Fake Checks. Bruce Crawford, [email protected]

Download the attached PDF File to read our offer.

Contact: [email protected] for more information.

iHop Restaurant

The attached pdf doc (image);





Email header details;

Received: from imta-38.everyone.net (imta-35.everyone.net [216.200.145.35])
by mtain-dd06.r1000.mx.aol.com (Internet Inbound) with ESMTP id 247E138000144;
Sun, 31 Jul 2011 13:13:04 -0400 (EDT)
Received: from pps.filterd (omta001 [127.0.0.1])
by imta-38.everyone.net (8.14.4/8.14.4) with SMTP id p6VH9edv031798;
Sun, 31 Jul 2011 10:13:01 -0700
X-Eon-Dm: dm0213
Received: by dm0213.mta.everyone.net (EON-AUTHRELAY2 - 4174a7c4)
id dm0213.4e2a400f.1f55f9; Sun, 31 Jul 2011 10:06:58 -0700
X-Eon-Sig: AQN5zxVONYuyHeMWiQIAAAMe,9a2b792806c08e89c5fbd4c43a90d01e
Reply-To: <[email protected]>
From: "iHOP Restaurant"<[email protected]>
Subject: MAKE MONEY BY SIMPLY DRIVING YOUR VEHICLE
Date: Sun, 31 Jul 2011 13:06:58 -0400
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0128_01C2A9A6.65043EEC"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
To: undisclosed-recipients: ;
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.4.6813,1.0.211,0.0.0000
definitions=2011-07-31_03:2011-07-29,2011-07-31,1970-01-01 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=39 spamscore=39 ipscore=0 suspectscore=0
phishscore=2 bulkscore=2 adultscore=0 classifier=spam adjust=0 reason=mlx
scancount=1 engine=6.0.2-1012030000 definitions=main-1107310117
x-aol-global-disposition: S
X-AOL-VSS-INFO: 5400.1158/72927
X-AOL-VSS-CODE: clean
X-AOL-SCOLL-SCORE: 0:2:185273344:93952408
X-AOL-SCOLL-URL_COUNT: 0
X-AOL-REROUTE: YES
x-aol-sid: 3039ac1d40924e358d207083
X-AOL-IP: 216.200.145.35
X-AOL-SPF: domain : automobile.com SPF : none

Further scam script plus details on the western union pick up contact.

Hello *removed* ,

How are you doing today and the family.I will like to inform you that the payment for the car advert design has been mail out to the address you provided earlier.You will deduct your payment of 400$ which is the payment for 4weeks advert upfront from the whole of the money and have the remaining sent to the Expert.All you need to do is to get the check payment deposited in your account and urgently make a partial withdrawal of the balance and have it sent to the Expert.Please note that you are to deduct the western union charges from the balance.The Expert will be responsible for removing the design from your car at the end of the duration without any damage done to your car.The payment is been delivered by the fedex courier service.Here is the payment package information *removed* .Do visit http://www.fedex.com to track payment package.

Send the balance after deducting western union charges to the name below:

NAME....
ADD........ Glendale Blvd
CITY......Los Angeles
STATE....CA
ZIP CODE....90039

Get back to me with the MONEY TRANSFER CONTROL NUMBER(MTCN) and the exact amount to be received after western union charges has been deducted. The Expert shall contact you as soon as he receives the funds.

Then you will get back with the following details

1)The MTCN..........10 digits
2)Actual amount sent
3)The Name and Address of the sender.

Bruce Crawford



Email header details;

Delivered-To: *removed*
Received: by 10.223.70.142 with SMTP id d14cs91111faj;
Fri, 12 Aug 2011 06:30:57 -0700 (PDT)
Received: from mr.google.com ([10.224.207.193])
by 10.224.207.193 with SMTP id fz1mr757959qab.348.1313155856960 (num_hops = 1);
Fri, 12 Aug 2011 06:30:56 -0700 (PDT)
Received: by 10.224.207.193 with SMTP id fz1mr548984qab.348.1313155856103;
Fri, 12 Aug 2011 06:30:56 -0700 (PDT)
Return-Path: <[email protected]>
Received: from blu0-omc2-s38.blu0.hotmail.com (blu0-omc2-s38.blu0.hotmail.com [65.55.111.113])
by mx.google.com with ESMTP id fm8si6641951qab.9.2011.08.12.06.30.55;
Fri, 12 Aug 2011 06:30:56 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 65.55.111.113 as permitted sender) client-ip=65.55.111.113;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 65.55.111.113 as permitted sender) [email protected]
Received: from BLU166-W20 ([65.55.111.73]) by blu0-omc2-s38.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Fri, 12 Aug 2011 06:30:55 -0700
Message-ID: <[email protected]>
Return-Path: [email protected]
Content-Type: multipart/alternative;
boundary="_0fbe0dbe-f237-4302-919e-42f46def2039_"
X-Originating-IP: [82.128.3.107]
From: Bruce Crawford <[email protected]>
To: <*removed*>
Subject: =?windows-1256?Q?NOTICE:Car?= =?windows-1256?Q?_Advert_Pa?=
=?windows-1256?Q?yment_Deli?= =?windows-1256?Q?vered_To_y?=
=?windows-1256?Q?our_Locati?= =?windows-1256?Q?on..Instru?=
=?windows-1256?Q?ctions!!!=FE?=
Date: Fri, 12 Aug 2011 13:30:55 +0000
Importance: Normal
In-Reply-To:
<CAG9Skh+5BJ8mumUhf0SK5r5w6J3OqKywkbQqjUW+1M-SJ64T9g@mail.gmail.com>
References:
<CAG9Skh+5BJ8mumUhf0SK5r5w6J3OqKywkbQqjUW+1M-SJ64T9g@mail.gmail.com>
MIME-Version: 1.0
X-OriginalArrivalTime: 12 Aug 2011 13:30:55.0527 (UTC) FILETIME=[10473B70:01CC58F4]