World Bank [email protected]

Delivered-To: <snipped>
Received: by 10.202.199.8 with SMTP id x8csp1426047oif;
Mon, 30 Mar 2015 09:13:38 -0700 (PDT)
X-Received: by 10.42.41.200 with SMTP id q8mr57531945ice.61.1427732017848;
Mon, 30 Mar 2015 09:13:37 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mail-ig0-x244.google.com (mail-ig0-x244.google.com. [2607:f8b0:4001:c05::244])
by mx.google.com with ESMTPS id jt7si9328542icb.78.2015.03.30.09.13.37
for <<snipped>>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Mon, 30 Mar 2015 09:13:37 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 2607:f8b0:4001:c05::244 as permitted sender) client-ip=2607:f8b0:4001:c05::244;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 2607:f8b0:4001:c05::244 as permitted sender) [email protected];
dkim=pass [email protected];
dmarc=pass (p=NONE dis=NONE) header.from=gmail.com
Received: by mail-ig0-x244.google.com with SMTP id h15so5318661igd.2
for <<snipped>>; Mon, 30 Mar 2015 09:13:37 -0700 (PDT)
DKIM-Signature: <snipped>
MIME-Version: 1.0
X-Received: by 10.42.104.9 with SMTP id p9mr60586037ico.82.1427732017330; Mon,
30 Mar 2015 09:13:37 -0700 (PDT)
Received: by 10.64.216.10 with HTTP; Mon, 30 Mar 2015 09:13:37 -0700 (PDT)
Reply-To: [email protected]
Date: Mon, 30 Mar 2015 08:13:37 -0800
Message-ID: <CALzSP1jGq-6uAOb3cTdOx=J+LwVrinwU0cZGDXKKdMCo23S=vg@mail.gmail.com>
Subject: CONGRATULATIONS
From: World Bank <[email protected]>
To: undisclosed-recipients:;
Content-Type: text/plain; charset=UTF-8
Bcc: <snipped>

This good news is reaching to you directly from world bank group and
be informed that United Nations president had given us final order to
credit your fund to your account freely.They complained that your
transfer failed apart between you and office handed over your
$2.5million dollars in Africa-that you never received your fund yet
and we are very sorry for the inconvenience.

World Health Organization reported to United Nations President how
many citizens are sealing their kidney in name to recover the money
they loose to wrong people and this compensation is for you to recover
your fund without thinking of sealing your kidney or any part of your
body.

United Nations president had pleaded our management to volunteer
himself and make sure that your fund credited to your account before 6
days and our management will personal handle your transfer with our
free transfer advantage world wide.

Remember that everything is up to you to reply back with your account
information for you to receive your fund and start making use of your
fund.

Yours in service.
Fatima Mohamed

Using the same Reply-to email address:

from: World Bank Group <[email protected]>
reply-to: [email protected]

Delivered-To: <snipped>
Received: by 10.202.169.142 with SMTP id s136csp248909oie;
Fri, 29 May 2015 03:26:32 -0700 (PDT)
X-Received: by 10.152.206.75 with SMTP id lm11mr7114684lac.41.1432895192182;
Fri, 29 May 2015 03:26:32 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mail-la0-x234.google.com (mail-la0-x234.google.com. [2a00:1450:4010:c03::234])
by mx.google.com with ESMTPS id w2si3858630lbs.89.2015.05.29.03.26.31
for <<snipped>>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Fri, 29 May 2015 03:26:32 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 2a00:1450:4010:c03::234 as permitted sender) client-ip=2a00:1450:4010:c03::234;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 2a00:1450:4010:c03::234 as permitted sender) [email protected];
dkim=pass [email protected];
dmarc=pass (p=NONE dis=NONE) header.from=gmail.com
Received: by mail-la0-x234.google.com with SMTP id py14so36512678lab.0
for <<snipped>>; Fri, 29 May 2015 03:26:31 -0700 (PDT)
DKIM-Signature: <snipped>
MIME-Version: 1.0
X-Received: by 10.152.179.195 with SMTP id di3mr7297632lac.15.1432895190859;
Fri, 29 May 2015 03:26:30 -0700 (PDT)
Received: by 10.25.164.131 with HTTP; Fri, 29 May 2015 03:26:30 -0700 (PDT)
Reply-To: [email protected]
Date: Fri, 29 May 2015 03:26:30 -0700
Message-ID: <CAOn0FAqhwrxmzqut5AezAJzyEg68bZQLPY-zpbaRmtxbEMdiwA@mail.gmail.com>
Subject: All necessary investigation had be positively made in your transfer
From: World Bank Group <[email protected]>
To: undisclosed-recipients:;
Content-Type: multipart/mixed; boundary=001a1133a466da5423051735e81f
Bcc: <snipped>

The World Bank Group have confirmed your fund in Benin republic
ministry of finance and am here on behalf of world bank group to guide
you with the agreement issued on your fund because united nation
president had appointed our board to travel and stand as the eyes of
both party to ensure that everything goes straight forward on your
transfer if possible to transfer your fund by our self to make sure
that your fund reach to your account before four days.

