Norton Finance Loan Company - [email protected]

IP: 78.138.19.210 Nigeria (Bénin)*

Delivered-To: @gmail.com
Received: by 10.216.25.80 with SMTP id y58cs146871wey;
Thu, 30 Jul 2009 05:54:24 -0700 (PDT)
Received: by 10.141.2.5 with SMTP id e5mr717976rvi.134.1248958458230;
Thu, 30 Jul 2009 05:54:18 -0700 (PDT)
Return-Path: <[email protected]>
Received: from macro.bio.ncue.edu.tw (macro.bio.ncue.edu.tw [120.107.166.3])
by mx.google.com with ESMTP id 5si6117436pzk.89.2009.07.30.05.53.47;
Thu, 30 Jul 2009 05:54:18 -0700 (PDT)
Received-SPF: neutral (google.com: 120.107.166.3 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=120.107.166.3;
Authentication-Results: mx.google.com; spf=neutral (google.com: 120.107.166.3 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Received: from webmail.bio.ncue.edu.tw (localhost.bio.ncue.edu.tw [127.0.0.1])
by macro.bio.ncue.edu.tw (8.12.9/8.12.5) with ESMTP id n6UCkPZt014381;
Thu, 30 Jul 2009 20:46:25 +0800 (CST)
From: "NORTON LOAN" <[email protected]>
Reply-To: [email protected]
Subject: {Spam?} loan offer at 3% intrest rate......................
Date: Thu, 30 Jul 2009 21:46:25 +0900
Message-Id: <[email protected]>
X-Mailer: Open WebMail 2.41 20040926
X-OriginatingIP: 78.138.19.210 (huangsc)
MIME-Version: 1.0
Content-Type: text/plain;
charset=windows-1252
X-macro-MailScanner-Information: Please contact the ISP for more information
X-macro-MailScanner: Found to be clean
X-macro-MailScanner-SpamCheck: spam, ORDB-RBL
X-MailScanner-From: [email protected]

My name is Mr Brown Greffin,the managing director of Norton
Finance Loan Company.I am a private loan lender.I give out loans to
business people and individuals for just 3% interest rate.* Applicant Full
Names
* Direct-Phone Number:* Country:* Age:* Marital Status:* Amount Required As
Loan:
* Proposed Terms/Duration Of Loan:
Regards,
Mr Brown Greffin
E-mail:[email protected]
Tel:Tel+44 70457 95686

The phone number has been associated with several scam email addresses: Clicky

There is a genuine company called Norton Finance; their website is here:

http://www.nortonfinance.co.uk/

These scam emails, however, are not from the genuine company. The writers of these mails will never make any loans to anyone, but, instead, take money from you, for nothing in return.

From: Claudette Shackelford <[email protected]>
Date: Fri, Oct 30, 2009
Subject: Attention

Attention,

Norton Finance Loan Company has come to Offer Private,
Commercial and Personal Loans with a very Minimal annual
Interest Rates as Low as 2% within a 1 year to 50 years
Repayment duration period to any part of the world.

We give out loans within the range of $5,000 to $500,000,000 USD.
Our loans are well insured for maximum security is our priority.
Norton Finance is a leading online provider of finance.

If you need a consolidation loan, we have many flexible
plans on our lending panel to help you release the equity
in your home. We can even help with business finance!

Interested Persons should contact me via E-mail:

Lender's Name: Mr.Mark David
Lender's Email:[email protected]

BORROWERS INFORMATION
Names:
Country:
Fax Number:
Personal Number:
Occupation:
Sex:
Amount Needed:
Loan duration:

Best Regards
Claudette Shackelford
Online Advertiser @ Norton Finance Company (NFC)

This crowd should be hunted and hung. I got caught out with them €500 I lost to them...

Welcome here Robtjregan

Sorry to hear you got scammed. Could you post some of the emails they send you? If possible with the full headers. If you don't know how to get the headers, just ask one of the support team members.
Be carefull on the internet regarding loans. Please read this information about loan scams here: http://www.scamwarners.com/forum/viewtopic.php?f=35&t=3161 that will help finding out wether it's a scam or not.

