joewein.de LLC
Fighting spam and scams
on the Internet

Home / Blog / About us
Spam
419/Nigeria
Online fraud
jwSpamSpy
Contact

Email Spam Filter:
jwSpamSpy
Try it for free!

Google

 

419 Scam – "UNIVERSAL TRUST WORLDWIDE LOTTERY / SPEEDFAST WORLDWIDE"

"UNIVERSAL TRUST WORLDWIDE LOTTERY / SPEEDFAST WORLDWIDE" are labels used by a fake lottery and fake "claims agent" in Nigeria and the UK.

This scam is part of the same cluster as the "Dgcourier (Edward Pinto)" fake lottery scam.

jwSpamSpy
Are you sick of spam too? Do you want it stopped now?
Try jwSpamSpy, the spamfilter we use to track the spammers!
Free 30-day trial version available now!

Example email:

FROM:
MR SIMON CROFT.
THE COORDINATOR, EGLOBAL LOTTERY UK.
INTERNATIONAL PROMOTIONS / PRIZE AWARD DEPARTMENT.
EGLOBAL LOTTERY, UK.

UNIVERSAL TRUST WORLDWIDE PROMOTION LOTTERY
138 EDWARD STREET, 
4TH FLOOR BARINOR BUILDING
UK LONDON, ENGLAND   
Ref: UT/941OY2/02
Batch: 12/25/DC34
13/12/2004
WINNING NOTIFICATION:
We happily announce to you the draw of the Euro - Afro Asian 
SweepstakeInternational programs held on the 30th of october 2004 
in cairo Egypt.Your e-mail address attached to ticket number:
56475600545-288 with Serial number 5388/02 drew the lucky numbers  
31-6-26-13-35-7, which subsequently won you the lottery in the 3RD 
category You have therefore been approved to claim a total sum of 
US$2,500,00000 (Two million, five hundred Thousand,United States 
Dollars) in cash credited to file PC/9080118308/02. This is from 
a total cash prize of US $25Million dollars,
shared amongst the first Fifty (50) lucky winners in this 
category.Please note that your lucky winning number falls within 
our European booklet representative office in Europe as indicated 
in your playcoupon.
Inview of this, your US$2,500,000.00 (Two million, five hundred 
thousand,United States Dollars) would be released to you by our 
security firm in Europe.
OurEuropean agent will immediately commence the process to facilitate 
the release of your funds as soon as you contact him. All participants 
were selected randomly from World Wide Web site through computer draw 
system and extracted fromover 100,000 companies. This promotion takes
place annually. For security reasons, you are advised to keep your 
winning information confidential till your claims is processed 
and your money remitted to you in whatever manner you deem fit to 
claim your prize This is part of our precautionary measure to avoid 
double claiming and unwarranted abuse of this program by some 
unscrupulous elements. To file for your
claim, please contact our fiduciary agent:
Mr Thomas Walter.
Email: thomasw_alter
To avoid unnecessary delays and complications, please quote your
reference/batch numbers in any
correspondences withus or our designated agent. Congratulations once
more from all membersand
staffs of this program.
Thank you for being part of our promotional lottery
program.
Sincerely,
SIR H.J.PONFA
UNIVERSAL TRUST WORLDWIDE LOTTERY Coordinator.
EMAIL: thomasw_alter@safe-mail.net

Message headers:

Received: from host81-136-109-4.in-addr.btopenworld.com ([81.136.109.4]
 helo=onmo3395.com)
	by emailhost with smtp (Exim 4.43)
	id 1CdoVq-0007xk-8m
	for emailaddress; Mon, 13 Dec 2004 12:37:10 +0100
From: "UNIVERSAL TRUST" <thomsaw_aler@safe-mail.net>
Reply-To: thomasw_alter@safe-mail.net
To: emailaddress
Date: Mon, 13 Dec 2004 11:37:11 +0000
Subject: LOTTERY  WINNER

