player@national-lottery.co.uk - swebster@e-mail.ua

[firefly]

Email:

Your Debit card from the National UK Lottery has been stopped, please view attached file for further details

Return-Path: <info@irs.gov>
Received: from 99-38-132-176.lightspeed.irvnca.sbcglobal.net ([99.38.132.176]:59919 helo=User)
Reply-To: <irsusa@x5g.com>
From: "info@irs.gov"<info@irs.gov>
Subject: Your Debit Card from the National Lottery

Originating IP: 99.38.132.176
Originating ISP: At&t U-verse
City: La Crescenta
Country of Origin: United States

Attachment:

Tax Division
United States Department of Justice
California
2525 Capitol St, Fresno. CA. 93888, United.

STOP ORDER ON YOUR SHIPMENT
This is to inform you that the California Department of the Internal Revenue
Service has placed a Hold on your package from Fedex. The package was sent
by the National Lottery in London. UK- The package contains a non~taxable
ATM Debit card which we have verified to be legitimate and is valued at
$6o.3million. It is as a result of a Bonus Lottery from the National UK Lottery.
We have placed it on hold because we need you to obtain the international
Lottery winners commission certificate because the winnings is from another
country. T he certificate costs $4000 here in America and GBP1200 (US$2OOO)
from the UK. The certificate fee is non-negotiable. Please let me know which
country you would prefer to get the certificate from so i would furnish you with
the details you need. The certificate must be obtained within the next
seven working days lest the Debit card be confisticated.
Yours Truly.

Brian Wilkinson
Administration

[firefly]

Email:

Anti-Terrorist and Monetary Crimes Division
Fbi Headquarters In Washington, D.C.
Federal Bureau Of Investigation
J. Edgar Hoover Building
935 Pennsylvania Avenue, NW Washington, D.C. 20535-0001
Website: www.fbi.gov ;


I wish to inform you that i am aware that your Debit Card was stopped by the IRS in California. They are asking for the International Lottery Winners Commission Certificate and they said it is $2000 from the UK. This is because they are using a very expensive Lawyer.

I reached out to a friend of mine in the National Lottery in UK who owes me a huge favour. She has promised to get the International Lottery Winners Commission Certificate at $700 only. This is great News. When you have the $700, let me know so i would give you her moneygram receivers information so you could send the $700 to her.

She would get the certificate and we will get this over with. Thank you and have a lovely weekend

Your's Sincerely,
Robert Mueller
Federal Bureau Of Investigation
United States of America

cc James Comey

Delivered-To:
Received: by 10.25.215.211 with SMTP id q80csp2122542lfi;
Sat, 6 Aug 2016
Return-Path: <robertmueller@fbi.gov>
Received: from cooper.lunarbreeze.com (cooper.lunarbreeze.com. [64.50.161.40])
Received-SPF: fail (google.com: domain of robertmueller@fbi.gov does not designate 64.50.161.40 as permitted sender) client-ip=64.50.161.40;
Authentication-Results: mx.google.com;
spf=fail (google.com: domain of robertmueller@fbi.gov does not designate 64.50.161.40 as permitted sender) smtp.mailfrom=robertmueller@fbi.gov;
dmarc=fail (p=NONE dis=NONE) header.from=fbi.gov
Message-Id: <57a59475.5700620a.f3db7.0f3eSMTPIN_ADDED_MISSING@mx.google.com>
Received: from 99-38-132-176.lightspeed.irvnca.sbcglobal.net ([99.38.132.176]:63120 helo=User)
by cooper.lunarbreeze.com with esmtpa (Exim 4.87)
(envelope-from <robertmueller@fbi.gov>)
id 1bVwDh-0002gl-8f; Sat, 06 Aug 2016 00:40:34 -0700
Reply-To: <robertmueller9@thefbi.co.uk>
From: "robertmueller@fbi.gov"<robertmueller@fbi.gov>
To: robertmueller@fbi.gov
Subject: About International Lottery Winners Commission Certificate
Date: Sat, 6 Aug 2016
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_00EE_01C2A75B.7496A4AC"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - cooper.lunarbreeze.com

[firefly]

Fake site used in scam:

Free FBI domain, unlimited email and web space

More Information About The FBI...
The Federal Bureau of Investigation (FBI) is an agency of the United States Department of Justice that serves as both a federal criminal investigative body and an internal intelligence agency. The FBI has investigative jurisdiction over violations of more than 200 categories of federal crime. Its motto is "Fidelity, Bravery, Integrity", corresponding to the FBI initials.
The FBI's headquarters, the J. Edgar Hoover Building, is located in Washington, D.C.. Fifty-six field offices are located in major cities throughout the United States as well as over 400 resident agencies in smaller cities and towns across the country. More than 50 international offices called "legal attach�s" are in U.S. embassies worldwide.
Sign up for your free FBI email address and webspace now!

Fake site details:

Domain name:
thefbi.co.uk

Registrant:
Freeola Limited

Registrant type:
UK Limited Company, (Company number: 5335999)

Registrant's address:
92 - 102 East Street
Braintree
Essex
CM7 3JW
United Kingdom

Data validation:
Nominet was able to match the registrant's name and address against a 3rd party data source on 18-Jun-2014

Registrar:
Freeola Limited t/a Top Address [Tag = TOPADDRESS]
URL: http://GetDotted.com

Relevant dates:
Registered on: 18-Jul-1999
Expiry date: 18-Jul-2018
Last updated: 16-Jun-2016

This is what the "FBI site" is looking like:

[firefly]

Email:

Anti-Terrorist and Monetary Crimes Division
Fbi Headquarters In Washington, D.C.
Federal Bureau Of Investigation
J. Edgar Hoover Building
935 Pennsylvania Avenue, NW Washington, D.C. 20535-0001
Website: www. fbi.gov ;


Below are the receivers information for you to send $700 via moneygram

Name: Chellin Magonde
Address: 1 London Bridge Street, London SE1 9GF, United Kingdom
Email: chellinmagonde@uksolicitor.org

I have already told her everything. She is expecting your email with the payment information. Please contact her only when you have sent the $700. Contact me if anything else.
Congratulations once more as you are in the final stage of receiving your funds.
Your's Sincerely,
Robert Mueller
Federal Bureau Of Investigation
United States of America

cc James Comey

Return-Path: <robertmueller@fbi.gov>
Received: from cooper.lunarbreeze.com (cooper.lunarbreeze.com. [64.50.161.40])
by mx.google.com with ESMTPS id 79si30672072pfl.71.2016.08.07.02.37.59
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sun, 07 Aug 2016
Received-SPF: fail (google.com: domain of robertmueller@fbi.gov does not designate 64.50.161.40 as permitted sender) client-ip=64.50.161.40;
Authentication-Results: mx.google.com;
spf=fail (google.com: domain of robertmueller@fbi.gov does not designate 64.50.161.40 as permitted sender) smtp.mailfrom=robertmueller@fbi.gov;
dmarc=fail (p=NONE dis=NONE) header.from=fbi.gov
Message-Id: <57a70178.d20b620a.4615a.05f7SMTPIN_ADDED_MISSING@mx.google.com>
Received: from 99-38-132-176.lightspeed.irvnca.sbcglobal.net ([99.38.132.176]:51882 helo=User)
by cooper.lunarbreeze.com with esmtpa (Exim 4.87)
(envelope-from <robertmueller@fbi.gov>)
id 1bWKWq-000352-K6; Sun, 07 Aug 2016
Reply-To: <robertmueller9@thefbi.co.uk>
From: "robertmueller@fbi.gov"<robertmueller@fbi.gov>
To: robertmueller@fbi.gov
Subject: Receivers details for the certificate
Date: Sun, 7 Aug 2016
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_0123_01C2A75B.673C17E8"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - cooper.lunarbreeze.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - FaceBook.gov
X-Get-Message-Sender-Via: cooper.lunarbreeze.com: authenticated_id: james128/only user confirmed/virtual account not confirmed
X-Authenticated-Sender: cooper.lunarbreeze.com: james128

[firefly]

Email:

Anti-Terrorist and Monetary Crimes Division
Fbi Headquarters In Washington, D.C.
Federal Bureau Of Investigation
J. Edgar Hoover Building
935 Pennsylvania Avenue, NW Washington, D.C. 20535-0001
Website: www. fbi.gov ;

I wish to inform you that the card has been sent back to the National Lottery. There was nothing more i can do. I am sure it is currently still in USA so if you hurry and send the $700, i would be able to stop it before it leaves USA but if you do not send the $700 today, It would leave USA.