Here is another email from Norton Finance Loans

Fred

Email HEADER

Return-Path: <[email protected]>
Received: from cdptpa-mxlb.mail.rr.com ([10.127.255.84])
by cdptpa-imta05.mail.rr.com with ESMTP
id <[email protected]>
for <[email protected]>; Tue, 13 Jul 2010 11:28:38 +0000
Return-Path: <[email protected]>
X-Cloudmark-Score: 0
X-RR-Connecting-IP: 218.102.48.82
X-Authority-Analysis: v=1.1 cv=OAk7bGrAYdUhGMLlBwhmALV9SQYWKtdtgbuHmFmk0ME= c=1 sm=0 a=lZI1NaRo3WoA:10 a=CYtdG_-2rjoA:10 a=H7duyQikAcbrJAorCIWU/w==:17 a=_1Q8kXXRZlj_lbLxPrwA:9 a=VVEMkqWP-4rj2vmqNawA:7 a=l0QC16pRgQKrznDYO_hom1OAJBwA:4 a=4VmKGKSqCdEA:10 a=vIJFbumtlKKx4VpV:21 a=L2SMOTzJ3nuIgqd7:21 a=H7duyQikAcbrJAorCIWU/w==:117
Received: from [218.102.48.82] ([218.102.48.82:38932] helo=wmail04dat.netvigator.com)
by cdptpa-iedge04.mail.rr.com (envelope-from <[email protected]>)
(ecelerity 2.2.2.39 r()) with ESMTP
id 40/3D-09435-3ED4C3C4; Tue, 13 Jul 2010 11:28:38 +0000
Received: from ocmas05.netvigator.com ([219.76.94.1])
by wmail04dat.netvigator.com
(InterMail vM.6.01.03.02 201-2131-111-104-20040324) with ESMTP
id <20100713112832.RICB442.wmail04dat.netvigator.com@ocmas05.netvigator.com>;
Tue, 13 Jul 2010 19:28:32 +0800
Received: from obavout.netvigator.com ([218.102.53.42])
by ocmas05.netvigator.com with bizsmtp
id hPUY1e0010ueSLA01PUY6j; Tue, 13 Jul 2010 19:28:32 +0800
X-Mailer: Openwave WebEngine, version 2.8.19 (webedge20-101-1110-20050615)
X-Originating-IP: [201.238.222.93]
From: "Norton Finance Loans "<[email protected]>" <[email protected]>
To: [email protected]
Subject:
Date: Tue, 13 Jul 2010 19:28:32 +0800
MIME-Version: 1.0
Content-Type: text/plain; charset=Big5
Content-Transfer-Encoding: 7bit
Message-Id: <20100713112832.RICB442.wmail04dat.netvigator.com@ocmas05.netvigator.com>

ORIGINAL TEXT

Dear Sir/Madam,

We (Norton Finance Loans) are a private loan agency located in
london,united kingdom,We Offer Private, Commercial and Personal Loans with
very Minimal annual Interest Rates as Low as 2% within a 1year to 50years
repayment duration period to any part of the world. We give out loans within the
range of $10,000 to $100,000,000 USD. Our loans are well insured and maximum
security is our priority,Interested Persons should contact me via E-mail :

BORROWERS INFORMATION
Your Names:
Your Country:
Your Address:
Your Age:
Your Fax Number:
Personal Number:
Office Number:
Your Occupation:
Sex:
Monthly Income:
Exact Loan Amount Needed:
Loan duration:
Brief description of individual:

Norton Finance Loans (NFL)

Welcome here joker52837

Thanks for posting this! It will help others who do a search for this scammer. I noticed that you forgot to edit out your own email address, and to prevent getting lots of spam, you'd better do some editting.

The sender IP 202.81.252.51 is from Hong Kong? according to http://network-tools.com.