WHOIS details for sending network (IP 81.136.109.4):

     inetnum:      81.136.60.0 - 81.136.119.255
     remarks:      *******************************************************
     remarks:      * Please send abuse reports to abuse@btopenworld.com  *
     remarks:      *******************************************************
     netname:      BT-ADSL
     descr:        IP Pools
     country:      GB
     admin-c:      BTOW1-RIPE
     tech-c:       BTOW1-RIPE
     status:       ASSIGNED PA
     mnt-by:       BTNET-MNT
     mnt-lower:    BTNET-MNT
     mnt-routes:   BTNET-MNT
     changed:      preston.dialip@bt.com 20040121
     source:       RIPE
     
     route:        81.128.0.0/11
     descr:        BT Public Internet Service
     origin:       AS2856
     mnt-by:       BTNET-MNT
     changed:      support@bt.net 20030615
     source:       RIPE
     
     role:         BT OPENWORLD OPERATIONAL SUPPORT
     remarks:      ********************************************************
     remarks:      *  Please send abuse reports to abuse@btopenworld.com  *
     remarks:      *                                                      *
     remarks:      ********************************************************
     address:      BT
     address:      Openworld
     address:      UK
     e-mail:       ims.adastral@btopenworld.com
     admin-c:      IT337-RIPE
     tech-c:       RJG3-RIPE
     nic-hdl:      BTOW1-RIPE
     mnt-by:       BTNET-MNT
     changed:      preston.dialip@bt.com 20030520
     source:       RIPE
WHOIS details for sending network (IP 81.136.109.4):
     inetnum:      81.136.152.0 - 81.136.199.255
     remarks:      Please send abuse notification to abuse@btopenworld.com
     netname:      BT-ADSL
     descr:        IP Pools
     country:      GB
     admin-c:      BTOW1-RIPE
     tech-c:       BTOW1-RIPE
     status:       ASSIGNED PA
     mnt-by:       BTNET-MNT
     mnt-lower:    BTNET-MNT
     mnt-routes:   BTNET-MNT
     changed:      preston.dialip@bt.com 20030426
     changed:      preston.dialip@bt.com 20040205
     source:       RIPE
     
     route:        81.128.0.0/11
     descr:        BT Public Internet Service
     origin:       AS2856
     mnt-by:       BTNET-MNT
     changed:      support@bt.net 20030615
     source:       RIPE
     
     role:         BT OPENWORLD OPERATIONAL SUPPORT
     remarks:      ********************************************************
     remarks:      *  Please send abuse reports to abuse@btopenworld.com  *
     remarks:      *                                                      *
     remarks:      ********************************************************
     address:      BT
     address:      Openworld
     address:      UK
     e-mail:       ims.adastral@btopenworld.com
     admin-c:      IT337-RIPE
     tech-c:       RJG3-RIPE
     nic-hdl:      BTOW1-RIPE
     mnt-by:       BTNET-MNT
     changed:      preston.dialip@bt.com 20030520
     source:       RIPE


Response from "Mr. Thomas Walter" (see also Edward Pinto for another version of the scam):

ATTENTION: 

I am Dr Thomas Walter the fiduciary agent assigned to your case. I wish 
to Congratulate you on your victory,you are lucky person to have won this 
lottery.
Your email address is amongst those chosen this quarter from our new 
java-based software that randomly selects email addresses from the web 
from which winners are selected. You are required to forward the following 
details to help facilitate the processing of your claims and certificate 
which will facilitate the release of your winnings.

1. Full names.
2. Residential address.
3. Phone number.
4. Fax number.
5. Occupation.
6. Sex.
7. Age. 
8. Nationality.

You are advised to forward these informations as soon as possible to 
enable us attend to your file.Please note that your funds have been 
deposited safely in a security firm in Europe,and your information will 
be forwarded to them before they can release your winnings.

After you have sent down these information, a certificate will be 
prepared for you. This is to be your proof of winning from this office 
to the payment center before they release your funds.You are adviced 
to keep your winning numbers secret to avoid unscripulous elements 
from taking advantage of the situation.
Once again, congratulations.

