Jacob Lew [email protected] [email protected]

[Tim Atem]

Header Analysis Quick Report
Originating IP: 217.106.32.169
Originating ISP: Ojsc Rostelecom
City: n/a
Country of Origin: Russian Federation
* For a complete report on this email header goto ipTRACKERonline

Delivered-To: <snipped>
Received: by 10.107.170.86 with SMTP id t83csp186480ioe;
Tue, 30 Jun 2015 13:12:41 -0700 (PDT)
X-Received: by 10.112.157.36 with SMTP id wj4mr20788476lbb.115.1435695160788;
Tue, 30 Jun 2015 13:12:40 -0700 (PDT)
Return-Path: <[email protected]>
Received: from Dionis.r40.rosreestr.ru (dionis.r40.rosreestr.ru. [217.106.32.169])
by mx.google.com with ESMTPS id i6si39051378lai.30.2015.06.30.13.12.29
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Tue, 30 Jun 2015 13:12:40 -0700 (PDT)
Received-SPF: fail (google.com: domain of [email protected] does not designate 217.106.32.169 as permitted sender) client-ip=217.106.32.169;
Authentication-Results: mx.google.com;
spf=fail (google.com: domain of [email protected] does not designate 217.106.32.169 as permitted sender) smtp.mail=[email protected]
Received: from localhost ([127.0.0.1])
by Dionis.r40.rosreestr.ru (Kerio Connect 7.2.4);
Tue, 30 Jun 2015 23:12:40 +0300
To: undisclosed-recipients:;
From: Михайлина Елена <[email protected]>
Subject: US TREASURY DEPARTMENT
Reply-To: [email protected]
Message-ID: <[email protected]>
Date: Wed, 01 Jul 2015 00:12:40 +0400
X-Mailer: Kerio Connect 7.2.4 WebMail
X-User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/43.0.2357.130 Safari/537.36
MIME-Version: 1.0

I am Jacob J. Lew i am the new Secretary of the United States National
Treasury,I was instructed by the United Nation and also the World bank to
ask why you have not received payment valued of US$700,000.00

Moreover, Their are two gentlemen here who came from your country to claim
your US$700,000.00 on your behalf and they told us that you are DEAD and
we want to confirm if you are DEAD or Not, And if we don't get any
response back from you within 7 banking days, we will hand over your
US$700,000.00 to them. We cannot be held liable for any loss or diversion
of your fund due to wrong information. Most of the required statutory fees
to be paid by you has been suspended or waivered by the relevant
authorities following the intervention of the World Bank regarding the
long delay and inconveniences suffered by you while waiting to receive
this payment.

Due to the numerous fraudulent activities by some financial institutions
in-charge of making this payment to you, we have resolved to implement the
use of International Swift ATM Card for the release of your payment to
you. In this payment scheme, your payment will be credited into an
International Swift ATM Card account which will enable you either to make
withdrawals at any cash point,it is imperative that you supply us with the
following requirements;

1. Your full names as would appear on your card.
2. Full address safe for the delivery of your card
3. Any proof of identification
4. Phone and Fax number

Note that you are to appear before us here in WASHINGTON D.C within Five Banking
Days to finalize your accreditation modalities with the board of directors
where we shall hand over your International Swift ATM Card to you in
person after signing the necessary documents.

But in a case where by you can not travel due to time factor,Please do
confirm that you will take responsibility for the cost of delivery which
only is Us$100 payable only to the dispatch unit department here in our
office, Please be informed that your delivery will only take 48 hours (2
days) to get to your residential address upon confirmation of your
payment for delivery.

Also note For the guarantee of this project, The delivery fee is the only
money you are to pay and nothing more than that. You will be given a
Payment Guarantee if you want for your perusal and confidentiality and
safety of this venture in accordance.

Thank you and God bless you,

Mr.Jacob J. Lew.
Executive Secretary United States Treasury Department
Main Treasury 1500 Pennsylvania Avenue, NW
Washington, D.C. 20220

[Tim Atem]

He's changed email addresses, he replied using [email protected] and he's using the US phone number 248-255-4103 :

from: Jacob Lew Jr <[email protected]>
to:
date: Thu, Jul 2, 2015 at 10:42 AM
subject: INFORMATION

