Al Ghurair Investment - [email protected]

An email from their CFO - where does it come from?

Delivered-To: [email protected]
Received: by 10.112.150.195 with SMTP id uk3csp509723lbb;
Sat, 31 Oct 2015 13:00:30 -0700 (PDT)
X-Received: by 10.194.190.19 with SMTP id gm19mr17282255wjc.0.1446321630514;
Sat, 31 Oct 2015 13:00:30 -0700 (PDT)
Return-Path: <[email protected]>
Received: from ct11.fastbighost.net (ct11.fastbighost.net. [195.191.24.151])
by mx.google.com with ESMTPS id v6si17284864wju.65.2015.10.31.13.00.30
for <[email protected]>
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Sat, 31 Oct 2015 13:00:30 -0700 (PDT)
Received-SPF: neutral (google.com: 195.191.24.151 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=195.191.24.151;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 195.191.24.151 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected];
dkim=temperror (no key for signature) [email protected]
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=alghurairinvestment.com; s=default;
h=Content-Transfer-Encoding:Content-Type:MIME-Version:To:From:Subject:Date:References:In-Reply-To:Message-ID; bh=qeWS4mmIdV1YZWa4eginqdMjgBgvO7prP+b0e4KHPps=;
b=lcP8mO4zh886EK1OG49IlL3eYpHsvmcmWKDx9vDcf8MO5K/prZlL12XrN/WdyvHOv66eRvfkaPZiME9ye9ewf+KGJK+wpBhFCm1ZnrmuhkczgKmY9HgNHZL3GzIWqY5N65WyY4gVmoSDwMNrMnrM1V/qPOikE8aS3laYr/7sBh2iEbnqdXXHlBc614O/wuZMJMZP+JwbzSb+wde9Un/9fKUhmCGVhhwfGLeDbj0jZTfmyvR9fHXJVf52fJ85raGehodYt6XAFuwr7vhOoLrUpdTu0uZnteTv5JvqJrha88Sz6NNlYsxLHXL550HTgQl3S8XkHeq0l1BpJWofTKaE4w==;
Received: from localhost ([127.0.0.1]:39105 helo=alghurairinvestment.com)
by ct11.fastbighost.net with esmtpa (Exim 4.85)
(envelope-from <[email protected]>)
id 1ZscJX-0002ct-Oo
for [email protected]; Sat, 31 Oct 2015 19:59:47 +0000
Received: from 197.211.53.29 ([197.211.53.29])
(SquirrelMail authenticated user [email protected])
by alghurairinvestment.com with HTTP;
Sat, 31 Oct 2015 23:59:47 +0400
Message-ID: <8fbc205aded86a847259f0117df2ff9a.squirrel@alghurairinvestment.com>
In-Reply-To:
<CAH-ugKZo6wJF1JeaKJ2qvE6JKPMvXrsT3wuA34vfE-wnQt=g7Q@mail.gmail.com>
References:
<CAH-ugKZo6wJF1JeaKJ2qvE6JKPMvXrsT3wuA34vfE-wnQt=g7Q@mail.gmail.com>
Date: Sat, 31 Oct 2015 23:59:47 +0400
Subject: Re: M.Saif - inquiry
From: [email protected]
To: "XXXX XXXXXXXXXXX" <[email protected]>
User-Agent: SquirrelMail/1.5.2 [SVN]
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - ct11.fastbighost.net
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - alghurairinvestment.com
X-Get-Message-Sender-Via: ct11.fastbighost.net: authenticated_id: [email protected]
X-Source:
X-Source-Args:
X-Source-Dir:

Mr. XXXXXXXXXXX,


He is authorized to discuss and we already have an existing contract with
you, which Bellshill insurance is to underwrite your bond.

I handed over the application from the insurance to Saif to email you, and
the fees are legitimate fees, which is mandatory on applying for the
surety bond.

So, kindly proceed, as we have a time line to close your deal before we
shut down funding for the year.


