Welcome to Orange Frog Productions Scams, Shams & Flim-Flams Section [Banner]

Search this site powered by FreeFind

Page Title:

Please be sure to read my Nigerian Scams Home Page

NOTE: All external links on this page open a new window.

Things I Did, Below

I, personally, receive email in HTML format. The following was received (and looked) like I received it. At the time, I was more interested in the message than the headers and do not have the original. This is a copy I forwarded to myself as I sent it to my father.

  • I removed my email addresses. These came to various accounts and some no longer exist. There are places on this site you can get hold of me if you wish or need to. They are protected from spambots using JavaScript, but all you have to do is click on them.
  • All scammer and related email addresses, and any actual website links have been changed, at least putting spaces into them. They appear as underlined blue links, though they aren't.
  • Any notes I added in the actual letter are in square brackets ("[" "]"), are bold, red in color, and highlighted. If what I found "behind the links" (email or website) are different than what was displayed, I will include them in this type of note.
  • All spelling, spacing, line-wrapping, and punctuation errors are the ones that appeared in the original received email. (I may or may not analyze some or all of these.)

Scam Example
Received October 23, 2007 and October 24, 2007

I received five (5) copies of this version of the Nigerian Scam with the same names and content in them on October 23, 2007 and October 24, 2007. I have included the brief email headers of each here, followed by the content of all five (5) emails (every one was exactly the same content), then the full headers of each, below.

Brief Headers

From: MR. Steven Williams [<-- Behind the name: stevenwilliams1856 @ yahoo.dk]
To: undisclosed-recipients:
Sent: Tuesday, October 23, 2007 9:20 AM [received 01:01PM]
Subject: Good News Contact Steven Williams Immediately

From: MR. Steven Williams  [<-- Behind the name: stevenwilliams1856 @ yahoo.dk]
To: undisclosed-recipients:
Sent: Tuesday, October 23, 2007 9:23 AM [received 01:04PM]
Subject: Good News Contact Steven Williams Immediately

From: MR. Steven Williams [<-- Behind the name: stevenwilliams03 @ yahoo.dk]
Sent: Wednesday, October 24, 2007 12:17 AM  [received 12:21AM]
Subject: Good News Contact Steven Williams Immediately

From: MR. Steven Williams [<-- Behind the name: stevenwilliams03 @ yahoo.dk]
Sent: Wednesday, October 24, 2007 1:07 AM  [received 01:07AM]
Subject: Good News Contact Steven Williams Immediately

From: MR. Steven Williams [<-- Behind the name: stevenwilliams03 @ yahoo.dk]
Sent: Wednesday, October 24, 2007 4:50 AM  [received 04:50AM]
Subject: Good News Contact Steven Williams Immediately

Email Content

Good News Contact Steven Williams Immediately

Dear Friend,

How are you today? Hope all is well with you and your family? I hope this
mail meets you in a perfect condition.

I am using thank you for your great effort to our unfinished transfer of
fund into your account due to one reason or the other best known to you.

But I want to inform you that I have uccessfully transferred the fund out
of my bank to someone else account who was capable of assisting me in this
great venture.

Due to your effort, sincerity, courage and trust worthiness you showed at
 the course of the transaction I want to compensate you and show my
gratitude to you with the sum of $1,000.000.00 (One Million United States
Dollars) I have authorized the finance house were I deposited my money to
issue you international certified bank draft cashable at your bank.

My dear friend I will like you to contact the finance house for the
collection of this international certified bank draft.

The name and contact address of the Person with your Cheque MR. Steven
williams is as follows.

MR. Steven Williams
Email: [10/23 emails:] steven_williams000 @ yahoo.dk
          [10/24 emails:] steven.williams111 @ yahoo.dk
Phone: [10/23 emails:] +234-80-80-211-706
          [10/24 emails:] +234-808-021-1706

At the moment, I'm very busy here because of the investment projects which
myself and my new partner are having at hand.Finally, remember that I have
forwarded instruction to the finance house on your behalf to send the bank
draft to you as soon as you contact them without delay.

Please I will like you to accept this token with good faith as this is
from the bottom of my heart.

Thanks and God bless you and your family.

Hope to hear from you soon.

Best Regards,
PAUL SMITH.

[NOTE: I left names, email addresses, and phone numbers in here for the search engines to find. DO NOT TRY TO CONTACT THEM! I'm SURE you will be ripped off! -LE]

Email Headers

This section contains the full email headers of each of the five (5) emails I received over the two (2) day period of October 23 and October 24, 2007.

