Scam Tip Report #95498 - Congratulations: Winner.


Falcons-Fan
Lilburn, GA, United States
2019-04-18 01:05:34
Nigerian/419 Scam
+3 Congratulations: Winner. 
 Scammer Information
Email Address:
villa.toolz@mail.ru
Scam Website:
Fax:
Country of Scam:
United States (US)
This is an advanced fee scam...I also included the full headers. Law enforcement can get them by contacting Scamalot. Please read about the scam below....

DKIM: 'FAIL' with domain fixituae.com

Congratulations: Winner.

We are pleased to inform you that your e-mail address associated with the
ticket number: UKNLB4401 with the serial number 00811C drew the numbers
02-06-21-23-43-47 bonus number 29, which was successful for the sum of
***£950,000.00 GBP***.

Contact our payment officer.

Name: Mr. Eric Walters.
E-mail: ericwalters431@outlook.com

Mr. Shareef Emadi.
UK National Lottery.
Follow Ups/Extra Information. Most recent is listed first.
This is an advanced fee scam...I also included the full headers. Law enforcement can get them by contacting Scamalot. Please read about the scam below...
197.210.52.32 Scammer IP Block NIGERIA ISP MTN Nigeria Communication Limited
Dear Customer
Your account has been opened successful and credited with the total sum of £950,000 below are your account details. Account Name: Account no: 2050921007
You are advised to login via: www.westoakcredit.com to make electronics wire transfer to your personal bank account. NOTE: Your account number is your login details.
Login details: www.westoakcredit.com Login: 2050921007 Password: xxancisxxxane00x
If you have any difficulties you can contact us for help.
Thanks Best Regard Management. West Oak Credit

Scam Email
Subject: Attention
From: info <info@westoakcredit.com> delivered-to: @gmail.com
received: from [197.210.52.32] (port=53871 helo=[192.168.8.101]) by server121.web-hosting.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-S...
arc-seal: i=1; a=rsa-sha256; t=1556518169; cv=none; d=google.com; s=arc-20160816; b=x+6LZgXCm98rhLQVIdsChfzki5tMyKdQJ+ta9RQ4aZ...
arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:to:from:importance:subject:date:savedfr...
arc-authentication-results: i=1; mx.google.com; dkim=pass header.i=@westoakcredit.com header.s=default header.b=ET1RToSu; spf=neutral (google.com:...
return-path: <info@westoakcredit.com>
received-spf: neutral (google.com: 199.188.201.73 is neither permitted nor denied by best guess record for domain of info@westoakcredit.com) c...
authentication-results: mx.google.com; dkim=pass header.i=@westoakcredit.com header.s=default header.b=ET1RToSu; spf=neutral (google.com: 199....
message-id: <5cc69519.1c69fb81.5db8c.2b64SMTPIN_ADDED_MISSING@mx.google.com>
dkim-signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=westoakcredit.com; s=default; h=Content-Type:MIME-Version:To:From:Subject: Da...
savedfromemail: info@westoakcredit.com
date: Mon, 29 Apr 2019 07:09:28 +0100
importance: normal
mime-version: 1.0
content-type: multipart/alternative; boundary="--_com.samsung.android.email_4406766536037630"

Falcons-Fan   (Lilburn, GA, United States) Added the following extra information on :2019-04-29 18:26:26
 Scammer Information
Email Address:
info@westoakcredit.com
Scam Website:
Fax:
This is an advanced fee scam...I also included the full headers. Law enforcement can get them by contacting Scamalot. Please read about the scam below...
Dear , find in the attachment is your UK National Lottery winning certificate scan and save in computer.
Contact the bank with the following Bank email: info@westoakcredit.com
You are hereby advise to contact our paying bank WEST OAK CREDIT BANK for the payment of your lottery won fund of £950,000.00 with the stated information's below.
Full Name: Email: Phone number: Occupation: Date of Birth: Marital Status: Gender: House/Office Address:
Thanks and congratulations once more.
Mr. Eric Walters. UK National Lottery. ...

Scam Email
Subject: Re: To file a claim, fill out the form below.
From: Mr Eric Walters <ericwalters431@outlook.com> delivered-to: @gmail.com
received: from AM6PR10MB2374.EURPRD10.PROD.OUTLOOK.COM ([fe80::6847:f74b:7484:2fb0]) by AM6PR10MB2374.EURPRD10.PROD.OUTLOOK.COM ([fe80::68...
arc-seal: i=1; a=rsa-sha256; t=1556436054; cv=none; d=google.com; s=arc-20160816; b=YvHO4hc+5oZZSYSjXFkBm3bTF58w64/wQ/b8/l1OQu...
arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:content-language:accept-language:in-rep...
arc-authentication-results: i=1; mx.google.com; dkim=pass header.i=@outlook.com header.s=selector1 header.b=auaoP8j2; spf=pass (google.com: domain...
return-path: <ericwalters431@outlook.com>
received-spf: pass (google.com: domain of ericwalters431@outlook.com designates 40.92.68.31 as permitted sender) client-ip=40.92.68.31;
authentication-results: mx.google.com; dkim=pass header.i=@outlook.com header.s=selector1 header.b=auaoP8j2; spf=pass (google.com: domain of e...
dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-...
thread-topic: To file a claim, fill out the form below.
thread-index: AQHU+43cPjPMIarQxEO0jvjgrm4jyqZNKL4AgAQD6mk=
date: Sun, 28 Apr 2019 07:20:52 +0000
message-id: <AM6PR10MB2374F8896281CA36BB2C36A99D380@AM6PR10MB2374.EURPRD10.PROD.OUTLOOK.COM>
references: <CA+r8-Pbp+tYkm5HKER+hkOTB4KOa1rE4VSZjJmWhptCPQScfAQ@mail.gmail.com> <CA+r8-PbDutfd6c9bqLDN=zmp_6z62Y6qem_1JvMPdEAGEauaLw@mail.g...
in-reply-to: <CA+r8-PaLBYV6=hAjP6g_k7k=zMY++gV4zNZ=+5OC1_vfX6Ub_g@mail.gmail.com>
accept-language: en-US
content-language: en-US
content-type: multipart/mixed; boundary="_005_AM6PR10MB2374F8896281CA36BB2C36A99D380AM6PR10MB2374EURP_"
mime-version: 1.0

