Be very careful

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Hello I'm New here! Joined: 01 Nov 2010 Posts: 1

To all whom it may concern.
We would like to confirm information from Danozo ( http://forum.419eater.com/forum/viewtopic.php?t=185679&highlight= ), posted on 419 Eater in Jun 11, 2010.
Be very careful, if you will contact with guy, who pretending to be a contractor for the Ministry of Finance in Iraq.
He said that his name is Ali, but we have many doubts, that it is his real name.
His email addresses Are: [email protected] , [email protected] and many others, similar to its.
Exclamation

Hello I'm New here! Joined: 03 Nov 2010 Posts: 1

What is this? I cannot understand the point?

Dave,

Posted: Fri Nov 05, 2010 12:23 am

Follow the link in the post, dave88.

Dominikpl, appears to be confirming that the email addresses in the link are, in fact, scammers. He was also kind enough to start another thread linking to the old one, in lieu of necroing a 5 month old thread. Wink

And welcome here, to both of you! Smile

(moved here from "Published")

Hello I'm New here! Joined: 09 Nov 2010 Posts: 7

Thank you so much Dominikpl for your post. I also have been contacted by this ALI guy with exactly the same email addresses you gave and the official-looking documents. I have to admit that I did believe him up until he sent me the final documents and asked for money which immediately raised a red flag because the documents just didn't seem right, and the way he wanted me to pay was also pretty suspicious. Luckily for me I have been involved in bids for a long time and so was able to spot the inconsistencies, and I have always learned that "too good to be true" deals are just that. Anyway, this guy has put a lot f time and effort into this that I wouldn't be surprised if people do fall for his scam! Again, as Dominikpl noted, be very careful and don't send or give this ALI guy any information or of course money. Again, some of the email addresses he uses are: [email protected] and [email protected]. The latter is a legitimate domain email address with a gov't extension and I have yet to figure out how he did that. Good luck guys, and always remember, IF IT'S TOO GOOD TO BE TRUE, IT IS!

Posted: Tue Nov 09, 2010 3:32 pm

If someone would post up the headers and scam emails from [email protected] and [email protected] we could get those domains closed down.

I can't see that they are legit domains, but we need some evidence of the fakery to get the registrars and hosts to close them down. Very Happy

http://www.mof-gov-iq-ar.com/

Quote:

Domain Name: MOF-GOV-IQ-AR.COM
Registrar: UK2 GROUP LTD.
Whois Server: whois.hostingservicesinc.net
Referral URL: http://www.resell.biz
Name Server: NS1.HOSTING2NV.COM
Name Server: NS3.HOSTING2NV.COM
Status: clientTransferProhibited
Updated Date: 23-feb-2010
Creation Date: 23-feb-2010
Expiration Date: 23-feb-2011

http://www.al-hahdiagroup.com/

Quote:

Domain Name: AL-HAHDIAGROUP.COM
Registrar: NETEARTH ONE, INC. DBA NETEARTH
Whois Server: whois.advancedregistrar.com
Referral URL: http://www.netearthone.com
Name Server: NS1.HOSTING2NV.COM
Name Server: NS3.HOSTING2NV.COM
Status: clientTransferProhibited
Updated Date: 13-feb-2010
Creation Date: 13-feb-2010
Expiration Date: 13-feb-2011

Hello I'm New here! Joined: 09 Nov 2010 Posts: 7

Their doesn't seem to be a consistent header. The 1st one I got was titled Attn:Mr. "my name" (DETAILS)‏. I have contacted the ministry he claims to represent and hope to get a reply soon. Maybe that would be proof enough. Do let me know if there's anything else I could provide to prevent this guy from screwing any more people.
Thnx.

Posted: Tue Nov 09, 2010 3:56 pm

prodg, we just need the header information from the emails the scammer(s) have sent you. What email program do you use? Gmail, yahoo, hotmail, etc? If we know that, we can help you get the headers to post up.