Regards,

Dr Thomas Walter

Message headers:

Received: from pc ([81.136.191.249]) by SAFe-mail.net with https
Subject: CLAIMS VERIFICATION 
Date: Thu, 10 Mar 2005 07:28:30 -0500
From: thomasw_alter@SAFe-mail.net


ATTENTION: 
 
We hereby inform you that we have processed your payment and your 
cheque is ready for disbursement,along with your winning certificate.
In this regard you are to choose from the options below the one that 
best suites you on how you wish to receive your funds.
Also your funds deposited with us is not in liquid form but in Bank 
Cheque, this advice complies with the Anti-Fraud section 2,sub section 
(iv) of the procedural manual of the funds disbursement agreement 
existing between courier companies and the British Government. The 
options to receive your winnings are:

1.You come down to our office in London  to collect your certificate 
and also your certified bank cheque and take it to our payment centre 
in person to redeem your winning sum. ADDRESS OF OFFICE:10 NORTHUMBERLAND 
AVENUE, LONDON WC2N 5BX, THE UNITED KINGDOM
 
2. Have our affiliate courier company send the cheque to you. In 
consonance with our policy in this regard,be advised that if you opt 
for the cheque to be couriered, we however exempts ourself from all
liability related to this service. The cost of this service would be 
borne by you; this is a prerequisite for this option. You will be 
referred to our affiliate courier company so that you can make
enquires concerning modalities, and charges. The reason for the courier 
option is for the fact of double taxation, that is if you are to come 
over to sign for the release of your winnings personally, you
would have to pay taxes on the winnings in Britain and then go and 
pay taxes on the same winnings in your country once the funds get there.

3.Thirdly your winnings will be electronically transfered to your 
bank of choice through our payment center.You will be contacted by 
them immediately and we advise you adhere to their instructions so 
as to enable you receive your winnings soonest,If for any reasons 
you prefer our other options you are to inform us immediately.
This is the main reason why we would advise that you take the courier 
option, you have not collected the winnings until you sign for it and 
the only way you can sign for it via courier is when you have taken
delivery of the parcel containing the winnings cheque and certificate 
of winning. This would be in your country, the options are open to 
you and we are there to serve you, no matter the option taken.
We expect that you will notify us of your choice upon receipt of this 
message so that appropriate arrangement can be put in place.Also you 
are to get back to us once you have been contacted.

Regards, 
Dr THOMAS WALTER

Message headers:

Received: from pc ([81.136.127.173]) by SAFe-mail.net with https
Subject:  CLAIMS VERIFICATION
Date: Fri, 11 Mar 2005 04:53:24 -0500
From: thomasw_alter@SAFe-mail.net


The "winner" asked some questions about the courier company. Notice how "Dr Thomas Walter" in his reply started using a virus scanner, which he didn't have before? That's because this email is from a different source. The victim has already been passed on to the enxt stage in the scam. This email originates from Nigeria, not the UK. This "Thomas Walter" is actually the same person as the "Paul Reid" of "Speedfast Worldwide Services" mentioned in this email. The postal address is the same as for "Dgcourier Service" in another version of the scam.

Hello Surname,
I am happy for your prompt reply but i wold rather that you get the 
information you asked for from the courier company because there would 
be in a better position to let you on on it.
We have sent your details as well as your cheque to them thi morning 
so we believe that there are in control now and will attend to you 
once you can reach them with your information.
You are to contact the courier at once on the requirements to sending 
your to you. Below are their contact details:

SpeedFast Worldwide Services
Rovex House, Hay Hall Rd., Tyseley,
Birmingham. B11 2AG. England
Handling Officer: Mr Paul Reid
email:speedfast@mail2consultant.com
Once again congratulations.
Dr Thomas Walter


-- 
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.7.2 - Release Date: 3/11/2005

Message headers:

Received: from pc ([213.181.83.2]) by SAFe-mail.net with https
Subject: DETAILS AGAIN
Date: Mon, 14 Mar 2005 13:58:26 -0500
From: thomasw_alter@SAFe-mail.net