Falcons-Fan   (Lilburn, GA, United States) Added the following extra information on :2019-04-29 18:20:09
 Scammer Information
Scam Website:
Fax:
Hello! As for your received mail, I would like you to fill out the form below for the requirements of your won fund of £950,000.00 GBP.
To file a claim, fill out the form below.
Full Name:............ Contact Address: ...... Gender and Age: ............ Country:.............. Nationality:.......... Date of Birth:........ Mobile and Office Number: .....
Once again, congratulations on your victory.
Thank you and God bless. Mr. Eric Walters Agent UK National Lottery.
PLEASE READ THE WARNINGS AND HELPFUL INFORMATION BELOW....
Use BOTH Bing and Google to search email addresses and phone numbers so you won't get ripped off.
Never use Money Gram,Western Union,Ria to send a fee to strangers. Never buy an i-tunes card,Amazon card(s) or any gift cards to send to scammers.Never use bitcoin and send the wallet/address to scammers. If you do,it is gone for ever. If you must send the money (please don't), insist on Using direct bank transfer only. Send the money to a US,UK,Canada, or South Africa bank account only. You could get your money back by following the advice below.. If you send money to this scammer or to any scammer,please In the US... 1.first... file a police report 2. second... file a complaint at www.ic3.gov and include the case number of the police report in the UK... 1.first... file a police report 2. second... file a complaint at www.actionfraud.police.uk and include the case number of the police report

Scam Email
Subject: To file a claim, fill out the form below.
From: Mr Eric Walters <ericwalters431@outlook.com> delivered-to: @gmail.com
received: from DB7PR10MB2377.EURPRD10.PROD.OUTLOOK.COM ([fe80::d0ec:3cf1:8d5a:2a2e]) by DB7PR10MB2377.EURPRD10.PROD.OUTLOOK.COM ([fe80::d0...
arc-seal: i=1; a=rsa-sha256; t=1555550594; cv=none; d=google.com; s=arc-20160816; b=KiSPB/t+fpilo+nWqx+Bc+gqWuPjM1LvUtD6TXpwAt...
arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:content-language:accept-language:in-rep...
arc-authentication-results: i=1; mx.google.com; dkim=pass header.i=@outlook.com header.s=selector1 header.b=iYe5srPg; spf=pass (google.com: domain...
return-path: <ericwalters431@outlook.com>
received-spf: pass (google.com: domain of ericwalters431@outlook.com designates 40.92.69.57 as permitted sender) client-ip=40.92.69.57;
authentication-results: mx.google.com; dkim=pass header.i=@outlook.com header.s=selector1 header.b=iYe5srPg; spf=pass (google.com: domain of e...
dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-...
thread-topic: To file a claim, fill out the form below.
thread-index: AQHU9YVLc58OZzjIKku7iVRgz2aKHg==
date: Thu, 18 Apr 2019 01:23:13 +0000
message-id: <DB7PR10MB23778568532FA67BA3F081199D260@DB7PR10MB2377.EURPRD10.PROD.OUTLOOK.COM>
references: <955179d80ab8708c4fe9b0b2c79235a0.squirrel@fixituae.com>,<CANqK3KMBCqmCUmE3GOPADrgHiyF7q+r-K4Fe6j3qVyDkX5Or=w@mail.gmail.com>
in-reply-to: <CANqK3KMBCqmCUmE3GOPADrgHiyF7q+r-K4Fe6j3qVyDkX5Or=w@mail.gmail.com>
accept-language: en-US
content-language: en-US
content-type: multipart/alternative; boundary="_000_DB7PR10MB23778568532FA67BA3F081199D260DB7PR10MB2377EURP_"
mime-version: 1.0

Falcons-Fan   (Lilburn, GA, United States) Added the following extra information on :2019-04-18 01:27:25
 Scammer Information
Scam Website:
Fax:

 Got more information on this Scam/Scammer? Add to Scam Report
 Problems with this Report? Let us know Report to Scamalot

Ad Blocker Detected
Our website is made possible by displaying online advertisements to our visitors.
Please consider supporting us by disabling your ad blocker.
Thanks!
Scamdex
PING