Letter Source:  This letter appears to have originated in Oregon, however the the time stamps suggest that in fact, it originated in the UK.  The email was "bounced" off a web site located in Oregon.  These scammers sure know how to play cloaking games, as you will see by reading the Letter Source reports for the rest of the emails in this series.

There is no web site called milesstaff.biz: it's only a saved construction page.  Scammers buy domains all the time in order to obtain an email address with a proprietary domain extension like @milesstaff.biz.  It makes them appear more legitimate than an @yahoo or @hotmail extension.

DO NOT CONFUSE allianzfinance.biz with the real Allianz Finance II BV / Allianz Group, a legitimate Dutch company.  The bad guys love to use the names of legitimate companies to do their dirty work.  They have also plastered bank logos on their site to make themselves appear legitimate.

Both allianzfinance.biz and milesstaff.biz domains (www.whois.biz) are registered through Gandi, an accredited French registrar located at 38 rue Notre Dame de Nazareth.  MIlesstaff.biz appears to belong to someone in Hawaii, while allianzfinance.biz appears to belong to someone in Texas with contact information on the web site listing a London address.

Let's see, we have registrants located in one country, domain registration located in another, and contact information located in a third.  Nope, legitimate concerns don't operate like that.

____________________________________________________