Gloria Mackenzie [email protected]

Header Analysis Quick Report
Originating IP: 41.58.24.170
Originating ISP: Swiftng
City: Lagos
Country of Origin: Nigeria
* For a complete report on this email header goto ipTRACKERonline

Delivered-To: <snipped>
Received: by 10.107.143.18 with SMTP id r18csp1722219iod;
Sun, 2 Aug 2015 19:17:46 -0700 (PDT)
X-Received: by 10.152.120.198 with SMTP id le6mr14504218lab.38.1438568266321;
Sun, 02 Aug 2015 19:17:46 -0700 (PDT)
Return-Path: <[email protected]>
Received: from srv5.iggo.fi (srv5.iggo.fi. [212.68.16.22])
by mx.google.com with ESMTPS id cz4si10722105lac.110.2015.08.02.19.17.43
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sun, 02 Aug 2015 19:17:46 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 212.68.16.22 as permitted sender) client-ip=212.68.16.22;
Authentication-Results: mx.google.com;
spf=softfail (google.com: domain of transitioning [email protected] does not designate 212.68.16.22 as permitted sender) [email protected];
dmarc=fail (p=NONE dis=NONE) header.from=gmail.com
Received: from localhost ([::1]:59181 helo=srv5.iggo.fi)
by srv5.iggo.fi with esmtpa (Exim 4.82)
(envelope-from <[email protected]>)
id 1ZM5Js-0001x1-0L; Mon, 03 Aug 2015 05:17:40 +0300
Received: from 41.58.24.170 ([41.58.24.170])
(SquirrelMail authenticated user [email protected])
by srv5.iggo.fi with HTTP;
Mon, 3 Aug 2015 05:17:40 +0300
Message-ID: <[email protected]>
Date: Mon, 3 Aug 2015 05:17:40 +0300
Subject: its my pleasure to write you here.
From: "Gloria Mackenzie" <[email protected]>
Reply-To: [email protected]
User-Agent: SquirrelMail/1.5.2 [SVN]
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - srv5.iggo.fi
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - gmail.com
X-Get-Message-Sender-Via: srv5.iggo.fi: authenticated_id: [email protected]

I am Mrs. Gloria C. Mackenzie, the power-ball lottery winner and I have
donated $2,000,000.00 USD to you.

Delivered-To: <snipped>
Received: by 10.112.98.68 with SMTP id eg4csp2321700lbb;
Tue, 4 Aug 2015 05:53:05 -0700 (PDT)
X-Received: by 10.140.131.9 with SMTP id 9mr7025364qhd.44.1438692784905;
Tue, 04 Aug 2015 05:53:04 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mail-qg0-x242.google.com (mail-qg0-x242.google.com. [2607:f8b0:400d:c04::242])
by mx.google.com with ESMTPS id w36si1537752qgw.110.2015.08.04.05.53.03
for <<snipped>>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Tue, 04 Aug 2015 05:53:04 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 2607:f8b0:400d:c04::242 as permitted sender) client-ip=2607:f8b0:400d:c04::242;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 2607:f8b0:400d:c04::242 as permitted sender) [email protected];
dkim=pass [email protected];
dmarc=pass (p=NONE dis=NONE) header.from=gmail.com
Received: by mail-qg0-x242.google.com with SMTP id f45so536814qgd.3
for <<snipped>>; Tue, 04 Aug 2015 05:53:03 -0700 (PDT)
DKIM-Signature: <snipped>
MIME-Version: 1.0
X-Received: by 10.140.131.146 with SMTP id 140mr6986738qhd.90.1438692783890;
Tue, 04 Aug 2015 05:53:03 -0700 (PDT)
Received: by 10.140.94.1 with HTTP; Tue, 4 Aug 2015 05:53:03 -0700 (PDT)
In-Reply-To: <snipped>
References: <snipped>
Date: Tue, 4 Aug 2015 13:53:03 +0100
Message-ID: <CAMGdscDEEXsCEws6=0KBh_0grPfnGBpBqYDUNZoE0KPRZ6MyYQ@mail.gmail.com>
Subject: Re: its my pleasure to write you here.
From: Gloria Mackenzie <[email protected]>
To: <<snipped>>

My entire family is pleased to read your reply to us. I am Mrs. Gloria
C. Mackenzie i am a 84 years old Widow, and I am from Zephyr hills,
Florida, Moved to United Kingdom in July after i won my Power ball
Jackpot of $590,500.00 million in June 5, 2013, My jackpot was a gift
from God to me and my entire family has agreed to do the will of God.
I may not know you, but i believe if you were chosen by God to receive
my donation of 2,000,000 USD. You must be a God fearing individual, I
am a catholic, and i believe that Good things happen to those people
who wait and also believe.

