The world's premier anti internet scam, anti fraud information website 

  • [email protected]

  • 419 scam database with 50,000+ reports. Verify suspicious inheritance emails, lottery wins, and money transfer requests. Names, emails and bank details exposed.
Who are you really talking to? Check their location - InfoSniper
419 scam database with 50,000+ reports. Verify suspicious inheritance emails, lottery wins, and money transfer requests. Names, emails and bank details exposed.
  Been Targeted by This Scam?

Learn how to report a scam to the FBI, FTC, and the right authorities. Been asked to invest in crypto? Read about pig butchering scams. Received a suspicious check? Learn about fake check scams. Not sure if it's real? Use our free Scam Checker Tool.

  by Tim Atem
 
ipTRACKERonline.com wrote:Header Analysis Quick Report
Originating IP: 200.42.138.135
Originating ISP: Cablevision
City: Buenos Aires
Country of Origin: Argentina
* For a complete report on this email header goto ipTRACKERonline
Delivered-To: <snipped>
Received: by 10.107.39.139 with SMTP id n133csp1793926ion;
Mon, 23 Nov 2015 12:28:02 -0800 (PST)
X-Received: by 10.140.23.83 with SMTP id 77mr28991450qgo.58.1448310482321;
Mon, 23 Nov 2015 12:28:02 -0800 (PST)
Return-Path: <[email protected]>
Received: from relay9.ciudad.com.ar (relay9.ciudad.com.ar. [200.42.138.232])
by mx.google.com with ESMTP id z128si391760qhd.38.2015.11.23.12.28.01;
Mon, 23 Nov 2015 12:28:02 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 200.42.138.232 as permitted sender) client-ip=200.42.138.232;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 200.42.138.232 as permitted sender) smtp.mailfrom=[email protected];
dkim=fail [email protected];
dmarc=pass (p=QUARANTINE dis=NONE) header.from=ciudad.com.ar
Received: from localhost (unknown [200.42.138.135])
by relay9.ciudad.com.ar (Postfix) with ESMTP id 24ED422DC44;
Mon, 23 Nov 2015 17:28:01 -0300 (ART)
DKIM-Signature: <snipped>
DomainKey-Signature: <snipped>
X-Virus-Scanned: amavisd-new at zrm4.int.cmd.com.ar
X-Spam-Flag: YES
X-Spam-Score: 8.201
X-Spam-Level: ********
X-Spam-Status: <snipped>
Received: from relay4.ciudad.com.ar ([127.0.0.1])
by localhost (zrm4.int.cmd.com.ar [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id O9aG_tzbZnj9; Mon, 23 Nov 2015 17:27:53 -0300 (ART)
Received: by relay4.ciudad.com.ar (Postfix, from userid 509)
id 2D1364AE77; Mon, 23 Nov 2015 17:27:53 -0300 (ART)
Received: from zsp8.int.cmd.com.ar (zsp8.int.cmd.com.ar [10.4.1.183])
by relay4.ciudad.com.ar (Postfix) with ESMTP id 975764AE87;
Mon, 23 Nov 2015 17:27:22 -0300 (ART)
Date: Mon, 23 Nov 2015 17:27:22 -0300 (ART)
From: [email protected]
Reply-To: lebrom james <[email protected]>
Message-ID: <[email protected]>
Subject: *** SPAM *** Re: Cashier's Check
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Originating-IP: [10.4.0.15]
X-Mailer: Zimbra 8.0.7_GA_6021 (ZimbraWebClient - GC45 (Win)/8.0.6_GA_5922)
Thread-Topic: Cashier's Check
Thread-Index: HQJa3O97q4BEvb9y5z8mxt/bjD8LbA==
To: undisclosed-recipients
Re: Cashier's Check
How are you? It has been long and I didn’t hear from you. This is to inform you that I have finally negotiated with the bank and they agreed to issue a certify Cashier’s Check in your name. Please provide your name & full address where the Check will be sent to you. Forward your address to the bank here. Email: ([email protected]), Thanks.