Airticket request

Owning a travel agency I get those "requests" very often.

A quick look at it and it is clear that this is a fraud.
The tickets will be paid with CreditCard, but with stolen CC infos, so that in the end you have to pay everything by yourself.


Here is the latest one, received a couple minutes earlier:

FULL HEADER:
Return-Path: <admin>
Received: from mailin12.aul.t-online.de (mailin12.aul.t-online.de [172.20.26.70])
by mhead503 with LMTP; Thu, 06 Dec 2007 01:45:42 +0100
X-Sieve: CMU Sieve 2.2
Received: from fepa01-svc.webpage.t-com.de ([80.152.31.131]) by mailin12.aul.t-online.de
with esmtp id 1J04rm-1HV3fE0; Thu, 6 Dec 2007 01:45:26 +0100
Received: from [207.217.120.47] by mail.webpage.t-com.de InterMail
with ESMTP
id <20071206004526>
for <XXXmyemailaddressXXX>; Thu, 6 Dec 2007 01:45:26 +0100
Received: from [209.179.142.19] (helo=whwamui-soar.pas.sa.earthlink.net)
by whasmtp-shoe.pas.sa.earthlink.net with asmtp (Exim 4.34)
id 1J04qQ-0003K7-EV; Wed, 05 Dec 2007 16:44:02 -0800
Received: from 41.219.236.9 by webmail.hosting.earthlink.net with HTTP; Wed, 5 Dec 2007 16:44:02 -0800
Message-ID: <8286283>
Date: Wed, 5 Dec 2007 16:44:02 -0800 (PST)
From: "westernpacificoilandgas.com" <admin>
Reply-To: "westernpacificoilandgas.com" <westernpacifi_oilandgas>
To: [email protected]
Subject: AIRTICKET RESERVATION REQUEST!!!!!!!!!!!!!!!!!!
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
X-Mailer: EarthLink Zoo Mail 1.0
X-ELNK-Trace:
X-Originating-IP: 209.179.142.19
X-TOI-SPAM: n;1;2007-12-06T00:45:42Z
X-TOI-VIRUSSCAN: clean
X-TOI-EXPURGATEID: 149288::071206014542-26FCFBB0-0662D44B/0-0/0-0
X-TOI-SPAMCLASS: CLEAN, NORMAL
X-TOI-MSGID: 6c158b2a-bc19-403d-85ee-680d8175cf8c
X-Seen: false
X-ENVELOPE-TO: <XXXmyemailaddressXXX>



LOL
The scammer even made a mistake in the "return to" email.
Dumb a$$...


Here's the body:

Dear sir/Madam,
I AM LARRY BENSON A PERSONEL MANAGER, I REQUIRE YOUR AGENCY TO HELP US ARRANGE FLIGHT TICKETS AND HOTELS FOR SOME OF OUR CLIENTS COMING AND GOING OUT OF THE COUNTRY ON BUSINESS TRIP AND VACATIONS.I WILL REQUIRE YOU TO BOOK THE TICKETS FOR THEM ON ALL THE ROUTES THEY REQUEST AND ALSO CAN YOU ADVICE ME IF YOU ACCEPT VISA AND MASTER CREDIT CARDS FOR PAYMENT FOR THE SERVICES
Below is the name and itinerary for booking.




1.ROBERT / BABATUNDE MR
2.SOARES / BABATUNDE MR




ROUTES :LOS / DEL (ROUND TRIP)
DEPARTURE DATE :15 DECEMBER 2007
RETURN DATE : 29TH DECEMBER 2007
CLASS :ECONOMY CLASS
CARRIER :ANY AIRLINE





Payment follows immediately the reservation is made,kindly Email the
booking and the fare quote as soon as possible.

Looking forward to your positive reply.

Regards
Larry.
Protocol officer.

Western pacific Oil & Gas
15 Marsh Wall , London, E14 9TB
UK.
Tel:447024098094
E-MAIL. [email protected]




The travel industry has been warned many times about those frauds.
´
As stated above, they pay with false CreditCards. CC's that are in fact not theirs, stolen ones, or dupes of CC's that do exist.

Hi Iceman, it will come as no surprise to learn that, the scam email was sent to you from a Nigerian IP address:

41.219.236.9 = Nigeria

Thanks for posting.

Yeah, I know.

41.219.236.0/24
Starcomms Ltd. RESERVED Nigeria


Just wanted to let everybody know.

Received another one.

Also through Starcomms Ltd. Reserved Nigeria
From: 41.219.249.7



FULL HEADER:

Return-Path: <reynoldsintl35>
Received: from mailin31.aul.t-online.de (mailin31.aul.t-online.de [172.20.27.137])
by mhead503 with LMTP; Sat, 29 Dec 2007 11:48:50 +0100
X-Sieve: CMU Sieve 2.2
Received: from fepb01-svc.webpage.t-com.de ([80.152.31.31]) by mailin31.aul.t-online.de
with esmtp id 1J8ZEv-1O4J600; Sat, 29 Dec 2007 11:48:25 +0100
Received: from [193.19.92.223] by mail.webpage.t-com.de InterMail
with ESMTP
id <20071229104840>
for <XXX>; Sat, 29 Dec 2007 11:48:40 +0100
Received: (qmail 3544 invoked by uid 48); 29 Dec 2007 11:35:40 +0100
X-Additional-Header: /usr/share/psa-horde/imp
Received: from dial-pool88.lg.starcomms.net (dial-pool88.lg.starcomms.net
[41.219.249.7]) by webmail.netdig.at (Horde MIME library) with HTTP; Sat,
29 Dec 2007 11:35:38 +0100
Message-ID: <20071229113538>
Date: Sat, 29 Dec 2007 11:35:38 +0100
From: Brian Reynolds <reynoldsintl35>
To: undisclosed-recipients: ;
Subject: seasons greetings,
MIME-Version: 1.0
Content-Type: text/plain;
charset=ISO-8859-1;
DelSp="Yes";
format="flowed"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
User-Agent: Internet Messaging Program (IMP) H3 (4.1.4)
X-TOI-SPAM: n;1;2007-12-29T10:48:34Z
X-TOI-VIRUSSCAN: clean
X-TOI-EXPURGATEID: 149288::071229114834-03928BB0-23F58E46/2199479565-0/0-0
X-TOI-SPAMCLASS: CLEAN, NORMAL
X-TOI-MSGID: 00f2c26d-8059-42f6-855d-469485189256
X-Seen: false
X-ENVELOPE-TO: <XXX>




-----Original Message-----
From: Brian Reynolds [mailto:[email protected]]
Sent: Saturday, December 29, 2007 11:36 AM
To: undisclosed-recipients:
Subject: seasons greetings,


seasons greetings,

my name is Brian Reynolds, I would like to know if you can handle

the booking i stated below for my clients.


FLIGHT BOOKING
CLASS : ECONOMY CLASS
ROUTH : HAMBURG - LONDON - HAMBURG
DEPARTS : 20/01/2008
RETURN : 20/02/2008

FLIGHT BOOKING
CLASS : ECONOMY CLASS
ROUTH : BERLIN - LONDON - BERLIN
DEPARTS : 20/01/2008
RETURN : 20/02/2008



If you can handle the services stated above ,kindly advise the

cheepest airline you can issue flight ticket

Advise if u accept Master Card or Visa Card



Awaiting your swift response.


Best regard

Brian Reynolds




Be aware of those scammers!