WHOIS details for sending network (IP 213.181.83.2):

     inetnum:      213.181.64.0 - 213.181.95.255
     org:          ORG-BL4-RIPE
     netname:      NG-BROADBANDTECH-20000327
     descr:        BT Limited
     descr:        PROVIDER Local Registry
     country:      NG
     admin-c:      IO243-RIPE
     tech-c:       IO243-RIPE
     status:       ALLOCATED PA
     notify:       bt@micro.com.ng
     mnt-by:       RIPE-NCC-HM-MNT
     mnt-routes:   BT-LIMITED-MNT
     mnt-lower:    BT-LIMITED-MNT
     changed:      hostmaster@ripe.net 20000327
     changed:      hostmaster@ripe.net 20001003
     changed:      hostmaster@ripe.net 20010507
     changed:      hostmaster@ripe.net 20010704
     changed:      lir-help@ripe.net 20011214
     changed:      hostmaster@ripe.net 20020419
     changed:      hostmaster@ripe.net 20020423
     changed:      hostmaster@ripe.net 20020613
     changed:      hostmaster@ripe.net 20030211
     changed:      hostmaster@ripe.net 20040406
     source:       RIPE
     
     organisation: ORG-BL4-RIPE
     org-name:     BT Limited
     org-type:     LIR
     address:      BT Limited
     address:      8B Ademola Street,
     address:      Off Awolowo Road,
     address:      S. W. Ikoyi,
     address:      Lagos, Nigeria.
     phone:        +234 1 2693192
     fax-no:       +234 1 2693192
     e-mail:       bt@micro.com.ng
     admin-c:      IO243-RIPE
     admin-c:      IO243-RIPE
     mnt-ref:      BT-LIMITED-MNT
     mnt-ref:      RIPE-NCC-HM-MNT
     mnt-by:       RIPE-NCC-HM-MNT
     changed:      hostmaster@ripe.net 20040415
     source:       RIPE
     
     person:       Israel Oyeleke
     address:      BT Limited
     address:      8B Ademola Street
     address:      Ikoyi S.W.
     address:      Lagos, Nigeria
     phone:        +234 1 2673532
     fax-no:       +234 1 2673203
     e-mail:       i.oyeleke@moneynett.com
     nic-hdl:      IO243-RIPE
     notify:       i.oyeleke@moneynett.com
     changed:      ifiok@btlimited.com 20010605
     changed:      ifiok_moses@yahoo.com 20030917
     source:       RIPE


Here is a message from "Paul Reid" of the delivery service. The message is sent from the same IP address Nigeria as the last message by "Thomas Walter" and they both use the same version of the virus scanner ;-) The following message was sent twice because the first time it was addressed to the name of another lottery scam victim.

Hello Wrongfirstname Wronglastname,

All arrangements have now been finalised and we are waiting on proof 
of payment of the required charges so
that we may courier your winning check and certificate of winnings 
to you.Below are the charges that you required to pay to enable us 
courier your certificate of winnings as well as your certified bank 
check of US$2.5 million to you. We will despatch as soon as we get 
confirmation of payment of the required charges. It
will take twenty-four hours to get them across to you:

We have received the sent informations and confirmed it to be true.

Description Of Parcel to be couriered.

An original certificate of
Winning....................0.35kg
Bank Cheque .............................0.17kg
Total weight of parcel ...............................0.52kg
Colour of parcel .....................................Brown
Lenght of Days .......................................Nextday

Destination of delivery:

NAME: 
ADDRESS:

PLEASE RE CONFIRM FULL NAMES AND ADDRESS

Please find below our charges:

Courier charges .............................US$193.00
Administrative ............................. US$175.00
Taxes ..................................... US$167.00
Insurance .................................. US$194.00
TOTAL ......................................US$729.00

You are to make the payment through western union money transfer 
so as to speed up the process of sending your winnings. You are 
to make the payment through the name of our accounts 
officer below:

Mr Simin William
25 HILLSIDE DRIVE,
EDGWARE,LONDON
HA8 7PF
UNITED KINGDOM

After payment, you are to send us the following information which 
you will find on the receipt of the transfer after you must have 
made the transfer. The details are: money transfer control number, 
senders name and address as it appears in the transfer,amount sent,
test question and answer if any. .