Delivered-To: <snipped>
Received: by 10.112.26.75 with SMTP id j11csp543405lbg;
Thu, 2 Jul 2015 08:42:07 -0700 (PDT)
X-Received: by 10.140.42.115 with SMTP id b106mr43621539qga.105.1435851727108;
Thu, 02 Jul 2015 08:42:07 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mout.gmx.com (mout.gmx.com. [74.208.4.201])
by mx.google.com with ESMTPS id m70si6719475qhb.89.2015.07.02.08.42.06
for <<snipped>>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Thu, 02 Jul 2015 08:42:07 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 74.208.4.201 as permitted sender) client-ip=74.208.4.201;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 74.208.4.201 as permitted sender) smtp.mail=[email protected]
Received: from [207.244.72.201] by 3capp-mailcom-lxa11.server.lan (via
HTTP); Thu, 2 Jul 2015 17:42:05 +0200
MIME-Version: 1.0
Message-ID: <trinity-fe04253a-da1b-4be2-9ae9-31dc84a3c04b-1435851725136@3capp-mailcom-lxa11>
From: "Jacob Lew Jr" <[email protected]>
To: <snipped>
Subject: INFORMATION
Content-Type: text/html; charset=UTF-8
Date: Thu, 2 Jul 2015 17:42:05 +0200
Importance: normal
Sensitivity: Normal
X-Priority: 3
X-Provags-ID: <snipped>
X-UI-Out-Filterresults: <snipped>

Following your mail to me, i want you to understand that your International Swift ATM Card is ready for delivery to your location as planned. and you are to appear before us here in Washington D.C within Five Banking Days to finalize your accreditation modalities with the board of directors where we shall hand over your International Swift ATM Card to you in person after signing the necessary documents. And incase you are not able to make it down to our office here in Washington, D.C., you will be required to handle the delivery of your atm master card which is just $100.

And once the $100 is received by the dispatch department in our office your International Swift ATM Card will be place on transit to your location immediately and it will only take 48hrs to get you, And below is the Money Gram payment information you will use in sending the $100 to the dispatch department.

NAME: <snipped>
ADDRESS:HOLDERNESS- NEW HAMPSHIRE
TEXT QUESTION: YES
ANSWER: YES
AMOUNT SEND: $100

And once the payment is been confirmed paid to here as planned, i want you to kindly get back to me with the Money Gram payment information and also the reference number used in making the payment to her as planned. So that your International Swift ATM Card will be place on transit immediately.

NOTE: I WANT YOU TO KINDLY GET BACK TO ME WITH YOUR FULL ADDRESS AND CELL PHONE NUMBER TO AVOID ANY FURTHER DELAYS WHEN YOUR DELIVERY WILL TAKE PLACE. YOU YOU CAN TEXT OR CALL ME ON THIS NUMBER 248-255-4103

Thank you and God bless you
Photo: Jacob J. Lew


Mr.Jacob J. Lew.
Executive Secretary United States Treasury Department
Main Treasury 1500 Pennsylvania Avenue, NW
Washington, D.C. 20220


This email came in later:

Delivered-To: <snipped>
Received: by 10.112.26.75 with SMTP id j11csp1094661lbg;
Fri, 3 Jul 2015 04:59:15 -0700 (PDT)
X-Received: by 10.180.9.75 with SMTP id x11mr24985393wia.80.1435924755249;
Fri, 03 Jul 2015 04:59:15 -0700 (PDT)
Return-Path: <[email protected]>
Received: from nm13-vm3.bullet.mail.ir2.yahoo.com (nm13-vm3.bullet.mail.ir2.yahoo.com. [212.82.96.182])
by mx.google.com with ESMTPS id az10si14807412wib.65.2015.07.03.04.59.14
for <<snipped>>
(version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
Fri, 03 Jul 2015 04:59:15 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 212.82.96.182 as permitted sender) client-ip=212.82.96.182;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 212.82.96.182 as permitted sender) smtp.mail=[email protected];
dkim=pass [email protected];
dmarc=pass (p=REJECT dis=NONE) header.from=yahoo.com
DKIM-Signature: <snipped>
Received: from [212.82.98.58] by nm13.bullet.mail.ir2.yahoo.com with NNFMP; 03 Jul 2015 11:59:15 -0000
Received: from [212.82.98.75] by tm11.bullet.mail.ir2.yahoo.com with NNFMP; 03 Jul 2015 11:59:14 -0000
Received: from [127.0.0.1] by omp1012.mail.ir2.yahoo.com with NNFMP; 03 Jul 2015 11:59:14 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
X-YMail-OSG: <snipped>
Received: by 217.12.9.12; Fri, 03 Jul 2015 11:59:14 +0000
Date: Fri, 3 Jul 2015 11:59:14 +0000 (UTC)
From: Erica Smith <[email protected]>
Reply-To: Erica Smith <[email protected]>
To: "<snipped>" <<snipped>>
Message-ID: <[email protected]>
Subject: PLEASE HELP ME
MIME-Version: 1.0

I am Mrs Erica Smith from Canada, I want you to know that i am aware of your atm card that is about to be sent to you by the US Treasury Department. I want you to do me a big favour and tell Jacob lew to cancel your payment files with them and change your payment files to my name and have your atm card sent to me in Canada, And i will be so happy to give you 10% of the $700,000 once your atm card is delivered to me in Canada.

Please get back to me ASAP.

Mrs Erica Smith