If you have been scammed, please post here and share your experience; it may help others avoid the same situation!
by Guiguy Wed Feb 06, 2013 4:54 am
x-store-info:4r51+eLowCe79NzwdU2kR3P+ctWZsO+J
Authentication-Results: hotmail.com; spf=none (sender IP is 98.139.212.233) [email protected]; dkim=none header.d=yahoo.cn; x-hmca=none
X-SID-PRA: [email protected]
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD00
X-Message-Info: o9rlR4nWDTdTdba36fAIvrEJUyTVzYSH9/idftUemXbpcWppRHAZPjFgaZKzKYJNyABL975KqUjZXVk3pCF0m7Dmds9ixC7/k4nxJ1/IIzWV26vLNtbuN0TFC3e30by+99nkezuYTtBYrl/HoGq4lA==
Received: from omp1042.mail.bf1.yahoo.com ([98.139.212.233]) by BAY0-MC3-F10.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Tue, 5 Feb 2013 17:12:00 -0800
Received: (qmail 57084 invoked by uid 1000); 6 Feb 2013 01:11:59 -0000
Received: (qmail 55709 invoked by uid 60001); 6 Feb 2013 01:11:58 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1360113117; bh=K9YmTuUFvGouTfKaNxV2cRi00VOoiD5D7/s5uIO9cD8=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=Azr3qq1PuShq0UaRuKeqYyTkH936VzcWIlp9gz++9jJafp3Dcy9qMb2SG1dP1wyYuYgT+Loww1iPROFa/gSffUh6T1ZT3lzr+ZIOknOQQWRSJ0/hxlBnzf/TEnn0kiD9l9SjwgCkCQi4oxwe25fMt3/p7+/81diWCKEvTng2XeU=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b=3/epHfLsG0FawXyvCmTsjWJnI9C2vG/20SIPdJqdB4n6K8EblIinJMm3Gib9C5vLY+sl0ZqzhGw+lM8dXHu0QiDtb4rr7JnCkwzgedCQJJ8Ealt2bu3B1Xa4ZmnfPyPOxc9YHT/VxJti8qCqphaHuhr4fHhosONLQUmLhdIumwA=;
X-YMail-OSG: EcPHzNYVM1kyhT6J2Jt6P83RYEaMcYdUvz_hgc9YqGqKj7u
zJ7U_dn3MdgvZrdohrt5niqR.AiG7UYVQwoCzo3_IF_ga2I8.E0VE6C6PEVL
drWKlomMVp15vuIJVIz7LXdbQbKuo3n4pRm8DSayqOoH_I9apn_BXsDDxXy8
ge7xMvrbAy5qacitPT6tOnAakpaw03lnG_oHcihBTB1rqNL92RdDKbzQ0RFw
fNWgG676bdJWCB6lao.YxS0NiAJkwtkJvgNILRfSTzJZFV_U17RG6fPzZbap
tgUa3xfQzKnUF8AOctep1XFC0RtKelMWSkAZOYQiQ5VPNUfNNjshPraxpKHA
whbisupHQjKfmuHFio1KK2BO9qYPuvf6_OoAvbr.qttkRibXbW8bdmA1eQhK
b0040syZPGWF8W8OE3dThQy6Ppoa6tN3XQt1fw.w1Sp1z2vjZF9qzdG6vBq.
vNg--
Received: from [41.150.9.57] by web162502.mail.bf1.yahoo.com via HTTP; Tue, 05 Feb 2013 17:11:57 PST
X-Rocket-MIMEInfo: 001.001,RGVhciwKQW1vdW50OiAkMiw3MTAgwqB3YXMgc2VudCDCoHRvZGF5IGJ5IG1lIGF0IDExOjQwQU0gYnkgbWUsIGkganVzdCBjb25maXJtZWQgb24gd2VzdGVybiB1bmlvbiBzaXRlIGFuZCBpdCBpcyB0aGVyZSB3YWl0aW5nIGZvciB5b3UgdG8gUmVjZWl2ZSBpdC4KCk10Y24tIDY4NS0wMzktNTYxNgpTZW5kZXJzIG5hbWUgLSBZb2xhbmRhIERhbGFnCgp0ZXh0IFF1ZXN0aW9uIGFuZCBhbnN3ZXIgaXMgwqB0aGUgwqBzYW1lIGFzIGJlZm9yZQrCoApQbGVhc2UgZGVhciBhc2sgdGhlIGxhd3llciB0byByZWNvbmYBMAEBAQE-
X-RocketYMMF: monalisa_loveplanet
X-Mailer: YahooMailWebService/0.8.132.503
Message-ID: <[email protected]>
Date: Tue, 5 Feb 2013 17:11:57 -0800 (PST)
From: Yolanda Dolag <[email protected]>
Reply-To: Yolanda Dolag <[email protected]>
Subject: Re:Western Union Details,Get back to me
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="-1314897756-1105281429-1360113117=:33128"
Return-Path: [email protected]
X-OriginalArrivalTime: 06 Feb 2013 01:12:00.0428 (UTC) FILETIME=[F737FEC0:01CE0406]

---1314897756-1105281429-1360113117=:33128
Content-Type: multipart/alternative; boundary="-1314897756-2094789294-1360113117=:33128"

---1314897756-2094789294-1360113117=:33128
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