--
Khalid Sani
Chief Financial Officer
Al Ghurair Investment
Dubai, UAE
Tel: +971 558 469 630
Fax: +97 143-332-8438



On Sat, October 31, 2015 11:16 pm, XXXX XXXXXXXXXXX wrote:
> Sir,
>
>
> Excuse my intrusion. I was communicating with a certain M.Saif - email
> M.
> Saif <[email protected]> - regarding a loan of XXXXX USD.
>
> I'd like to verify with you is all that is real and not a scam. The
> reason for me to suspect scam is the required surety bond, the application
> of which requires an upfront application fee.
>
> Thank you for a quick reply on this important issue of possible fraud.

It is a scam. Once you it is a scam stop all contact. Do not educate the scammer. Any advance fee for a loan is a scam.

Scammers location:

Originating IP: 197.211.53.29
Originating ISP: Globacom Ltd
City: Lagos
Country of Origin: Nigeria

Another nd associated Fraudster website

Helmut Platzer
Bellshill Insurance Services
12b Thorniewood Road
Uddingston, Glasgow
Lanarkshire, G71 5QQ
Phone: +44-704 571 9175
+44 141 628 7718
Fax: +44-709 286 7040
Website: http://bellshillinsuranceservice.co.uk

Bellshill Insurance <[email protected]> is originated from Lagos, Nigeria. Same IP address as Alghurairinvestment.com

Header Analysis Quick Report<br>Originating IP: 197.211.53.29<br>Originating ISP: Globacom Ltd<br> City: Lagos<br>Country of Origin: Nigeria<br>* For a complete report on this email header goto ipTRACKERonline

[AlanJones]

From alghurairinvestment.com

Al-Ghurair Investment
The Gate, East Wing
P.O. Box 72888 Dubai, United Arab Emirates

Email: [email protected]

TelFax: +971-433328438
CFO: +971-527796117

From the WhoIs for alghurairinvestment.com:

Creation Date: 19-feb-2014
Expiration Date: 19-feb-2016

Registrant Name: FAYAD HABIB
Registrant Organization:
Registrant Street: OFFICE 4, 8TH FLOOR, THE GATE FINANCIAL HOUSE
Registrant City: DUBAI
Registrant State/Province: DUBAI
Registrant Postal Code: 50037
Registrant Country: AE
Registrant Phone: +971.522342337
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: [email protected]

Phone number +97 143-332-8438 is associated with another fake website in the name of "Arabian Investments Group" arabiainvestmentsgroups.com.

From the website bellshillinsuranceservice.co.uk:

Bellshill Insurance Services

Office Address
12b Thorniewood Road
Uddingston, Glasgow
Lanarkshire, G71 5QQ
Office: +44 141 628 7718
Bond Department: +44-704 571 9175
Fax: +44-709 286 7040
Email: [email protected]
Legal Deparment: [email protected]
Manager: [email protected]
Bond procurement: [email protected]

Bellshill Insurance Services. Registered in England and Wales. Authorised and regulated by the Financial Services Authority (FSA) on 14/01/2005 with Ref No: 308473.

Bellshill Insurance Services is a real company, whose identity has been stolen by the scammers. The FCA register details their real contact details (different phone numbers) and has no website listed for them.

There is also no registered person named Helmut Platzer listed as a registered person.

From the WhoIs for bellshillinsuranceservice.co.uk:

Domain name:
bellshillinsuranceservice.co.uk

Registrant:
Bellshill

Registrant type:
UK Individual

Registrant's address:
12b Thorniewood Road
Uddingston
Glasgow
G71 5QQ
United Kingdom

Data validation:
Nominet was not able to match the registrant's name and/or address against a 3rd party source on 21-Jan-2014

Registrar:
eNom, Inc. [Tag = ENOM]
URL: http://www.enom.com

Relevant dates:
Registered on: 21-Jan-2014
Expiry date: 21-Jan-2016
Last updated: 20-Jan-2015

Registration status:
Registered until expiry date.

Name servers:
dns.hostony.com
dns.hostony.org

Associated scammer, who asked for an application fee for a surety bond:

Helmut Platzer
Bellshill Insurance Services
12b Thorniewood Road
Uddingston, Glasgow
Lanarkshire, G71 5QQ
Phone: +44-704 571 9175
+44 141 628 7718
Fax: +44-709 286 7040
Website: http://bellshillinsuranceservice.co.uk

His emails come from Lagos, Nigeria too.