Money Gram [email protected] Yahoo Invite Format

[Tim Atem]

There were actually two of these, one was the original invite and then right after was the cancel. I didn't see a need to post all contents of both. They were both from the same Yahoo email, had the same content/look. The Google invite was a link that wasn't there anymore since it was cancelle, but the Yahoo invite had the fake Money Gram script in it. Posting because it provides two email addresses and a phone number.

What the email looks like:

Delivered-To: <snipped>
Received: by 10.202.199.202 with SMTP id x193csp1349844oif;
Sat, 14 Mar 2015 14:03:10 -0700 (PDT)
X-Received: by 10.141.28.197 with SMTP id f188mr69029651qhe.103.1426366990364;
Sat, 14 Mar 2015 14:03:10 -0700 (PDT)
Return-Path: <[email protected]>
Received: from n5-vm9.bullet.mail.bf1.yahoo.com (n5-vm9.bullet.mail.bf1.yahoo.com. [72.30.235.61])
by mx.google.com with ESMTPS id 75si5526208qhq.31.2015.03.14.14.03.09
for <<snipped>>
(version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
Sat, 14 Mar 2015 14:03:10 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 72.30.235.61 as permitted sender) client-ip=72.30.235.61;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 72.30.235.61 as permitted sender) smtp.mail=[email protected];
dkim=neutral (body hash did not verify) header.i=@;
dmarc=fail (p=NONE dis=NONE) header.from=yahoo.fr
Message-Id: <[email protected]>
DKIM-Signature: <snipped>
Received: from [66.196.81.179] by n5.bullet.mail.bf1.yahoo.com with NNFMP; 14 Mar 2015 21:03:09 -0000
Received: from [10.194.147.220] by t9.bullet.mail.bf1.yahoo.com with NNFMP; 14 Mar 2015 21:03:09 -0000
Date: 14 Mar 2015 21:03:09 +0000
Received: from [127.0.0.1] by ec03.vm.unp.bf1.yahoo.com with NNFMP; 14 Mar 2015 21:00:36 -0000
To: <snipped>
From: "Money Gram" <[email protected]>
Reply-To: "Money Gram" <[email protected]>
MIME-Version: 1.0
X-Yahoo-Newman-Property: calendar-remind
X-Yahoo-Newman-Id: calendar-remind-cf6b9020-dc7e-4430-981c-ed01101040ce
Subject: Annulé : CONTACT MONEY GRAM OFFICE

Mar13Fri
CONTACT MONEY GRAM OFFICE
From Google Calendar
This event has been canceled.
MARS
13
"CONTACT MONEY GRAM OFFICE" has been
annulé
Quand vendredi, 13 mars 2015
07:00 PM à 08:00 PM
(GMT) Greenwich Mean Time - Dublin/Édimbourg/Lisbonne/Londres
Message ATTN DEAR: WE FINALLY CONCLUDED TO EFFECT YOUR PAYMENT OF (US$1,5M) VIA MONEY GRAM OFFICE THIS MORNING AS THE BEST AND EASIER WAY TO CASH YOUR FUNDS IN ANY OF YOUR NEAREST MONEY GRAM OFFICE IN YOUR CITY, WELL BASED ON MY AGREEMENT WITH MONEYGRAM DIRECTOR, DR.CHRIS MICHAEL, YOUR TRANSFER WILL START IMMEDIATELY YOU CONTACT HIM WITH ALL YOUR INFORMATION AS FOLLOW YOUR NAME___________ YOUR HOME ADDRESS_______ YOUR COUNTY/CITY__________ YOUR AGE/SEX_______ ______ DIRECT PHONE NUMBER_______ ID COPY_______ OCCUPATION_______ MONEY GRAM OFFICE:CONTACT PERSON: DR. CHRIS MICHAEL E-MAIL: [email protected] PHONE NO +229 68825122 BEST REGARDS, MRS. GRACE JOHNSON
Cette invitation à un évènement a été envoyée à partir de Yahoo Agenda




From the invite.ics file that was with the email:

BEGIN:VCALENDAR
PRODID://Yahoo//Calendar//EN
VERSION:2.0
METHOD:CANCEL
BEGIN:VEVENT
SUMMARY:CONTACT MONEY GRAM OFFICE
DESCRIPTION:ATTN DEAR: WE FINALLY CONCLUDED TO EFFECT YOUR PAYMENT OF (US$1
\,5M) VIA MONEY GRAM OFFICE THIS MORNING AS THE BEST AND EASIER WAY TO CAS
H YOUR FUNDS IN ANY OF YOUR NEAREST MONEY GRAM OFFICE IN YOUR CITY\, WELL
BASED ON MY AGREEMENT WITH MONEYGRAM DIRECTOR\, DR.CHRIS MICHAEL\, YOUR TR
ANSFER WILL START IMMEDIATELY YOU CONTACT HIM WITH ALL YOUR INFORMATION AS
FOLLOW YOUR NAME___________ YOUR HOME ADDRESS_______ YOUR COUNTY/CITY____
______ YOUR AGE/SEX_______ ______ DIRECT PHONE NUMBER_______ ID COPY______
_ OCCUPATION_______ MONEY GRAM OFFICE:CONTACT PERSON: DR. CHRIS MICHAEL E-
MAIL: [email protected] PHONE NO +229 68825122 BEST REGARDS\, MR
S. GRACE JOHNSON
CLASS:PUBLIC
DTSTART;TZID=Etc/GMT-1:20150313T190000
DTEND;TZID=Etc/GMT-1:20150313T200000
PRIORITY:0
SEQUENCE:320
STATUS:CONFIRMED
UID:b01bc0b7-597a-4ce3-82db-4aca37c6bdd8
DTSTAMP:20150314T210035Z
ATTENDEE;ROLE=REQ_PARTICIPANT;RSVP=TRUE:mailto:<snipped - potential victim>
ATTENDEE;ROLE=REQ_PARTICIPANT;RSVP=TRUE:mailto:<snipped - potential victim>
ATTENDEE;ROLE=REQ_PARTICIPANT;RSVP=TRUE:mailto:<snipped - potential victim>
ATTENDEE;ROLE=REQ_PARTICIPANT;RSVP=TRUE:mailto:<snipped - potential victim>
ATTENDEE;ROLE=REQ_PARTICIPANT;RSVP=TRUE:mailto:<snipped - potential victim>
ATTENDEE;ROLE=REQ_PARTICIPANT;RSVP=TRUE:mailto:<snipped - potential victim>
ATTENDEE;ROLE=REQ_PARTICIPANT;RSVP=TRUE:mailto:<snipped - potential victim>
com
ORGANIZER;CN=Money Gram;SENT-BY="mailto:[email protected]":mailto
:[email protected]
X-YAHOO-YID:moneygramoffice311
TRANSP:OPAQUE
STATUS:CONFIRMED
X-YAHOO-USER-STATUS:BUSY
X-YAHOO-EVENT-STATUS:BUSY
BEGIN:VALARM
ACTION:DISPLAY
DESCRIPTION:
TRIGGER;RELATED=START:-PT30M
END:VALARM
END:VEVENT
END:VCALENDAR

[Tim Atem]

from: MRS. GRACE JOHNSON <[email protected]>
reply-to: [email protected]
MONEY GRAM OFFICE:CONTACT PERSON:

DR. CHRIS MICHAEL
E-MAIL: [email protected]
PHONE NO +229 998 087 33

Delivered-To: <snipped>
Received: by 10.107.170.83 with SMTP id t80csp665594ioe;
Tue, 21 Apr 2015 08:37:09 -0700 (PDT)
X-Received: by 10.180.104.4 with SMTP id ga4mr6995624wib.86.1429630629151;
Tue, 21 Apr 2015 08:37:09 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mail-wg0-x241.google.com (mail-wg0-x241.google.com. [2a00400c:c00::241])
by mx.google.com with ESMTPS id br1si4194855wib.95.2015.04.21.08.37.08
for <<snipped>>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Tue, 21 Apr 2015 08:37:09 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 2a00400c:c00::241 as permitted sender) client-ip=2a00400c:c00::241;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 2a00400c:c00::241 as permitted sender) smtp.mail=[email protected];
dkim=pass [email protected];
dmarc=pass (p=NONE dis=NONE) header.from=gmail.com
Received: by mail-wg0-x241.google.com with SMTP id z12so21977085wgg.0
for <<snipped>>; Tue, 21 Apr 2015 08:37:08 -0700 (PDT)
DKIM-Signature: <snipped>
MIME-Version: 1.0
X-Received: by 10.180.83.6 with SMTP id m6mr5895902wiy.72.1429630628574; Tue,
21 Apr 2015 08:37:08 -0700 (PDT)
Received: by 10.27.204.136 with HTTP; Tue, 21 Apr 2015 08:37:08 -0700 (PDT)
Reply-To: [email protected]
Date: Tue, 21 Apr 2015 20:07:08 +0430
Message-ID: <CAC1n-BFxRDJK4vhM8MUzGv0QnFtHZbDurAyNsoBNhGqx2g4MOA@mail.gmail.com>
Subject: CONTACT MONEY GRAM OFFICE
From: "MRS. GRACE JOHNSON" <[email protected]>
To: undisclosed-recipients:;
Content-Type: text/plain; charset=UTF-8
Bcc: <snipped>