Dear,=0AAmount: $2,710 =A0was sent =A0today by me at 11:40AM by me, i just =
confirmed on western union site and it is there waiting for you to Receive =
it.=0A=0AMtcn- 685-039-5616=0ASenders name - Yolanda Dalag=0A=0Atext Questi=
on and answer is =A0the =A0same as before=0A=A0=0APlease dear ask the lawye=
r to reconfirm the wire instruction below=0AHSBC Bank Plc=0A32 Gloucester R=
oad,=0ARoss On Wye, Herefordshire,=0AHR9 5LF=0ASort Code: 40-39-06=0AAccoun=
t Number: 11428225=0AAccount name.....Fritz Fryer Antique Lighting=0A=A0=0A=
I will go to the bank Tomorrow for the transfer of from my personal account=
$95,000 for the tax=0A=A0=0Aclearance.=0A=A0=0A=A0=0AAlso I've attached th=
e senders copy of the western union slip, take every necessary info you wil=
l be needing in it.. i have to go back to the office now.=0A=A0=0A*********=
*******************=0A=A0=0A120 Washington Blvd., Suite 425. Arlington,=0AV=
A, 2220 45757. Phone: (571) 357-2330.=0AFax: (571) 357-2316=0A
---1314897756-2094789294-1360113117=:33128
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

<html><body><div style=3D"color:#000; background-color:#fff; font-family:ti=
mes new roman, new york, times, serif;font-size:12pt"><div><div><font face=
=3D"times new roman, new york, times, serif">Dear,</font></div><div><font f=
ace=3D"times new roman, new york, times, serif">Amount: $2,710 &nbsp;was se=
nt &nbsp;today by me at 11:40AM by me, i just confirmed on western union si=
te and it is there waiting for you to Receive it.</font></div><div><font fa=
ce=3D"times new roman, new york, times, serif"><br></font></div><div><font =
face=3D"times new roman, new york, times, serif">Mtcn- 685-039-5616</font><=
/div><div><font face=3D"times new roman, new york, times, serif">Senders na=
me - Yolanda Dalag</font></div><div><font face=3D"times new roman, new york=
, times, serif"><br></font></div><div><font face=3D"times new roman, new yo=
rk, times, serif">text Question and answer is &nbsp;the &nbsp;same as befor=
e</font></div><div><font face=3D"times new roman, new york, times,
serif">&nbsp;</font></div><div><font face=3D"times new roman, new york, ti=
mes, serif">Please dear ask the lawyer to reconfirm the wire instruction be=
low</font></div><div><font face=3D"times new roman, new york, times, serif"=
>HSBC Bank Plc</font></div><div><font face=3D"times new roman, new york, ti=
mes, serif">32 Gloucester Road,</font></div><div><font face=3D"times new ro=
man, new york, times, serif">Ross On Wye, Herefordshire,</font></div><div><=
font face=3D"times new roman, new york, times, serif">HR9 5LF</font></div><=
div><font face=3D"times new roman, new york, times, serif">Sort Code: 40-39=
-06</font></div><div><font face=3D"times new roman, new york, times, serif"=
>Account Number: 11428225</font></div><div><font face=3D"times new roman, n=
ew york, times, serif">Account name.....Fritz Fryer Antique Lighting</font>=
</div><div><font face=3D"times new roman, new york, times, serif">&nbsp;</f=
ont></div><div><font face=3D"times new roman, new york, times, serif">I wil=
l go to the
bank Tomorrow for the transfer of from my personal account $95,000 for the=
tax</font></div><div><font face=3D"times new roman, new york, times, serif=
">&nbsp;</font></div><div><font face=3D"times new roman, new york, times, s=
erif">clearance.</font></div><div><font face=3D"times new roman, new york, =
times, serif">&nbsp;</font></div><div><font face=3D"times new roman, new yo=
rk, times, serif">&nbsp;</font></div><div><font face=3D"times new roman, ne=
w york, times, serif">Also I've attached the senders copy of the western un=
ion slip, take every necessary info you will be needing in it.. i have to g=
o back to the office now.</font></div><div><font face=3D"times new roman, n=
ew york, times, serif">&nbsp;</font></div><div><font face=3D"times new roma=
n, new york, times, serif">****************************</font></div><div><f=
ont face=3D"times new roman, new york, times, serif">&nbsp;</font></div><di=
v><font face=3D"times new roman, new york, times, serif">120 Washington Blv=
d., Suite
425. Arlington,</font></div><div><font face=3D"times new roman, new york, =
times, serif">VA, 2220 45757. Phone: (571) 357-2330.</font></div><div><font=
face=3D"times new roman, new york, times, serif">Fax: (571) 357-2316</font=
></div><div style=3D"font-family: 'times new roman', 'new york', times, ser=
if; font-size: 12pt;"><br></div></div></div></body></html>
---1314897756-2094789294-1360113117=:33128--
---1314897756-1105281429-1360113117=:33128
Content-Type: application/x-msdownload; name="WesternUnionDetails.JPG.exe"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="WesternUnionDetails.JPG.exe"

Mod edit: removed html coding for picture. DJ
Advertisement

by vonpaso xlura Wed Feb 06, 2013 8:39 am
The attachment has a file type "JPG.exe". That is probably a worm intended for a Windows box. It is malware; if you open it on a Windows box, thinking it's a picture, it will take over your computer, possibly turning it into a bot, possibly sending out more copies of itself. Don't ever open unknown files on a Windows box or put a Windows box directly on the Internet.

... ni los estafadores heredarĂ¡n el reino de Dios. 1 Cor. 6:10
by Guiguy Wed Feb 06, 2013 9:02 am
Thanks for your advising...
Guiguy
by vonpaso xlura Wed Feb 06, 2013 10:11 am
Further checking: The email is from Pretoria, South Africa. If you know the sender and she's not in South Africa, someone has guessed her password. If you know the sender and she is in South Africa, her computer is infected.

... ni los estafadores heredarĂ¡n el reino de Dios. 1 Cor. 6:10
by Guiguy Thu Feb 07, 2013 1:53 pm
I don't know him.
I haven't friends in South Africa.

Who is online

Users browsing this forum: ClaudeBot and 4 guests