEN AND REPLY
Western Union Phishing Scam - Deactivated account
SCAM VICTIM'S COMPENSATION FROM THE IMF BENIN REPUBLIC
Ebay Small Business Store Limited 419 Scam
Related Malware Samples:
No related malware samples found.[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]
So, all out of the blue the 419 scammers want to give you money because of the global economic crisis? Get real, they are just going to steal some more.
So what is this, a lottery or a charity fund? There is a reason why they only gave you 4 digits, they don't have the rest and the first four is fake anyway. They only want a reason for you to contact them.
This is interesting. This e-mail came from a South African ISP, but the telephone number you need to dial is in the UK. So this spam was either sent from a malware infected computer, or 419 scammers in South Africa is helping their friends in the UK to distribute this spam.
Even the reply to e-mail address is UK based. 9.cn is an organisation that provides email addresses powered by Windows Live Hotmail and 9.cn e-mail addresses seem to be popular among 419 scammers these days.