ATTN DEAR:

WE FINALLY CONCLUDED TO EFFECT YOUR PAYMENT OF (US$1,5M) VIA MONEY
GRAM OFFICE THIS MORNING AS THE BEST AND EASIER WAY TO CASH YOUR FUNDS
IN ANY OF YOUR NEAREST MONEY GRAM OFFICE IN YOUR CITY, WELL BASED ON
MY AGREEMENT WITH MONEYGRAM DIRECTOR, DR.CHRIS MICHAEL, YOUR TRANSFER
WILL START IMMEDIATELY YOU CONTACT HIM WITH ALL YOUR INFORMATION AS
FOLLOW

YOUR NAME___________
YOUR HOME ADDRESS_______
YOUR COUNTY/CITY__________
YOUR AGE/SEX_______ ______
DIRECT PHONE NUMBER_______
ID COPY_______
OCCUPATION_______

MONEY GRAM OFFICE:CONTACT PERSON:

DR. CHRIS MICHAEL
E-MAIL: [email protected]
PHONE NO +229 998 087 33

BEST REGARDS,
MRS. GRACE JOHNSON

[Tim Atem]

Using the same from email address, [email protected] and phone number +229-99808733

from: Mr.PETER GOMEZ <[email protected]>
reply-to: [email protected]
to:
date: Mon, Jun 29, 2015 at 3:09 AM
subject: ATTENTION DEAR

Delivered-To: <snipped>
Received: by 10.112.26.75 with SMTP id j11csp529983lbg;
Mon, 29 Jun 2015 01:09:27 -0700 (PDT)
X-Received: by 10.182.114.138 with SMTP id jg10mr1570593obb.55.1435565366702;
Mon, 29 Jun 2015 01:09:26 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mail-oi0-x244.google.com (mail-oi0-x244.google.com. [2607:f8b0:4003:c06::244])
by mx.google.com with ESMTPS id vc9si11990527obb.31.2015.06.29.01.09.25
for <<snipped>>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Mon, 29 Jun 2015 01:09:26 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 2607:f8b0:4003:c06::244 as permitted sender) client-ip=2607:f8b0:4003:c06::244;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 2607:f8b0:4003:c06::244 as permitted sender) smtp.mail=[email protected];
dkim=pass [email protected];
dmarc=pass (p=NONE dis=NONE) header.from=gmail.com
Received: by mail-oi0-x244.google.com with SMTP id v1so5687273oia.0
for <<snipped>>; Mon, 29 Jun 2015 01:09:25 -0700 (PDT)
DKIM-Signature: <snipped>
MIME-Version: 1.0
X-Received: by 10.202.57.137 with SMTP id g131mr11252977oia.122.1435565365583;
Mon, 29 Jun 2015 01:09:25 -0700 (PDT)
Received: by 10.76.58.73 with HTTP; Mon, 29 Jun 2015 01:09:25 -0700 (PDT)
Reply-To: [email protected]
Date: Mon, 29 Jun 2015 10:09:25 +0200
Message-ID: <CAC1n-BHdY8tMq8zmDBQ5sVkU3Qu3Sgy1h6QNUVDAM8-iTAi0Wg@mail.gmail.com>
Subject: ATTENTION DEAR
From: "Mr.PETER GOMEZ" <[email protected]>
To: undisclosed-recipients:;
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Bcc: <snipped>

ATTENTION DEAR,

I know it is because of your past expenses that make you not to
believe me but I told you before that I cannot deceive you because my
bible says what shall it profit a man to gain material things
and=loose your soul, any way their is good news now, i raised some
money=to help you out and make sure that your payment will be release
to you the same day you send the $59.00 as well.

