Help Badly Need Help & Advice (Parcel + Advance Payment)

Hi need a trace of this email add. He sent me a package and it was detained in Malaysia by the customs due to the money inside. the Origin of the package was UK, the courier sent me an web address http://www.worldinterlink.page.tl with trace numbers and passwords. I already deposited a total amount of Philippine Peso 46,000 through Western Union.

=========================================================================
From Dwen Thompson Sat Jun 18 03:16:51 2011
X-Apparently-To:xxx via 98.138.90.114; Sat, 18 Jun 2011 03:17:00 -0700
Return-Path: <[email protected]>
X-YahooFilteredBulk: 98.138.91.67
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: MxS9GHAWLDvvfVO.4HBgc0v7ytoUch6K3Mck3_mU998pexBm
d4dLCnwQgMUPV9GeB02FpzAVNw1KrLqycl5WySVgYMigIEZtPwlIo2Q.e7cm
WytGP9D1xbgIwaG4MKyWe4wIJJZA8396oQAG.eLNMi4MUtMDEaIOHbzlaGam
zC_pPSfkMdQpoK8L16_IMOKBbTVpc8Dw9xVXfxmuPC4Sua3lwVR_4OvxUXCm
aG8D93BlpR5lpA3ksZqM8S8_pihVDfIKdO7WdMG2jb1ZlMUXhwzqk4OW_or6
0B0aP7ZXoJjVyWVzIgFLaVDSP_V6.r4TjjmZvXmDuFD5jKVVwCr_W3yKwypF
eT5OjuxP4pESiEaI4MNtpD9Do0dRHMm5e.Vku8mmPleZoeHlSD0OHZTiYnhb
nTQrVbsQue_6v0uofZuaipU1gmgC2tlbwEGj6k.dOdIyPlVbG0cjDrLZG6Ql
qqBq_PPxYN3DvBvkd70FivNTFL4uqfwo4jBbJSZVxK1HUGc7XMD.yZAwg2z2
d2rGoVvIlqLMyDb2TpQOV_74AiawhJUPz1lrU1YMafWL.4miA3fC3NztlFWY
wzCHi9VHkpmNAWPUkix3dV3RPnedurgXzHMCujf7HKMiYqzlTkLJxRHVLlhU
gAwevTK3I.Cftcjg9tv3mfVXbWwZj4a3.UyngNJbLlbUuC7iORu5vk8HOmoA
4853H4j0315eQG2bRN8OVOfE.0jGkW24B8Lahit1lFmgqO7Ujy2CBZxUIIx7
ZXyCHrfKkEeeXLnTmZ4YHSCy7lz8Pb71wAbQZl_r3XbctvdKp_Wrw0egcLKw
CKtPirc_UpRImTqlgk7oAHOVQKEJDmLyq1w3Q8r9R53ElL7_a6EoJBFMYRuc
hoZS15KzVeLpeRkVzV3RLoFOq7C.ISn0noLiiYAYW.W0fjYLumNVnHmLQ.Fa
0Y_sRhyxTp_3lnxB3H1cxoDffpYQ7Oix8ELuuAApNmIDlf.izhD9wmu767jk
4Jt0ppqQoSEJn2FLylL_se6bhYmGnLtzMz.FLHTVg_PyM_Z4b2j9LNx.oCMb
y0_icSrMHUME4gky_m47CnBn.AQlXyMJziDEpUgh1h2KXr7bPCeg8cBO81LE
Y6jnWSQvFyCc_zX9brsHFHEZUureiPgt8Abg6p48.3Rz6_wWpb.WxUJ3.nOA
c71h0ONxzUnSMmfFQW3QfnsN2r0gOZpWpmJ3pWMkpw--
X-Originating-IP: [98.138.91.67]