The look like this:

Quote:

Delivered-To: [email protected]
Received: by 10.42.219.7 with SMTP id hs7cs68110icb;
Tue, 9 Nov 2010 02:00:04 -0800 (PST)
Received: by 10.142.140.15 with SMTP id n15mr5989217wfd.247.1289296804238;
Tue, 09 Nov 2010 02:00:04 -0800 (PST)
Return-Path: <@yahoo.com>
Received: from web114703.mail.gq1.yahoo.com (web114703.mail.gq1.yahoo.com [98.136.183.130])
by mx.google.com with SMTP id u39si13260359wfc.117.2010.11.09.02.00.02;
Tue, 09 Nov 2010 02:00:03 -0800 (PST)
Received-SPF: pass (google.com: best guess record for domain of @yahoo.com designates 98.136.183.130 as permitted sender)
client-ip=98.136.183.130;
Authentication-Results: mx.google.com; spf=pass (google.com:
best guess record for domain of
@yahoo.com designates
98.136.183.130 as permitted sender) [email protected];
dkim=pass (test mode) [email protected]
Received: (qmail 49689 invoked by uid 60001); 9 Nov 2010 10:00:02 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=yahoo.com; s=s1024; t=1289296802; bh=i3dCDaH4RpkE8/Ma+v49zJ8EfwfzdiLbnef9A1Tq7Mo=; h=Message-ID:X-YMail-OSG:
Received:X-Mailer:Date:From:Subject:To:In-Reply-To:
Received: from [41.218.224.68] by web114703.mail.gq1.yahoo.com via HTTP; Tue, 09 Nov 2010 02:00:02 PST
X-Mailer: YahooMailClassic/11.4.9 YahooMailWebService/0.8.107.285259
Date: Tue, 9 Nov 2010 02:00:02 -0800 (PST)
From: <@yahoo.com>
Subject: Re: Sebastian is coming here this week!
To: [email protected]
In-Reply-To: <AANLkTi=BOOUOucfFsCcY1HuXfddM3hJ3pnTTEUdKOfer@
mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1925169578-1289296802=:49070"

You can edit out your email address, we just need the rest -- header and scam email. Wink

Hello I'm New here! Joined: 09 Nov 2010 Posts: 7

Oh, I see. I use hotmail, so if you can show me how I'd be glad to send the header. Thanks DoraTheExplorer.

Posted: Tue Nov 09, 2010 4:15 pm

For hotmail, I believe you can right click the message that you received then select "View Message Source." Do NOT open the message or right click the message from the reading pane while it's open. Copy the information that will appear on a new window.

But I see that there were some issues with that recently and someone posted up a workaround if you can't get clear headers from hotmail: http://forum.419eater.com/forum/viewtopic.php?t=177249

I don't use hotmail, so hopefully it will work for you. Very Happy

Hello I'm New here! Joined: 09 Nov 2010 Posts: 7

Here it is, I hope. It's large but I'm not an expert and wasn't sure what to remove and what to send:

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MDtTQ0w9Mg==
X-Message-Status: n
X-SID-PRA: AL HAHDIA CONTRACTING GROUP BAGHDAD, IRAQ <[email protected]>
X-AUTH-Result: NONE
X-Message-Info: JGTYoYF78jF7h34DMiowIZ4bJGqDbJ0bR7vQFr9bADDKjiZij8LlUYwXKgXUfd5oitNdfS0cmnpMxW9/e40R9EJLS8gxhUUQ
Received: from forwarded-smtp.ord.emailsrvr.com ([173.203.2.22]) by COL0-MC4-F7.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Tue, 9 Nov 2010 07:37:03 -0800
Received: from ord16.emailsrvr.com (store36a.mail.ord1a.rsapps.net [10.130.0.36])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by smtp27.gate.ord1a.emailsrvr.com (SMTP Server) with ESMTPS id 728DE130207
for <[email protected]>; Tue, 9 Nov 2010 10:37:04 -0500 (EST)
Received: by store36a.mail.ord1a (SMTP Server, from userid 5000)
id 5F66E28016E; Tue, 9 Nov 2010 10:37:04 -0500 (EST)
X-Sieve: Dovecot Sieve 0.1.15
Received: from smtp27.gate.ord1a.emailsrvr.com (smtp27.gate.ord1a.rsapps.net [10.130.4.27])
by store36a.mail.ord1a (SMTP Server) with ESMTP id 463AA280164
for <[email protected]>; Tue, 9 Nov 2010 10:37:04 -0500 (EST)
Received: from gate50.gate.dfw.mlsrvr.com (gate50.gate.dfw1a.rsapps.net [172.20.100.50])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by smtp27.gate.ord1a.emailsrvr.com (SMTP Server) with ESMTPS id 8A8D513025A
for <[email protected]>; Tue, 9 Nov 2010 10:37:03 -0500 (EST)
X-Orig-To: [email protected]
X-Virus-Scanned: OK
X-Spam-Flag: NO
X-Spam-Score: 0
X-Spam-Level:
X-Spam-Status: No, score=0 tagged_above=-100 required=6 tests=[none]
X-Connected-To: mx2
X-Originating-Ip: [72.20.33.49]
Received: from sta6h2.hosting2nv.com (plz.dont.ask2ask.com [72.20.33.49])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(No client certificate requested)
by gate50.gate.dfw.mlsrvr.com (SMTP Server) with ESMTPS id 68AA73D480C2
for <[email protected]>; Tue, 9 Nov 2010 10:36:32 -0500 (EST)
Received: from localhost ([127.0.0.1]:56427 helo=[72.20.33.49])
by sta6h2.hosting2nv.com with esmtpa (Exim 4.69)
(envelope-from <[email protected]>)
id 1PFpig-0002e1-IF
for [email protected]; Tue, 09 Nov 2010 15:02:46 +0000
Received: from 172.190.84.9 ([172.190.84.9])
(SquirrelMail authenticated user [email protected])
by 72.20.33.49 with HTTP;
Tue, 9 Nov 2010 18:02:46 +0300
Message-ID: <[email protected]>
In-Reply-To: <[email protected]>
References: <[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>
<[email protected]>
Date: Tue, 9 Nov 2010 18:02:46 +0300
Subject: RE:INFO

