An
Email with the Subject "TR: PAYMENT NOTIFICATION / FINAL ORDER./02" was
received in one of Scamdex's honeypot email accounts on Mon, 05 May 2008 14:11:45 -0700
and has been classified as a Generic Scam Email.
The sender shows as "Bernard Teyssou" <bernard.teyssou@orange.fr>.
The email address was probably spoofed. Do not reply to or contact any persons or organizations referenced in
this email, or follow any URLs as you may expose yourself to scammers and, at the very least, you will be
added to their email address lists for spam purposes.
Scam TagCloud
nigeriaaccidentfinanceattorneybankwindrawaccountclaimnotificationpayment transfermailbank bank account union bank the bank nominated bank userspamach(smtp server)(localhost [127.0.0.1])(cest)(mail.pop.co.th [203.150....(localhost.localdomain [1...(postfix)(ict)([127.0.0.1])(mail.pop.co.th [127.0.0.1])(amavisd-new, port 10024)(postfix, from userid 10001)(proxying for 192.168.0.37)(overlook authenticated u...(utc)(normal)[mailto:trinarongs@pop.co.th](ubs) mr. thomasnmick mr thomas mick
NO CHART DATA - EMAIL HAS NOT YET BEEN ANALYSED
Scam Email Headers
This a (redacted) view of the raw email headers of this scam email.
Personally Identifiable Information (PII) has been suppressed, but can be
supplied as received to appropriate investigating or law enforcement agencies on request.
EEEEEstdClass Object
(
[return-path:] =>
[envelope-to:] => JS_SUBMISSIONS@scamdex.com
[delivery-date:] => Mon, 05 May 2008 14:11:46 -0700
[received:] => Array
(
[0] => from smtp2f.orange.fr ([80.12.242.152])by gogol.o7e.net with esmtp (Exim 4.68)(envelope-from )id 1Jt7y6-0004a4-Gkfor JS_SUBMISSIONS@scamdex.com; Mon, 05 May 2008 14:11:45 -0700
[1] => from me-wanadoo.net (localhost [127.0.0.1])by mwinf2f24.orange.fr (SMTP Server) with ESMTP id 07E78700008C;Mon, 5 May 2008 23:11:52 +0200 (CEST)
[2] => from maisoncfe2676d (APoitiers-157-1-7-247.w90-5.abo.wanadoo.fr [90.5.62.247])by mwinf2f24.orange.fr (SMTP Server) with ESMTP id 595617000089;Mon, 5 May 2008 23:11:50 +0200 (CEST)
)
[x-me-uuid:] => 20080505211150365.595617000089@mwinf2f24.orange.fr
[from:] => "Bernard Teyssou"
[to:] => "Bernard Teyssou"
[subject:] => TR: PAYMENT NOTIFICATION / FINAL ORDER./02
[date:] => Mon, 5 May 2008 23:11:49 +0200
[x-mailer:] => Array
(
[0] => <001101c8aef4$a36d9460$0a01a8c0@maisoncfe2676d>
[1] => Microsoft Office Outlook 11
)
[mime-version:] => 1.0
[content-type:] => text/plain;charset="iso-8859-1"
[content-transfer-encoding:] => quoted-printable
[thread-index:] => AcituPLZoodW046+RBKINm+ixFOH9gBO6B1w
[x-mimeole:] => Produced By Microsoft MimeOLE V6.00.2900.3198
[x-spam-status:] => No, score=3.6
[x-spam-score:] => 36
[x-spam-bar:] => +++
[x-spam-flag:] => NO
[x-o7e-flag:] => J-3509981-042508::smtp2f.orange.fr [80.12.242.152]
[message-id:] => REIDs3x1239839786.M20955P32690V-S3X
[x-scamdex-scores:] => S:59 P:48 A:54 L:52 E:52 G:46
[x-scamdex-classtype:] => S
[x-scamdex-classscore:] => 59
[x-scamdex-totscore:] => 311
[x-scamdex-kw:] => accident,account,agent,bank,claim,finance,foreign,fund,nigeria,notification,paid,payment,process,report,resident,union
[x-scamdex-em:] => 2A7FD580008B@mwinf2e26.oran,595617000089@mwinf2f24.oran,info_info60@mail.ru,officemail@pop.co.th,trinarongs@pop.co.th
[x-scamdex-dir:] => B
[x-scamdex-id:] => B1239839786.M20955P32690V
[x-scamdex-copyright:] => This Email is Copyright Scamdex.com 2009, Reproduction Prohibited
)
Domain Names used for collecting scam email ("Honeypot email accounts") have been obscured and replaced with the token 'HUN1P0T'
Community Action - SPAM/non-Scam Report
Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this
email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.
Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not
be in our database. Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or
SPAM, via unpublished 'Honeypot' email addresses.
Return-Path: <trinarongs@pop.co.th>
Received: from mwinf2e26.orange.fr (mwinf2e26.orange.fr)
by mwinb0k01 (SMTP Server) with LMTP; Sun, 04 May 2008 09:32:04
+0200
X-Sieve: Server Sieve 2.2
Received: from me-wanadoo.net (localhost [127.0.0.1])
by mwinf2e26.orange.fr (SMTP Server) with ESMTP id C3CC35800083;
Sun, 4 May 2008 09:32:04 +0200 (CEST)
Received: from mail.pop.co.th (mail.pop.co.th [203.150.1.4])
by mwinf2e26.orange.fr (SMTP Server) with ESMTP id 2A7FD580008B;
Sun, 4 May 2008 09:32:02 +0200 (CEST)
X-ME-UUID: 20080504073202174.2A7FD580008B@mwinf2e26.orange.fr
Received: from localhost (localhost.localdomain [127.0.0.1])
by mail.pop.co.th (Postfix) with ESMTP id E05587754B;
Sat, 3 May 2008 08:09:31 +0700 (ICT)
X-Virus-Scanned: amavisd-new at pop.co.th
Received: from mail.pop.co.th ([127.0.0.1])
by localhost (mail.pop.co.th [127.0.0.1]) (amavisd-new, port 10024)
with LMTP id 9dShglojqxgb; Sat, 3 May 2008 08:09:31 +0700 (ICT)
Received: by mail.pop.co.th (Postfix, from userid 10001)
id 053BE8238C; Fri, 2 May 2008 22:42:29 +0700 (ICT)
Received: from 83.229.90.48 (proxying for 192.168.0.37)
(OverLook authenticated user officemail@pop.co.th)
by mail.pop.co.th with HTTP;
Fri, 2 May 2008 15:42:29 -0000 (UTC)
Message-ID: <56988.83.229.90.48.1209742949.overlook@mail.pop.co.th>
Date: Fri, 2 May 2008 15:42:29 -0000 (UTC)
Subject: RE: PAYMENT NOTIFICATION / FINAL ORDER./02
From: "MINISTRY OF FINANCE" <trinarongs@pop.co.th>
To: "."@pop.co.th
Reply-To: info_info60@mail.ru
User-Agent: OverLook/1.4.5
MIME-Version: 1.0
Content-Type: text/plain;charset=windows-874
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
X-me-spamlevel: not-spam
X-me-spamrating: 48.923969
-----Message d'origine-----
De : MINISTRY OF FINANCE [mailto:trinarongs@pop.co.th]
Envoyé : vendredi 2 mai 2008 17:42
À : "."@pop.co.th
Objet : RE: PAYMENT NOTIFICATION / FINAL ORDER./02
PRESIDENCY
OFFICE OF THE MINISTER FOR FINANCE
AND FINANCIAL MATTERS TO THE PRESIDENT
RE: PAYMENT NOTIFICATION / FINAL ORDER.
This is to draw your attention that your contract payment is still
lying in suspense account with the Central Bank of Nigeria. Federal
Government of Nigerian has authorized them to effect payment on her
behalf,the only problem now is that we dictated a lot of irregularities
attached to your payment file.
(1) Did you at any time delegate any body not even from your family to
claim your fund on your behalf?
(2) Were you involved in a motor accident?
(3) Are you aware or related to one Mr. Thomas Mick from your country?
Please reconfirm and answer the above questions because one Mr. Thomas
Mick came to our foreign payment department and submitted an application
that you authorized your contract payment of US$12.5M to be paid into the
account of Union Bank of Switzerland (UBS) with Account number UBS-
A943BDG99 with a report that you are now paralyzed as a result of the
ghastly motor accident you had last month.
In the course of processing the application by Mr Thomas Mick himself
which he made known to us that he came from you, he succeeded in paying
all the bank charges that you are supposed to pay so as to make sure
that we effect this transfer payment as quickly as possible without any
further delay. All duplicate copies of his payment receipt is attached
to your file. He has made part payment all amounting to $25,000.00.
The delay in the transferring the contract payment is due to the
requested for a power of attorney authorizing him to pursue this
payment on your behalf. He asked for a week so as to submit the
documents, but up till now we have not received any of the documents from
any of you. Why?
please forward us the power of attorney by a return fax or by E-mail so
that we can ask Union Bank of Switzerland(UBS) to effect your payment
to his nominated Bank account on your behalf without delay.
