What about iesecuredeals.com

[lightfair]

First, have you already filed a report with the police? If not do this immediately.

Second, what I need is the complete (long) mail HEADERS, not the mail itself. Do you use hotmail as webmail or with a mail client? Here are some descriptions ho to display the complete mail headers:

http://mail.google.com/support/bin/answ ... wer=22454#

Please copy just the headers and again use XXXX for your own email address.

[ecler2003]

hello here is a fuul header message maybe it will be helpfull



X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MDtTQ0w9MA==
X-Message-Status: n:0
X-SID-PRA: vor48ba@gmail.com <vor48ba@gmail.com>
X-SID-Result: Pass
X-AUTH-Result: PASS
X-Message-Info: HKIYGN+H3D+QShLNGWNUtQ052VyAzTHXMn7oAFp/qCfh/F21vOXN3Ib+2bhcLjcODn59L8VC+Y0W0zAWnHNnd28MBUPZK/9A
Received: from qw-out-1920.google.com ([74.125.92.149]) by SNT0-MC3-F32.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Tue, 9 Feb 2010 13:57:16 -0800
Received: by qw-out-1920.google.com with SMTP id 5so894073qwf.46
for XXXX; Tue, 09 Feb 2010 13:57:16 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=domainkey-signature:mime-version:received:in-reply-to:references
:date:message-id:subject:from:to:content-type;
bh=rD/FAC7n5++WVVfRL1oq804ItI4nfuaK4VBU/daAIDM=;
b=g4caFtJCKZgxvAPm0TCQXhO6YDjydYigVUGKEA3jWzZzD/DBvwJ1xe0I2yd26iviy3
HLz/CczlbKgg7xiSReodUuSAb46me3S6urBvIssrbz6kRbYDpTLYM5DjHEWczyIJxaxD
lnAHKG0j1/TMZ0vpoKZRwBBHcTVQ9Pd92eaio=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=gmail.com; s=gamma;
h=mime-version:in-reply-to:references:date:message-id:subject:from:to
:content-type;
b=odqJSHP3yJg1/JopmRtPST1yn6xhB9L77B4r334f6cVRdJ5CJ3gQrZUadckapf8j/J
MtMf61XwpoTb8X0tiQczd4lmHT9aHL+MN1hfUJhcVT6o/NdRr4CECkXhmG6ml8SQEYI5
+DfZGL63LGSU6lFp0IFdLHt5z2wHONwcCs4sA=
MIME-Version: 1.0
Received: by 10.229.224.17 with SMTP id im17mr1416282qcb.41.1265752636403;
Tue, 09 Feb 2010 13:57:16 -0800 (PST)
In-Reply-To: <SNT133-w5571FE29CC1F2E66EB2F14D2500@phx.gbl>
References: <20100207185230.1F8D9CF15A4@mx10b.marktplaats.nl>
<23d6f10d1002091104j172aa7aewb98447e63459633d@mail.gmail.com>
<SNT133-w5571FE29CC1F2E66EB2F14D2500@phx.gbl>
Date: Tue, 9 Feb 2010 21:57:15 +0000
Message-ID: <23d6f10d1002091357j5826e039hdc030876a396293c@mail.gmail.com>
Subject: Re: Reply to your ad: Allen and Heath GL4000 32 Ch 2 x PSU
From: "vor48ba@gmail.com" <vor48ba@gmail.com>
To: XXXX
Content-Type: multipart/alternative; boundary=0016364ed78444313a047f320056
Return-Path: vor48ba@gmail.com
X-OriginalArrivalTime: 09 Feb 2010 21:57:16.0890 (UTC) FILETIME=[D83293A0:01CAA9D2]

(edited to just show the header and deleted the victim's email address from getting harvested)

[ecler2003]

