Two separate but identical email messages, a day apart, from two different hacked email accounts. The origin IP Address in both is the same, and the message text the same.

Email #1 Header information:

X-SID-PRA: Thomas Kocha <>

Received: from unknown (HELO User) (
by with SMTP; 17 Nov 2011 13:35:58 +0300

Reply-To: <>
From: "Thomas Kocha"<>
Subject: iKobo
Date: Thu, 17 Nov 2011 19:46:38 +0800

Email #1 Header information:

X-SID-PRA: Thomas Kocha <>

Received: from User (unverified []) by
(Vircom SMTPRS 5.0.916.3) with ESMTP id <>;
Fri, 18 Nov 2011 05:10:47 -0800

Reply-To: <>
From: "Thomas Kocha"<>
Subject: iKobo Beneficiary
Date: Fri, 18 Nov 2011 21:09:54 +0800

And for both emails, the header analysis gives:

Origin IP Address = = China Science & Technology Network, Beijing, China

Your Ref:
Dear Beneficiary,

iKobo is a company that specializes in money transfers. With them, you send money to the any countries with your MasterCard or Visa. The recipient gets your transfer put onto a secured Visa debit card which can be used worldwide at ATM locations for cash withdrawals. This debit card, which is reusable, is shipped to the recipient first. As part of our commitment in bringing our services to the world to the world, I wish to announce to you that your email emerged as one of the luck winners to receive a grant of 2.8 Million US Dollars. This funds would be made available to you through your an iKobo Visa card.

* Your Personal identification Number is 2222.
* Name On Card: iKobo Beneficiary
* iKobo Visa Card Number: 4147202034772580
* Expire: 07/2012
* Cvv Number: 367

We have concluded plans to deliver this card to you as soon as possible.
You are to Thomas Kocha( the following details:

* Full Name:
* Delivery Address:
* Country:
* Gender:
* Age:
* Occupation:
* Phone Number:
* Means of Identification:

We look forward to hearing from you soon.
Copyright 2001-2012 iKobo, Inc.