UPFRONT MONEY FRAUD

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Hello I'm New here! Joined: 14 Nov 2015 Posts: 2

EMAIL HEADER SEND TO ME:
Delivered-To: POST EDITED TO REMOVE EMAIL ADDY OF THE POSTER - TDG
Received: by 10.25.16.211 with SMTP id 80csp472109lfq;
Fri, 7 Jul 2017 12:32:24 -0700 (PDT)
X-Received: by 10.107.18.140 with SMTP id 12mr26684321ios.119.1499455944607;
Fri, 07 Jul 2017 12:32:24 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1499455944; cv=none;
d=google.com; s=arc-20160816;
b=JYPWAlarYrBWk0CPDNMD1KwQ/rzwRSUkn9gab4DL5W/+1sCn+LEuvkPNtCbb+O5UMM
JfCsSJ2+xWw0KK4x6AwEnVFSgXmWKXDqTDyHK8vGV6tpQdhN//uAvYUw1QOJABKDjOh2
FDYNOjJ5Mv8AcGgG33UdGJtpy4xJl6yXH4QFyC4U8f9No6/UxkKZYnMp78Am3izhBDHP
n19pHR/b4QLApmRj73LaIVqvgNwC9mJ40IthfByOVfWon/d1xCBLV92pmeOqHnrPoEwa
OgAeuURW14EOdpdrvvLQIHLgt4wJ6zRXxmIlmNOc95aXZ5ecr6IxgDD+01weANhJ1Yei
hzPA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=mime-version:spamdiagnosticmetadata:spamdiagnosticoutput
:content-language:accept-language:message-id:date:thread-index
:thread-topic:subject:to:from:arc-authentication-results;
bh=oSR00CNz+35+iaYV637D6/3eRLohLOf09KKM7DYC8U0=;
b=eMXWqEIo0Xb82icgYyCL4fP2YYwO2nmj0hOLJQG8Ei1DU0/YQ6TR1w4FklW+DchSRF
YoTB3Cvq5dDq3H/JlqWYtP1y3er3IapqK19SD53pvF/dsLZDZMjILo46mPTdTiWILnzu
5wsa+wrCRGRAHj5nsAH6RazCcmhojwU1ooFdybOaRKl3C78kc0DhEgf+i+dDf+qR5L8W
4rPscJoIjXvnQAOjaTNmmkODImtR3hGu0NPY3C0b3+5pPLFHrsnuxcsYDH+DBkaBEA8t
uxjA26TPXKz8p4VraFOkQ5PdMCIgwsTkuth/bHuGPlpNNlHUUg4zOclD9Zw41Iq4XLPF
vNTQ==
ARC-Authentication-Results: i=1; mx.google.com;
spf=pass (google.com: domain of [email protected] designates 40.107.67.138 as permitted sender) [email protected]
Return-Path: <[email protected]>
Received: from CAN01-TO1-obe.outbound.protection.outlook.com (mail-eopbgr670138.outbound.protection.outlook.com. [40.107.67.138])
by mx.google.com with ESMTPS id v202si257543itc.92.2017.07.07.12.32.24
for <[email protected]>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128);
Fri, 07 Jul 2017 12:32:24 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 40.107.67.138 as permitted sender) client-ip=40.107.67.138;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 40.107.67.138 as permitted sender) [email protected]
Received: from YTOPR01MB0266.CANPRD01.PROD.OUTLOOK.COM (10.166.151.26) by YTOPR01MB0266.CANPRD01.PROD.OUTLOOK.COM (10.166.151.26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1240.13; Fri, 7 Jul 2017 19:32:23 +0000
Received: from YTOPR01MB0266.CANPRD01.PROD.OUTLOOK.COM ([10.166.151.26]) by YTOPR01MB0266.CANPRD01.PROD.OUTLOOK.COM ([10.166.151.26]) with mapi id 15.01.1240.013; Fri, 7 Jul 2017 19:32:22 +0000
From: Rex Bailey <[email protected]>
To: "[email protected]" <[email protected]>
Subject: Money Market Account Application
Thread-Topic: Money Market Account Application
Thread-Index: AQHS91ceVuQELiFL80KybqRfn2rYGA==
Date: Fri, 7 Jul 2017 19:32:22 +0000
Message-ID: <YTOPR01MB0266A90DACD13611C441DE87B4AA0@YTOPR01MB0266.CANPRD01.PROD.OUTLOOK.COM>
Accept-Language: en-CA, en-US
Content-Language: en-CA
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=rbcmoneymarkets.com;
