A Scam Email with the Subject "REPORT FOR 06-30-2007 1434 HRS" was received in one of Scamdex's honeypot email accounts on Sat, 30 Jun 2007 11:38:42 -0700 and has been classified as a Advance Fee Fraud/419 Scam. The sender was "John Fitchpatrick" <firstname.lastname@example.org>, although it may have been spoofed.
THE BELOW IS THE ORIGINAL EMAIL HEADER INFORMATION: X-Apparently-To: email@example.com via 18.104.22.168; Sat, 30 Jun = 2007 10:53:20 -0700 X-Originating-IP: [22.214.171.124] Authentication-Results: mta108.vzn.mail.mud.yahoo.com from=3Dmchsi.com; = domainkeys=3Dneutral (no sig) Received: from 126.96.36.199 (EHLO vms169123pub.verizon.net) = (188.8.131.52) by mta108.vzn.mail.mud.yahoo.com with SMTP; Sat, 30 Jun 2007 10:53:20 = -0700 Received: from sccmmhc92.asp.att.net ([184.108.40.206]) by vms169123.mailsrvcs.net (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTP id <0JKG001IAN0U3B33@vms169123.mailsrvcs.net> for firstname.lastname@example.org (ORCPT email@example.com); Sat, 30 Jun 2007 12:53:19 -0500 (CDT) Received: from sccqwbc14 (scommcenter14.asp.att.net[220.127.116.11]) by sccmmhc92.asp.att.net (sccmmhc92) with SMTP id = <20070630175306m9200d9uvle>; Sat, 30 Jun 2007 17:53:08 +0000 Received: from [18.104.22.168] by sccqwbc14; Sat, 30 Jun 2007 17:53:00 = +0000 Date: Sat, 30 Jun 2007 17:53:00 +0000 From: firstname.lastname@example.org (MR. PATRICK DURU) Subject: [SPAM] PRIVATE $ CONFIDENTIAL X-Originating-IP: [22.214.171.124] Bcc: Message-id: = <063020071753.700.468698780007C842000002BC219791280203010CD2079C080C03BF0= 90E0D04070E030A0207040201@mchsi.com> MIME-version: 1.0 X-Mailer: AT&T Message Center Version 1 (May 3 2007) Content-type: multipart/alternative; boundary=3DNextPart_Webmail_9m3u9jl4l_700_1183225980_0 X-Authenticated-Sender: b25saW5lbWFpbGJhZ0BtY2hzaS5jb20=3D X-MSKTag: [SPAM] X-MSK: BYS=3D0.999999,RUL=3D1.200000 ------=_NextPart_000_0007_01C7BB24.5C354440 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Dwindows-1252"> <META content=3D"MSHTML 6.00.6000.16481" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff> <DIV><!-- WEBMAIL STATIONERY noneset --> <DIV>From Mr Patrick Duru.<BR>Account Manager Of Centre Point Bank = PLC.<BR>ICON=20 Building,<BR>Plot 999F, Idejo/Danmole Street,<BR>Victoria Island, = Lagos<BR>Tele:=20 23-401 761-6118<BR>E-mail:email@example.com <BR>Dear=20 Friend,<BR> <BR>My name is Mr Patrick Duru, a personal Accountant = Manager=20 to an Engineer who is a foriegner from your country, who till his death = was a=20 Contractor with Impressario Nigeria Limited/Moenier Oil & Gas = Consult and=20 Nigerian Ports authority. Here in after shall be referred to as=20 my<BR>client.On Saturday, 4 May, 2002, in plane crash. Let me = refer you to=20 thefront page of (BBC) World News of Saturday, 4 May 2002,). You can = check it=20 through their websiteat,)<BR> <BR><A=20 href=3D"">http://news.bbc.co.uk/1/hi/world/africa/1968616.stm</A><BR><A=20 href=3D"">http://news.bbc.co.uk/1/hi/world/africa/1968300.stm</A><BR><A=20 href=3D"">http://www.usafricaonline.com/ngrkanocrash.html</A> = <BR> <BR>Since=20 then I have made several inquiries to your embassy to locate any<BR>of = my=20 clients extended relatives this has also proved unsuccessful.<BR>After = these=20 several unsuccessful attempts, I decided to track you over the Internet, = to=20 locate any member of his family hence I contacted you I have contacted = you to=20 assist in epatriating the money left behind by my client before they get = confiscated or declared unserviceable by the<BR>bank,the name of the = bank=20 is.(CENTRE POINT BANK PLC) where this huge Monryis deposits his lodgeds, = where=20 the deceased had an account valued at about ($10.5 million US = dollars).the=20 bank has issued me a notice to<BR>provide the next of kin or have = the=20 account confiscated within the nextthirty official working=20 days.