I borrowed money on sunday after service from my Pastor, then you have
to send the remain balance now only $$59.00 but i don't see the
reason=you have to keep silent on me, honestly I am just dis appointed
at your behaviors before because you know that I cannot deceive you,
Just pay the $59.00 and leave rest for me watching me if I am telling
you lies.

Your payments is already approval today for you to receive it but the
management here says that you must pay $59.00 for the Stamp and
activation charge before you can receive the payment today, please
send the charge through western union immediately, i have assured you
a time without number that this is genuine and legitimate.

I swear If I fail to release your payment after you send the $59.00 as
I promise don't count on me again, I cannot fail you, I promise you
don’t fear as soon as you send the $$59.00 today please leave the rest
to me and see if I am lie to you because I can not use my life swear
because of $59.00, how can I swear against my life because of this
small amount? it is to show you that I am telling you the truth.

HERE IS THE INFORMATION TO SEND THE MONEY TO WESTERN UNION MONEY TRANSFER BELOW:

Receiver Name==== Edu Joe
Country====Benin Republic
Country Code======00229
City======Cototonou
Question====what color
Answer======Blue
Amount====$59.00
(M.T.C.N)=====
Sender's name===
Sender's Direct Telephone===

I promise you as soon as we hear from you with the payment of $59.
today we shall send your pick up information the same day you send the
$59.00 I swear.

Yours Sincerely
Mr.PETER GOMEZ
Foreign Operation Manager


CELL PHONE +229 998 087 33
emailaddress: ([email protected])

[Tim Atem]

And another one using the same phone number and email address [email protected]

Header Analysis Quick Report
Originating IP: 41.216.50.17
Originating ISP: Opt Benin / Benin Telecom
City: Cotonou
Country of Origin: Benin
* For a complete report on this email header goto ipTRACKERonline

Delivered-To: <snipped>
Received: by 10.112.26.75 with SMTP id j11csp1985955lbg;
Mon, 27 Jul 2015 23:17:25 -0700 (PDT)
X-Received: by 10.129.52.138 with SMTP id b132mr120177ywa.58.1438064245226;
Mon, 27 Jul 2015 23:17:25 -0700 (PDT)
Return-Path: <[email protected]>
Received: from if10-mail-fb05-mia.mta.terra.com (if10-mail-fb05-mia.mta.terra.com. [98.142.233.72])
by mx.google.com with ESMTP id s7si14576593ykd.138.2015.07.27.23.17.19;
Mon, 27 Jul 2015 23:17:25 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 98.142.233.72 as permitted sender) client-ip=98.142.233.72;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 98.142.233.72 as permitted sender) smtp.mail=[email protected]
Received: from mail-smtp03-mia.tpn.terra.com (unknown [10.235.200.60])
by mail-fb05-mia.tpn.terra.com (Postfix) with ESMTP id D8BE2800EEDD;
Tue, 28 Jul 2015 06:17:18 +0000 (UTC)
X-Terra-Karma: -2%
X-Terra-Hash: f1943ce9d636bf237f7de0fbae0fb819
Received: from localhost (1n1.terra.com [208.84.242.167])
(authenticated user centauri!speedylm)
by mail-smtp03-mia.tpn.terra.com (Postfix) with ESMTPA id 54845C0000E5;
Tue, 28 Jul 2015 06:17:18 +0000 (UTC)
reply-to: [email protected]
date: Tue, 28 Jul 15 06:17:18 +0000
message-id: <[email protected]>
X-Priority: 3
x-msmail-priority: normal
importance: normal
priority: normal
subject: ATTENTION DEAR,
x-origin: 41.216.50.17
from: "Dr.KATHY GEORGE" <[email protected]>
content-type: text/html; charset=utf-8
content-transfer-encoding: QUOTED-PRINTABLE
mime-version: 1.0
to:
X-CMAE-Score: 0

ATTENTION DEAR,

I know it is because of your past expenses that make you not to believe me but I told you before that I cannot deceive you because my bible says what shall it profit a man to gain material things and loose your soul, any way their is good news now, i raised some money to help you out and make sure that your payment will be release to you the same day you send the $59.00 as well.

