Has someone offered you a huge sum of money or a valuable consignment? It's a 419 or advance fee fraud - find out how they work, and what to do to be safe.
#265302 by Tim Atem Thu Aug 27, 2015 9:00 am
I'm putting this here instead of in the Romance scam forum because as you can see, her first email was very vague, but her second email (although she sent flowers) is leading into the orphaned refugee scam, not a romance scam.

ipTRACKERonline.com wrote:Header Analysis Quick Report
Originating IP: 106.10.196.95
Originating ISP: Internet Content Provider
City: n/a
Country of Origin: Singapore
* For a complete report on this email header goto ipTRACKERonline


Delivered-To: <snipped>
Received: by 10.107.9.195 with SMTP id 64csp3807005ioj;
Wed, 26 Aug 2015 05:22:25 -0700 (PDT)
X-Received: by 10.107.15.209 with SMTP id 78mr3138295iop.51.1440591745006;
Wed, 26 Aug 2015 05:22:25 -0700 (PDT)
Return-Path: <[email protected]>
Received: from nm47-vm9.bullet.mail.ne1.yahoo.com (nm47-vm9.bullet.mail.ne1.yahoo.com. [98.138.121.105])
by mx.google.com with ESMTPS id oo7si3326043igb.18.2015.08.26.05.22.24
for <<snipped>>
(version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
Wed, 26 Aug 2015 05:22:24 -0700 (PDT)
Received-SPF: neutral (google.com: 98.138.121.105 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=98.138.121.105;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 98.138.121.105 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected];
dkim=pass [email protected];
dmarc=fail (p=NONE dis=NONE) header.from=gmail.com
DKIM-Signature: <snipped>
Received: from [127.0.0.1] by nm47.bullet.mail.ne1.yahoo.com with NNFMP; 26 Aug 2015 12:22:24 -0000
Received: from [98.138.226.176] by nm47.bullet.mail.ne1.yahoo.com with NNFMP; 26 Aug 2015 12:19:43 -0000
Received: from [106.10.166.63] by tm11.bullet.mail.ne1.yahoo.com with NNFMP; 26 Aug 2015 12:19:43 -0000
Received: from [106.10.151.15] by tm20.bullet.mail.sg3.yahoo.com with NNFMP; 26 Aug 2015 12:19:43 -0000
Received: from [127.0.0.1] by omp1020.mail.sg3.yahoo.com with NNFMP; 26 Aug 2015 12:19:42 -0000
X-Yahoo-Newman-Property: ymail-4
X-Yahoo-Newman-Id: [email protected]
X-YMail-OSG: <snipped>
Received: by 106.10.196.95; Wed, 26 Aug 2015 12:19:42 +0000
Date: Wed, 26 Aug 2015 12:19:42 +0000 (UTC)
From: <[email protected]>
Reply-To: <[email protected]>
Message-ID: <[email protected]>
Subject: Hi
MIME-Version: 1.0


I am Lilian.nice to meet you



Delivered-To: <snipped>
Received: by 10.107.9.195 with SMTP id 64csp4377689ioj;
Wed, 26 Aug 2015 23:33:39 -0700 (PDT)
X-Received: by 10.112.130.97 with SMTP id od1mr1313895lbb.37.1440657219208;
Wed, 26 Aug 2015 23:33:39 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mail-la0-x22d.google.com (mail-la0-x22d.google.com. [2a00:1450:4010:c03::22d])
by mx.google.com with ESMTPS id z1si805201lbw.159.2015.08.26.23.33.38
for <<snipped>>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Wed, 26 Aug 2015 23:33:39 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 2a00:1450:4010:c03::22d as permitted sender) client-ip=2a00:1450:4010:c03::22d;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 2a00:1450:4010:c03::22d as permitted sender) [email protected];
dkim=pass [email protected];
dmarc=pass (p=NONE dis=NONE) header.from=gmail.com
Received: by mail-la0-x22d.google.com with SMTP id a3so4374571lab.1
for <<snipped>>; Wed, 26 Aug 2015 23:33:38 -0700 (PDT)
DKIM-Signature: <snipped>
MIME-Version: 1.0
X-Received: by 10.152.5.40 with SMTP id p8mr1672230lap.10.1440657218173; Wed,
26 Aug 2015 23:33:38 -0700 (PDT)
Received: by 10.114.161.228 with HTTP; Wed, 26 Aug 2015 23:33:37 -0700 (PDT)
Date: Thu, 27 Aug 2015 07:33:37 +0100
Message-ID: <CAPtmSRsAXqarutq=ibjKY373Ot36rjTFAjQ=tUH3YcGM8YJEwQ@mail.gmail.com>
Subject: Re: Hi
From: Lillian Wilson <[email protected]>
To: <<snipped>>


How is your day today? My name is Miss Lillian Wilson, 25 years of age, I am the only child of Late Dr Frank Wilson of South Sudan. My father was a successful business man. My purpose for contacting you is first, I want to know more about you so that I will know the areas of which you will be of assistance to my needs.

Although I don't know you personally; but your assurance can motivate me to tell you everything about me. As soon as I receive your response we will decide on the next line of action. You will know me more as we communicate along and I will also send more of my pictures. I attach my picture to enable you know who you are communicating with.
Thanks for your understanding, hoping to hear from you soon.

Yours sincerely,
Miss Lillian.

Image

Image

====================================
PLEASE DO NOT TELL A SCAMMER HE IS REPORTED HERE!