and this is the mail receive from iesecure.com officer

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MDtTQ0w9MA==
X-Message-Status: n:0
X-SID-PRA: squaretradeagent@gmail.com
X-SID-Result: Pass
X-AUTH-Result: PASS
X-Message-Info: JGTYoYF78jG9ZXbx0t2orsP8j08v2JQ/wAb8LAIlNYPZXwRyOXh8doWWbhQc4CbqeGtGUid5Oqng31+Bdx1jTsvsxq8ZrgsV
Received: from mail-ew0-f210.google.com ([209.85.219.210]) by col0-mc1-f25.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Wed, 10 Feb 2010 13:27:43 -0800
Received: by mail-ew0-f210.google.com with SMTP id 2so558597ewy.25
for XXXX; Wed, 10 Feb 2010 13:27:42 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=domainkey-signature:mime-version:sender:reply-to:received
:in-reply-to:references:date:x-google-sender-auth:message-id:subject
:from:to:content-type;
bh=dl5RxAaSx2qXO9bC2LfC6VqIZtHKqATwok8KZfwgEiI=;
b=CetwFLQ+hbyCQwIMelqB0ri8ERQyZ42+b8UL36rhlGS8ikydmQ1i1j5GE7jmBLeqpz
zM5uBl7Gr9B8k7SyKzCJ381CdF7n4XL/wbryi102nwoObK3OLMe0o/IzoD4wlRa6tsJp
q9/5TBitvvS7X3BP1Wn33uCD5pIZzJkH8pfmY=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=gmail.com; s=gamma;
h=mime-version:sender:reply-to:in-reply-to:references:date
-google-sender-auth:message-id:subject:from:to:content-type;
b=U3EYPN1lzeWYMx51fEeBAOpR8wnmrefigB+p5AG1JI4Rb4Dx6HqCISi7c3i3r84m12
k1ZP/0T3zHtcdE33abc4o8bhSjEzHBDa19Vl4tYHLZM1bnY+MtW1ao5N5t7fadBvA7jo
j/CXSB1pfebgOOptp7B/nz/2QMkWITKWoGFlc=
MIME-Version: 1.0
Sender: squaretradeagent@gmail.com
Reply-To: office@iesecuredeals.com
Received: by 10.213.97.28 with SMTP id j28mr6921404ebn.44.1265837255880; Wed,
10 Feb 2010 13:27:35 -0800 (PST)
In-Reply-To: <SNT133-w65C6E6FF313AA9BCA98D9FD24F0@phx.gbl>
References: <SNT133-w65C6E6FF313AA9BCA98D9FD24F0@phx.gbl>
Date: Wed, 10 Feb 2010 21:27:35 +0000
X-Google-Sender-Auth: fdc4dcb185f7a268
Message-ID: <63f9f16f1002101327k142d2b3dgc183101171c99fce@mail.gmail.com>
Subject: Re: CONFIRMATION PAYMENT
From: "office@iesecuredeals.com" <office@iesecuredeals.com>
To: XXXX
Content-Type: multipart/alternative; boundary=001636c5b63efaf01a047f45b3aa
Return-Path: squaretradeagent@gmail.com
X-OriginalArrivalTime: 10 Feb 2010 21:27:43.0246 (UTC) FILETIME=[E16FBAE0:01CAAA97]

(edited, see next entry for explanation)

Thanks to youuuuuuu

jean claude dahner

[lightfair]

Hello Jean Claude;

I've taken the liberty to edit your two previous messages in such a way that only the headers remain; and I've also removed your own email address from it to prevent it from being harvested by spambots.

Unfortunately we can see from those headers that both mails were sent directly via Googles (gmail) servers; and those servers don't include the originating IP address of the sender (most other mail services include this IP address). So we cannot trace back those mails to their originating point; however Google probably could. But they would probably need something "official" from a court to do this.

[ecler2003]

hello

yes indeed i will try to give all those details to my police agent but since now all website are desapered but i ve tried to get my money back from teh britisch bank maybe my last hope but i will try to continue to try to get this man out.

so iwill pay more attention to this kind of people in the next futur.

but one think everybody need to know

in case of it is possible to get your money back from the bank if you have a paper from the police and normally the bank give you money back....

Thanks to all of you

jean claude dahner

[Saiju]

Hi, I have lost my 2040 Euro by sending to the same account in UK. because I have seen an add on Gumtree.ie about a Panasonic Camcorder AG HMC 151 with mic for 2200 Euro. So I contacted the seller named as Alexander Hodge from UK. Finally he settled the camcorder and the whole kit for 2040 Euro including UPS Shipping. For payment, he sent me an email link of the Fake Escrow website. Without knowing the big fraud, I have registered and sent money to the mentioned account by Bank Transfer. But I never received a payment confirmation from the escrow company after may days. So I contacted my bank. According to the Bank they already received the money in UK. I couldn't log in to iesecuredeals.com , he may deleted the fake website. I am very much worried about my lost Money. I have reported the fraud to my nearest Police Station and my bank as well. I have informed to Gumtree.ie and the orginal Escrow company about his fraud.I think there is a big gang behind it.So be careful about this kind of fake website. The man Alexander Hodge used to send me email from : vor48ba@gmail.com
and the fake escrow office mail came from: office@iesecuredeals.com. I will report this scammer to may agency.

Regards,
xxxx, Ireland.

[lightfair]

Hello,

I'm sorry to hear about your loss. You are correct that there is a big gang behind it; as I wrote elsewhere this is organized crime operating from Eastern Europe.

As far as I can see there was no "original Escrow company" in this specific fraud; it's been all fake from the beginning. Please correct me if you have additional information about this.

[sailarmoon]

Did you actually trace his emails from the beginning?

Normal I would trace the emails from the sellers, to make sure that he is located from the same location (Country, Region, City) as he told me.

http://www.ip2location.com/emailtracer.aspx

This email header tracer only works for Microsoft Outlook, Yahoo! Mail. Hotmail, some Gmails but not for webmails.

I know that the geographical location of the traced IP is based on the seller's ISP location, not his home address. But I believe that the accuracy for the IP to Country is at least 99%.

[Saiju]

Hi, thanks for the reply. I didn't trace his(Alexander Hodge) email from the start. I never thought that it was a Fake Escrow Site. I think the scammer has downloaded some one's add with picture of the camcorder and cheated me. Because last day I have seen the same picture of the Panasonic camcorder AG HMC 151 on ebay. What I think , the scammer Gang is still active on various online shopping sites and offer a very attractive bargain price for used electronic things like camcorders and Audio systems to cheat the people. I am sure one day the gang will be punished.

Regards.