Mayfield Credit

Hello all. Not sure if this is on here already (as I am new), but Mayfield Credit is a scam. Another advance fee loan site. They seemed legit (asked for their deposit, which I now know is illegal). They later asked for another smaller fee, due to an "error". I fell for it all. Now they have almost a grand of my money, and no loan ever materialized (their phone number is now "out of service", but works when i block it, can't get through to anybody), and when i went to check the status of my loan on their website, my "loan" no longer exists. Please, spread the word everybody, do not use these criminals. Their website is www.mayfieldcredit.com.

I'm sorry you were scammed.

Unfortunately, we have a typical fake domain here. Registered less than a year ago, for one year only.

domain: mayfieldcredit.com
created: 05-Dec-2010
last-changed: 23-Jun-2011
registration-expiration: 05-Dec-2011

Did you receive any emails from any address at mayfieldcredit.com? If sou, could you post them, including headers (remove your own name/address first)? Our site killers will do what they can to get the website and/or domain killed so they can't hurt others, and the emails will help provide the necessary evidence.

Yes, I did (receive emails). I'll post them up when I have time.

Hi Nevesy, please include at least one set of headers (but remove your own email address from it). If you are unsure what headers are or how to find them, just let us know which email provider you use and we'll explain. Thanks

Hi Michael,

I use windows Hotmail, and I do not know what you are referring to when you say headers. If you could explain that would be awesome.

No problem

This is how to find headers in hotmail:

*Go to your inbox
*right-click on the email of which you want the headers (don't open the mail)
*Select 'View message source'

A new window will open with the headers. Just copy the complete thing and post it here, or mail it to me. If you do post them here, please check them for your own email address and delete it. Your own address may appear in it a few times and we wouldn't want you addy to get picked up by spambots etc

Is View Page Source the same thing

Ok, I tried copying/pasting one of those email headers, but it wouldn't let me as it contained more than the maximum allowable characters.

So sorry for the late reply! I only just noticed this post. No, it's not view page source.

If the method described earlier doesn't work it could be you're using a different version than me. Try this:

Open the mail
In the top right, next to reply, there is a small triangle. Click it.
Select "View message source"

That should work

You can just send the complete thing to me by email, I'll filter out the unnecessary parts.

Thanks. Here it is (i deleted my name an email address from this). This is the one I dealt with the most when I was dealing with these criminals.


Authentication-Results: hotmail.com; sender-id=temperror (sender IP is 184.154.126.218)
[email protected]; dkim=none header.d=mayfieldcredit.com; x-hmca=none
X-Message-Status: n:0:n
X-SID-PRA: [email protected]
X-DKIM-Result: None
X-AUTH-Result: NONE
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9NA==
X-Message-Info: M98loaK0Lo1tWPCbe4OE0ew7S8+Hpofa3ns2YiNTv5P3Ma4W/qD2DUD13YoPUyvy8AW90fk7V+l05Lz/hKeRqvUZUPVULd592VWotY2NCKDtug15QJkYi3J+9mvXqrIXoBoH1n5kFuU=
Received: from cx98.justhost.com ([184.154.126.218]) by col0-mc2-f20.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Sat, 16 Jul 2011 16:21:07 -0700
Received: from localhost ([127.0.0.1] helo=www.mayfieldcredit.com)
by cx98.justhost.com with esmtpa (Exim 4.69)
(envelope-from <[email protected]>)
id 1QiEAU-0006cT-JX
for ; Sat, 16 Jul 2011 18:21:06 -0500
Received: from 208.69.57.184 ([208.69.57.184])
(SquirrelMail authenticated user [email protected])
by www.mayfieldcredit.com with HTTP;
Sat, 16 Jul 2011 18:21:06 -0500
Message-ID: <[email protected]>
Date: Sat, 16 Jul 2011 18:21:06 -0500
Subject: Attn.:
From: [email protected]
To:
User-Agent: SquirrelMail/1.4.21
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - cx98.justhost.com
X-AntiAbuse: Original Domain - hotmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - mayfieldcredit.com
X-Source:
X-Source-Args:
X-Source-Dir:
Return-Path: [email protected]
X-OriginalArrivalTime: 16 Jul 2011 23:21:07.0417 (UTC) FILETIME=[0A419490:01CC440F]

We apologies for what has happened and plan to resolve this as soon as
possible. This matter will be looked at in detail on Monday and we expect
resolution as soon as possible. Please note that we have not provided our
Agent with your MTCN number to pick up the deposit balance. We thought it
best to leave it there until you can confirm receipt of your loan. Since
we were able to confirm that the deposit was sent the deposit our legal
department give us the OK to make the transfer.

We are confident that this matter will be resolved to your satisfaction
and we are looking at giving you a rate discount of .25% for your trouble.


Regards,
Mayfield Credit
[email protected]
www.mayfieldcredit.com

IP resolves here.
Scammer Found! (ID: 34907)
IP Block 208.69.57.184 (Frequent Scammer)
Country CANADA
I am sorry you were conned. Remember IP numbers in headers are the most important tool you have. It is the first number you see from the bottom line. 4 NUMBER BLOCK SEPARATED BY DOTS eg 208.69.57.184/208.69.57.24/41.221.69.57. I used http://www.nextwebsecurity.com/LocationTools.asp to get the report above. Negative reports don't mean it is safe but only not found yet. You will need to see if the info you have agrees with the general impression you are led to believe. Beware of fake phone number such as
+44 701/702 /703 etc, which are forward codes to Nigeria.
Nigeria , Ghana ,Senegal, Burkina Faso, Cote D' Ivoire, Benin, Malaysia (especially Yangon) are all red flag zones.

Excellent! We'll do what we can to get this site offline In the meantime, if you have other emails from them please post them as well - the more that is posted about them online, the more it will convince people from falling to the same scheme. Thank you very much for posting!

No problem. Also, there's another IP address in there that I traced to Chicago IL also.