Received October 23, 2007 at 01:01PM

[DO NOT send email to any of the following email addresses]

X-Message-Delivery: Vj0zLjQuMDt1cz0wO2k9MDtsPTA7YT0w
X-Message-Status: n:0
X-SID-PRA: MR. Steven Williams <stevenwilliams1856 @ yahoo.dk>
X-Message-Info: 6sSXyD95QpXVW3/ktgcX1evZ2GGhi2bNe [space added] QDfeIipbIpGDhWO1lZFnBgdv22euX5bhFs9iZJZ7qrbfuJwoeucCw==
Received: from outbound-mail-09.bluehost.com ([69.89.17.209]) by bay0-mc2-f21.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
Tue, 23 Oct 2007 10:01:25 -0700
Received: (qmail 30004 invoked by uid 0); 23 Oct 2007 17:01:25 -0000
Received: from unknown (HELO host50.hostmonster.com) (74.220.203.50)
by mailproxy1.bluehost.com with SMTP; 23 Oct 2007 17:01:25 -0000
Received: from localhost ([127.0.0.1])
by host50.hostmonster.com with esmtpa (Exim 4.68)
(envelope-from <stevenwilliams1856 @ yahoo.dk>)
id 1IkN82-0005Hz-C4; Tue, 23 Oct 2007 11:01:18 -0600
Received: from 41.219.241.135 ([41.219.241.135]) by letterpresschicago.com
(Horde MIME library) with HTTP; Tue, 23 Oct 2007 07:20:26 -0600
Message-ID: <20071023072026.x80as8kx6ogc84kw @ letterpresschicago.com>
Date: Tue, 23 Oct 2007 07:20:26 -0600
From: "MR. Steven Williams" <stevenwilliams1856 @ yahoo.dk>
Reply-to: stevenwilliams1856 @ yahoo.dk
To: undisclosed-recipients:;
Subject: Good News Contact Steven Williams Immediately
MIME-Version: 1.0
Content-Type: text/plain;
charset=ISO-8859-1;
DelSp="Yes";
format="flowed"
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
User-Agent: Internet Messaging Program (IMP) H3 (4.1.3)
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - host50.hostmonster.com
X-AntiAbuse: Original Domain - hotmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - yahoo.dk
Return-Path: stevenwilliams1856 @ yahoo.dk
X-OriginalArrivalTime: 23 Oct 2007 17:01:25.0597 (UTC) FILETIME=[589C38D0:01C81596]

Received October 23, 2007 at 01:04PM

[DO NOT send email to any of the following email addresses]

X-Message-Delivery: Vj0zLjQuMDt1cz0wO2k9MDtsPTA7YT0w
X-Message-Status: n:0
X-SID-PRA: MR. Steven Williams <stevenwilliams1856 @ yahoo.dk>
X-Message-Info: 6sSXyD95QpWuzzwn+NZkn349aHw54J5emYn[space added] S0bKP3nUCzgH3oLac2p3S/pTFh6NSDqkVUVHOBAko+nTwDiQjsg==
Received: from outbound-mail-25.bluehost.com ([69.89.21.20]) by bay0-mc8-f9.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
Tue, 23 Oct 2007 10:04:55 -0700
Received: (qmail 1835 invoked by uid 0); 23 Oct 2007 17:04:55 -0000
Received: from unknown (HELO host50.hostmonster.com) (74.220.203.50)
by mailproxy2.bluehost.com with SMTP; 23 Oct 2007 17:04:55 -0000
Received: from localhost ([127.0.0.1])
by host50.hostmonster.com with esmtpa (Exim 4.68)
(envelope-from <stevenwilliams1856 @ yahoo.dk>)
id 1IkNBT-0005q4-7U; Tue, 23 Oct 2007 11:04:51 -0600
Received: from 41.219.241.135 ([41.219.241.135]) by letterpresschicago.com
(Horde MIME library) with HTTP; Tue, 23 Oct 2007 07:23:57 -0600
Message-ID: <20071023072357.41pvqllsg80k80go @ letterpresschicago.com>
Date: Tue, 23 Oct 2007 07:23:57 -0600
From: "MR. Steven Williams" <stevenwilliams1856 @ yahoo.dk>
Reply-to: stevenwilliams1856 @ yahoo.dk
To: undisclosed-recipients:;
Subject: Good News Contact Steven Williams Immediately
MIME-Version: 1.0
Content-Type: text/plain;
charset=ISO-8859-1;
DelSp="Yes";
format="flowed"
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
User-Agent: Internet Messaging Program (IMP) H3 (4.1.3)
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - host50.hostmonster.com
X-AntiAbuse: Original Domain - hotmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - yahoo.dk
Return-Path: stevenwilliams1856 @ yahoo.dk
X-OriginalArrivalTime: 23 Oct 2007 17:04:55.0944 (UTC) FILETIME=[D5FCA080:01C81596]