Authentication-Results: mta1113.mail.mud.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm9-vm0.bullet.mail.ne1.yahoo.com) (98.138.91.67)
by mta1113.mail.mud.yahoo.com with SMTP; Sat, 18 Jun 2011 03:16:59 -0700
Received: from [98.138.90.56] by nm9.bullet.mail.ne1.yahoo.com with NNFMP; 18 Jun 2011 10:16:59 -0000
Received: from [98.138.89.249] by tm9.bullet.mail.ne1.yahoo.com with NNFMP; 18 Jun 2011 10:16:59 -0000
Received: from [127.0.0.1] by omp1041.mail.ne1.yahoo.com with NNFMP; 18 Jun 2011 10:16:51 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 64514 invoked by uid 60001); 18 Jun 2011 10:16:51 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1308392211; bh=aJ9QYm9A96/ZRjpNlYzpwrx3De27Xei9QsxI35qDWro=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=tuRozFpe2UADZ16/UHFh+177mSmM8Q6jDOnrzKPCCxpAGegaVcnDW4NS6aoaMKdWA/qWmZXgoYLuaSXYJ/HZ6WV7krWFjCqiDlLRsav+00oYDzJj5P7D+miuA38i9j/cIFbLcDT8DyAqO14/8GTl1969S+qH1pzu7ikdDnXYe7c=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type;
b=H1fXufQkWFRsPLZSSPUEOQvNWf29SFeJfOWyZovzCdcz0dbHb1DKEZLGmmWQVP2e2+w7gMuUggOjAuJEIDONqhjh8o16jEj+r9z0KzT8yHiHDBBFTpiSYGHAB/SSXWkp8Plj3fRCknrP/KVPp4o2PMwAQyEhLCV2ctfhIoo4OUA=;
Message-ID: <[email protected]>
X-YMail-OSG: UHFfx8AVM1mMOrIKdeIkzb7D5dZjV6..iqqvul7blWAQBuf
Yll0_qhuD6MrpgH5Ae93pXnDvbXKFPcb5eOwv0PHBAoo0K06T_3q.WOQEVSi
DU7R2EUwr6qWkAeqqYj5qdqsUduIytn9hOhn20xJBToUODWMglG5hmLStpQr
rtWZ1kNKS9Lra_RuJzyVA.SW9HDkPc5p2Te0zC7sbENh0lirQaOM39seM74t
itoriydHWcaQ9GAytzA9utakZ6hl3XA9UFKeyUdF_tlrWeRzX6_m.bPDLmaw
tifWBxja6tnaglEwPgFWn.8vlAd0YfwHYJGPwRBTQ4pK_NHq6MNZTzZ.CafP
GEJl8SwBHF9LfHHDxUIyJI8DWQKTimSWPwhQ6hIgQEJjZ6F3hISQallz8XJP
_ojOy7SZFAHgyTrk9vCWd
Received: from [219.93.13.235] by web121517.mail.ne1.yahoo.com via HTTP; Sat, 18 Jun 2011 03:16:51 PDT
X-Mailer: YahooMailClassic/14.0.3 YahooMailWebService/0.8.111.304355
Date: Sat, 18 Jun 2011 03:16:51 -0700 (PDT)
From: Dwen Thompson <[email protected]>
Subject: HONEY THE GIFT
To: xxx
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-514257973-1308392211=:63262"
Content-Length: 9123

