Khalid Main Shah, [email protected]

Facebook Scammer.
Khalid Main Shah, [email protected]
facebook.com/khalid.mainshah.9

Originating IP: 197.220.169.20
Originating ISP: Glo Mobile Ghana Ltd
City: n/a
Country of Origin: Ghana
His IP is Ghana

He claims as journalist in Syria, and asks victim to receive his valuables safe in victim's country. Obviously advance fee fraud with romance scam portion.


Introduction email (header attached to bottom of this posting.)

my name is Khalid,i am 46 years old ,i was born and brought up in Australia
i work here in syria as a photo Journalist ,
i have 9 years old daughter ,my wife died 6 years ago and am single now
i am 178cm my height and my weight is 80kg
am so happy to be your friend and i hope we can always get in touch
i like to know little about you
your facebook friend
Khalid

chat log to ask helping him receive non-existing valuables.

am safe but i have issues

i pray to leave here safely

on going on a mission tomorrow and i have my belongings here ,we are not allowed to move with out belongings
am confused
i dont want to loose my belongings

if you can help me and keep my belongings safe with you in (victim's country) and maybe you will send it to me in Australia
am just confused ,i dont know what else to do
in my belongings are my official documents ,my camera box and all the money i have made since my stay here

Email Header

x-store-info:4r51+eLowCe79NzwdU2kR3P+ctWZsO+J
Authentication-Results: hotmail.com; spf=pass (sender IP is 98.138.229.132; identity alignment result is pass and alignment mode is relaxed) [email protected]; dkim=pass (identity alignment result is pass and alignment mode is relaxed) header.d=yahoo.com; x-hmca=pass [email protected]
X-SID-PRA: [email protected]
X-AUTH-Result: PASS
X-SID-Result: PASS
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD00
X-Message-Info: o9rlR4nWDTcIrmVwzz8cEz4QPE5ib5KKINKvdtsyXw+kEzrDzJDKxCEfRIi/vS0LDprBeWXhY+ksOq5RimS9UGn0E6/n5pYyqUJOSMoJe4fZVL/yUQZkoYFtDXao3a1fZ79T7m80dE6wAeI468M0riQUWSdWWn2zX5ss9uavewLLgITJKdwGMT+uvO3eGEvzTGwlEmpauo6xlip7we3WG1pi4n6QM7xF0KmPFjHbi9Y=
Received: from nm37-vm4.bullet.mail.ne1.yahoo.com ([98.138.229.132]) by COL004-MC1F12.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23143);
Sat, 19 Sep 2015 10:40:33 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1442684432; bh=hf4ZFdYs52mIrnOzILe/5OfkR2R0S+29VaCs2plIIRw=; h=Date:From:Subject:To:From:Subject; b=pVIb58s+PZajMrJDjgwU6FvccIaxedJSag0BhVKuvhjf8TUXxbGErOoNE7oFNGHT4VQx00zdCC4qP9AtHn+W1j608gv27bGAt0NJQ0aqxsBzs2va/rHbNFTh91XR8LT5evsY5WBfyqcYznxHA+vyk5Y89rfDJJrmmA4L7byZMDu1FtaPnLZPusUsG8DagmdvDwI2Vg5qGdqug5WDMdX2s+co77qOTEdGAxAprgToEvyDwO0MOpwzpA+L/aAmoSfZnZU4u3r9LyHQgKGpz0se+i90dCekk3xu6P6NJDM0OgDHBEdnekWtsfJ0Yni+r9m78WXLBCiDGKSoXf3emlOYEA==