x-originating-ip: [199.119.233.168]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1;YTOPR01MB0266;7:csbQmONw4VkC0T0KeIXnJLBYf1tyKNKY2HQZe2CxpLXs1j5dWNh/D/UZDTzsqkv89/haLPhFeD/HkzZz1gAbshdU9ujd70S6qBNHP+puc5kbEeDCNT/xVRhDV++WEoExouoBNnvqcA48Uqm3BxWBfLoqztTXXqBszs6x/zlan6OPh4aJ5OK9X1qaQZVUniBpoKKKX54c24HV0lzLAzwJ7JFsw4TCURmX5H+3w0yi5q2p08jY+fYHV9CXxKQgMC7bIyrcYKjiyVayau6klG8ocIZFwtLFzSQPD7x2Oih2nAh4OjgzOQlMmaqVL6qIXFgUFEENVECg6jcqyLA6AF6kU+ef8nOafcGXKNmZZygwQMcCDH0pMbcnOWzTYZNeQLuQyfb0n9jw3JwbYzOIdrUqzhrISaEabthLlkMd5UBBjksL9c2aqFV/VfgZ0dC9a4mK3ttZ4R66FuZ4hcNZm/MMwC97pZGLNmZDb5vnL1Jkz7A7Iylp39j7ciwHEjnkqBfQrtEZ3tT/OOwHLf75LStHDwHB5n5PCy0/mI8Gf+0F5uRbWQFwG++iIOfGA+NLcCR0PHlt+1f/FSjKPj5gSpV9RTP3WaBadR0zGtAZdsta4EEGIRDqad1Mp67MkYB9L9I9QmWa2uDkkeR0gjJYoIH6ORkyikIDtKuGUV9LkGHwNOg4JSRMduNmJ9riXHabHgAgWgBmCJF/hX97IavAtBA3fvbQNE7KlhDJn2N/158WyIF0JD4VbqTzQLdQNA0amYMHLFp+mJHCsgJP+HZ8+LesUx4SodNXNN5rqwz2IPKKqXA=
x-ms-office365-filtering-correlation-id: 4e47d7cf-9feb-41da-253f-08d4c56ee3da
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(2017030254075)(300000503095)(300135400095)(2017052603031)(49563074)(201703131423075)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095);SRVR:YTOPR01MB0266;
x-ms-traffictypediagnostic: YTOPR01MB0266:
x-microsoft-antispam-prvs: <YTOPR01MB0266ED1F64874A22BB196740B4AA0@YTOPR01MB0266.CANPRD01.PROD.OUTLOOK.COM>
x-exchange-antispam-report-test: UriScan:(236129657087228)(92977632026198);
x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(102415395)(6040450)(2401047)(5005006)(8121501046)(3002001)(100000703101)(100105400095)(10201501046)(93006095)(93001095)(6041248)(6059035)(2016111802025)(16040078)(20161123558100)(201703131423075)(201703011903075)(201703061421075)(201703151056150)(201703061814153)(20161123562025)(20161123560025)(20161123564025)(20161123555025)(16043105)(6072148)(6043046)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:YTOPR01MB0266;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:YTOPR01MB0266;
x-forefront-prvs: 0361212EA8
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(6009001)(39450400003)(39410400002)(39830400002)(448600002)(5640700003)(53936002)(110136004)(14454004)(9686003)(39060400002)(3480700004)(3846002)(6506006)(102836003)(6116002)(15650500001)(25786009)(8936002)(8676002)(81166006)(7736002)(54356999)(2906002)(50986999)(38480400004)(3660700001)(2501003)(38600400001)(6606003)(38500400001)(77096006)(99936001)(6916009)(586005)(558084003)(33656002)(2900100001)(38610400001)(1411001)(66066001)(189998001)(74316002)(2351001)(86362001)(6436002)(54896002)(55016002)(7696004)(3280700002)(5660300001)(19627405001);DIR:OUT;SFP:1102;SCL:1;SRVR:YTOPR01MB0266;H:YTOPR01MB0266.CANPRD01.PROD.OUTLOOK.COM;FPR:;SPF:None;MLV:ovrnspm;PTR:InfoNoRecords;LANG:en;
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/mixed; boundary="_005_YTOPR01MB0266A90DACD13611C441DE87B4AA0YTOPR01MB0266CANP_"
MIME-Version: 1.0
X-OriginatorOrg: rbcmoneymarkets.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Jul 2017 19:32:22.3479 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 23d1460c-493d-434e-9673-c24284ea5345
X-MS-Exchange-Transport-CrossTenantHeadersStamped: YTOPR01MB0266

