Weird Lad mail with an Irish angle

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Thu Apr 26, 2012 1:04 am

Hey guys I was going through the 300+ strong lad mail mountain in my inbox and I came across this. I thought it was odd for a few reasons that hope some of you can shed some light on as I'm a bit baffled by the whole mail plus it's the first one I've seen with the Irish angle.

The name it's from is different from the name in the mail. Is this just a silly lad mistake or what? If he's Irish why is using two Spanish names? I have forgotten how to pin point IP's in that mess of numbers so is he in Ireland?

Lastly, I remember if we got a big list in the CC we could forward it somewhere. Anybody enlighten me on who to send it to. Cheers ^_^

Received: by 10.182.53.101 with SMTP id a5csp16817obp;
Thu, 19 Apr 2012 05:23:00 -0700 (PDT)
Received: by 10.180.94.161 with SMTP id dd1mr4789241wib.16.1334838179895;
Thu, 19 Apr 2012 05:22:59 -0700 (PDT)
Return-Path: <[email protected]>
Received: from nm6.bullet.mail.ukl.yahoo.com (nm6.bullet.mail.ukl.yahoo.com. [217.146.182.227])
by mx.google.com with SMTP id s65si2121563weq.63.2012.04.19.05.22.59;
Thu, 19 Apr 2012 05:22:59 -0700 (PDT)
Received-SPF: neutral (google.com: 217.146.182.227 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=217.146.182.227;
Authentication-Results: mx.google.com; spf=neutral (google.com: 217.146.182.227 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Received: from [217.146.183.214] by nm6.bullet.mail.ukl.yahoo.com with NNFMP; 19 Apr 2012 12:22:59 -0000
Received: from [217.146.183.165] by tm7.bullet.mail.ukl.yahoo.com with NNFMP; 19 Apr 2012 12:22:59 -0000
Received: from [127.0.0.1] by omp1006.mail.ukl.yahoo.com with NNFMP; 19 Apr 2012 12:22:59 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
X-Yahoo-Forwarded: from
Return-Path: <[email protected]>
X-YahooFilteredBulk: 146.83.195.21
X-Originating-IP: [146.83.195.21]
Authentication-Results: mta1034.mail.ukl.yahoo.com from=alumnos.ubiobio.cl; domainkeys=neutral (no sig); from=alumnos.ubiobio.cl; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO relay.ubiobio.cl) (146.83.195.21)
by mta1034.mail.ukl.yahoo.com with SMTP; Thu, 19 Apr 2012 12:22:57 +0000
Received: from localhost (localhost.localdomain [127.0.0.1])
by forward.ubiobio.cl (Postfix) with ESMTP id D585791E6FC;
Thu, 19 Apr 2012 09:22:53 -0300 (CLST)
X-Virus-Scanned: Checked using amavisd-new at antivirus.dci.ubiobio.cl
Received: from alumnos.ubiobio.cl ([146.83.195.27])
by localhost (antivirus.dci.ubiobio.cl [146.83.195.21]) (amavisd-new, port 10024)
with ESMTP id 3v5k5dIpHrfi; Thu, 19 Apr 2012 09:22:52 -0300 (CLST)
Received: by alumnos.ubiobio.cl (Postfix, from userid 33)
id 9E51A802E81; Thu, 19 Apr 2012 09:22:09 -0300 (CLST)
Received: from 41.203.64.134 ([41.203.64.134]) by alumnos.ubiobio.cl (Horde
MIME library) with HTTP; Thu, 19 Apr 2012 09:22:06 -0300
Message-ID: <[email protected]>

Date: Thu, 19 Apr 2012 09:22:06 -0300
From: Victor Andres Quintana Aedo <[email protected]>
Reply-to: [email protected]
Cc: <huge contact list snipped>
Subject:

My name is Mr.Gil Cesar, I am a senior partner in the Technical Advisory Board
of Allied Irish Bank Group(Senior Security Specialist). We are conducting a
standard process investigation on behalf of "AIB Group”, the International
Banking conglomerate.

This investigation involves a client who shares the same surname with you and
also the circumstances surrounding investments made by this client at "AIB
Group”, the Private Banking arm of Allied Irish Bank.

The client died in testate and nominated no successor in title over the
investments made with the bank. would respectfully request that you keep the
contents of this mail private and respect the integrity of the information you
come by as a result of this mail.

I contact you independently of our investigation and no one is informed of this
communication. I would like to intimate you with certain facts that I believe
would be of interest to you. You share similar details to the late fellow; I
am prepared to place you in a position to instruct the firm to release the
deposit to you as the closest surviving relation. Upon receipt of the deposit,
I am prepared to share the money with you, that is, I will simply nominate you
as the next of kin and have them release the deposit to you. We share the
proceeds 60/40.
I would have gone ahead to ask the funds be released to me, but that would have
drawn a straight line to me and my involvement in claiming the deposit. But on
the other hand, you with the same very name as the depositor's would easily
pass as the beneficiary with right to claim. I assure you that I could have
the deposit released to you within few working days.