Received: from [127.0.0.1] by nm37.bullet.mail.ne1.yahoo.com with NNFMP; 19 Sep 2015 17:40:32 -0000
Received: from [98.138.100.112] by nm37.bullet.mail.ne1.yahoo.com with NNFMP; 19 Sep 2015 17:37:32 -0000
Received: from [98.138.89.252] by tm103.bullet.mail.ne1.yahoo.com with NNFMP; 19 Sep 2015 17:37:32 -0000
Received: from [127.0.0.1] by omp1044.mail.ne1.yahoo.com with NNFMP; 19 Sep 2015 17:37:32 -0000
X-Yahoo-Newman-Property: ymail-4
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 9575 invoked by uid 60001); 19 Sep 2015 17:37:32 -0000
X-YMail-OSG: _5FHWhoVM1kkcRO0KT6hN.zWqhUUudGneepsMBLvYzgQdx9
ixtrATJezvy3.Tnorkd1XyKh_W3H3QJH4T_g5HbSXKJoUPA.9RY6fAhWK1Ho
7rnPETYm_7qvi5_r6hR9TUDrikD9mnEsJgPLv.MWn635aLBr4P2AssZAUkqy
pIDUacWyy1PCVZ.bIYClJEDVAfCvXPOcGpKvkOQLVWRrl3UOEbo1C59UquyL
lMiohy4_7dTYDPbwXBRLBe09i.ID7a.Rgn0ehOZnskJ5dnyEK9PnYRamUB4j
DiZ2yjeTIaOkXwqERy5JjWwbchzSN9L5xq40mTr8a3jXBeE_ewq_9TX0YiWX
fPVq3jbHfZ2.ohBYDm8UhMXQtTfVy5aPsVEh5GJU5oJUEhk9yrF9rCiKFzoP
gpFgZFRl4ZZmWjsMQ.WIuu_iZVyVVmYHR6n4Zo0CZqcRx7E.Kl7XIC6sBRLQ
f5zyxsca_QNBgSVgrbZ0Vu3o7Cw6O3ix5tsCRsIo3hDHasKB.3zNPaV90wlS
.J9z7g8R3vJReGCcEFEJmLBWKhvUYLttLOFsC3vW9D4m1uNJCQ7Y-
Received: from [197.220.169.20] by web121201.mail.ne1.yahoo.com via HTTP; Sat, 19 Sep 2015 10:37:32 PDT
X-Rocket-MIMEInfo: 002.001,SGVsbG8gQ2hlaWtvLA0KbXkgbmFtZSBpcyBLaGFsaWQsaSBhbSA0NiB5ZWFycyBvbGQgLGkgd2FzIGJvcm4gYW5kIGJyb3VnaHQgdXAgaW4gQXVzdHJhbGlhIA0KaSB3b3JrIGhlcmUgaW4gc3lyaWEgYXMgYSBwaG90byBKb3VybmFsaXN0ICwNCmkgaGF2ZSAgOSB5ZWFycyBvbGQgZGF1Z2h0ZXIgLG15IHdpZmUgZGllZCA2IHllYXJzIGFnbyBhbmQgYW0gc2luZ2xlIG5vdyANCmkgYW0gMTc4Y20gbXkgaGVpZ2h0IGFuZCBteSB3ZWlnaHQgaXMgODBrZyANCmFtIHNvIGhhcHB5IHRvIGJlIHlvdXIgZnJpZW5kIGEBMAEBAQE-
X-Mailer: YahooMailBasic/700 YahooMailWebService/0.8.203.817
Message-ID: <[email protected]>
Date: Sat, 19 Sep 2015 10:37:32 -0700
From: khalid main shah <[email protected]>
Subject: My beloved friend
To: (snipped)
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="1402361269-1202597705-1442684252=:71369"
Return-Path: [email protected]
X-OriginalArrivalTime: 19 Sep 2015 17:40:33.0461 (UTC) FILETIME=[4909D650:01D0F302]

--1402361269-1202597705-1442684252=:71369
Content-Type: text/plain; charset=us-ascii

私も騙されました。

Machine translate:

I was also fooled.

Welcome to Scamwarners,

Please post in English.

Byron Williams, I will respond PM in her language and also suggest her to stop all communication with the scammer.

(Edited)

However, I am glad to know someone searched my post and came to aware of the scam. I am not victim, just annoyed by the spams, but voluntarily posting hunted info here for these people who may be scammed.