I never answer emails like this, but thought I'd look it up online and found this site, so I thought I'd post the email details here. The first thing that should catch your attention is a supposedly multi-million dollar company and they are using a 'Reply to:' yahoo email address, I think not. Anyway, here it is:



Authentication-Results: hotmail.com; sender-id=temperror (sender IP is 202.81.252.51) [email protected]; dkim=none header.d=nortonfinance.co.uk; x-hmca=none
X-Message-Status: n:0:n
X-SID-PRA: Norton Finance <[email protected]>
X-DKIM-Result: None
X-AUTH-Result: NONE
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9NA==
X-Message-Info: E4hhm4+eWHMU/kemenGbyUUcbl6SjX2dJ6kwZYVJWfzMImkA+y06TAquDMyX81Qm5JL6tSDBJe87Z95F8WVi27cGPqL7fyLMpg/XNEwsleQKKq2sow39KmfVioF4dEcPSBc5K7jSg3Q=
Received: from frenzy.netfront.net ([202.81.252.51]) by bay0-mc3-f22.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Mon, 4 Jul 2011 08:05:59 -0700
Received: from prima.netfront.net (prima.netfront.net [202.81.252.242] (may be forged))
by frenzy.netfront.net (8.14.5/8.14.5) with ESMTP id p64F5oc1026304
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK);
Mon, 4 Jul 2011 23:05:53 +0800 (HKT)
Received: from prima.netfront.net (localhost [127.0.0.1])
by prima.netfront.net (8.14.4/8.14.5) with ESMTP id p64F5nR1031723;
Mon, 4 Jul 2011 23:05:50 +0800 (HKT)
From: "Norton Finance" <[email protected]>
Reply-To: [email protected]
Subject: Please Read
Date: Mon, 4 Jul 2011 23:05:49 +0800
Message-Id: <[email protected]>
X-Mailer: OpenWebMail 2.52 20060502
X-OriginatingIP: 69.31.50.203 (rita)
MIME-Version: 1.0
Content-Type: text/plain;
charset=iso-8859-1
X-DCC-netfront-Metrics: frenzy.netfront.net; whitelist
X-DCC-netfront-Metrics: prima.netfront.net; whitelist
Bcc:
Return-Path: [email protected]
X-OriginalArrivalTime: 04 Jul 2011 15:06:00.0105 (UTC) FILETIME=[E25C8190:01CC3A5B]



Norton Finance
Central Processing Office,
Norton House,
Mansfield Road, Rotherham,
South Yorkshire
S60 2EB, UK.

Attention Sir/Madam,
We Are Currently Offering Private, Commercial, Business and Personal
Loans with very Minimal annual Interest Rates as Low as 4% within a 5year to
25 years repayment duration period to any part of the world.

Please contact Mr. Mark Melvin for more information on [email protected]

Sincerely,
Katherine E. Wilson.

And what about signed:
Mr. Norton Nelson
loan officer
Norton Finance (U.K.) Limited?
IP adress of origin: 68.68.107.213 is from Delaware,U.S.A. - tax paradise..

Return-path: <[email protected]>
Received: from snt0-omc4-s11.snt0.hotmail.com
(snt0-omc4-s11.snt0.hotmail.com [65.55.90.214])
Received: from SNT141-W52 ([65.55.90.201]) by snt0-omc4-s11.snt0.hotmail.com
with Microsoft SMTPSVC(6.0.3790.4675); Thu, 19 Jan 2012 01:14:37 -0800
From: NORTON FINANCE UK LIMITED <[email protected]>
Subject: =?utf-8?B?xb5pYWRvc8WlIG8g?=
=?utf-8?B?w7p2ZXLigI/igI/igI/igI/igI/igI8=?=
In-reply-to: <39426912efe26afb923407efc7de7f7e@>
X-Originating-IP: [68.68.107.213]
To:
Message-id: <[email protected]>
MIME-version: 1.0
Content-type: multipart/alternative;
boundary=_7a8b770d-8475-4fd0-b5b9-57dc7620062c_
Importance: Normal
References: <39426912efe26afb923407efc7de7f7e>
Original-recipient: rfc822;
X-OriginalArrivalTime: 19 Jan 2012 09:14:37.0390 (UTC)
FILETIME=[C449BEE0:01CCD68A]
Old-X-EsetId: 94D7DE226D3A2730C09586
Old-X-EsetId: 94D7DE226D3A2730C09586
X-EsetScannerBuild: 10759
X-ESET-AntiSpam: OK;10;calc;2012-01-19 10:19:10;1201191019100012;A49E
Old-X-EsetId: 94D7DE226D3A2730C19382
Old-X-EsetId: 94D7DE226D3A2730C19786
X-EsetId: 94D7DE226D3A2730C1978E