I am very grateful to you for the interest shown in my plight and I
want to assure you that you will be greatly rewarded for what you have
chosen to do. Although we know each other for the first time but I
believe our father has directed me to you as I prayed and searched
over the internet for assistance because I saw your profile on a list
of registered email addresses provided to me by Microsoft list/Google
list from which I picked you.

Be assured you stand no risk as this is my money, for source and
verification please see the link below:

Please you can read more about me by Viewing this:
http://www.huffingtonpost.com/2013/06/0 ... 92040.html

I decided to donate Individuals and i told some Ministers about this
which they said was a welcome idea and promised they will get me a
list of some people who can help others with my donation and put smile
in the face of the needy, i decided to select myself by going to
Microsoft and Google to make a research.

I decided to elope to United Kingdom with my Son because of my poor
health been a cancer patient and ever since i won this lottery
different taxes have been fallen upon me and much are coming, my
pastor and my able minister's of God advice me to move to
United-Kingdom with my family rather than paying Tax each week.

My donation of $2,000,000 us dollars may not be much to you but i
believe it will go a long way to improving your standard of living
like my Power ball Jackpot did to me, I would like you to fill the
below and return back to me and my entire household will be glad for
you to visit us after my donation gets to you. Do this on time so you
can contact the payout bank for further directives to receive
donation,

Name:
Address:
Age:
Sex
Occupation:
Phone:

I do hope that you will be able to use the money wisely and
judiciously over there in your country. we will employ you to do what
you can to alleviate the level of poverty in your region and also try
to enhance the standard of living of as many people as you can because
that is the only objective of donating this money to you in the first
place.

May the Good lord bless your heart to be a blessing to your family and
your society as soon as my donation gets to you.

Best Wishes

Mrs. Gloria C Mackenzie

Gloria's "bank". The domain ctibnae.com is in the process of being reported for fraud.

Header Analysis Quick Report
Originating IP: 69.73.180.41
Originating ISP: Landis Holdings
City: Colorado Springs
Country of Origin: United States
* For a complete report on this email header goto ipTRACKERonline

Delivered-To: <snipped>
Received: by 10.112.98.68 with SMTP id eg4csp1071727lbb;
Thu, 6 Aug 2015 12:51:40 -0700 (PDT)
X-Received: by 10.170.61.208 with SMTP id d199mr3936966ykd.79.1438890699992;
Thu, 06 Aug 2015 12:51:39 -0700 (PDT)
Return-Path: <[email protected]>
Received: from birch.nocdirect.com (birch.nocdirect.com. [69.73.180.41])
by mx.google.com with ESMTPS id p62si2358676ywp.10.2015.08.06.12.51.38
for <<snipped>>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Thu, 06 Aug 2015 12:51:39 -0700 (PDT)
Received-SPF: neutral (google.com: 69.73.180.41 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=69.73.180.41;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 69.73.180.41 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected];
dkim=pass [email protected]
DKIM-Signature: <snipped>
Received: from localhost ([::1]:42251 helo=www.ctibnae.com)
by birch.nocdirect.com with esmtpa (Exim 4.85)
(envelope-from <[email protected]>)
id 1ZNRCT-001ONi-Fp
for <snipped>; Thu, 06 Aug 2015 15:51:37 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_d3fbec57d3ebd09bb98f78848fe23730"
Date: Thu, 06 Aug 2015 15:51:37 -0400
From: Account Dept Citibank <[email protected]>
To: <<snipped>>
Subject: Gloria Mackenzie
In-Reply-To: <snipped>
References: <snipped>
Message-ID: <[email protected]>
X-Sender: [email protected]
User-Agent: Roundcube Webmail/1.0.5
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - birch.nocdirect.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - ctibnae.com
X-Get-Message-Sender-Via: birch.nocdirect.com: authenticated_id: [email protected]
X-Source:
X-Source-Args:
X-Source-Dir:

Citibank UAE

P.O.Box: 749, Dubai, Sheikh Rashid Road,
Umm Hurair 2 Dubai, United Arab Emirates
E-mail: [email protected]
Tel: +971 557 927 332

UPGRADE ON OUR INTERNET BANKING.

