Fraudulent domains:
Sample scam email:
Attention: Firstname Lastname
This is to notify you that the time frame for unprocessed winnings has
almost elapsed. You are adviced to either process your winnings on or before
5th OF March (12 NOON GMT) or forfeit your prize money.
If you do not respond to this message positively, it will be taken as an
acknowledgement of this notification.You are advised to act promptly as we
will not be liable for forfeiture of your winnings. As all previous
correspondence will be disregarded. Also note most importantly that we do
not deal with second or third parties in the payment of winnings. We only
deal with winners who are ascertained legitimate winners. Do not send
anybody as he would not be attended to. If he has the funds he can transfer
through western union with the information given below;
Jack Smith
London, UK.
I will advice that you oblige the claims procedure to avoid any
inconvenience or cancellation of winnings which is getting close.
I look forward to your prompt response.
Regards,
Mr. Daniel Khan
FOREIGN SERVICE MANAGER,
UNIVERSAL SECURITY & FREIGHT UK
Message headers:
Note that "Daniel Khan" of "Universal Security and Freight UK" is writing from the email address of "Henrick Koenraad" of the "European Gaming Commision", two different fake identities used for the same scam.
Received: from 82.128.3.181 by by21fd.bay21.hotmail.msn.com with HTTP;
Mon, 28 Feb 2005 19:41:38 GMT
X-Originating-IP: [82.128.3.181]
X-Originating-Email: [henrickkoenraad@eu-gamingcommission.net]
X-Sender: henrickkoenraad@eu-gamingcommission.net
WHOIS details for sending network (IP 82.128.3.181):
inetnum: 82.128.0.0 - 82.128.31.255
netname: INET-MLTL
descr: Multi-Links Telecommunications Limited
country: NG
admin-c: DG26
tech-c: RIA27
status: ASSIGNED PA
notify: deep@multi-links.com
mnt-by: MLTL-INT-MNT
changed: deep@multi-links.com 20040416
changed: hostmaster@afrinic.net 20050205
remarks: data has been transferred from RIPE Whois Database 20050221
source: AFRINIC
person: Dwaipayan Ghosh
address: 231, Adeola Odeku Street
Victoria Island
Lagos, Nigeria
phone: +23417751039
e-mail: deep@multilinks.com
nic-hdl: DG26
notify: deep@multillinks.com
changed: deep@multilinks.com 20030507
changed: hostmaster@afrinic.net 20050205
remarks: data has been transferred from RIPE Whois Database 20050221
source: AFRINIC
person: IP Admin-RIPE
address: Multilinks Telecommunications Limited
address: 231 Adeola Odeku Str.
address: Victoria Island, Lagos, Nigeria
e-mail: ipadmin@multilinks.com
remarks: complaints/spam report : abuse@multilinks.com
phone: +2341774000
nic-hdl: RIA27
changed: techadmin@multilinks.com 20040331
changed: hostmaster@afrinic.net 20050205
remarks: data has been transferred from RIPE Whois Database 20050221
source: AFRINIC
WHOIS details for domain "eu-gamingcommission.net" (created 2005-01-27, complaints to abuse@msn.com)
Request: eu-gamingcommission.net
connected to whois.melbourneit.com [203.27.227.114:43] ...
Domain Name.......... eu-gamingcommission.net
Creation Date........ 2005-01-27
Registration Date.... 2005-01-27
Expiry Date.......... 2006-01-27
Organisation Name.... Eu-Gaming Commission
Organisation Address. 44 Wall Street 22nd Floor
Organisation Address.
Organisation Address. new york
Organisation Address. 10005
Organisation Address. NY
Organisation Address. UNITED STATES
Admin Name........... Eu-Gaming Commission
Admin Address........ 44 Wall Street 22nd Floor
Admin Address........
Admin Address........ new york
Admin Address........ 10005
Admin Address........ NY
Admin Address........ UNITED STATES
Admin Email.......... info@eu-gamingcommission.net
Admin Phone.......... +1.3473288775
Admin Fax............
Tech Name............ MSN NOC
Tech Address......... One Microsoft Way
Tech Address.........
Tech Address......... Redmond
Tech Address......... 98052
Tech Address......... WA
Tech Address......... UNITED STATES
Tech Email........... MSN-PA-TECH@msn.com
Tech Phone........... +1.4258828080
Tech Fax.............
Name Server.......... pdomns1.msn.com
Name Server.......... pdomns2.msn.com
Anti-Terrorism certificates
Drug-Free certificates
No such certificates actually exist. No such certificates are required for International wire transfers.
These fake documents are a tactical device 419 scams to tap victims for more money. They are supposedly issued by the International Court of Justice in Den Haag or by the local government in the country where the "lottery" or "bank" used in the scam claims to be located. Usually the criminals charge thousands of dollars for these fake certificates. Payment has to be sent by Western Union or MoneyGram, which means the recipient of the payment can't be traced. Any email that mentions these certificates and asks you to pay for them is a scam!
Example fraud emais:
EU Money Laundry Monetary Team
EU Money Laundry Monetary Team
Amsterdam Netherlands.
Phone: +31-64-921-6227
Fax: +31-84-729-0534
Date: 03/01/06,
Attention: Firstname Lastname,
Be informed that your transfer from Barclays Bank Ref #bls/227/444/wt is already on hold at the EU Apex bank and not even 0.1GBP can be realized from it without the issuance of your Anti-Terrorism certificate from the international court of justice Den Haag in The Netherlands.
Further more, I am sorry deductions can not be made from your funds and as such you would be required to make a personal payment of the required fees.
As soon as we are in receipt of your completed application form more details would be further communicated to you for your prompt attention.
Mr. Thomas Walkden (Sir)
Duty Officer EU MLMT.
--
___________________________________________________
Play 100s of games for FREE! http://games.mail.com/
Message headers:
Date: Tue, 03 Jan 2006 10:14:15 -0500
Subject: Attention: Firstname Lastname
Received: from [81.199.161.53] by ws1-6.us4.outblaze.com with http for
thom_walkden@europe.com; Tue, 03 Jan 2006 10:14:15 -0500
X-Originating-Ip: 81.199.161.53
WHOIS details for sending network (IP 81.199.161.53):
This is a satellite ISP in Israel that connects a lot of African custoemrs to the internet.
inetnum: 81.199.160.0 - 81.199.161.255
netname: IPPLANET-04
descr: IP PLanet Network range
country: il
admin-c: TECH6-RIPE
tech-c: TECH6-RIPE
status: ASSIGNED PA
mnt-by: AS12491-MNT
mnt-lower: AS12491-MNT
mnt-routes: AS12491-MNT
source: RIPE # Filtered
person: Tech IP Planet
address: Yegia Kapaim St.
address: Petach-Tikva
address: Israel
phone: +972 3 9255015
fax-no: +972 3 9217938
abuse-mailbox: abuse@ipplanet.com
nic-hdl: TECH6-RIPE
mnt-by: AS12491-MNT
source: RIPE # Filtered
% Information related to '81.199.160.0/23AS12491'
route: 81.199.160.0/23
descr: IP Planet Network Ltd
origin: AS12491
mnt-by: AS12491-MNT
source: RIPE # Filtered