|
419 Scam Example: "NETXPRESS LOTTERY INTERNATIONAL / Mr.GEORGE WILLIAMS / George Williams & Associates / Netxpress Diplomatic Courier Services"
"NETXPRESS LOTTERY INTERNATIONAL / Mr.GEORGE WILLIAMS" are labels used by a gang in Nigeria and the UK for a fake lottery fraud (advance fee fraud, "419"). Emails sent by "Mr.GEORGE WILLIAMS", who uses a UK postal address and UK phone numbers, are actually sent from Nigeria. The scam involves a fake lottery, a fake lawyer and a fake courier company. The lawyer and courier company send emails from the same IP address. The courier company also sends mail from a different IP address used in the Greenwood Consultants Ltd fake lottery scam. Probably NETXPRESS and GREEENWOOD CONSULTANTS LTD are different labels for the same scam. Several of these scams use the nonexistant postal address "7a Omiston Grove" in London and send emails from the same IP address 80.88.128.12.
Domains used in this scam:
Example of "NETXPRESS LOTTERY INTERNATIONAL" scam email: From: "jonathan meyers" Reponse from the claims agent: ATTN:FIRSTNAME LASTNAME, Message headers: Received: from [80.88.128.12] by web42105.mail.yahoo.com via HTTP; Wed, 16 Feb 2005 10:46:31 PST Date: Wed, 16 Feb 2005 10:46:31 -0800 (PST) From: george williams <georgewilliamchambers@yahoo.com> Subject: YOUR WINNING PRIZE.
WHOIS details for sending network (IP 80.88.128.12): inetnum: 80.88.128.0 - 80.88.128.127 netname: EMP-MFG-NOC descr: Central infrastucture for Emperion at Middelfartgade. descr: Supports various NMS systems, IP DVB Encoders as well as one descr: router pr. customer link. country: DK admin-c: KW6968-RIPE tech-c: EMP5-RIPE status: ASSIGNED PA notify: noc@emperion.net mnt-by: EMP-NOC-MNT changed: hostmaster@ripe.net 20010829 changed: kmw@Emperion.net 20010903 changed: kmw@Emperion.net 20010906 changed: gbl@emperion.net 20030210 source: RIPE route: 80.88.128.0/20 descr: DK-EMPERION-20010828-ROUTE origin: AS21125 mnt-by: EMP-NOC-MNT changed: kmw@Emperion.net 20010906 source: RIPE role: Emperion NOC Operator address: Emperion A/S address: Middelfartgade 7 address: 2100 Koebenhavn Oe address: DK phone: +45 3929 3530 e-mail: noc@emperion.net trouble: kmw@emperion.net admin-c: KW6968-RIPE tech-c: KW6968-RIPE tech-c: SRL7-RIPE tech-c: AJ163-RIPE tech-c: GB1283-RIPE tech-c: FL497-RIPE nic-hdl: EMP5-RIPE notify: noc@emperion.net mnt-by: EMP-NOC-MNT changed: KMW@EMPERION.NET 20010906 changed: kmw@emperion.net 20020110 changed: kmw@emperion.net 20021107 source: RIPE person: Kim Wohlert address: Emperion A/S address: Middelfartgade 7 address: 2100 Koebenhavn Oe address: DK phone: +45 3929 3530 e-mail: kmw@emperion.net nic-hdl: KW6968-RIPE mnt-by: EMP-NOC-MNT changed: andreas@dk.uu.net 20010807 changed: hostmaster@dk.uu.net 20010903 changed: kmw@emperion.net 20020110 source: RIPE
WHOIS details for "georgewilliamchambers.com" (created 2005-10-26): Request: georgewilliamchambers.com connected to whois.enom.com [66.151.151.170:43] ... Registration Service Provided By: Microsoft Contact: personal_address@css.one.microsoft.com Visit: http://support.msn.com/contactus.aspx?pk=PersonalAddress Domain name: georgewilliamchambers.com Registrant Contact: george williams george williams (INFO@georgewilliamchambers.com) +1.3104554777 Fax: none 887 glenway drive #4 inglewood inglewood, CA 90302 US Administrative Contact: george williams george williams (INFO@georgewilliamchambers.com) +1.3104554777 Fax: none 887 glenway drive #4 inglewood inglewood, CA 90302 US Technical Contact: NOC MSN NOC MSN (MSN-PA-TECH@msn.com) +1.4258828080 Fax: none One Microsoft Way Redmond, WA 98052 US Billing Contact: NOC MSN NOC MSN (MSN-PA-BILL@MSN.COM) +1.4258828080 Fax: none One Microsoft Way Redmond, WA 98052 US Status: Locked Name Servers: pdomns1.msn.com pdomns2.msn.com Creation date: 26 Oct 2004 05:32:22 Expiration date: 26 Oct 2005 05:32:22 Then the fake lawyer passes the victim on to the fake courier company, who are the ones who demand cash from the victim. Emails from the "lawyer" and the "courier service" are actually sent from the Emperion IP address in West Africa, i.e. are probably sent from the same Internet cafe in Nigeria by the same gang.