Thanks

Sorry to know about what happened to you. (removed)

1. Please stop all contact with the scammer and no need to tell him that you cease all contacts. Whatever they say are lies and no meaning to continue contacting him and try to find more info. Please block his contacts, and if possible, change your email, phone numbers, messenger accounts such as line or whatsapp etc. This is common advise this site gives to all victims without exception.

2. (Removed part of advise and discuss privately on PM). Please follow this site's general advises and comments from moderators.

3. I stopped investigating this guy because I got IP that shows Ghana and this is sufficient to prove that this guy is scammer. The messages posted are from a (removed nationality statement) person on Facebook who came to aware of scam and notified to me about this guy. Fortunately she did not send any money, and blocked the scammer.

4. Please post all possible information here, such as email requesting money, other characters in the story, fake website info, etc. Please PM me for further advises on what to post. This is very general and common advises usually given to victims visiting here.

Edited and removed contents that may cause victim to concern about.

i dont know what to say or where to start because it has been explosions everywhere here in Syria
I am trying to escape but its not easy because due to the Russians Air strikes ,the war has become more dangerous

(Removed ) .i have a some of my luggage here with me ,which contains ,my cameras ,my cloths and a huge sum of money ,i dont have anyone i could trust but you have been my best friend and i can only trust you now because i dont have a choice
i want to send you my luggage in japan ,,,,,can you keep my luggage safe with you until i come to (removed) ???
please i am counting on you my dear friend
dont let me down
Khalid

i want you to send me your house address and phone number so that i can send my bagagge to you .
A journalist was kidnapped today and we are all scared
i have a huge sum of money in my baggage and my cameras too
the shipping company will leave tomorrow
please reply to me (removed)
Khalid

i Finally succeeded to send my luggage to you (removed),
you are my best friend and i trust you because you are very matured and responsible
in my baggage is a Hug sum of money and i dont want you to tell anyone about it
so that thieves will not come after my baggage

they Red cross delivery company will send you an email when they get to (removed)

i am really counting on you
have a lovely day
Khalid

Hello (removed)
How was your day ?am sure its late over there in (removed)
i got am email from the shipping company and they said the Indonesia Border Control have requested
that 12,500 US Dollars should be remitted before they can ship my baggage to your door step
i have a hug sum of money in my luggage and if they notice it my baggage could be delayed or seized .
please i want you to help me and remit the money to them ,when i come to (removed) to take my luggage then i will remit back the money to you
i dont want to loose everything i worked so hard to get
thank you in advance and for your understanding
yours beloved friend

Fake shipping company email
fake shipping company, [email protected]

Both use different names but under same email address.

Attention: (removed)

This is to inform you that your delivery man has arrived in Turkey on a transit to (removed),the luggage detaisl are:

Sender's Name:Felix Ijezie
Receiver: (removed)
Label Number: DHL7567351D
Expected Delivery Date: October 27, 2015
Destination :（removed)
Class: Package Services
Service(s): Delivery Confirmation
Status: Notification sent


Delivery Address:(removed)

please Madam,we want you to comform your address before we can Deliver your luggage to your door step' in other not to deliver your luggage to the wrong address.

Reply this email as soon as you get it.

Thanks from
Rev Maxwell. A.O
Chain Manager.

Attention:(removed)

Below is the bank account the Indonesia custom as instructed you to pay the payment through:

Bank Name:Pt. Bank Commonwealth
Account Number : 246000(last 4 digits removed)
Account Name : (removed)
SWIFT CODE : BICNIDJA
Address Bank : Komplek ruko bekasi mas Blok C No. 8 Bekasi
Beneficiary address:(removed)
Info already reported.(BW)
Note:For the confidentiality of this delivery if the bank where you are going to send the money through ask you whom you are sending the money to ,tell them is for your family in Indonesia so that they can send the money quickly.
Madam, we are waiting urgently for you to make the payment so that we can clear our way out and baord to (removed) without any waste of time.
Any delay will attract a penalty and this is the main reason why you must hurry up and makw the payment this morning.

