Mr. Thorsten Haas - [email protected]

Delivered-To: Received: by 10.79.96.135 with SMTP id u129csp733164ivb;
Wed, 4 Nov 2015 07:11:31 -0800 (PST)
X-Received: by 10.194.133.137 with SMTP id pc9mr2439227wjb.77.1446649891399;
Wed, 04 Nov 2015 07:11:31 -0800 (PST)
Return-Path: <>
Received: from IND01-MA1-obe.outbound.protection.outlook.com (mail-ma1ind01hn0242.outbound.protection.outlook.com. [104.47.100.242])
by mx.google.com with ESMTPS id wm8si2076325wjc.181.2015.11.04.07.11.29
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128);
Wed, 04 Nov 2015 07:11:31 -0800 (PST)
Received-SPF: pass (google.com: domain of IND01-MA1-obe.outbound.protection.outlook.com designates 104.47.100.242 as permitted sender) client-ip=104.47.100.242;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of IND01-MA1-obe.outbound.protection.outlook.com designates 104.47.100.242 as permitted sender) smtp.mailfrom=
Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=<>;
Received: from [100.66.134.169] (116.202.34.26) by
PN1PR01MB0047.INDPRD01.PROD.OUTLOOK.COM (10.164.138.143) with Microsoft SMTP
Server (TLS) id 15.1.318.15; Wed, 4 Nov 2015 15:11:18 +0000
Content-Type: multipart/alternative; boundary="===============1935448533=="
MIME-Version: 1.0
Subject: PLEASE REPLY BACK
To: Recipients
From: ATTENTION
Date: Wed, 4 Nov 2015 20:41:10 +0530
Reply-To: <[email protected]>
X-Originating-IP: [116.202.34.26]
X-ClientProxiedBy: HKNPR06CA0036.apcprd06.prod.outlook.com (10.141.16.26) To
PN1PR01MB0047.INDPRD01.PROD.OUTLOOK.COM (25.164.138.143)
Return-Path: <>

Dear Sir/Madam

Thanks for your mail. I apologize if my message do not suit your current status, my name is Mr. Thorsten Haas, I am a Citizen of Germany, happily married with two kids. I contacted you because I have interest of investing in your country in Real Estate business (ie: Hotel, Lands and Tourism) as well as seek your services in a private and confidential matter because of the rapid growth in your country economy. I am a Chartered Accountant and Chief Auditor here in our bank. On my routine inspection I discovered a dormant domiciliary account with a balance of $5,000,000.00 USD {Five Million United Dollars Only}.

I write to seek your indulgence and assistance in transferring this fund to your country through legal means as repatriation of fund for
Investment. I am proposing to make this trans,transfer to a designated bank account of your choice in your country for investment. At the
conclusion of this transaction,

I promise to give 30% of the total amount, 70% will be for me and my colleagues who will help make this
business a success

Willing to proceed? Kindly send your response to my email address - [email protected]

Best Regards,

The scammer is still using the same script with a new email address thorsten haas [email protected]

Another scripted message.

I NEED YOUR ID PROOF

Hello Mr xxxx,
Thanks for your mail, I receive your detailed information which I require for us to proceed with this very transaction, I want you to kindly send me any of your Identity Proof either your Driver’s License, International Passport or Voters ID-CARD, so that I will give my Attorney Barrister Sila Blair an Authorization letter with your detailed information including your Identity Proof for the release of this fund worth $5,000,000.00 USD(Five Million United States Dollars Only) in our favor by the HSBC Bank of London here in United Kingdom. I assure you once again that this very business Deal is 100% legit, secure and risk free.
I urge you to be checking your Emails every day, because I will be updating you on the situation report daily in regards to this very transaction, Lest I forget, how are you and your family today, I hope you are pretty good and splendid? I await to receive the scan copy of any Identity Proof of yours either Driver’s License, International Passport or Voters ID-CARD, in your return mail so that we can proceed further with this Deal without much delay or wasting of time.
Best Regards,
Thorsten