It's definitely a scam, I'm afraid. IP 219.93.13.235 is Kuala Lumpur Malaysia, where the imaginary package is claimed to be. I'm sorry to have to tell you that the money you sent by Western Union is gone forever,
The courier site is fake, and has a free 4470 redirect phone number.
Is this related to the au-pair scam you asked about last month?

Aseh, I'm sorry you have become a victim of a scam. If you look through the email header, NNFMP can be seen. When that is contained within the header it usually indicates a scam from what I'm led to believe. As Arnold indicated, the money you sent via western union is gone and there is no chance of retrieval. Scammers use western union and moneygram for that very reason.

I post this situation for asking help and advice for my friend using my account,were already doubting that this is not true,but its too late she already sent money.. Please kindly remove the email add of my friend for her protection..thank you for the advice.

Aseh,

I have removed the email address. Please feel free to ask if any other questions come up.

I appreciated this site so much,but unfortunately my friend was a victim of this that i cannot warned her that this is definitely scam,because she noticed me so late.the scammer still talking to her asking another payment w/c is 90 thousand pesos for settlement.i told her to stop communicating to him,and she said she wants to play and pretend she believed them.they are two person,the person that chatting her from uk,and the other one is in malaysia who said that incharge to claim the payment.i think this two person own one identity..i hope u can trace him and block,or ban to all social network site to stop him,to avoid and give warning to other. Thank you and be bless!

Hi Aseh,
please tell your friend it's a bad idea to "play" with a criminal. He has got a lot of information about her, and if he finds out and gets angry, he might try to harrass her, for example by threatening her, or by posting lies about her all over the internet. She really must stop communicating with him and begin to get on with her life.

Sadly, the criminal will not get arrested any time soon. He operates anonymously. And blocking him on social sites won't stop him, he will just open fresh profiles with a new identity.

By the way, you may be right, the scammer could be playing two characters.

I know the identity of someone who sent me an email from this ip address, it was a love scam and she faked i got her pregnant, if I go to the australian police, can they get the malay police to investigate?
here is a copy of the email she sent me.