--_005_YTOPR01MB0266A90DACD13611C441DE87B4AA0YTOPR01MB0266CANP_
Content-Type: multipart/alternative; boundary="_000_YTOPR01MB0266A90DACD13611C441DE87B4AA0YTOPR01MB0266CANP_"

--_000_YTOPR01MB0266A90DACD13611C441DE87B4AA0YTOPR01MB0266CANP_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Dear Mr. Khelil

I had sent this application and instruction to open a money market account =
with us via a personal email. I was just directed to pass the documents to =
you through my official email. You may reply to this email at all times.

Rex Bailey

[email protected]

--_000_YTOPR01MB0266A90DACD13611C441DE87B4AA0YTOPR01MB0266CANP_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<style type=3D"text/css" style=3D"display:none;"></style>
</head>
<body dir=3D"ltr">
<div id=3D"divtagdefaultwrapper" style=3D"font-size:12pt;color:#000000;font=
-family:Calibri,Helvetica,sans-serif;" dir=3D"ltr">
<p>Dear Mr. Khelil</p>
<p>I had sent this application and instruction to open a money market accou=
nt with us via a personal email. I was just directed to pass the documents =
to you through my official email. You may reply to this email at all times.=
</p>
<p>Rex Bailey</p>
<p>[email protected]</p>
</div>
</body>
</html>

--_000_YTOPR01MB0266A90DACD13611C441DE87B4AA0YTOPR01MB0266CANP_--
--_005_YTOPR01MB0266A90DACD13611C441DE87B4AA0YTOPR01MB0266CANP_
Content-Type: application/pdf; name="Account Information(Opening) Khelil.pdf"
Content-Description: Account Information(Opening) Khelil.pdf
Content-Disposition: attachment; filename="Account Information(Opening) Khelil.pdf"; size=43649; creation-date="Fri, 07 Jul 2017 19:27:49 GMT"; modification-date="Fri, 07 Jul 2017 19:27:49 GMT"
Content-Transfer-Encoding: base64

--_005_YTOPR01MB0266A90DACD13611C441DE87B4AA0YTOPR01MB0266CANP_
Content-Type: application/pdf; name="file-633558.pdf"
Content-Description: file-633558.pdf
Content-Disposition: attachment; filename="file-633558.pdf"; size=166954; creation-date="Fri, 07 Jul 2017 19:28:05 GMT"; modification-date="Fri, 07 Jul 2017 19:28:05 GMT"
Content-Transfer-Encoding: base64

--_005_YTOPR01MB0266A90DACD13611C441DE87B4AA0YTOPR01MB0266CANP_--
=============== END OF HEADER =================
Email of ; REX BAILY; [email protected]
----
This person is working together with another one as scams in trying to let you believe that you have got a fund at the RBC Bank in Canada. Will ask you to fill at RBC Ban Account Application , just down loaded fro the real RBC home page.
----
This team of SCAMS are usign this home page there will redirect you to the REal 'RBC (Royal Bank fo Canada) to let your believe that is genius home page.
They are using thsi home page Domain :
-----
Domain Name: rbcmoneymarkets.com
Registrar URL: http://www.godaddy.com
Registrant Name: Rex Bailey
Registrant Organization:
Name Server: NS03.DOMAINCONTROL.COM
Name Server: NS04.DOMAINCONTROL.COM
DNSSEC: unsigned
------------------
Thie site is already reported to Godaddy as the provider of this domain name.
http://www.godaddy.com
--------------------------------------
BE aware : WARNING THEY ARE SCAMS. They will ask you to send money to HongKong. DO NOT DO THAT...
---------------------------------------------------
Do NOT ask them anytHing or inform them....
Thank YOU.

Posted: Tue Jul 11, 2017 8:09 am

Welcome youskhel,
I see you have already reported the scam email at Scamwarners, thank you for doing this. If possible, can you add the email headers to your post? This will help establish that he is using this fake bank site to send email.

Here's info on how you can find email headers - make sure to remove reference to your own email address before posting
https://www.spamcop.net/fom-serve/cache/19.html

I've posted a thread in the Fake Banks forum about this site,
http://forum.419eater.com/forum/viewtopic.php?p=2323485