Waiting for your urgent feedback.Please when you send the money send me the pyament slip immediately for us to assess the money.
Your confidentaility to this deliver is our most concern to avoid us been attacked by Armed Robbers when we arrive (removed).

Sincerely,
Emery Howard, MPA, FCIS

Bank Name:Pt. Bank Commonwealth
Account Number : 246000(last 4 digits removed)
Account Name : (removed)
SWIFT CODE : BICNIDJA
Address Bank : Komplek ruko bekasi mas Blok C No. 8 Bekasi
Beneficiary address:(removed)

Check your PM's.

One more email from fake shipper

Attention:(removed),

We encountered a serious delay of the delivery of your consignment with the customs at the clearing room In Indonessia
International Airport (Husein Sastranegara International Airport).Based on the 2009 Aviation Law of Indonesia, the government had to transfer air navigation service management from airport operators to a non-profit institution and consignment box has to Indonesia borders to (removed) and the Indonesia Authority has demanded for the UN Non-Inspection Sticker and a handling charges of USD$65000 .
However, the Sticker can be acquire immediately here in Indonesia and the cost is USD$6000 British Pounds.
In total you have to send USD$12,500. Soonest i will send you the Bank account of the Indonesia customs Authority sob that vyou bcan make the payment to enable all the needed protocols completed for the pass of the consignment boc from the Indonesia Border for your delivery to your door step.



Note:This consignment box has been demanded to meet these requirements because it has to cross the borders without searching to know its content because it is under a diplomatic immunity.
Madam, we aspect you to respond to this mail immediately so that the consignment will not have any more delay there to avoid unwanted attention.

Sincerely,
Emery Howard, MPA, FCIS

Originating IP: 41.66.208.210
Originating ISP: Vodafone Ghana
City: n/a
Country of Origin: Ghana

x-store-info:J++/JTCzmObr++wNraA4Pa4f5Xd6uensWQjutc4PB1BzxFksOJi5exG+AOELES1PrT+wfilZWt7duw8BVaLpjAlnsqGMPccrrzWU2XrJj8ubmfsZIBE6ye4LRKlVBZ+IYWOOuglMIHA=
Authentication-Results: hotmail.com; spf=pass (sender IP is 74.208.4.201) [email protected]; dkim=none header.d=europe.com; x-hmca=pass [email protected]
X-SID-PRA: [email protected]
X-AUTH-Result: PASS
X-SID-Result: PASS
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MTtHRD0xO1NDTD0w
X-Message-Info: NhFq/7gR1vQFW6HQxHtSUU16zNXaK/wka9ZVjA+8cxzHV9TmiDzDhofpwBVQlHir8BinQem9vgQQUxgZ5whrZcfQwC9/hUtYWQJPDRpwO/skkVWzQ/+2YPiHHNYbVHVrsVgGUeQ1MnZ0gyBUlUICvB0wo5NpmWRZJT+WaaEULOv8rv7a91PsWrujUXExQP6EPZkT6LYHcQlVPK55f/MU5Ld3qp9PY76sdcpWr4HkxNsqGCWLi+GxNw==
Received: from mout.gmx.com ([74.208.4.201]) by BAY004-MC2F53.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23143);
Mon, 26 Oct 2015 03:20:32 -0700
Received: from [41.66.208.210] by 3capp-mailcom-lxa05.server.lan (via HTTP);
Mon, 26 Oct 2015 11:20:31 +0100
MIME-Version: 1.0
Message-ID: <trinity-b21069db-9cf5-41d5-aeee-d01c27a98af2-1445854831541@3capp-mailcom-lxa05>
From: [email protected]
To: (removed)
Cc: [email protected]
Subject: Ready to deliver to your door step
Content-Type: text/html; charset=UTF-8
Date: Mon, 26 Oct 2015 11:20:31 +0100
Importance: normal
Sensitivity: Normal
X-Priority: 3
X-Provags-ID: V03:K0:mb+WyRWsHibYknU6j0d03HgxU49OnRY/VIdVA8fBjUJ
zbbIRH5ZEE4Gb3tqsvKEipUyv7/VRIWs9vEzsze7g1+Up3z8Sk
YtaOk9b2KqL38T2f/XyZz7GDzzdpTdODCVgg7fc7vK12bX41B5
AW6tlyqryu6HYsHwjDPGvHpgWdm1GVHfltyWuzZcnKrAL72st+
J6X2eSRfTWpA3aCehcs3LKn0zvSVb0pB0OPqg1hOjv+XaWn8OG
9KpoOm2k3nFbNuy1UQbcraO6Bk1I0DRI2wRM2MOiWmjdAcrBaq
0GnUtmffbNsogbzXaU+XD6KuNAK
X-UI-Out-Filterresults: notjunk:1;V01:K0:0OP1mtY/bPI=:doyuqQNSpANWHZNmVZ8etQ
zRxkN3hMh1MK9HfvY1cPNgOD3jAVyDwvVSSZZlbBaZq2Zss7CBxAS3fBL5LuT2Ot2Rr8dC4J+
tOB4eUYbdSLNEqWPtsmxHHvjTeM24UVOnCagRb7EN5D85HL+so/r7rnoqodIv+DL1zI00vCIW
flw5cjVrj4slPSgyBD3+TvAh33IXRZtVkhs9KIBs8YTS7oUQjWunnnPjgIJkUZlUibXgyy8Xj
9fhAfKqZYOr3HfQBzMb54p329N0mPyDNFKqHKeXW9ictwCXcJax5SA3WKvwg2ruytkCRceyPS
jRivU/FnjnxMlczUgEre/OHup2EDViPmjbbZtMeLERv4DLhEDZGneHNZR4fm4ULP0OHTnrfdZ
rCqaVhxjdbf24NEz2kGii+48QueMyq9Ug5vlIexvyxu7E+tBxbGbeZrSMiIq1hoK+XP0YKEHN
SYCdDCeLCw==
Return-Path: [email protected]
X-OriginalArrivalTime: 26 Oct 2015 10:20:32.0793 (UTC) FILETIME=[F24C5890:01D10FD7]

