cpsdubai@gmail.com jovilljoy@yahoo.com

[SlapHappy]

* 41.71.184.122 Visafone Lagos Nigeria

Return-Path: <jovilljoys@yahoo.com>
Received: from star.mytruehost.com (star.mytruehost.com. [72.29.94.226])
by mx.google.com with ESMTPS id l8si34185656qey.104.2013.11.25.21.03.18
for <multiple recipients>
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Mon, 25 Nov 2013 21:03:22 -0800 (PST)
Received-SPF: neutral (google.com: 72.29.94.226 is neither permitted nor denied
by best guess record for domain of jovilljoys@yahoo.com) client-ip=72.29.94.226;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 72.29.94.226 is neither permitted nor denied by best
guess record for domain of jovilljoys@yahoo.com) smtp.mail=jovilljoys@yahoo.com
Message-Id: <52942b9a.e852310a.5f88.00b5SMTPIN_ADDED_MISSING@mx.google.com>
Received: from [41.71.184.122] (port=51025 helo=User)
by star.mytruehost.com with esmtpa (Exim 4.82)
(envelope-from <jovilljoys@yahoo.com>)
id 1VlAma-0003Oo-Jp; Tue, 26 Nov 2013 00:02:02 -0500
Reply-To: <jovilljoy@yahoo.com>
From: "CPS GLOBAL GENERAL TRADING LLC"<jovilljoys@yahoo.com>
Subject: SWIFT PAYMENT gbam
Date: Tue, 26 Nov 2013 06:00:10 -0800
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_00FB_01C2A9A6.551C2668"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-AntiAbuse: This header was added to track abuse, please include it with
any abuse report
X-AntiAbuse: Primary Hostname - star.mytruehost.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - yahoo.com
X-Get-Message-Sender-Via: star.mytruehost.com: authenticated_id:
Lahore@labservpakistan.com

Dear Sir

We have transferred your payment from our HSBC account to your bank
account as advance against your PI.
Best regards,

CPS GLOBAL GENERAL TRADING LLC

Phone : +971 4 2667751
Fax : +971 4 2667781
P.O. Box: 115514 | Dubai | UAE
E mail- cpsdubai@gmail.com

attachment;
filename="HSBC TT SWIFT.html"
Do not click on file attachment in your email! << Phishing form could be infected.
--

Phone : +97142667751
Fax: +97142667781

[SlapHappy]

Another email almost like above except this different info:

* 41.138.180.113 Visafone Communications Limited Lagos Nigeria

Subject: SWIFT COPY