Please note that on confirmation of the paid charges,the date and 
time of departure and expected date of delivery will be sent to you.

We are glad to be of service to you.

Paul Reid
Speedfast Worldwide Services
Rovex House, Hay Hall Rd., Tyseley,
Birmingham. B11 2AG. England 

_______________________________________________________________
Get the FREE email that has everyone talking at http://www.mail2world.com
250MB & 2GB Email Accounts – POP3 – Calendar – SMS – Translator - Much More! 


--------------------------------------------------------------------------------

No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.7.2 - Release Date: 3/11/2005

Message headers:

Received: from [213.181.83.2] by mail2Consultant.com
 with HTTP; 3/15/2005 12:03:51 AM PST
thread-index: AcUpNYaAZ9y3DqxSSKif1nqUKEaoTA==
Thread-Topic: COURIER CHARGES
From: "speedfast courier" <speedfastworldwide@mail2Consultant.com>
To: emailaddress
Subject:  COURIER CHARGES
Date: Tue, 15 Mar 2005 00:03:51 -0800


The following reply comes from a different ISP in Nigeria:

Hello Surname,
Thank you again.We hope that you got our instructions clearly and 
like i told you on phone earlier today you are to make the courier 
charges immediately and get back to us.You are to acknowledge this 
email also.Once again congratulations.
Warmest Regards,
Mr Paul Reid. 
_______________________________________________________________
Get the FREE email that has everyone talking at http://www.mail2world.com
250MB & 2GB Email Accounts – POP3 – Calendar – SMS – Translator - Much More! 

--------------------------------------------------------------------------------

No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.7.3 - Release Date: 3/15/2005

Message headers:

Received: from [81.199.85.64] by mail2Consultant.com
 with HTTP; 3/15/2005 10:05:39 AM PST
thread-index: AcUpiZicsAED2asERNG/6j0hicGSqw==
Thread-Topic: THANK YOU
From: "speedfast courier" <speedfastworldwide@mail2Consultant.com>
To: <emailaddress>
Subject: THANK YOU
Date: Tue, 15 Mar 2005 10:05:39 -0800

WHOIS details for sending network (IP 81.199.85.64):

     inetnum:      81.199.84.0 - 81.199.87.255
     netname:      CIDR-COMMUNICATION-01
     descr:        Internet service provider
     country:      NG
     admin-c:      TECH7-RIPE
     tech-c:       TECH7-RIPE
     status:       ASSIGNED PA
     notify:       lir@ipplanet.net
     mnt-by:       AS12491-MNT
     changed:      lir@ipplanet.net 20040902
     source:       RIPE
     
     person:       Tech Supernet300
     address:      21 Mobolaji Bank
     address:      Anthony Way Ikeja
     address:      Lagos
     address:      Nigeria
     phone:        + 234 1 4976493
     e-mail:       admin@supernet300.com
     nic-hdl:      TECH7-RIPE
     changed:      lir@ipplanet.net 20040902
     source:       RIPE


Goodday Lastname,
We had made an attempt to call you earlier today and are now writing 
you to inform you we are still awaiting to hear from you regarding 
the courier fee so we can send out your winning cheque to you.
Once again congratulations .
Mr Paul Reid. 
_______________________________________________________________
Get the FREE email that has everyone talking at http://www.mail2world.com
250MB & 2GB Email Accounts – POP3 – Calendar – SMS – Translator - Much More! 

--------------------------------------------------------------------------------

No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.7.3 - Release Date: 3/15/2005

Message headers:

Received: from [213.181.83.2] by mail2Consultant.com
 with HTTP; 3/16/2005 10:10:27 AM PST


Message headers:

jwSpamSpy
Are you sick of spam too? Do you want it stopped now?
Try jwSpamSpy, the spamfilter we use to track the spammers!
Free 30-day trial version available now!