Thanks for your co-operation
Best Regard
Alex Thompson
Personal clerk/confidential secretary to the Minister of Finance
Return-Path: <trinarongs@pop.co.th>
Received: from mwinf2e26.orange.fr (mwinf2e26.orange.fr)
by mwinb0k01 (SMTP Server) with LMTP; Sun, 04 May 2008 09:32:04
+0200
X-Sieve: Server Sieve 2.2
Received: from me-wanadoo.net (localhost [127.0.0.1])
by mwinf2e26.orange.fr (SMTP Server) with ESMTP id C3CC35800083;
Sun, 4 May 2008 09:32:04 +0200 (CEST)
Received: from mail.pop.co.th (mail.pop.co.th [203.150.1.4])
by mwinf2e26.orange.fr (SMTP Server) with ESMTP id 2A7FD580008B;
Sun, 4 May 2008 09:32:02 +0200 (CEST)
X-ME-UUID: 20080504073202174.2A7FD580008B@mwinf2e26.orange.fr
Received: from localhost (localhost.localdomain [127.0.0.1])
by mail.pop.co.th (Postfix) with ESMTP id E05587754B;
Sat, 3 May 2008 08:09:31 +0700 (ICT)
X-Virus-Scanned: amavisd-new at pop.co.th
Received: from mail.pop.co.th ([127.0.0.1])
by localhost (mail.pop.co.th [127.0.0.1]) (amavisd-new, port 10024)
with LMTP id 9dShglojqxgb; Sat, 3 May 2008 08:09:31 +0700 (ICT)
Received: by mail.pop.co.th (Postfix, from userid 10001)
id 053BE8238C; Fri, 2 May 2008 22:42:29 +0700 (ICT)
Received: from 83.229.90.48 (proxying for 192.168.0.37)
(OverLook authenticated user officemail@pop.co.th)
by mail.pop.co.th with HTTP;
Fri, 2 May 2008 15:42:29 -0000 (UTC)
Message-ID: <56988.83.229.90.48.1209742949.overlook@mail.pop.co.th>
Date: Fri, 2 May 2008 15:42:29 -0000 (UTC)
Subject: RE: PAYMENT NOTIFICATION / FINAL ORDER./02
From: "MINISTRY OF FINANCE" <trinarongs@pop.co.th>
To: "."@pop.co.th
Reply-To: info_info60@mail.ru
User-Agent: OverLook/1.4.5
MIME-Version: 1.0
Content-Type: text/plain;charset=windows-874
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
X-me-spamlevel: not-spam
X-me-spamrating: 48.923969
-----Message d'origine-----
De : MINISTRY OF FINANCE [mailto:trinarongs@pop.co.th]
Envoyé : vendredi 2 mai 2008 17:42
À : "."@pop.co.th
Objet : RE: PAYMENT NOTIFICATION / FINAL ORDER./02
PRESIDENCY
OFFICE OF THE MINISTER FOR FINANCE
AND FINANCIAL MATTERS TO THE PRESIDENT
RE: PAYMENT NOTIFICATION / FINAL ORDER.
This is to draw your attention that your contract payment is still
lying in suspense account with the Central Bank of Nigeria. Federal
Government of Nigerian has authorized them to effect payment on her
behalf,the only problem now is that we dictated a lot of irregularities
attached to your payment file.
(1) Did you at any time delegate any body not even from your family to
claim your fund on your behalf?
(2) Were you involved in a motor accident?
(3) Are you aware or related to one Mr. Thomas Mick from your country?
Please reconfirm and answer the above questions because one Mr. Thomas
Mick came to our foreign payment department and submitted an application
that you authorized your contract payment of US$12.5M to be paid into the
account of Union Bank of Switzerland (UBS) with Account number UBS-
A943BDG99 with a report that you are now paralyzed as a result of the
ghastly motor accident you had last month.
In the course of processing the application by Mr Thomas Mick himself
which he made known to us that he came from you, he succeeded in paying
all the bank charges that you are supposed to pay so as to make sure
that we effect this transfer payment as quickly as possible without any
further delay. All duplicate copies of his payment receipt is attached
to your file. He has made part payment all amounting to $25,000.00.
The delay in the transferring the contract payment is due to the
requested for a power of attorney authorizing him to pursue this
payment on your behalf. He asked for a week so as to submit the
documents, but up till now we have not received any of the documents from
any of you. Why?
please forward us the power of attorney by a return fax or by E-mail so
that we can ask Union Bank of Switzerland(UBS) to effect your payment
to his nominated Bank account on your behalf without delay.
Thanks for your co-operation
Best Regard
Alex Thompson
Personal clerk/confidential secretary to the Minister of Finance