From: "AL HAHDIA CONTRACTING GROUP BAGHDAD, IRAQ" <[email protected]>
To: [email protected]
Reply-To: [email protected]
User-Agent: SquirrelMail/1.4.20
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Confirm-Reading-To: [email protected]
Disposition-Notification-To: [email protected]
X-Priority: 3 (Normal)
Importance: Normal
Return-Receipt-To: [email protected]
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - sta6h2.hosting2nv.com
X-AntiAbuse: Original Domain - securituff.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - al-hahdiagroup.com
X-Source:
X-Source-Args:
X-Source-Dir:
Return-Path: [email protected]
X-OriginalArrivalTime: 09 Nov 2010 15:37:04.0108 (UTC) FILETIME=[F57E0AC0:01CB8023]

Posted: Tue Nov 09, 2010 4:34 pm

Great! That's a good start! Now please post up the email showing the scam from this email address and then we might have something to work with to get the domain closed down.

Did you say you had contact with the mof-gov-iq-ar.com domain also?

I have to go run some errands now, but I will check this thread when I get back. Very Happy

Hello I'm New here! Joined: 09 Nov 2010 Posts: 7

This came from the following address: [email protected]:

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0xO0Q9MTtTQ0w9MQ==
X-Message-Status: n
X-SID-PRA: MINISTRY OF FINANCE BAGHDAD REPUBLIC OF IRAQ <[email protected]>
X-AUTH-Result: NONE
X-Message-Info: JGTYoYF78jHLZeylKBj4bF36YUvjjxEuxqrDaJCpMqzfeJDGjVa3E0UDQQ/d3UJKq3ptDQ4wRbA75lAdO5jhAmCRGRDjn6vN
Received: from forwarded-smtp.ord.emailsrvr.com ([173.203.2.22]) by SNT0-MC3-F7.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Tue, 9 Nov 2010 07:06:58 -0800
Received: from ord16.emailsrvr.com (store36a.mail.ord1a.rsapps.net [10.130.0.36])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by smtp18.gate.ord1a.emailsrvr.com (SMTP Server) with ESMTPS id DB2A02A8197
for <[email protected]>; Tue, 9 Nov 2010 10:06:57 -0500 (EST)
Received: by store36a.mail.ord1a (SMTP Server, from userid 5000)
id C88EF28016C; Tue, 9 Nov 2010 10:06:57 -0500 (EST)
X-Sieve: Dovecot Sieve 0.1.15
Delivered-To: [email protected]
Received: from smtp25.gate.ord1a.emailsrvr.com (smtp25.gate.ord1a.rsapps.net [10.130.4.25])
by store36a.mail.ord1a (SMTP Server) with ESMTP id B8B3F280164
for <[email protected]>; Tue, 9 Nov 2010 10:06:57 -0500 (EST)
Received: from gate49.gate.dfw.mlsrvr.com (gate49.gate.dfw1a.rsapps.net [172.20.100.49])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by smtp25.gate.ord1a.emailsrvr.com (SMTP Server) with ESMTPS id ACFC0300006
for <[email protected]>; Tue, 9 Nov 2010 10:06:57 -0500 (EST)
X-Orig-To: [email protected]
X-Virus-Scanned: OK
X-Spam-Flag: NO
X-Spam-Score: 0
X-Spam-Level:
X-Spam-Status: No, score=x tagged_above=-100 required=6 WHITELISTED tests=[]
X-Connected-To: mx2
X-Originating-Ip: [72.20.33.49]
Received: from sta6h2.hosting2nv.com (plz.dont.ask2ask.com [72.20.33.49])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(No client certificate requested)
by gate49.gate.dfw.mlsrvr.com (SMTP Server) with ESMTPS id 214D83AD02AC
for <[email protected]>; Tue, 9 Nov 2010 10:06:44 -0500 (EST)
Received: from mofgoviq by sta6h2.hosting2nv.com with local (Exim 4.69)
(envelope-from <[email protected]>)
id 1PFpFr-0007ql-3a
for [email protected]; Tue, 09 Nov 2010 14:32:59 +0000
To: [email protected]
X-Autorespond: RE: RFQ/SOLICITATION BID WIN NOTIFICATION FOR: e-Commerce COMPANY
MIME-Version: 1.0
X-Loop: [email protected]
Precedence: auto_reply
X-Precedence: auto_reply
From: ""MINISTRY OF FINANCE BAGHDAD REPUBLIC OF IRAQ"" <[email protected]>