Fake Passport


Fake IOU

Fake Australian Driver's license




Really fake!!

Kelvin Taylor
[email protected]
Phone +81 (‪0)7053689003 Japan PHS phone‬

The fake shipping company person who is said to be carried non-existing box from Syria.

Photo is Nigerian politician, Orji Uzor Kalu
See here:
https://en.m.wikipedia.org/wiki/Orji_Uzor_Kalu
http://www.kamervibe.com/nigerian-polit ... t-of-fifa/

Hello Madam,

Good morning Madam, I'm Mr. Kelvin, I arrived yesterday with your luggage, can you come to (removed) Station today with the money and pick up your luggage.

This is my number, you can also call me: 07053689003

Thanks,
Kelvin

He has attempted to meet his sucker locally by pretending that he was the one who travelled from Indonesia. But the fact is he is resident there in that country.

He has new facebook.
Edited: Email address confirmed as still the same. [email protected]

According to people who came to aware he is fishy, his scam scenario is still the same. Journalist in Syria wants to send his consignment to the victim's country.

facebook.com/khalid.mainshah

Profile;
Photo journalist
Journalist
[email protected]

He had his school as in Kashimir but he has deleted it and now claims as Photo Journalist from Australia.

I'm Australian but i live here in syria

I'm christian Australian

am at work right now and would gladly tell you more about me wen am free okay

i studied in the University of Kashmir Pakistan

I'm 42 years old and single and you ???

we all live everyday like our last nights over here
there is lawlessness,looting,rape ,kidnapping ,No food and good water ,Isis roadblock everywhere. its not easy to live here though the Russians are doing a great work over here ,even the civilians are affected

this is me and my crew
does it look like somewhere close to an Airport? this is Aleppo Ghosts Hunts people over here

Photos stolen from news sites, to show how dangerous he is now in Syria.
The scammer is in Ghana. Not in Syria!!