Dated: 06- 08- 2015

To Whom It May Concern.

Attn:
Sir/Madam,

This is to acknowledge the receipt of your e-mail to us, requesting the release and transfer of your donation funds in our custody, amounted the sum of 2,000,000.00 (Two Million United States Dollars Only) Without wasting much of your time, we would want you to know that it is 100% possible to effect transfer of your donation funds into your nominated bank account, carrying out this transfer directly from our bank here in Dubai to your bank account in your country, it would required you to secured the Dubai Financial Services Authority (DFSA) International Fund Transfer Registration Clearance Certificate. This type of certificate would empower/enable us carry out the transfer of your donation funds swiftly into your designated bank account.

Without this sort of clearance documentation, transferring your donation funds from bank directly to your bank account would not be an easy one. First we would advise you to furnish us your full details to enable us apply for your International Fund Transfer Registration Clearance Certificate. and funds transfer approval documentation from Dubai Financial Services Authority (DFSA)

Below are the details required from you to enable us facilitate the process of transferring you donation funds swiftly.

Your Full Name:

Home address:

Mobile Telephone #:

Office/Fax Number:

Office Address:

Occupation:

Date Of Birth:

Attach scan copy of your International Passport for proper identification.

Upon receipt of your details as listed above, we would facilitate the procurement of beneficiary documentation which are to be signed properly by you as the beneficiary donation funds.

Your cooperation is highly required to enable is serve you more better.
Thank you for banking with Citibank UAE, Dubai.

Yours Sincerely,
Mr. Clarkson John.
Director International Transfer Unit (DITU)
Image result for Citibank E Banking
==============================================================
This is a confidential email and may also be privileged. If you are not the intended recipient, please inform us immediately. You are not allowed to copy or use it for any purpose nor disclose its contents to any other person Please note that there is a risk that information requested via email can be tampered with, by hackers while en route to your mailbox or seen by unauthenticated individuals if your mailbox security is inadequate Emails are your contribution towards a safer, cleaner environment. We thank you for contributing to the protection of our environment, do not print this mail.

Gloria's bank has a new website and email address, both in the process of being reported.

E-mails: [email protected] & [email protected]
Website: http://www.citbuae.com/uae-bn/eng/enteracct/

Header Analysis Quick Report
Originating IP: 69.73.181.112
Originating ISP: Landis Holdings
City: Colorado Springs
Country of Origin: United States
* For a complete report on this email header goto ipTRACKERonline

Delivered-To: <snipped>
Received: by 10.112.170.227 with SMTP id ap3csp1091302lbc;
Sun, 16 Aug 2015 20:16:57 -0700 (PDT)
X-Received: by 10.13.205.196 with SMTP id p187mr57657460ywd.119.1439781416876;
Sun, 16 Aug 2015 20:16:56 -0700 (PDT)
Return-Path: <[email protected]>
Received: from aspen.nocdirect.com (aspen.nocdirect.com. [69.73.181.112])
by mx.google.com with ESMTPS id t3si8094479ywd.120.2015.08.16.20.16.56
for <<snipped>>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sun, 16 Aug 2015 20:16:56 -0700 (PDT)
Received-SPF: neutral (google.com: 69.73.181.112 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=69.73.181.112;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 69.73.181.112 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected];
dkim=pass [email protected]
DKIM-Signature: <snipped>
Received: from localhost ([127.0.0.1]:52406 helo=citbuae.com)
by aspen.nocdirect.com with esmtpa (Exim 4.85)
(envelope-from <[email protected]>)
id 1ZRAuu-002X9k-9I
for <snipped>; Sun, 16 Aug 2015 23:16:56 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_a9f2ed02509d65ca77af08f519b225f3"
Date: Sun, 16 Aug 2015 23:16:56 -0400
From: Transfer Dept Citibank <[email protected]>
To: <snipped>
Subject: Attn:
Reply-To: [email protected]
Mail-Reply-To: [email protected]
Message-ID: <[email protected]>
X-Sender: [email protected]
User-Agent: Roundcube Webmail/1.0.5
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - aspen.nocdirect.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - citbuae.com
X-Get-Message-Sender-Via: aspen.nocdirect.com: authenticated_id: [email protected]
X-Source:
X-Source-Args:
X-Source-Dir:

Citibank UAE teknoworld teknoworld
P.O.Box: 749, Dubai, Sheikh Rashid Road,
Umm Hurair 2 Dubai, United Arab Emirates
E-mail: [email protected]
Tel: +971 557 927 332

UPGRADE ON OUR INTERNET BANKING .