Content-type: text/plain; charset=ansi_x3.110-1983
Subject: YOUR ENQUIRY/MESSAGE(S)
Message-Id: <[email protected]>
Date: Tue, 09 Nov 2010 14:32:59 +0000
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - sta6h2.hosting2nv.com
X-AntiAbuse: Original Domain - securituff.com
X-AntiAbuse: Originator/Caller UID/GID - [568 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - sta6h2.hosting2nv.com
X-Source: /usr/local/cpanel/bin/autorespond
X-Source-Args: /usr/local/cpanel/bin/autorespond [email protected] /home/mofgoviq/.autorespond
X-Source-Dir: /
Return-Path: [email protected]
X-OriginalArrivalTime: 09 Nov 2010 15:06:58.0173 (UTC) FILETIME=[C1123AD0:01CB801F]

Hello I'm New here! Joined: 09 Nov 2010 Posts: 7

Here's the first email I got from this guy. This is his opening email, and is followed up by many more if you entertain it.

> Date: Sun, 10 Oct 2010 12:52:22 +0300
> Subject: Re: FURTHER DETAILS
> From: [email protected]
> To: [email protected]
>
> Dear xxx,
>
> Thank you very much for your mail.
>
> It is very important you take out time to read through our detailed mail for a
> better understanding of how we can actualize this partnership for our mutual
> benefit.
>
> There is no problem regarding where you shall deem fit to secure supply once we
> are able to get the win to supply in your company favour.
>
> This is our first time is reaching out to a company outside of Iraq for work for
> out mutual benefit and we expect to establish a long term relationship with your
> company.
>
> There is a procedure is securing supply here and we shall step by step follow
> things to a final conclution meeting up all requirements .
>
> The units required will be determined by top officials after we must have met
> with them for purchase consideration of any information we receive from you.
>
>
> We do not have any contact with any producers as that will be your role to play
> as we are working as i had informed earlier to secure 100% payment before supply
> so that we shall have enough time to finalize with any manufacturer you may deem
> fit to order from once payment is secured.
>
> All Fund Release order document are signed at the Aquisition unit in Europe for
> contractors who are not able to be in Iraq due to the present situation.
>
> Do note also that several units of each of these machines are required and it is
> upon information on any or all that you provide that we shall use to present to
> the top officials at the Ministry for purchase consideration as they also will
> advise us on how you will adjust the price for us to make good profit as usualy
> done here.
>
>
> Do send us price information on :
>
> Metal Detectors
> Armored Vehicles
> Bomb Detectors
> X-ray Security System
>
>
>
> Specification/Model......,Price in USD including shipping cost delivery based on
> CIF Umm Quasr Port Iraq.USD$...........
>
> You can deem it fit to call Mr Abdulateef for direct clarifications on any area
> you do not understand.+88216 466 89 444.
>
> Our company has been in operation since 2001 and we are very sure of securing
> this project as long as we can be rest asured of your caoability to handle things
> on your side and we want to deal directly with the owner of this company as a
> matter of capability.
>
> We shall await to hear from you ASAP.
>
> Regards,
> Ali Faris
> --
> MR SAMEER ABDULATEEF HAMEED(CEO)
> AL HAHDIA CONTRACTING GROUP BAGHDAD, IRAQ
> Al-Mansur Street - 609/16/53 CENTRAL BAGHDAD,IRAQ
> TEL:96479008900/Sat:+88216 466 89 444
> EMAIL:
> [email protected]/[email protected]