Learn what a scam is and how to protect yourself
https://www.scamwarners.com/forum/viewtopic.php?f=3&t=5
Advertisement

#265723 by Tim Atem Sun Aug 30, 2015 10:12 am
She's using the phone number +221-766500870

Delivered-To: <snipped>
Received: by 10.55.185.133 with SMTP id j127csp380272qkf;
Fri, 28 Aug 2015 11:14:02 -0700 (PDT)
X-Received: by 10.112.219.165 with SMTP id pp5mr5453205lbc.23.1440785642780;
Fri, 28 Aug 2015 11:14:02 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mail-lb0-x232.google.com (mail-lb0-x232.google.com. [2a00:1450:4010:c04::232])
by mx.google.com with ESMTPS id ra3si6092308lbb.160.2015.08.28.11.14.01
for <<snipped>>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Fri, 28 Aug 2015 11:14:02 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 2a00:1450:4010:c04::232 as permitted sender) client-ip=2a00:1450:4010:c04::232;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 2a00:1450:4010:c04::232 as permitted sender) [email protected];
dkim=pass [email protected];
dmarc=pass (p=NONE dis=NONE) header.from=gmail.com
Received: by mail-lb0-x232.google.com with SMTP id bn3so32243734lbc.2
for <<snipped>>; Fri, 28 Aug 2015 11:14:01 -0700 (PDT)
DKIM-Signature: <snipped>
MIME-Version: 1.0
X-Received: by 10.112.13.166 with SMTP id i6mr5693944lbc.50.1440785641623;
Fri, 28 Aug 2015 11:14:01 -0700 (PDT)
Received: by 10.114.160.146 with HTTP; Fri, 28 Aug 2015 11:14:01 -0700 (PDT)
Date: Fri, 28 Aug 2015 19:14:01 +0100
Message-ID: <CAPtmSRujLLtbbQ2Qtx=yri7cUDqsuR9Sca3dKsq=ii3jatrtog@mail.gmail.com>
Subject: Re: Hi
From: Lillian Wilson <[email protected]>
To: <<snipped>>


Hello dear,

I have the belief as i promise you right now in the name of God, that this communication will later be a testimony in our life. though we just known each other through internet which is now an unsecured means of communication, since some people of wicked mind without conscience come here to tell lies and put others in trouble. please read my message very well, though it may be the least of what you expects from me since we are just new friend. It is my wish and desire to tell you all about me due to my happiness from knowing you. My name is Lillian Wilson, born and raised up into a Christian family that cherish the principle of good moral child, i am from Jubal Darfur South Sudan northeastern Africa. I decided to let you know everything about me because i have faith it was God that lead me to know you, After fasting and prayers to God. My birthday is 19-10-1990. My father, Late Dr & Mrs Frank Wilson, of the blessed memory was a business man. He was previously a diplomat that served at South Sudan in Ethiopia and Senegal. Death never give me the opportunity of having to enjoy the comfort of my good home for long, as i first lost my mother two days to my 17Th birthday anniversary. It was after the death of my mother that my father concluded that South Sudan is no more safe for girls, my father take the decision that i will continue my education in Senegal which he said is safer country with his previous experience there, since many people have been raped and killed in South Sudan without justice being done to the rapists.

Tears always slip my face each time i remember the events that took my father's life when i least expected and expose me to struggle for survival in life, but for what i am and not for my beauty or family background, i have learn to accept and face challenges. I am alive giving account of my life experiences saying Thanks to God Most Gracious, Most Merciful. Crisis broke up in my Country that caused the instant death of my younger brother with other relatives though my father survived with serious multiple injuries from the rebels. My father sent for me through our family lawyer of which i arrived to South Sudan from Senegal and met him receiving treatment in a hospital bed in Juba Darfur. My father gave me a file containing some documents and told me that our family lawyer is also with some money which he will be sending to me if i have need in my studies and other things until he recovers from his injuries without sensing that death is already at the corner. On Tuesday the 30Th of December which is exactly five days after the incident, my father gave up the ghost and after his burial according to Christian rites, i took some money from the lawyer and traveled back to continue with my studies in Senegal. When it was time to pay school fees, i tried reaching our family lawyer whom i was told have left South Sudan, i had no other choice at that time than to disclose the situation to school authority which took me to the camp of United Nations High Commission for Refugees(UNHCR) in Route de bambilor / Lac rose, Rufisque B.P 632 Rufisque, Senegal, from where i am writing this message and i proclaim All Praise Be To God for keeping me alive till today.

One of the documents in the file given to me by my late father was a bond certificate of Two million three hundred US dollars, in an account he opened with a leading bank of which i am the next of kin to the account. I waited to reach 25 years because in the bond certificates was written that should if anything happen to my late father, I being the next of kin would inherit the money after attaining 25 years. I have communicated with the bank and was searching for a sincere person to help me retrieve the money from the bank since the bank said a person with refugee status can not transact with them, being a clause from United Nations and i need that money to be able to regain my life back out of this camp. I am also ready to relocate and meet with you once you accept me with all your heart. The bank requested me to appoint a representative on my behalf as trustee giving them his first and last name with email address so that they will tell him how to take the money on my behalf.
You can reach me on my phone [ 00221766500870 ), i am staying at the female hostel block 104A. attach here is my pictures. I have already developed confidence with you since i believe knowing you was through divine intervention but please promise and assure me that you will always stand by me even after receiving the money in your account if you are willing to help me. I am with the wish and desire that my quiet and peaceful life will come through your help and in all i proclaim (Glory Be To God) for guiding me to know someone like you as i expect to see your reply soonest.

Your new friend,
Lillian.

Image

Image

====================================
PLEASE DO NOT TELL A SCAMMER HE IS REPORTED HERE!

Learn what a scam is and how to protect yourself
https://www.scamwarners.com/forum/viewtopic.php?f=3&t=5

Who is online

Users browsing this forum: Bing [Bot] and 125 guests