Received October 24, 2007 at 12:21AM

[DO NOT send email to any of the following email addresses]

X-Message-Delivery: Vj0zLjQuMDt1cz0wO2k9MDtsPTA7YT0w
X-Message-Status: n:0
X-SID-PRA: MR. Steven Williams <steven_williams03 @ yahoo.dk>
X-Message-Info: 7qBLIdTf0bmuDOHp7yXsO5NJQCLY53f/ [space added] U1rnmiAzdlnX8yVM85b2pZTqGvkKd5L/i1RsGP0692ZVa1aLy0rrIw==
Received: from NOC1-Gige02.ipSecureNetwork.com ([208.98.1.32]) by bay0-mc8-f6.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
Tue, 23 Oct 2007 21:21:52 -0700
Received: from [127.0.0.1] (helo=west-domains.com ident=IPSN)
by NOC1-Gige02.ipSecureNetwork.com with esmtpa (Exim 4.68 (FreeBSD))
(envelope-from <steven_williams03 @ yahoo.dk>)
id 1IkXgU-0009P7-Bb; Wed, 24 Oct 2007 01:17:34 -0300
Received: from 41.219.216.32 ([41.219.216.32])
(SquirrelMail authenticated user buscadores @ west-domains.com)
by west-domains.com with HTTP;
Wed, 24 Oct 2007 01:17:34 -0300 (ART)
Message-ID: <1298.41.219.216.32.1193199454.squirrel @ west-domains.com>
Date: Wed, 24 Oct 2007 01:17:34 -0300 (ART)
Subject: Good News Contact Steven Williams Immediately
From: "MR. Steven Williams" <steven_williams03 @ yahoo.dk>
Reply-To: steven_williams111 @ yahoo.dk
User-Agent: SquirrelMail/1.4.9a
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - NOC1-Gige02.ipSecureNetwork.com
X-AntiAbuse: Original Domain - hotmail.com
X-AntiAbuse: Originator/Caller UID/GID - [26 6] / [26 6]
X-AntiAbuse: Sender Address Domain - yahoo.dk
Bcc:
Return-Path: steven_williams03 @ yahoo.dk
X-OriginalArrivalTime: 24 Oct 2007 04:21:52.0726 (UTC) FILETIME=[6779B760:01C815F5]

Received October 24, 2007 at 01:07AM

[DO NOT send email to any of the following email addresses]

X-Message-Delivery: Vj0zLjQuMDt1cz0wO2k9MDtsPTA7YT0w
X-Message-Status: n:0
X-SID-PRA: MR. Steven Williams <steven_williams03 @ yahoo.dk>
X-Message-Info: 7qBLIdTf0bmFdiL8mUtO85gHAp+/2bqgvg+[space added] vB8kgjgWLL1xdBXKlba0JIo2AEJH0nzVOWkVkg05gaRfIKWZ4Dw==
Received: from NOC1-Gige02.ipSecureNetwork.com ([208.98.1.32]) by bay0-mc7-f13.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
Tue, 23 Oct 2007 22:07:48 -0700
Received: from [127.0.0.1] (helo=west-domains.com ident=IPSN)
by NOC1-Gige02.ipSecureNetwork.com with esmtpa (Exim 4.68 (FreeBSD))
(envelope-from <steven_williams03 @ yahoo.dk>)
id 1IkYSR-000Fcu-Qj; Wed, 24 Oct 2007 02:07:07 -0300
Received: from 41.219.213.19 ([41.219.213.19])
(SquirrelMail authenticated user buscadores @ west-domains.com)
by west-domains.com with HTTP;
Wed, 24 Oct 2007 02:07:07 -0300 (ART)
Message-ID: <1179.41.219.213.19.1193202427.squirrel @ west-domains.com>
Date: Wed, 24 Oct 2007 02:07:07 -0300 (ART)
Subject: Good News Contact Steven Williams Immediately
From: "MR. Steven Williams" <steven_williams03 @ yahoo.dk>
Reply-To: steven_williams111 @ yahoo.dk
User-Agent: SquirrelMail/1.4.9a
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - NOC1-Gige02.ipSecureNetwork.com
X-AntiAbuse: Original Domain - hotmail.com
X-AntiAbuse: Originator/Caller UID/GID - [26 6] / [26 6]
X-AntiAbuse: Sender Address Domain - yahoo.dk
Bcc:
Return-Path: steven_williams03 @ yahoo.dk
X-OriginalArrivalTime: 24 Oct 2007 05:07:48.0358 (UTC) FILETIME=[D1F5CA60:01C815FB]

Received October 24, 2007 at 04:50AM

[DO NOT send email to any of the following email addresses]