I borrowed money on sunday after service from my Pastor, then you have to send the remain balance now only $$59.00 but i don't see the reason you have to keep silent on me, honestly I am just dis appointed at your behaviors before because you know that I cannot deceive you, Just pay the $59.00 and leave rest for me watching me if I am telling you lies.

Your payments is already approval today for you to receive it but the management here says that you must pay $59.00 for the Stamp and activation charge before you can receive the payment today, please send the charge through Money Gram immediately, i have assured you a time without number that this is genuine and legitimate.

I swear If I fail to release your payment after you send the $59.00 as I promise don't count on me again, I cannot fail you, I promise you don’t fear as soon as you send the $$59.00 today please leave the rest to me and see if I am lie to you because I can not use my life swear because of $59.00, how can I swear against my life because of this small amount? it is to show you that I am telling you the truth.

HERE IS THE INFORMATION TO SEND THE MONEY TO MONEY GRAM OFFICE BELOW:

Receiver Name==== Jekwu Igwilo
Country====Benin Republic
Country Code======00229
City======Cototonou
Question====what color
Answer======Blue
Amount====$59.00
(M.T.C.N)=====
Sender's name===
Sender's Direct Telephone===

I promise you as soon as we hear from you with the payment of $59. today we shall send your pick up information the same day you send the
$59.00 I swear.

Yours Sincerely
Dr.KATHY GEORGE
Foreign Operation Manager


CELL PHONE +229 998 087 33
emailaddress: ([email protected])

[Tim Atem]

Using the same email address [email protected] from the above emails and the same phone number +229-99808733

Header Analysis Quick Report
Originating IP: 41.216.50.141
Originating ISP: Opt Benin / Benin Telecom
City: n/a
Country of Origin: Benin
* For a complete report on this email header goto ipTRACKERonline

Delivered-To: <snipped>
Received: by 10.55.47.194 with SMTP id v185csp6386294qkh;
Tue, 29 Dec 2015 03:37:32 -0800 (PST)
X-Received: by 10.140.22.74 with SMTP id 68mr76712356qgm.87.1451389052913;
Tue, 29 Dec 2015 03:37:32 -0800 (PST)
Return-Path: <[email protected]>
Received: from if09-mail-fb06-mia.mta.terra.com (if09-mail-fb06-mia.mta.terra.com. [208.84.243.230])
by mx.google.com with ESMTP id s5si44606714qhc.29.2015.12.29.03.37.29;
Tue, 29 Dec 2015 03:37:32 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 208.84.243.230 as permitted sender) client-ip=208.84.243.230;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 208.84.243.230 as permitted sender) smtp.mailfrom=[email protected]
Received: from mail-smtp14-mia.tpn.terra.com (unknown [10.235.200.53])
by mail-fb06-mia.tpn.terra.com (Postfix) with ESMTP id F2FD88003F9E;
Tue, 29 Dec 2015 11:37:27 +0000 (UTC)
X-Terra-Karma: -2%
X-Terra-Hash: 14e30970a952e1be4ac2df0a988a3dc6
Received: from localhost (13k.terra.com [208.84.242.163])
(authenticated user soniarviajes!speedylm)
by mail-smtp14-mia.tpn.terra.com (Postfix) with ESMTPA id D3118C0011E9;
Tue, 29 Dec 2015 11:37:26 +0000 (UTC)
reply-to: [email protected]
date: Tue, 29 Dec 15 11:37:26 +0000
message-id: <[email protected]>
X-Priority: 3
x-msmail-priority: normal
importance: normal
priority: normal
subject: Attention My Dear
x-origin: 41.216.50.141
from: Mrs.Grace Small <[email protected]>
content-type: text/html; charset=utf-8
content-transfer-encoding: QUOTED-PRINTABLE
mime-version: 1.0
to:
X-CMAE-Score: 0

Attention My Dear

Your first payment of $5000.00 has been sent today via western union.You are advise to Contact western union office with your full information to enable them give you Sender Name, Question and Answer to pick up your First $5000 MTCN= (6368-406-063) sender name (Peggy Beise) For more information contact Mr. Frank Onyechi, Tele: +229-99808733 Email ([email protected]) he'll keep sending your payment until your total fund of 2.5M is Completed

Receiver's Name________
Address: ____________
Country: ____________
Phone Number: ________

Best Regard
Mrs.Grace Small