Joseph D. Opatry [email protected]

[Tim Atem]

Header Analysis Quick Report
Originating IP: 41.138.185.89
Originating ISP: Visafone
City: Lagos
Country of Origin: Nigeria
* For a complete report on this email header goto ipTRACKERonline

Delivered-To: <snipped>
Received: by 10.112.61.9 with SMTP id l9csp1251685lbr;
Fri, 23 Oct 2015 11:11:24 -0700 (PDT)
X-Received: by 10.55.217.206 with SMTP id q75mr27672469qkl.109.1445623884591;
Fri, 23 Oct 2015 11:11:24 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mout.gmx.com (mout.gmx.com. [74.208.4.201])
by mx.google.com with ESMTPS id i197si19866919qhc.94.2015.10.23.11.11.23
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Fri, 23 Oct 2015 11:11:24 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 74.208.4.201 as permitted sender) client-ip=74.208.4.201;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 74.208.4.201 as permitted sender) smtp.mailfrom=[email protected]
Received: from [41.138.185.89] by 3capp-mailcom-lxa09.server.lan (via HTTP);
Fri, 23 Oct 2015 20:09:43 +0200
MIME-Version: 1.0
Message-ID: <trinity-ff4a57ee-3528-434a-87ed-674ebd306794-1445623782923@3capp-mailcom-lxa09>
From: "First Federal Bank" <[email protected]>
Subject: Official notification
Content-Type: text/html; charset=UTF-8
Date: Fri, 23 Oct 2015 20:09:43 +0200
Importance: normal
Sensitivity: Normal
X-Priority: 3
X-Provags-ID: <snipped>
X-UI-Out-Filterresults: <snipped>

Hi,
You are receiving business notification from the manager of First Federal Community Bank Berlin, Ohio 44610. Your response must be directly to the manager's private e-mail for business discussion, kindly reply to the bank manager 'Joseph D OPATRY' at e-mail: [email protected]

With regards,
First Federal Community Bank
5120 State Route 39
Berlin, Ohio 44610
http://www.onlineberlin.com

[Tim Atem]

The other email in this scam is also posted here: https://www.scamwarners.com/forum/viewt ... om#p274302

There are a number of email addresses in this email and it looks like the scammer had two scripts in this one email:

[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

Header Analysis Quick Report
Originating IP: 83.221.132.154
Originating ISP: Netgroup A/s
City: Copenhagen
Country of Origin: Denmark
* For a complete report on this email header goto ipTRACKERonline

Delivered-To: <snipped>
Received: by 10.112.73.147 with SMTP id l19csp2220103lbv;
Wed, 11 Nov 2015 00:01:46 -0800 (PST)
X-Received: by 10.140.101.73 with SMTP id t67mr9673173qge.71.1447228906511;
Wed, 11 Nov 2015 00:01:46 -0800 (PST)
Return-Path: <[email protected]>
Received: from mout-xforward.gmx.com (mout-xforward.gmx.com. [82.165.159.130])
by mx.google.com with ESMTPS id d141si6460180qhc.18.2015.11.11.00.01.45
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Wed, 11 Nov 2015 00:01:46 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 82.165.159.130 as permitted sender) client-ip=82.165.159.130;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 82.165.159.130 as permitted sender) smtp.mailfrom=[email protected]
Received: from [83.221.132.154] by 3capp-mailcom-lxa15.server.lan (via
HTTP); Wed, 11 Nov 2015 09:00:02 +0100
MIME-Version: 1.0
Message-ID: <trinity-2835205c-d741-46a4-902d-811c11339aed-1447228802735@3capp-mailcom-lxa15>
From: "Rickenbacher Joseph" <[email protected]>
Subject: Updating you with the achieved progress
Content-Type: text/html; charset=UTF-8
Date: Wed, 11 Nov 2015 09:00:02 +0100
Importance: normal
Sensitivity: Normal
X-Priority: 3
X-Provags-ID: <snipped>
X-UI-Out-Filterresults: <snipped>

Dear friend,

Note that i have commence the procurement of third party beneficiary approval in your favour and the Portfolio will be moved directly to you hopefully before the end of today based on your swift action, i officially advice you quickly confirm receipt of this message directly to my secured private email for confidential reasons, Private email: [email protected] and [email protected]

Endeavour to reconfirm your complete details which must be officially confirmed to the UBS Executive Director for portfolio shipment authorization in your favour.

Respectively,

Joseph Rickenbacher
Deputy Chief Credit Officer,
Head of Credit and Portfolio Analytics
Union Bank of Switzerland UBS
E-mail: [email protected]
E-mail: [email protected]

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Hi,
As a financial professional, i always look for timely insights and ideas to help serve clients, manage investments and run practice. With actionable ideas and fresh perspectives, we believe UBS will soon become a valued resource in your arsenal. However, there're lot of unclaimed Portfolio and i can make you a beneficial subsequent to your participation to utilize this magnificent opportunity.

We can sensitively handle this magnificent opportunity as the Portfolio is worth €14.5 Million Euro and will be shared equal. Hoping to receive professional ideas response from you to forge ahead, contact me via email [email protected] and phone number will be provided for private discussion upon receipt of your professional collaboration response.

Regards,
Joseph Rickenbacher
Deputy Chief Credit Officer,
Head of Credit and Portfolio Analytics
Union Bank of Switzerland UBS
E-mail: [email protected]