419 Scam – "OMEGA LOTTERY INTERNATIONAL / United Trust Agency"
"OMEGA LOTTERY INTERNATIONAL" and "United Trust Agency" are labels used for a fake lottery comany and a fake claims agent. The gang behind this fraud operates in Belgium, using Belgian mobile phone numbers and free webmail accounts for correspondence.
In one instance, the scammers sent email with a fake sender address of email@example.com, abusing a domain name of a measuring instrument company! The spam was not sent by Omega.com:
Email addresses associated with this scam:
Example of spam email:
Received: from [18.104.22.168] (helo=omega360.com) by vmx55.multikabel.net with smtp (Exim 4.43) id 1CeZy1-00031P-EX for ############; Wed, 15 Dec 2004 15:17:26 +0100 From: FROM:OMEGA LOTTERY INTERNATIONAL <firstname.lastname@example.org> To: ############ Reply-To: MrDPerry147@netscape.net Subject: WINNING AWARD NOTIFICATION Date: Wed, 15 Dec 2004 06:17:06 -0800 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="e5931f60-8fc3-472c-9703-ccfdb071b5b0" X-MailScanner-SpamCheck: spam, SpamAssassin (score=12.768, required 5, BAYES_60 0.37, MIME_BOUND_MANY_HEX 2.70, MIME_QP_LONG_LINE 0.04, MSGID_FROM_MTA_HEADER 0.05, MSGID_FROM_MTA_ID 1.72, NIGERIAN_BODY1 3.40, NIGERIAN_BODY2 0.60, RCVD_IN_BL_SPAMCOP_NET 1.22, RCVD_IN_SORBS_SPAM 2.00, SUBJ_ALL_CAPS 0.67) X-MailScanner-From: email@example.com This is a multi-part message in MIME format --e5931f60-8fc3-472c-9703-ccfdb071b5b0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable WINNING AWARD NOTIFICATION FROM:OMEGA LOTTERY INTERNATIONAL INTERNATIONAL PROMOTION/PRIZE AWARD DEPT. REF: MLI/231-ILGI0431/03 BATCH: IPD/15/096/PTNL RE: WINNING FINAL NOTIFICATION. Sir/Madam, We are pleased to inform you of the result of the Lottery Winners = International programs held on the 15th of December, 2004. Your e-mail = address attached to ticket number 20511465897-6291 with serial number = 472-971103 drew lucky numbers -66-97-22-71-64,Security Acredited File Number = OELP/002112, which consequently won in the 2nd category, you have therefore = been approved for a lump sum pay out of US$ 800,000.00 (Eight Hundred = Thousand United States Dollars). CONGRATULATIONS!!! Due to mix up of some numbers and names, we ask that you keep your winning = information very confidential till your claim hasbeen processed an your = prize/money remitted to you. This is part of our security protocol to avoid double claiming and = unwarranted abuse of this program by some participants. All participants were selected through a computer ballot system drawn from = over 200,000,000 company and 300,000,000 individual email addresses and names = from all over the world. This promotional program takes place annually. We hope with part of your = winning you will take part in our next year USD100 million international = lottery. To file for your claim, please contact our/your fiducial agent of the, United Trust Agency TEL: +32 485 561 097 Email:MrDPerry147@netscape.net Note that all winning must be claimed not later than 22nd of December, 2004. = After this date all unclaimed,funds will be included in the next stake. Please note in order to avoid unnecessary delays and complications please = remember to quote your reference number and batch numbers in all = correspondence. Furthermore,should there be any change of address do inform our agent as soon = as possible. Congratulations once more from our members of staff and thank you for being = part of our promotional program. Note: Anybody under the age of 18 is automatically disqualified. Sincerely yours, Mrs. Serena Van Hoog. Lottery Coordinator. --e5931f60-8fc3-472c-9703-ccfdb071b5b0--
WHOIS-record for the source IP address:
inetnum: 22.214.171.124 - 126.96.36.199 netname: BE-SKYNET-ADSL1 descr: Belgacom Skynet SA/NV descr: ADSL Access country: BE admin-c: SN2068-RIPE tech-c: SN2068-RIPE rev-srv: ns.ripe.net rev-srv: ns1.skynet.be rev-srv: ns2.skynet.be rev-srv: ns3.skynet.be rev-srv: ns4.skynet.be status: ASSIGNED PA mnt-by: SKYNETBE-MNT changed: firstname.lastname@example.org 20030825 source: RIPE route: 188.8.131.52/14 descr: SKYNETBE-CUSTOMERS origin: AS5432 notify: email@example.com mnt-by: SKYNETBE-MNT changed: firstname.lastname@example.org 20021202 source: RIPE role: Skynet NOC administrators address: Belgacom SA de droit public address: ANS/ROC/RNO/IEC - TGX Building address: Boulevard du Roi Albert II, 27 address: B-1030 Bruxelles address: Belgium phone: +32 2 202-4111 fax-no: +32 2 203-6593 e-mail: email@example.com e-mail: firstname.lastname@example.org admin-c: BIEC1-RIPE tech-c: BIEC1-RIPE nic-hdl: SN2068-RIPE remarks: ------------------------------------------- remarks: Network problems to: email@example.com remarks: Peering requests to: firstname.lastname@example.org remarks: Abuse notifications to: email@example.com remarks: - I did *not* hack your computer remarks: - I did *not* send you SPAM or virus remarks: - I will *not* read your abuse complaints remarks: ------------------------------------------- notify: firstname.lastname@example.org mnt-by: SKYNETBE-MNT changed: email@example.com 20010907 changed: firstname.lastname@example.org 20040804 changed: email@example.com 20041105 changed: firstname.lastname@example.org 20041201 source: RIPE