x-store-info:sbevkl2QZR7OXo7WID5ZcdV2tiiWGqTnH3b3GbmtpD+mtWnBb6jbvvGETX4XqxlWCM6REwLzu3BnNBlhc60wNp4N3J0VoGxjwUDD2v51+K7Uu4aDUjEpzg==
Authentication-Results: hotmail.com; sender-id=temperror (sender IP is 72.30.238.206) [email protected]; dkim=pass (testing mode) header.d=yahoo.com; x-hmca=none
X-Message-Status: n:0:n
X-SID-PRA: Janet Jane <[email protected]>
X-DKIM-Result: Pass(t)
X-AUTH-Result: NONE
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0xO0Q9MTtHRD0xO1NDTD0w
X-Message-Info: gamVN+8Ez8V+RHg+F+brAVvl77TsXdONnKdLX22GcMffnB1VM01tPPPrULGLfT+mtyfNSKTxMq0P53qCzOxscyPnqDH8Vz6C8CAtZt2R08tKcYkVZ4GbsNABn5phQyqaWCSudPthXQI=
Received: from nm37-vm6.bullet.mail.bf1.yahoo.com ([72.30.238.206]) by BAY0-MC2-F26.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Thu, 22 Dec 2011 01:28:12 -0800
Received: from [98.139.212.148] by nm37.bullet.mail.bf1.yahoo.com with NNFMP; 22 Dec 2011 09:28:11 -0000
Received: from [98.139.215.228] by tm5.bullet.mail.bf1.yahoo.com with NNFMP; 22 Dec 2011 09:28:10 -0000
Received: from [127.0.0.1] by omp1068.mail.bf1.yahoo.com with NNFMP; 22 Dec 2011 09:28:10 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 76719 invoked by uid 60001); 22 Dec 2011 09:28:10 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1324546090; bh=k7SU76DVyo30eje2HFumPk0bMdNOrfKO56SlouxFsFM=; h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:MIME-Version:Content-Type; b=6YutR812yL3eipBIXJLghQIzMr+DGG+7XLNTNNpLFs5ST3Qk9929n5NEePkXEU4RsPGz6BAbEs2BMWbCQN7k0aKyFwMzapqgAFvj4d+t0/6Tg2zxLw+HIlwjObwA0/yYNrVpxUqxy5Thnc7xDq9XouPHChyLBu/y5vqcUpT8fbQ=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:MIME-Version:Content-Type;
b=BbUxtcTXwAwwrDdVyIBtvatmNLFTLQwXS/5xrZvYtMgJ8imlByFrurp3x8Ffd9/4J3ATxoeDN+U6EnmKNz4B9cWlLZZiDiffygwEcF1zvqUxf4Gi3Y7GehuDZDNNCRfwneV6vkDiAG+lgUIkxAeEIE4ROn8DFihKQu5p8G1f7Xg=;
X-YMail-OSG: qs_aEA8VM1n7yRmdKD0OWw8ZZ4cxprZToMXdNQ3PqzQxmEF
1TtQXARgkLl393VW9wFgSLgB0IH5cVwZlXfxFbyqU2m0bNq5bXpyorkHNbNH
.0R_83hUf.ceu9GeX8WHaMsMDx6hzZ.Op2dQJnO6RvGNrWhMyczEEn1zGmAx
a_g8B4M3hKlQbJYMcOVrGhs9_TIIkzDESpXT9QLK36.DgF87S3IazfEfnFPz
y.Z15v8IpSCdsXNp57KDaTIGBiW6YD5XzJOCsgPokFCofKdg_cLguEYQefKi
3DCKG7b7IdNYNGFJuP1MyeWwk2cQkDQadxwlFGgQ6C6qW.2imHbGmNkGrPjN
D6r6K.PBQcgA9Y1DqpY6pkjrnxnSSCJCqkqsUQz9kCnh29BNDad89ypuQsNr
6dvb1ttPtuSKX.h290je2PH5S7i.sl7Hq9.aBdTJbCqLeH8I_.bZS9aSGmYV
QWQNmVe0of.wHn4sYJ49tSPHOt0IK8fcdZjEW6GvR88bS3NjiDzrihIstKfs
60RUCpLG20UC2bkl2_5CrspjcpYYejiiLjUfxqVPwKSOs94O5g546NtMD37c
z2zXK4hIJndY7ACpO3_Bck01g_o3fgM9c6n9m_DGMoiFlfgPOAdzE6oiztEc
.jDKvdtQ-
Received: from [219.93.13.235] by web162102.mail.bf1.yahoo.com via HTTP; Thu, 22 Dec 2011 01:28:10 PST
X-Mailer: YahooMailClassic/15.0.4 YahooMailWebService/0.8.115.331698
Message-ID: <[email protected]>
Date: Thu, 22 Dec 2011 01:28:10 -0800 (PST)
From: Janet Jane <[email protected]>
Subject: =?utf-8?B?Rnc6IGtpbXBhIGt3ZWxpbiBqdW4gKEJvb2tpbmcgTm86IEJDSjJXSykgMjkg?=
=?utf-8?B?RGVjIDIwMTEgS1VMIC0gUEVSIOKAkyBUcmF2ZWwgSXRpbmVyYXJ5?=
To: Removed
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="1915525664-1759410993-1324546090=:56940"
Return-Path: [email protected]
X-OriginalArrivalTime: 22 Dec 2011 09:28:12.0176 (UTC) FILETIME=[065F3900:01CCC08C]

--1915525664-1759410993-1324546090=:56940
Content-Type: multipart/alternative; boundary="1915525664-341426505-1324546090=:56940"

--1915525664-341426505-1324546090=:56940
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Personal details removed - CW

Hi zoontag,

you may try to inform the Australian police, but do not place too much hope they are willing to ask malay authorities to cooperate. Anyway this can potentially increase their awareness toward this kind of crime.

As cutelilly explained, the authorities are reluctant to pursue fradulent scammers because of the complexities it would involve. Scammers are not high priority I'm afraid! Reporting to the authorities is still a good idea because the scam will be placed on record. Whether it's acted upon and the scammer brought to justice is another story. The email header looks normal and doesn't appear to have been forged in any way.

^^^
According to the Yahoo postmaster, any message containing a “with NNFMP” clause is a FORGED message.

^ interesting about that. Does it indicate address spoofing or other shennanigans?