|
419 Scam Example: "CapTrust Finance and Securities Amsterdam"
"CapTrust Finance and Securities Amsterdam" is a fake lottery scam run by a gang in the Netherlands. They demand payment of € 850 for processing a lottery prize which is never paid out because it doesn't exist. There is no lottery company called "European Lottery International" or "European Lotto International" as listed on the fake certificates used in this scam. In fact the presence of the word "International" in the name of any lottery company is a sure sign of a scam: All legitimate lotteries are organized strictly for residents of one particular country or state. There are no "international" lotteries. In some cases the victims of this scam were contacted once more several months later and were told the employee they dealt with before had been fired and they could once more claim their prize. This is of course just an extension of the scam, as the criminals try to extract as much money as possible from the victims. All phone numbers used in the scam are Dutch mobile phones. It appears to be the same scam as FEIRENS FINANCE BV / Jason Van Aken.
Example of "winning notification":
From: "Euro Lottery International" <eurolottery2005@zwallet.com>
Money demand from "CAPTRUST FINANCE AND SECURITIES":
CAPTRUST FINANCE AND SECURITIES Message headers: Received: from imo-d01.mx.aol.com (imo-d01.mx.aol.com [205.188.157.33]) by h782.serverid.net (h782.serverid.net) with ESMTP id 501F82F4511 for <emailaddress>; Wed, 27 Apr 2005 12:27:24 +0200 (CEST) Received: from captrustfinance@netscape.net by imo-d01.mx.aol.com (mail_out_v38_r1.7.) id d.1af.ddfd299 (16239) for <emailaddress>; Wed, 27 Apr 2005 06:27:14 -0400 (EDT) Received: from netscape.net (mow-d15.webmail.aol.com [205.188.139.131]) by air-in03.mx.aol.com (vx) with ESMTP id MAILININ33-3f6f426f69012ed; Wed, 27 Apr 2005 06:27:13 -0400 Date: Wed, 27 Apr 2005 06:27:13 -0400 From: captrustfinance@netscape.net To: emailaddress Subject: Approval! MIME-Version: 1.0 Message-ID: <1C36FF24.3712D775.446712F6@netscape.net> X-Mailer: Atlas Mailer 2.0 X-AOL-IP: 62.234.157.6 X-AOL-Language: english
WHOIS details for sending network (IP 62.234.157.6):
inetnum: 62.234.128.0 - 62.234.191.255
netname: EURONET-ADSL
descr: Euronet Internet BV
descr: Muiderstraat 1
descr: 1011 PZ Amsterdam
country: NL
admin-c: EIAR1-RIPE
tech-c: EIAR1-RIPE
status: ASSIGNED PA
mnt-by: EURONET-MNT
source: RIPE # Filtered
role: EuroNet Internet Administrative Role Account
address: Wanadoo Nederland BV (formerly EuroNet Internet BV)
address: Network Department
address: Muiderstraat 1
address: 1011 PZ Amsterdam
address: The Netherlands
phone: +31 20 535 5555
fax-no: +31 20 535 5400
e-mail: eiar1@euro.net
admin-c: AW2096-RIPE
admin-c: RK31337-RIPE
tech-c: BL78
tech-c: FB1141-RIPE
tech-c: GD31337-RIPE
tech-c: HT772-RIPE
nic-hdl: EIAR1-RIPE
remarks: In case of abuse issues, please contact abuse@wanadoo.nl
mnt-by: EURONET-MNT
source: RIPE # Filtered
% Information related to 'EIAR1-RIPE'
route: 62.234.0.0/16
descr: EuroNet Internet
origin: AS5390
mnt-by: EURONET-MNT
source: RIPE # Filtered
After the initial € 850 have been paid, the criminals then demand another € 5000 in "tax" plus € 220 in "attorney fees":
Dear Lastname Firstname, Message headers: Received: from omail9.walla.co.il (omail9.walla.co.il [192.118.71.129]) by h782.serverid.net (h782.serverid.net) with ESMTP id 0A8402F59FE for <emailaddress>; Thu, 28 Apr 2005 14:56:57 +0200 (CEST) Date: Thu, 28 Apr 2005 15:56:55 +0300 Received: from ([81.206.142.219]) by omail1.walla.co.il ([192.118.71.123]) with HTTP; Thu, 28 Apr 2005 15:56:54 +0300 From: =?UTF-8?Q?=43=61=70=20=54=72=75=73=74?= <captrustsecurities@walla.com> X-Sender: captrustsecurities@walla.com X-Originating-Email: [captrustsecurities@walla.com] X-Originating-IP: [81.206.142.219]
WHOIS details for sending network (IP 81.206.142.219):
inetnum: 81.206.0.0 - 81.206.255.255
netname: NL-PMG-ADSL
descr: ADSL9
country: NL
admin-c: PT978-RIPE
tech-c: PT978-RIPE
status: ASSIGNED PA
mnt-by: AS8737-MNT
remarks: Please mail abuse issues to: abuse@planet.nl
remarks: Please mail security issues to: security@planet.nl
source: RIPE # Filtered
role: Planet Technologies
address: Stationsstraat 115 (visit address)
address: P.O. box 3053
address: 3800 DB Amersfoort
address: The Netherlands
phone: +31 30 6588612
e-mail: lir@planet.nl
nic-hdl: PT978-RIPE
admin-c: RH13540-RIPE
tech-c: RH13540-RIPE
tech-c: PFOR-RIPE
tech-c: NKOL-RIPE
remarks: For security & abuse issues see inetnum.
mnt-by: AS8737-MNT
source: RIPE # Filtered
% Information related to 'PT978-RIPE'
route: 81.204.0.0/14
descr: PIADDR
origin: AS8737
mnt-by: AS8737-MNT
source: RIPE # Filtered
|