X-Message-Delivery: Vj0zLjQuMDt1cz0wO2k9MDtsPTA7YT0w
X-Message-Status: n:0
X-SID-PRA: MR. Steven Williams <steven_williams03 @ yahoo.dk>
X-Message-Info: 7qBLIdTf0bkXOdNphUCtzlRH4GNn3rMptbi [space added] NIXaZ4Crf3A32Hp8LQkUBk4753P2UAw4xFiVN1ZMTvQZvhTeLFQ==
Received: from NOC1-Gige02.ipSecureNetwork.com ([208.98.1.32]) by bay0-mc8-f6.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
Wed, 24 Oct 2007 01:50:38 -0700
Received: from [127.0.0.1] (helo=west-domains.com ident=IPSN)
by NOC1-Gige02.ipSecureNetwork.com with esmtpa (Exim 4.68 (FreeBSD))
(envelope-from <steven_williams03 @ yahoo.dk>)
id 1IkbwK-000ADW-Tg; Wed, 24 Oct 2007 05:50:13 -0300
Received: from 41.219.245.125 ([41.219.245.125])
(SquirrelMail authenticated user buscadores @ west-domains.com)
by west-domains.com with HTTP;
Wed, 24 Oct 2007 05:50:12 -0300 (ART)
Message-ID: <1296.41.219.245.125.1193215812.squirrel @ west-domains.com>
Date: Wed, 24 Oct 2007 05:50:12 -0300 (ART)
Subject: Good News Contact Steven Williams Immediately
From: "MR. Steven Williams" <steven_williams03 @ yahoo.dk>
Reply-To: steven_williams111 @ yahoo.dk
User-Agent: SquirrelMail/1.4.9a
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - NOC1-Gige02.ipSecureNetwork.com
X-AntiAbuse: Original Domain - hotmail.com
X-AntiAbuse: Originator/Caller UID/GID - [26 6] / [26 6]
X-AntiAbuse: Sender Address Domain - yahoo.dk
Bcc:
Return-Path: steven_williams03 @ yahoo.dk
X-OriginalArrivalTime: 24 Oct 2007 08:50:38.0655 (UTC) FILETIME=[F34734F0:01C8161A]

Notes

Problems I see:

  • Obvious (to me, anyway) errors:
    • Why in the hell would I get FIVE DIFFERENT EMAILS to Undisclosed-Recipient lists (or blank - which infers it was sent to a mailing list).
    • from the email, itself:
      • Various spelling, grammar, and spacing errors.
      • I have NEVER even replied to any of these emails. So how can we have "unfinished transfer" of anything anywhere?
      • This email was (supposedly) SENT from Steven Williams. Why did Paul Smith "sign" it? ... And why is the email in the third person, as if Paul Smith wrote it? Shouldn't it be first person with a note that the info was provided by Paul Smith?
    • from the Email Headers:
      • I always have a problem with people who should have business email addresses sending them from FREE email services like Yahoo and Hotmail.
      • Denmark? (yahoo.dk?) My uncle has been to Denmark, but I have never emailed any Denmark email address...
      • I also have problems when emails that appear to be written specifically to me do NOT have my name in them, nor do they have one of my email addresses in the TO.
        • Why would Mr Williams or Mr Smith send the email to a MAILING LIST, if he wanted to "compensate" me for the "effort, sincerity, courage and trust worthiness [I] showed at the course of the transaction...?"
      • 41.219.241.135, 41.219.241.135, 41.219.216.32, 41.219.213.19, and 41.219.245.125 are ALL from Lagos, Nigeria.
        • I don't trust ANY email (or website) from Nigeria, for obvious reasons. (Check out the name of this page!)
        • If the email is actually FROM Nigeria
          • Why would the email ADDRESS be from and to Denmark? or
          • Why would someone with a Denmark email address be sending the email from Nigeria?

Send comments/questions about this page to Bill Sanders at:

Return to OFPv2/SSFF - Scams - TYPE Scam Home page

| Home | Main | Owner | Scams, Shams & More Flim-Flams | Glossary | Sitemap | Contact |

Send email to Bill Sanders ()
with questions or comments about this page or site.

This site, all text and graphics (unless otherwise noted) on it
were designed, developed and published by Bill Sanders of Orange Frog Productions.
It and it's CSS was validated and complies with both the: CSS and HTML 4.01 validators from W3C.
NOTE: All CSS validates except the "New Window Buttons" which include some invalid code (ie: hacks),
added PicoSearch Tables, and warnings for using transparent backgrounds when color foregrounds defined.
Copyright © 2003, 2004, 2005, 2006, 2007 by Bill Sanders / Full site last modified: October 21, 2006
Any reproduction, printing, or selling of this content is prohibited without express written consent from William D. Sanders.
ctr