Attention:FIRSTNAME LASTNAME, Congratulations! The Notarisation of your your papers have been completed by the elected Certified Notary Public.Your Winning cheque and Certificate are now ready,and will be dispatched to the Courier company for onward delivery to your specified address.Bear in mind that the checks have been made out in two instalments of 625,000 euros each.This according to the promoters is to ensure that all winners get part of their payment at a time instead of one winner having 1.250m euros while others have nothing.So,the courier company will deliver the first instalment to you In your mail,you elected the courier service option,in this vein you are advised to contact NETXPRESS DIPLOMATIC COURIER SERVICES LONDON; find hereunder their contact information: NETXPRESS DIPLOMATIC COURIER SERVICES,JERMYN STREET LONDON SW1Y 4UH, UNITED KINGDOM. Communication with the courier company in this regard should be addressed to The Customer Relations Officer, MRS JANET HARRISON through her email: customerservice@netxpresscourier.com It is necessary that you formaly notify her that you want the courier firm to deliver your cheque winnings along with the winnings certificate,and what it will cost you. Attached is a scanned copy of your winning Certificate.I cannot not send you a copy of your cheque for obvious security reasons.Please call to confirm if indeed you receive it. Note that it is necessary that you update us on developments with regards to the courier firm,be sure to give the address you want the parcel delivered to.Your winning may also be taxable in your country of origin.The taxes however vary from one country to another.We just taught you should know all these.We also hope you spend your winning wisely and donate some to charity. Sincerely, Mr.GEORGE WILLIAMS, George Williams & Associates (Legal Practitioners/Notary Public) 7a Omiston Grove, London,EC3N 2PR United Kingdom. TEL+447040116180 FAX+448701300393 ************************************************************************ The information contained in this email and/or attachments is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. If you are not the intended recipient of this email, please delete the message and notify the sender. You must not copy, disclose, reproduce or disseminate in any way or act in reliance of the information contained within it. Any views or opinions presented are solely those of the author, except where the individual is authorised to express views on behalf of George Williams & Associates.
Return-Path: <info@netxpresslottery.com> Received: from 64.4.22.54 (EHLO hotmail.com) (64.4.22.54) by mta109.mail.dcn.yahoo.com with SMTP; Thu, 17 Feb 2005 08:09:03 -0800 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Thu, 17 Feb 2005 08:09:00 -0800 Received: from 83.170.12.18 by by23fd.bay23.hotmail.msn.com with HTTP; Thu, 17 Feb 2005 16:08:47 GMT X-Originating-IP: [83.170.12.18] X-Originating-Email: [info@netxpresslottery.com] X-Sender: info@netxpresslottery.com From: "jonathan meyers" <info@netxpresslottery.com> To: emailaddress Subject: YOUR CHECK AND WINNING CERTIFICATE. Date: Thu, 17 Feb 2005 16:08:47 +0000 Mime-Version: 1.0 Content-Type: text/plain; format=flowed X-OriginalArrivalTime: 17 Feb 2005 16:09:00.0966 (UTC) FILETIME=[FE441C60:01C5150A] Content-Length: 420 ATTENTION: FIRSTNAME LASTNAME, THIS IS TO INFORM YOU THAT YOUR WINNING CERTIFICATE AND PRIZE MONEY HAS BEEN PROCESSED FOR DELIVERY TO YOU.PLEASE CONTACT YOUR CLAIMS/FUDICIARY AGENT FOR ONWARD DELIVERY TO YOU.THANK YOU FOR BEING PART OF OUR INTERNATIONAL PROMOTIONS PROGRAM.WE HOPE YOU WILL TAKE PART IN NEXT YEAR'S SWEEPSTAKE. CONGRATULATIONS ONCE MORE. YOUR FAITHFULLY, JONATHAN MEYERS FOR NETXPRESS INTERNATIONAL.