Dated: 17- August - 2015

To Whom It May Concern.

Sir/Madam

Greeting to you today. We write you this few lines of e-mail to officially inform you that we have had attack over the week with hacker, for that reason our E-banking website was shutdown so as to protect customer's like you from losing there funds in our custody.
We are happy to inform you that the issue has been resolved and our security system is strong now. You should be rest accursed that your funds with us is safe and secured. You can now log into your online bank account with us using the same username and password. Non if your information was changed expect our login page. http://www.citbuae.com/uae-bn/eng/enteracct/

The details of your offshore online bank account is still the same.

Kindly follow the instruction and try as much as possible to log into your online bank account with us to confirm your available balance. You can change the password to your online bank account for security reasons. and to protect your account from internet hackers.
Please contact Citibank our full interactive self service Center on +971 557 927 332 for further assistance If you face any difficulties accessing your online bank account with us.

Thank you for choosing Citibank UAE, Dubai.

Yours Sincerely,
Mr. Clarkson John.
Director International Transfer Unit (DITU)
Image result for Citibank E Banking
==============================================================
This is a confidential email and may also be privileged. If you are not the intended recipient, please inform us immediately. You are not allowed to copy or use it for any purpose nor disclose its contents to any other person Please note that there is a risk that information requested via email can be tampered with, by hackers while en route to your mailbox or seen by unauthenticated individuals if your mailbox security is inadequate Emails are your contribution towards a safer, cleaner environment. We thank you for contributing to the protection of our environment, do not print this mail.

The domain citibnkgroup.org is in the process of being reported for fraud.

Header Analysis Quick Report
Originating IP: 2.49.239.220
Originating ISP: Emirates
City: Dubai
Country of Origin: United Arab Emirates
* For a complete report on this email header goto ipTRACKERonline

Delivered-To: <snipped>
Received: by 10.112.170.227 with SMTP id ap3csp2443933lbc;
Mon, 24 Aug 2015 10:28:06 -0700 (PDT)
X-Received: by 10.194.122.200 with SMTP id lu8mr40729150wjb.83.1440437285753;
Mon, 24 Aug 2015 10:28:05 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mail.pipni.cz (mail.pipni.cz. [2a00:1ed0:1:500::a005])
by mx.google.com with ESMTPS id fh2si22769369wic.121.2015.08.24.10.28.04
for <<snipped>>
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Mon, 24 Aug 2015 10:28:05 -0700 (PDT)
Received-SPF: neutral (google.com: 2a00:1ed0:1:500::a005 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=2a00:1ed0:1:500::a005;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 2a00:1ed0:1:500::a005 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected];
dkim=temperror (no key for signature) [email protected]
DKIM-Signature: <snipped>
Received: from mail.pipni.cz ([93.185.104.5] helo=citibnkgroup.org)
id 1ZTvXM-0003D7-71
for <snipped>; Mon, 24 Aug 2015 19:28:00 +0200
From: "Citibank Account Department" <[email protected]>
To: <<snipped>>
Subject: Re:
Date: Mon, 24 Aug 2015 18:28:00 +0100
Message-Id: <[email protected]>
X-OriginatingIP: 2.49.239.220 ([email protected])
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=OPENWEBMAIL_ATT_0.943863835043402"
X-pipni-MailScanner-ID: 1ZTvXM-0003D7-71
X-pipni-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details
X-pipni-MailScanner-SpamCheck: not spam (too large)
X-pipni-MailScanner-From: [email protected]

Citibank UAE

P.O.Box: 749, Dubai, Sheikh Rashid Road,
Umm Hurair 2 Dubai, United Arab Emirates
E-mail: [email protected]
Tel: +971 557 927 332

UPGRADE ON OUR INTERNET BANKING .

Dated: 24- August - 2015
To Whom It May Concern.

Sir.