The National Lottery says if the card gets back to them, it would cost you about $50,000 to get it back. The choice is yours. I have done my best for you

Your's Sincerely,


Robert Mueller
Federal Bureau Of Investigation
United States of America

cc James Comey

Return-Path: <robertmueller@fbi.gov>
Reply-To: <robertmueller9@thefbi.co.uk>
From: "robertmueller@fbi.gov"<robertmueller@fbi.gov>
To: robertmueller@fbi.gov
Subject: Your Debit Card Back to UK

[firefly]

Pushing the victim to get a loan for paying the fee...

Anti-Terrorist and Monetary Crimes Division
Fbi Headquarters In Washington, D.C.
Federal Bureau Of Investigation
J. Edgar Hoover Building
935 Pennsylvania Avenue, NW Washington, D.C. 20535-0001
Website: www.fbi.gov ;

You can Contact Global Finance via email ( globalservfile001@excite.com ) for the loan

Your's Sincerely,

Robert Mueller
Federal Bureau Of Investigation
United States of America

cc James Comey

Return-Path: <robertmueller@fbi.gov>
Received: from 99-38-132-176.lightspeed.irvnca.sbcglobal.net ([99.38.132.176]:55692 helo=User)
by cooper.lunarbreeze.com with esmtpa (Exim 4.87)
(envelope-from <robertmueller@fbi.gov>)
Reply-To: <robertmueller9@thefbi.co.uk>
From: "robertmueller@fbi.gov"<robertmueller@fbi.gov>
To: robertmueller@fbi.gov
Subject: Financier Details

Originating IP: 99.38.132.176
Originating ISP: At&t U-verse
City: La Crescenta
Country of Origin: United States

[firefly]

Email:

Anti-Terrorist and Monetary Crimes Division
Fbi Headquarters In Washington, D.C.
Federal Bureau Of Investigation
J. Edgar Hoover Building
935 Pennsylvania Avenue, NW Washington, D.C. 20535-0001
Website: www.fbi.gov ;

Dear Sir,

I went to the National Lottery in England to plead with them to reduce the $50,000 fee or allow you pay it after you get the card. I met with the Director of the National Lottery and he eventually agreed after hours of pleading. However, he insists you must pay the late penalty claim fee of $500 before he can hand me the card to bring to you. Yes, he has agreed to give me the card to bring to you myself after you send them the $500 for late claim.

However, he said if the $500 is not sent by Tuesday, an additional charge of $10 is to be added daily. This means you would have to send $510 on Wednesday and $520 on Thursday. Please hurry and contact the Director and ask him how you can send the $500 to him today. His email is ( uklotterydirector@ukgamers.net ). $500 is all that stands between you and the Debit Card containing $60.3million.

Please let me know when you can send the $500. Email me on ( rm112@thefbi.co.uk ). I am lodged in a hotel and incurring expenses being paid by the FBI but i have a time limit. Please hurry.

Your's Sincerely,
Robert S. Mueller, III
FBI

Return-Path: <bd100@dxc1.onmicrosoft.com>
Subject: About Your Card in UK
To: "robertmueller@fbi.gov" <bd100@dxc1.onmicrosoft.com>
From: "robertmueller@fbi.gov" <bd100@dxc1.onmicrosoft.com>
X-Originating-IP: [71.95.162.182]

Originating IP: 71.95.162.182
Originating ISP: Charter Communications
City: Whittier
Country of Origin: United States

[firefly]

Email:

Anti-Terrorist and Monetary Crimes Division
Fbi Headquarters In Washington, D.C.
Federal Bureau Of Investigation
J. Edgar Hoover Building
935 Pennsylvania Avenue, NW Washington, D.C. 20535-0001
Website: www.fbi.gov ;


YOUR DEBIT CARD IN NIGERIA

Due to your inability to claim your National Lottery Win to the tune of $60.3million, the money has been sent to Nigeria to aid with the fight against terrorism. Unfortunately, the Nigerian Government is very corrupt and will put the money in their personal pockets. I contact their ministry of Finance and they have agreed to send the card to you if you would pay the diplomatic delivery cost of $200. A diplomat with the Finance ministry will bring the debit card to you. Please note that they would be happy if you do not send the $200 as this means they would get to keep the money for themselves. Please ensure this does not happen. You are to contact them and ask how you can send the money to them. Please do whatever they ask as i do not want them to have any excuse not to send you the card. Let me know when you send them the $200. Their email is ( minfinanceng@officials.co.uk ). Please contact them now.