WHOIS details for sending network (IP 83.170.12.18): inetnum: 83.170.12.0 - 83.170.13.255 netname: DE-IABG-TELEPORT-COBRANET-ISP descr: IABG - Teleport customer CobraNet country: LB admin-c: HM1517-RIPE tech-c: ED740-RIPE status: ASSIGNED PA notify: guardian@teleport-iabg.de mnt-by: IABG-MNT changed: gabriel@iabg.de 20040616 source: RIPE route: 83.170.0.0/18 descr: IABG mbH origin: AS29259 notify: lir.teleport@iabg.de mnt-lower: IABG-MNT mnt-routes: IABG-MNT mnt-by: IABG-MNT changed: bschmidt@teleport-iabg.de 20040420 source: RIPE person: Hikmat Mardo address: Lagos-Nigeria address: Lekki Phase 1 address: rafiu babatunde street plot 8 phone: +23417767720 phone: +234802 832 2133 phone: +23415555656 phone: +9613666325 e-mail: hjm@cobranet.org nic-hdl: HM1517-RIPE notify: guardian@teleport-iabg.de mnt-by: IABG-MNT changed: gabriel@iabg.de 20040617 source: RIPE person: Elie Dib address: Lagos-Nigeria address: Lekki Phase 1 address: rafiu babatunde street plot 8 phone: +9613235266 e-mail: elie@cobranet.org nic-hdl: ED740-RIPE notify: guardian@teleport-iabg.de mnt-by: IABG-MNT changed: gabriel@iabg.de 20040617 source: RIPE
WHOIS details for domain "netxpresslottery.com" (created 2004-10-26):
Request: netxpresslottery.com connected to whois.enom.com [66.151.151.170:43] ... Registration Service Provided By: Microsoft Contact: personal_address@css.one.microsoft.com Visit: http://support.msn.com/contactus.aspx?pk=PersonalAddress Domain name: netxpresslottery.com Registrant Contact: louis gomez louis gomez (admin@netxpresslottery.com) +1.3104554777 Fax: none 887 glenway drive #4 inglewood inglewood, CA 90302 US Administrative Contact: louis gomez louis gomez (admin@netxpresslottery.com) +1.3104554777 Fax: none 887 glenway drive #4 inglewood inglewood, CA 90302 US Technical Contact: NOC MSN NOC MSN (MSN-PA-TECH@msn.com) +1.4258828080 Fax: none One Microsoft Way Redmond, WA 98052 US Billing Contact: NOC MSN NOC MSN (MSN-PA-BILL@MSN.COM) +1.4258828080 Fax: none One Microsoft Way Redmond, WA 98052 US Status: Locked Name Servers: pdomns1.msn.com pdomns2.msn.com Creation date: 26 Oct 2004 04:43:51 Expiration date: 26 Oct 2005 04:43:51
Email from the fake courier company: Attn: FIRSTNAME LASTNAME, We are in receipt of your mail,requesting our services in delivering your Lottery winning Certificate and Cheque to you.We extend our warm and sincere congratulations on your winning.You must be a lucky person to have won this lottery. The total amount you won is 1.250. million euros which will be paid in 2 instalments of 625.000.euros (BARCLAYS BANK OF ENGLAND INTERNATIONAL BANK DRAFT) each.The first package is ready for delivery. Ours is not the conventional run of the mill courier delivery.We are a diplomatic courier service.We specialise in the delivery of "diplomatic items and sensitive materials" hence the obvious choice by the promoters of this lottery for the delivery of your package. It will cost you a total of 250.00 Pounds for the Cheque and the Certificate which are going to be sent to you as seperate packages. The packages will be delivered to you within 4 working days after receipt of courier charges(250.00 Pounds) to be paid via Western Union Money Transfer(www.westernunion.com ) to expediate action. You are advised to make the payment with the following information: NAME OF RECEIVER: CHRIS WILLIAMS ADDRESS: LONDON, UNITED KINGDOM. CHRIS WILLIAMS is the Head of Accounts Department. forward to him the full payment information as soon as the payment is made on his e-mail: accounts@netxpresscourier.com.He will attach a tracking no to your package. Notify my office as soon as you do this for proper documentation.Also send to us the address where you want the packages to be delivered to.You shall have your full receipt and tracking nos sent to you upon comfirmation of your payment from the accounts dept so that you can track the movement of the package.Please remember to include your mobile phone nos incase our official do not meet you at the point of delivery.Bear in mind he cannot deliver to anyone else except you.Keep proper indentification please. Best Regards, JANET HARRISON, Netxpress Diplomatic Courier Services NO 1 JERMYN STREET LONDON SW1Y 4UH, UNITED KINGDOM Message headers: Received: from 80.88.128.12 by by23fd.bay23.hotmail.msn.com with HTTP; Fri, 18 Feb 2005 15:51:52 GMT X-Originating-IP: [80.88.128.12] X-Originating-Email: [customerservice@netxpresscourier.com]