Posted: Tue Nov 09, 2010 7:28 pm

I appreciate you taking the time to post those up. Now help me understand -- so I could explain to a hoster/registrar, what the scam is?

Usually we deal with 419 AFF scam and while I do believe this isn't legit, I need something to prove it is a scam to the hoster/registrar for them to take action in closing the domains down. And since these domains are email-only (no actual website showing the fraud/scam), I need to be able to prove it in the emails.

Google isn't helping me too much pull up any info on these scams. Confused

Hello I'm New here! Joined: 09 Nov 2010 Posts: 7

The first email I got, which I posted yesterday, says that this ALI guy (or whatever his real name is) represents a contracting company in Iraq who wants to participate in an upcoming bid for the ministry of finance, and lists all of the products that are required. He claims that the quantities are huge, and that we should act fast as to not miss this wonderful opportunity. That is the bait, and once you bite, just like any other well-thought scam, he attempts to build credibility and trust by having you communicate directly with the ministry through one of the fictitious emails he set up, and also by showing you how much he has already paid to ministry officials through legit-looking receipts with the ministry logo, signatures, and the works. As "negotiations" are under way, he will inform you that they bribed officials with up to $250K in kick backs, and another $25K in fees. He even arranges for the "CEO" of the company by the name of SAMEER ABDULATEEF HAMEED to give you a call. Same guy of course. The only thing is that although the CEO is supposed to be an Iraqi, he just happens to have a thick Indian/Pakistani accent and doesn't speak a word of Arabic! 1ST RED FLAG, at least for someone who has experience with middle easterners. After making you invest effort and time, one is likely to drop their guard, and that's when "the ministry" informs you that you won the bid, and the next step is to send an acceptance letter to the ministry along with a receipt for $11K that you should have already paid to a bank in Singapore: 2ND RED FLAG! Of course the assumption is that $11K is nothing compared to the millions you'll be making from this deal, and so I'm sure enough people would readily send the money.

Things started breaking down after I started asking too money questions for him to handle, and I know as someone who's been in business for a long time these are typical simple questions that any legit business or business man would be more than happy to answer, especially that there is supposedly so much at stake.

I'm sure for a crook like him, a couple of scams like that a month generating more than $20K is not a bad deal. Other than the email addresses we have, we also received detailed bank info including account no., beneficiary, etc. Hopefully this is enough information to work with to track this small time crook down. By the way here's the signature he uses in his emails:

Ali Faris
For:
MR SAMEER ABDULATEEF HAMEED(CEO)
AL HAHDIA CONTRACTING GROUP BAGHDAD, IRAQ
Al-Mansur Street - 609/16/53 CENTRAL BAGHDAD,IRAQ
TEL: 96479008900/Sat:+88216 466 89 444
EMAIL: [email protected]/[email protected]

DoraTheExplorer, thank you for your effort to make sure that people are safe from scammers and crooks, and I'd be glad to answer anymore questions you might have.

Hello I'm New here! Joined: 17 Mar 2013 Posts: 4

this guy is back.

now his name is Mr Hassooni

same satellite number used before +88216 466 89 444

the company that he uses for the scam is

Al-Mosamin Trading Group.
Sa'adoun Dist.107/St.35/No.6,Baghdad
TEL/FAX:964-1-7185533190
SAT:+88216 444 29169
Email:[email protected]/[email protected]

Same type of scam: a message from a fake Miniter of Finance in Iraq. The fake address is

MINISTRY OF FINANCE,BAGHDAD,IRAQ <[email protected]>

Posted: Sun Mar 17, 2013 10:35 am

No need to necro a thread that is three years old. Make a new one instead and post a link to the old thread in it.