Your's Sincerely,
Robert Mueller
FBI
rm112@thefbi.co.uk

Return-Path: <h4n203@alb4.onmicrosoft.com>
Subject: Your Debit Card in Nigeria
To: "robertmueller@fbi.gov" <h4n203@alb4.onmicrosoft.com>
From: "robertmueller@fbi.gov" <h4n203@alb4.onmicrosoft.com>
Reply-To: <mwaet@e-mail.ua>
X-Originating-IP: [108.53.252.208]

Originating IP: 108.53.252.208
Originating ISP: Verizon Fios
City: Jersey City
Country of Origin: United States

[firefly]

Email:

Anti-Terrorist and Monetary Crimes Division
Fbi Headquarters In Washington, D.C.
Federal Bureau Of Investigation
J. Edgar Hoover Building
935 Pennsylvania Avenue, NW Washington, D.C. 20535-0001
Website: www.fbi.gov ; ;


YOUR DEBIT CARD IN NIGERIA

The Nigerian Minister of Finance says you have not sent the $200 to them yet. This makes me very sad and this would mean they get to keep the money for themselves after all my efforts. This is really very saddening. The deadline given by National Lottery is Monday 12th September 2016. If unclaimed by then, they are to give the funds to charity. Like i said earlier, they would claim they have given it to charity but they would not. They will keep the money anf share it amongst the top officials of the Ministry of Finance. Please do not let this happen. I magine how many people you can help with $60.3million. Imagine all the things you can do with it. Send them the $200 today. Their email is ( minfinanceng@officials.co.uk ). Please contact them now.

Your's Sincerely,
Robert Mueller
FBI
rm112@thefbi.co.uk

Return-Path: <c8z4@xes1.onmicrosoft.com>
Subject: Your $60.3million in Nigeria
To: "robertmueller@fbi.gov" <c8z4@xes1.onmicrosoft.com>
From: "robertmueller@fbi.gov" <c8z4@xes1.onmicrosoft.com>
X-Originating-IP: [91.103.122.11]

Originating IP: 91.103.122.11
Originating ISP: Maycom
Country of Origin: Ukraine

[firefly]

Email:

Anti-Terrorist and Monetary Crimes Division
Fbi Headquarters In Washington, D.C.
Federal Bureau Of Investigation
J. Edgar Hoover Building
935 Pennsylvania Avenue, NW Washington, D.C. 20535-0001
Website: www.fbi.gov ; ;


YOUR DEBIT CARD IN NIGERIA

Due to the fact that i do not want you to lose your funds, I have sent an FBI Agent from Washington to Nigeria to retrieve the card for you. He is currently in Nigeria. You are to send the $200 to him and he would do the necessary paperwork and come back with the Diplomat to the to deliver the card to you.

They are to make sure the card works and you withdraw from it before they leave. You are to send the $200 to the FBI Agent in Nigeria via moneygram or western union using the details below

Name: Carl Johnson
City: Abuja
Country: Nigeria
Test Question: color
Answer: black

Send me the payment slip from western union or moneygram.
As soon as i get the payment details from you, I will send it to the FBI Agent and he will do the rest

Your's Sincerely,
Robert Mueller
FBI
rm112@thefbi.co.uk

Return-Path: <robertmueller@fbi.gov>
Received: from User ([40.76.82.57])
Reply-To: <rm112@thefbi.co.uk>
From: "robertmueller@fbi.gov" <robertmueller@fbi.gov>
Subject: My FBI Agent in Nigeria

Originating IP: 40.76.82.57
Originating ISP: Microsoft Corporation
City: Boydton
Country of Origin: United States