Has someone offered you a huge sum of money or a valuable consignment? It's a 419 or advance fee fraud - find out how they work, and what to do to be safe.
#273247 by ampman Sat Oct 31, 2015 5:32 pm
An email from their CFO - where does it come from?

Delivered-To: [email protected]
Received: by with SMTP id uk3csp509723lbb;
Sat, 31 Oct 2015 13:00:30 -0700 (PDT)
X-Received: by with SMTP id gm19mr17282255wjc.0.1446321630514;
Sat, 31 Oct 2015 13:00:30 -0700 (PDT)
Return-Path: <[email protected]>
Received: from ct11.fastbighost.net (ct11.fastbighost.net. [])
by mx.google.com with ESMTPS id v6si17284864wju.65.2015.
for <[email protected]>
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Sat, 31 Oct 2015 13:00:30 -0700 (PDT)
Received-SPF: neutral (google.com: is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=;
Authentication-Results: mx.google.com;
spf=neutral (google.com: is neither permitted nor denied by best guess record for domain of [email protected]) [email protected];
dkim=temperror (no key for signature) [email protected]
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=alghurairinvestment.com; s=default;
h=Content-Transfer-Encoding:Content-Type:MIME-Version:To:From:Subject:Date:References:In-Reply-To:Message-ID; bh=qeWS4mmIdV1YZWa4eginqdMjgBgvO7prP+b0e4KHPps=;
Received: from localhost ([]:39105 helo=alghurairinvestment.com)
by ct11.fastbighost.net with esmtpa (Exim 4.85)
(envelope-from <[email protected]>)
id 1ZscJX-0002ct-Oo
for [email protected]; Sat, 31 Oct 2015 19:59:47 +0000
Received: from ([])
(SquirrelMail authenticated user [email protected])
by alghurairinvestment.com with HTTP;
Sat, 31 Oct 2015 23:59:47 +0400
Message-ID: <[email protected]m>
<[email protected]om>
<[email protected]om>
Date: Sat, 31 Oct 2015 23:59:47 +0400
Subject: Re: M.Saif - inquiry
From: [email protected]
To: "XXXX XXXXXXXXXXX" <[email protected]>
User-Agent: SquirrelMail/1.5.2 [SVN]
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - ct11.fastbighost.net
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - alghurairinvestment.com
X-Get-Message-Sender-Via: ct11.fastbighost.net: authenticated_id: [email protected]


He is authorized to discuss and we already have an existing contract with
you, which Bellshill insurance is to underwrite your bond.

I handed over the application from the insurance to Saif to email you, and
the fees are legitimate fees, which is mandatory on applying for the
surety bond.

So, kindly proceed, as we have a time line to close your deal before we
shut down funding for the year.

Khalid Sani
Chief Financial Officer
Al Ghurair Investment
Dubai, UAE
Tel: +971 558 469 630
Fax: +97 143-332-8438

On Sat, October 31, 2015 11:16 pm, XXXX XXXXXXXXXXX wrote:
> Sir,
> Excuse my intrusion. I was communicating with a certain M.Saif - email
> M.
> Saif <[email protected]> - regarding a loan of XXXXX USD.
> I'd like to verify with you is all that is real and not a scam. The
> reason for me to suspect scam is the required surety bond, the application
> of which requires an upfront application fee.
> Thank you for a quick reply on this important issue of possible fraud.

#273248 by Bryon Williams Sat Oct 31, 2015 5:41 pm
It is a scam. Once you it is a scam stop all contact. Do not educate the scammer. Any advance fee for a loan is a scam.

Scammers location:
Originating IP:
Originating ISP: Globacom Ltd
City: Lagos
Country of Origin: Nigeria

Please contacta moferatorstor if you have a question or information about this post.

Please do not tell the scammer he is posted here.

Please remember the fallen. https://www.odmp.org/
#273282 by ampman Sun Nov 01, 2015 4:55 am
Another nd associated Fraudster website

Helmut Platzer
Bellshill Insurance Services
12b Thorniewood Road
Uddingston, Glasgow
Lanarkshire, G71 5QQ
Phone: +44-704 571 9175
+44 141 628 7718
Fax: +44-709 286 7040
Website: http://bellshillinsuranceservice.co.uk

Bellshill Insurance <[email protected]> is originated from Lagos, Nigeria. Same IP address as Alghurairinvestment.com

ipTRACKERonline.com wrote:Header Analysis Quick Report<br>Originating IP:<br>Originating ISP: Globacom Ltd<br> City: Lagos<br>Country of Origin: Nigeria<br>* For a complete report on this email header goto ipTRACKERonline
#273313 by AlanJones Sun Nov 01, 2015 8:45 am
From alghurairinvestment.com

Al-Ghurair Investment
The Gate, East Wing
P.O. Box 72888 Dubai, United Arab Emirates

Email: [email protected]

TelFax: +971-433328438
CFO: +971-527796117

From the WhoIs for alghurairinvestment.com:
Creation Date: 19-feb-2014
Expiration Date: 19-feb-2016

Registrant Name: FAYAD HABIB
Registrant Organization:
Registrant City: DUBAI
Registrant State/Province: DUBAI
Registrant Postal Code: 50037
Registrant Country: AE
Registrant Phone: +971.522342337
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: [email protected]

Phone number +97 143-332-8438 is associated with another fake website in the name of "Arabian Investments Group" arabiainvestmentsgroups.com.

From the website bellshillinsuranceservice.co.uk:
Bellshill Insurance Services

Office Address
12b Thorniewood Road
Uddingston, Glasgow
Lanarkshire, G71 5QQ
Office: +44 141 628 7718
Bond Department: +44-704 571 9175
Fax: +44-709 286 7040
Email: [email protected]
Legal Deparment: [email protected]
Manager: [email protected]
Bond procurement: [email protected]

Bellshill Insurance Services. Registered in England and Wales. Authorised and regulated by the Financial Services Authority (FSA) on 14/01/2005 with Ref No: 308473.

Bellshill Insurance Services is a real company, whose identity has been stolen by the scammers. The FCA register details their real contact details (different phone numbers) and has no website listed for them.

There is also no registered person named Helmut Platzer listed as a registered person.

From the WhoIs for bellshillinsuranceservice.co.uk:
Domain name:


Registrant type:
UK Individual

Registrant's address:
12b Thorniewood Road
G71 5QQ
United Kingdom

Data validation:
Nominet was not able to match the registrant's name and/or address against a 3rd party source on 21-Jan-2014

eNom, Inc. [Tag = ENOM]
URL: http://www.enom.com

Relevant dates:
Registered on: 21-Jan-2014
Expiry date: 21-Jan-2016
Last updated: 20-Jan-2015

Registration status:
Registered until expiry date.

Name servers:

Please do not tell scammers that they are listed here - it will take them seconds to change their fake details and their new details will not be listed for any future victims to find.

Who is online

Users browsing this forum: No registered users and 26 guests