I am aware of the consequences of this proposal. I ask that if you find no
interest in this project that you should discard this mail. I ask that you do
not be vindictive and destructive. If my offer is of no appeal to you, delete
this message and forget I ever contacted you. Do not destroy my career because
you do not approve of my proposal. You may not know this but people like
myself who have made tidy sums out of comparable situations run the whole
private banking
sector.

I am not a criminal and what I do, I do not find against good conscience, this
may be hard for you to understand, but the dynamics of my industry dictates
that I make this move. Such opportunities only come ones in a lifetime. I
cannot let this chance pass me by, for once, I have found myself in total
control of my destiny. These chances won't pass me by. I ask that you do not
destroy my chance, if you will not work with me let me know and let me move on
with my life but do not destroy me.

I have family and this is an opportunity to provide them with new opportunities.
There is a reward for this project and it is a task well worth undertaking. I
have evaluated the risks and the only risk I have here is from you refusing to
work with me. I am the only one who knows of this situation, good fortune has
blessed you with a name that has planted you into the center of relevance in
my life.

Lets share the blessing. If you find yourself able to work with me, contact
me.If you give me positive signals,I will initiate this process towards a
conclusion.

I send you this mail not without a measure of fear as to what the consequences,
but I know within me that nothing ventured is nothing gained and that success
and riches never come easy or on a platter of gold.

This is the one truth I have learned from my private banking clients. Do not
betray my confidence. If we can be of one accord, we should plan a meeting
soon.

Kind regards,
Mr.Gil Cesar
Email:[email protected]

Posted: Thu Apr 26, 2012 1:32 am

Hi Fanny! I am very happy to see the more "mature" members of 419Eater, please post more. Your lad is from Lagos.

ipTRACKERonline.com wrote:

Header Analysis Quick Report
Originating IP: 41.203.64.134
Originating ISP: Globacom Ltd
City: Lagos
Country of Origin: Nigeria
* For a complete report on this email header goto ipTRACKERonline

Posted: Thu Apr 26, 2012 5:48 am

Despite the wordiness, it is a standard Next-of-Kin scam:

Quote:

This investigation involves a client who shares the same surname with you .... The client died in testate and nominated no successor in title over the investments .... I am prepared to place you in a position to instruct the firm to release the deposit to you as the closest surviving relation.

The lad had to select some bank to pretend to represent, and just happened to choose the Allied Irish Bank - probably just a random bank he found on the internet, and which seemed 'foreign' enough for his targets.

The 'from' address may have been obtained by phishing, or may belong to someone he knows, or it may be forged. He doesn't want anyone replying there, anyway - the reply-to Hotmail address is the one he wishes to use, and the name in that matches the fake banker name in the email.

Regarding cc-lists - the cc-ed recipients will probably be receiving as many scam mails as your own catcher account, and most people probably ignore all of them. There's no way of telling if any of these people will respond and stay believing the lad. It could even be confusing to many people to receive a scam warning, when they haven't replied to any scam mails. Therefore, it is no longer usual to warn people who have merely received a first script/introductory scam mail. If, however, you discover that a 'deeper into the scam' email contains victim's details, then that information should certainly be forwarded to a mod.

Posted: Thu Apr 26, 2012 6:32 pm

[URL=http://scamwarners.com/main/v.php?id=12306Secure form jpg.jpg][IMG]http://scamwarners.com/main//guestupload/12306Secure form jpg.jpg[/IMG][/URL]

We have a big problem with money laundering, begorrah. Allied Irish like all banks must take big precautions or the bosses all go to jail (I wish)

PM me with your address so I can send you this special five page Irish Govt security form, your lad will find it most helpful Twisted Evil

By the way, I don't speak Irish, I think the heading means Citizens' Advice Bureau or similar

Posted: Fri Apr 27, 2012 7:33 am

Hi all,

I'm a total newb and I don't feel ready to bait yet, but I speak Irish fluently, so if you need anything translated to or from Irish, let me know.
After all, being of the AIB, they *should* know some Gaeilge, should't they? Twisted Evil

Posted: Fri Apr 27, 2012 10:50 am

Ignore Victor Quintana. That's someone in a Chilean school whose account was cracked to send the email.

Send the list of CCed recipients to a mod. She'll pass it on to someone at Scamwarners who will notify everyone that it's a scam. If the mail has not been read in a day or two, resend it to another mod.