<BR> <BR>Since I have been unsuccessful in locating the = relatives for=20 over 4<BR>years now l seek your consent to present you as the next of = kin of=20 the< BR>deceased so that the proceeds of this account valued at = US10.5=20 million<BR>dollars can be paid to you and then you and me can share the=20 money.60%<BR>shall be for me and 40% for you.<BR> <BR>I have all = neccessary=20 legal documents that can be used to back up any<BR>claim we may make. = All I=20 require is your honest co-operation to enable<BR>us see this deal = through.I=20 guarantee that this will be executed under a<BR>legal arrangement that = will=20 protect you from any breach of the law.<BR>Please, if you are willing to = transact this business with me, kindly getback to me as soon as you = received=20 this email, in your return mail,<BR>private contact telephone number, = fax number=20 full name and address to<BR>enable us file letter of claim to the=20 appropriate departments for necessary approvals before the transfer. And = reply=20 through my private/<BR>alternative email address: <A=20 href=3D"">firstname.lastname@example.org</A></DIV> <DIV>Looking forward to your response,<BR> <BR>Regards,<BR>Mr = Patrick=20 Duru<BR>PRIVATE $ CONFIDENTIAL </DIV> <DIV> </DIV><STRONG><EM><FONT face=3DArial = size=3D2></FONT></EM></STRONG></DIV> <DIV><STRONG><EM><U><FONT face=3DArial color=3D#ff0000 size=3D4>THE = BELOW IS THE=20 ORIGINAL EMAIL HEADER INFORMATION:</FONT></U></EM></STRONG></DIV> <DIV> <DIV><BR></DIV> <DIV><STRONG><EM><FONT face=3DArial size=3D2>X-Apparently-To: <A=20 href=3D"mailto:email@example.com">firstname.lastname@example.org</A> via=20 126.96.36.199; Sat, 30 Jun 2007 10:53:20 -0700<BR>X-Originating-IP:=20 [188.8.131.52]<BR>Authentication-Results: = mta108.vzn.mail.mud.yahoo.com =20 from=3Dmchsi.com; domainkeys=3Dneutral (no sig)<BR>Received: from = 184.108.40.206 =20 (EHLO vms169123pub.verizon.net) (220.127.116.11)<BR> by=20 mta108.vzn.mail.mud.yahoo.com with SMTP; Sat, 30 Jun 2007 10:53:20=20 -0700<BR>Received: <FONT color=3D#ff0000>from = sccmmhc92.asp.att.net</FONT>=20 ([18.104.22.168])<BR> <FONT color=3D#ff0000>by=20 vms169123.mailsrvcs.net<BR></FONT> (Sun Java System Messaging = Server=20 6.2-6.01 (built Apr 3 2006))<BR> with ESMTP id <<A=20 href=3D"mailto:0JKG001IAN0U3B33@vms169123.mailsrvcs.net">0JKG001IAN0U3B33= @vms169123.mailsrvcs.net</A>>=20 for<BR> <A = href=3D"mailto:email@example.com">firstname.lastname@example.org</A>=20 (ORCPT <A = href=3D"mailto:email@example.com">firstname.lastname@example.org</A>);=20 Sat,<BR> 30 Jun 2007 12:53:19 -0500 (CDT)<BR>Received: from <FONT=20 color=3D#ff0000>sccqwbc14=20 (scommcenter14.asp.att.</FONT>net[22.214.171.124])<BR> by=20 sccmmhc92.asp.att.net (sccmmhc92) with SMTP id=20 <20070630175306m9200d9uvle>;<BR> Sat, 30 Jun 2007 17:53:08=20 +0000<BR>Received: from [126.96.36.199] by sccqwbc14; Sat, 30 Jun 2007 = 17:53:00=20 +0000<BR>Date: Sat, 30 Jun 2007 17:53:00 +0000<BR>From: <A=20 href=3D"mailto:email@example.com">firstname.lastname@example.org</A> (MR. = PATRICK=20 DURU)<BR>Subject: [SPAM] PRIVATE $ CONFIDENTIAL<BR>X-Originating-IP:=20 [188.8.131.52]<BR>Bcc:<BR>Message-id:<BR> <<A=20 href=3D"mailto:063020071753.700.468698780007C842000002BC219791280203010CD= 2079C080C03BF090E0D04070E030A0207040201@mchsi.com">063020071753.700.46869= 8780007C842000002BC219791280203010CD2079C080C03BF090E0D04070E030A02070402= email@example.com</A>><BR>MIME-version:=20 1.0<BR>X-Mailer: AT&T Message Center Version 1 (May 3=20 2007)<BR>Content-type:=20 multipart/alternative;<BR> boundary=3DNextPart_Webmail_9m3u9jl4l_700= _1183225980_0<BR>X-Authenticated-Sender:=20 b25saW5lbWFpbGJhZ0BtY2hzaS5jb20=3D<BR>X-MSKTag: [SPAM]<BR>X-MSK:=20 BYS=3D0.999999,RUL=3D1.200000</FONT></EM></STRONG></DIV> <DIV> </DIV> <DIV><STRONG><EM><FONT face=3DArial = size=3D2></FONT></EM></STRONG> </DIV> <DIV> </DIV><!-- END WEBMAIL STATIONERY --></DIV></BODY></HTML> ------=_NextPart_000_0007_01C7BB24.5C354440--