WHOIS details for 419 fraud domain "netxpresscourier.com" (created 2004-10-26) Request: netxpresscourier.com connected to whois.melbourneit.com [203.27.227.114:43] ... Domain Name.......... netxpresscourier.com Creation Date........ 2004-10-26 Registration Date.... 2004-10-26 Expiry Date.......... 2005-10-26 Organisation Name.... billy bush Organisation Address. 887 glenway drive #4 inglewood Organisation Address. Organisation Address. inglewood Organisation Address. 90302 Organisation Address. CA Organisation Address. UNITED STATES Admin Name........... billy bush Admin Address........ 887 glenway drive #4 inglewood Admin Address........ Admin Address........ inglewood Admin Address........ 90302 Admin Address........ CA Admin Address........ UNITED STATES Admin Email.......... admin@netxpresscourier.com Admin Phone.......... +1.3104554777 Admin Fax............ Tech Name............ MSN NOC Tech Address......... One Microsoft Way Tech Address......... Tech Address......... Redmond Tech Address......... 98052 Tech Address......... WA Tech Address......... UNITED STATES Tech Email........... MSN-PA-TECH@msn.com Tech Phone........... +1.4258828080 Tech Fax............. Name Server.......... pdomns1.msn.com Name Server.......... pdomns2.msn.com
Fake lottery website http://www.primelottery.7p.com/contact.html AFRICA Franklin Giyamo, South Africa. SA@PrimeLottery.7p.com ASIA Oyibo Yunamugu Japan JP@PrimeLottery.7p.com AUSTRALIA Caroline Bryan Sydney AU@PrimeLottery.7p.com CANADA Jefferson O'Connor Toronto CA@PrimeLottery.7p.com EUROPE Todd Hendricks Finland FN@PrimeLottery.7p.com MIDDLE EASTERN REGIONS Ali Al-Mudibh Iran IR@PrimeLottery.7p.com USA Michael Andrews New York US@PrimeLottery.7p.com Past Winner Comments "This lottery is stunning!. They have completely changed my life forever.. One day I just received a rather mysterious email stating that I had won $2 million dollars in some lottery I never even entered for. At first I thought it was all some mischievous prank, but my curiosity got the better of me and I decided to follow it through to the end since I had nothing to lose...and I couldn't believe my ears when my bank called to confirm that the transfer had been made... I've actually just paid for my dream house in Jamaica and I think I might decide to take a cruise around the world or something...I'm still yet to recover from the shock! -Marilyn Zwelter, Oldville, Ontario, Canada. 2002 Winner The following is a reply from the claims agent of a fake lottery. The winning notification was sent by "Mrs. Grace smith": To file for your claim, please contact our fiducial agent: Mr. NEWTON O. GREEN at:Reply Email:newtongreenw@yahoo.co.uk Here is the reply: From: "Newton Green" <newtongreenw@yahoo.co.uk> To: Firstname Lastname <emailaddress> Sent: Thursday, 03 March, 2005 1:49 Subject: Re: PRIZE ATTENTION: Sir/Ma, I am Mr.Newton Green the fiduciary agent assigned to your case. I wish to Congratulate you on your victory, you are a lucky person to have won this lottery. Your email address was amongst those chosen this quarter from our new java-based software that randomly selects email addresses from the web from which winners are selected. You are required to forward the following details to help facilitate the processing of your claims and certificate which will facilitate the release of your winnings. 1. Full names. 2. Phone number. 3. Fax number. 4. Occupation. 5. Sex. 6. Age. 7. Nationality. You are advised to forward this information as soon as possible to enable us attend to your winnings. Our firm has been contracted to handle payments on your behalf, once we confirm your information, your payments would be processed. Everything was done in such a way that our payments mode would meet the standards set by the Lottery boards. After you have sent down these information, a certificate will be prepared for you. This is to be your proof of winning from this office to the payment center before they release your funds. Be advised that your winnings would be paid to you in Four(4) installments of 500,000.00 Pounds {Five Hundred Thousand Pounds}. This is done because of the amount won by you. You are advised to keep your winning numbers secret to avoid unscrupulous elements fromtaking advantage of the situation. Once again, congratulations. Sincerely, Mr. Newton Green Newton Green & associates 7a Omiston Grove, London,EC3N 2PR United Kingdom ........................................................... This email and its attachments are confidential and intended for the exclusive use of the addressee(s).This email and its attachments may also be privileged or protected by legal rules. If you have received this by mistake please let us know by reply immediately and destroy the email and its attachments without reading, copying or forwarding the contents. This scam email was sent from the same address as the email by "JANET HARRISON, Netxpress Diplomatic Courier Services": Received: from [] by web26503.mail.ukl.yahoo.com via HTTP; Wed, 02 Mar 2005 16:49:45 GMT Date: Wed, 2 Mar 2005 16:49:45 +0000 (GMT) From: Newton Green <newtongreenw@yahoo.co.uk> Subject: Re: PRIZE
|