Do you think, it is all right?

[AlanJones]

Hi anaalfabet and welcome to ScamWarners.

The email that you have received is definitely a scam. The domain nortonfnukltd.com was only set up in late last year and is email only (there is no web content) those are sure signs of a scam.

We would like to get the domain shut down, so can you please provide the main body of the email that you received.

Hi Alan, here is some examples of email main body:

NORTON FINANCE (U.K.) LIMITED
Norton house Mansfield road
Rotherham South Yorkshire
S60 2DR
Registered No. 02209551
TEL: +44-704-577-3742

Top of the day to you.

Below are your loan terms and conditions.

Loan Balance: €20,000.00
Adjusted Loan Balance: €20,000.00
Loan Interest Rate: 5.00%
Loan Term: 10 years
Monthly Loan Payment: €212.13
Number of Payments: 120
Cumulative Payments: €25,455.76
Total Interest Paid: €5,455.76

Note: The monthly loan payment was calculated at 119 payments of €212.13 plus a final payment of €212.29.

Please be informed that upon your agreement to the above terms, your loan will be approved and registered.

Also be informed that a loan agreement document will be sent to you for you to endorse your signature on it as it serves as a legal security between me and you.

Attached to this email is the company's registration certificate

Please try as much as possible to send your ID card or international
passport so that we can proceed.

2.

Top of the day to you.

Please be informed that your loan process have been completed and your loan have been registered and approved for you

Attached to this mail is a loan agreement contract. You are expected to sign and send a copy of it to me. This is very important in this transaction as it serves as an international legal security as this loan transaction is concerned.

Upon receipt of the signed agreement your loan will be officially approved for transfer and contacts of my paying bank will be sent to you so you can contact the bank on how to get your loan transferred to you.

I await the signed document

Regards

Norton Nelson

And finally now: (it is really scam..)

Top of the day to you

Please be informed that your loan have been approved for transfer and have been deposited with my official paying security company

You are advised to contact the bank on instructions on how you are to get your funds.

Reliance Security Group Limited,
Boundary House, Cricketfield Road,
Uxbridge, Middlesex UB8 1QG
Email: [email protected]

Also be informed that you are to send your banking information to the security company. The security company will require you to make payment of 455 Euro for the transfer of your loan into your account.

Keep me informed as soon as you have contacted the security company

I await your mail

Regards

Norton Nelson

[AlanJones]

Thanks for posting the email bodys, that will help us get the domain shut down. I am also working on gathering evidence for the other domain mentioned in the 3rd email.

Thank you too,Alan.. I wrote to that Reliance Security Group, so I wait for their response and will re send it here.. Keep me (us) informed about that company..
Have a lot of successes

there is a new informations about website from this "company" -copy of oficial website of genuine company Norton finance U.K. Ltd:

for more information about our company you can visit our website by clicking on the link below.

http://nortonfinukltd.com/nf/

It is also important for you to note that the bank charges are higher than that of the security company. We also consider for our customers the best possible way we can.

http://nortonfinukltd.com/nf/


Is in the process of being repo0rted.

Thanks for posting the email bodys, that will help us get the domain shut down. I am also working on gathering evidence for the other domain mentioned in the 3rd email.

I found some informations: this domain reliancesecurtygrp.com was registered in the same time like that nortonfnuk... It is interesant..Sofistical scam I think..