Your e-mail has been received and the content well noted clearly. We are surprise you did not receive the documentation we sent to you via e-mail attachment which clear start how much you are suppose to pay and the purpose you are paying the fee. For some reason we have sent you e-mail which we believe you did not receive because we also get the same Company from Mrs. Gloria that you have sent us e-mails which did not reach us, We did tried calling you time without number with no lock. would you be so kind to send us your reachable telephone number for easy communications. Meanwhile we are re-sending you our official bank documentation that clearly states how much charges you are due to pay and the purpose you are paying the charges.

The charges should be sent to our official cashier via the fastest mean of money transfer world wide *Money Gram money transfer* using the details of our official cashier as listed below.

Name: Evelyn Obiageli Ajumuka

Address: 749, Dubai, Sheikh Rashid Road, Umm Hurair 2 Dubai, United Arab Emirates

Amount: US$ 996

Kindly send us a scan copy of your money gram transfer slip via e-mail attachment for proper confirmation. upon receipt of the required charges, we will quickly Validate your online bank account and then issue you the transfer Activation Code which you will need any time you want to effect swift wire transfer from our e-banking system while sited in front of your computer system.

I am waiting for your urgent answer to my e-mail.

Thank you.

Yours Sincerely,
Mr. Clarkson John.
Director International Transfer Unit (DITU)

More scam letter from the same scammer:

Dated: 12- June- 2016

To Whom It May Concern.

Attn: xxxxxxxxxxxxx

This is to acknowledge the receipt of your e-mail to us with the content well noted clearly. This Letter is to officially inform you that we are make every necessary arrangement to ensure full assistance in any area we can assist you in receiving your donation funds in our bank amounted US$ 2,000,000.00 (Two Million United States Dollars) Only

The US$ 50,000.00 (Fifty Thousand United States Dollars) Only that we are sending as a cashier chaque from our financially department are mat to be used in paying all the necessary taxis and fee holding your donation funds, This automatically means that once you receive the cashier charges from our financially department you are required to deposit the chaque with your bank for clearance and once the check is cleared you are to wire transfer the amount down to our office here in UAE, to enable us facilitate the process of taken care of all the charges holding your donation funds

As a matter of urgency we advice that you furnish us your full personal information and banking details as listed below.

Your Full Name:

Your Address:

Your Telephone:

Bank Name:

Bank Address:

Routing Number:

Account Number:

Bank Telephone Number:

Your International Passport copy or drivers license

Please note that you must have a bank account where the cashier check would be deposited int, you are advice to send the same bank account details along with you details as requested above.

Upon receipt of those details above, we will quickly proceed with our financially department to ensure the cashier chaque are sent to you on or before Monday. As soon as you confirm the receipt of the cashier chaque US$ 50,000.00 (Fifty Thousand United States Dollars) in your position we would then futher advice you on what next to to and how you should send back the US$ 50,000.00 (Fifty Thousand United States Dollars) to our office to enable clear the issue on your US$ 2,000,000.00 Donation funds.

In this matter we need your full cooperation in getting back to us as quickly as possible to enable us facilitate thing as soon as possible. In case you have any question Kindly contact us on our customer care Tel: +971 557 927 332

=============================================================
He uses a new scamming domain:

ctbae.com registry whois
Updated 1 second ago - Refresh
Domain Name: CTBAE.COM
Registrar: ENOM, INC.
Sponsoring Registrar IANA ID: 48
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Name Server: NS1-FRANKLIN.NSWEBHOST.COM
Name Server: NS2-FRANKLIN.NSWEBHOST.COM
Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Updated Date: 26-aug-2015
Creation Date: 26-aug-2015
Expiration Date: 26-aug-2016
ctbae.com registrar whois
Updated 1 second ago
Domain Name: CTBAE.COM
Registry Domain ID: 1955576477_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.enom.com
Registrar URL: www.enom.com
Updated Date: 2015-08-26T13:45:12.00Z
Creation Date: 2015-08-26T20:45:00.00Z
Registrar Registration Expiration Date: 2016-08-26T20:45:00.00Z
Registrar: ENOM, INC.
Registrar IANA ID: 48
Reseller: NAMECHEAP.COM
Domain Status: clientTransferProhibited https://www.icann.org/epp#clientTransferProhibited
Registry Registrant ID:
Registrant Name: WHOISGUARD PROTECTED
Registrant Organization: WHOISGUARD, INC.
Registrant Street: P.O. BOX 0823-03411
Registrant City: PANAMA
Registrant State/Province: PANAMA
Registrant Postal Code: 00000
Registrant Country: PA