Note that all necessary investigation had be positively made in your
transfer and the only fee you needed to pay is $75 dollars according
to Benin republic ministry of finance to settle with the commission on
turn over the clearance of your fund in their custody.They Benin
republic ministry of finance insisted that the receipt of this $75
must confirmed from you in their office for them to confirmed that
you are the one we are going to transfer your fund after the clearance
of your fund from their office to avoid wrong transfer.

You are to send this $75 quickly to help us settle with the commission
on turn over the clearance of your fund for me to personal remit your
fund before flying back as am still in Benin republic now because i
don,t want to hand your transfer over to any body or any other office
to avoid further excuses in your transfer that is why am still here
waiting to finalize your transfer.

The above attachment is my Identity card who is in charge of your transfer.

Yours sincerely
Edward Ronald

Using the same email address [email protected] but this time posing as the World Health Organization:

from: World Health Organisation <[email protected]>
date: Sat, Aug 1, 2015 at 8:58 AM
subject: Happy New Month OF August

There was also an attachment of a medical emergency ID card form stolen from IDtagsonline

Delivered-To: <snipped>
Received: by 10.202.199.78 with SMTP id x75csp1090503oif;
Sat, 1 Aug 2015 06:58:36 -0700 (PDT)
X-Received: by 10.153.7.166 with SMTP id dd6mr8394760lad.42.1438437515902;
Sat, 01 Aug 2015 06:58:35 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mail-la0-x236.google.com (mail-la0-x236.google.com. [2a00:1450:4010:c03::236])
by mx.google.com with ESMTPS id l9si6820561lam.36.2015.08.01.06.58.35
for <<snipped>>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sat, 01 Aug 2015 06:58:35 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 2a00:1450:4010:c03::236 as permitted sender) client-ip=2a00:1450:4010:c03::236;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 2a00:1450:4010:c03::236 as permitted sender) [email protected];
dkim=pass [email protected];
dmarc=pass (p=NONE dis=NONE) header.from=gmail.com
Received: by mail-la0-x236.google.com with SMTP id ks4so13152877lab.0
for <<snipped>>; Sat, 01 Aug 2015 06:58:35 -0700 (PDT)
DKIM-Signature: <snipped>
MIME-Version: 1.0
X-Received: by 10.152.2.41 with SMTP id 9mr8246311lar.65.1438437514476; Sat,
01 Aug 2015 06:58:34 -0700 (PDT)
Received: by 10.25.149.204 with HTTP; Sat, 1 Aug 2015 06:58:34 -0700 (PDT)
Date: Sat, 1 Aug 2015 06:58:34 -0700
Message-ID: <CAOn0FAqtvrCmpkyHP-2mrzpOOE3qR5JEiikznNSa3DRsU3gfHQ@mail.gmail.com>
Subject: Happy New Month OF August
From: World Health Organisation <[email protected]>
To: undisclosed-recipients:;
Content-Type: multipart/mixed; boundary=089e013c6258158d25051c405594
Bcc: <snipped>

Dear Customer.

Breaking News Today AUGUST,1ST:This is to inform you that the higher
authorities of World Health Organization had decided to remit your
$2.5million straight to your bank account and the arrangement has been
made this morning, therefore the Federal High Court Of Justice Benin
Republic had approved your transfer and the only money you will send
once you receive this message is $63 for the Federal High Court Of
Justice Benin Republic to signed your transfer and give us go ahead
order on your transfer.

The board of World Health Organization will humbly transfer your fund
freely once we receive this $63 which stand as charge to obtain final
approval paper from Benin Republic Federal High Court who has the
final say in your transfer because they concluded with our management
that once they confirmed $63 they will sign and approve your transfer
as we complain to them that some many citizen are sealing their kidney
in Malaysia after loosing their money to wrong people and they had
granted to sign and approve your transfer.

You will fill your information in the gaps and submit it with this $63
to help us tender your file to Benin Republic Federal High Court for
final approval.

Your Faithfully
Dr.Luke Ikenna