Spam 419/Nigeria Online fraud jwSpamSpy Contact
Email Spam Filter: |
|
|
419 Scam – "WORLD WIDE CASH CHANGE LTD / PRESTIGIUOS LOTTERY U.K / Gary Blackwell" (Nigeria)
- About the 419 (Advance Fee) scam
- Email addresses used by 419 scammers
- Phone numbers used by 419 scammers
- How to report 419 spam to us
- Domains registered by 419 scammers
- Company names mentioned in 419 spam
- What can you do when you receive 419 spam
- Google search: "WORLD WIDE CASH CHANGE"
- How do the scammers make money: WORLD WIDE CASH CHANGE
"WORLD WIDE CASH CHANGE LTD" is the fake identity used by one Nigerian gang of advance fee fraud ("419") scammers operating in Nigeria, Benin and the United Kingdom. They ask you to send them £4,670 for processing a non-existent lottery win. It's a fraud. (see one example scam email here). Emails signed by "Gary Blackwell" are actually sent from computers in Nigeria and Benin (a small country right next to Nigeria, where the same Yoruba language is spoken). The scam is linked to a company called "GDOTBEN" and an individual named "JUBRIL OMOZOZO".
The four scam operations "HERITAGE FINANCE LTD / NATIONWIDE LOTTO UK", "WORLD WIDE CASH CHANGE / PRESTIGIOUS LOTTO UK", "SOUTHTRUST INVESTMENT PTY. / GOLDEN REEF LOTTERY" and "CASHFLO FINANCIAL SERVICES LTD / IMPERIAL LOTTERY UK" are probably closely related. The first three scams use websites of fake security companies, email from which is sent from Nigeria. They all send similarly worded money demands involving Word documents. The forth scam operation, "CASHFLO FINANCIAL SERVICES LTD / IMPERIAL LOTTERY UK" uses a domain registered with very similar details to the ones used by the "WORLD WIDE CASH CHANGE / PRESTIGIOUS LOTTO UK" scam.
|
Domains and abuse contacts for "WORLD WIDE CASH CHANGE LTD / PRESTIGIUOS LOTTERY U.K"
The scammers have registered websites for the fake lottery and fake claims agent:
Email addresses used with these domains (compare with
"Heritage Finance",
"CASHFLO FINANCIAL SERVICES"):
Other email addresses:
Links to similar scams
Example of money demand:
The following email established a clear link to Nigeria:
Another money demand:
This email was sent via MSN from a satellite broadband provider that serves Africa:
The attached "Invoice.doc" lists "System12" as the author and "GDOTBEN COMMUNICATION LTD" as the company that created the file. Acccording to an entry at businesspatrol.com, this is a company in Nigeria whose director is a Mr. JUBRIL OMOZOZO.
We wonder if "GDOTBEN" means "G . Benin", as in Nigeria's western neighbour country, because "MR. GARY BLACKWELL" is also sending emails from IP address 212.199.108.234 in an address range named "Gilat-ISP-Benin1", which appears to be in Benin, West Africa. We are not sure what the "G" stands for.
According to this thread here another domain used for a fake lottery fraud was registered in the name "JUBRIL OMOZOZO" in March 2003:
Rhyolite Software: Unwelcome Domains lists another domain resistered in this name, same postal address.
WHOIS record for "sprintsecurities.com" (2002-12-04):
Here is another example of a money demand:
Another money demand (2005-01-14):
Another email from the same source (IP 81.199.85.129) on 2005-01-29:
Sending network (IP 81.199.85.129):
This Western Union money demand was forwarded to us on 2005-01-24:
The Benin Connection
The attached "INVOICE.doc" was last saved by "gdotben", author "Word Wide Cash Change", company "Word Wide Cash Change".
Sending network (IP address 212.199.108.234 and 212.199.108.236):
Gilat-ISP-Benin1 is the name of an address range assigned to African customers of satellite provider Golden Lines (Petach-Tiikva, Israel).
Initially we weren't sure if "Benin" really referred to the country of Benin or if it was a reference to Benin City in Edo state, Nigeria. However, since there are other Golden Lines address ranges called Gilat-ISP-Nigeria1, Gilat-ISP-Zimbabew1 and Gilat-ISP-Mozamibque, it seems most likely that the name does refer to the country.
Email addresses used with IP 212.199.108.234:
Other domains used in the past:
MSN / Microsoft have allowed world-widecashchange.net and worldwide-cashchange.net to operate since early November 2004:
abuse@msn.com
Contact information for the web hoster of prestigiouslotteryuk.com and worldwidecashchange.net:
Australian Office:
Address: Unit 1 / 4 Moonbi Street
Brendale Queensland Australia 4500
Phone: 1300 76 4455
Fax: 1300 55 1201
International (+61) 500 844 111 (i.e. 011 61 500 844 111 from the US)
Email:
Sales Enquiries - sales@troublefreehosting.com
Support Requests - support@troublefreehosting.com
This scam is appears closely related to the "HERITAGE FINANCE LTD / DENNIS HAMMOND" scam. Just compare the wording of the scam emails, such as the reasons for the charge. The amount of £4670 demanded of the victims is exactly £1000 more than the amount requested by "Dennis Hammond". Both scams involve websites of fake lotteries and fake claims agents. Most 419 scams don't bother with that and charge much smaller amounts. Both fake lottery sites come complete with internet scam warnings. Domain world-widecashchange.net (hosted by MSN) was registered on 2004-11-07, one day after www.heritagefinanceltd-uk.com (also hosted by MSN), which was registered on 2004-11-06. We strongly suspect that both scams are run by the same people.
Note that the Royal Mail post code finder lists five different post codes associated with street address "73, BELGRAVE ROAD, LONDON", but none of them is "SW1V 2BB".
ATTN:
REFERENCE: PL44125645
Dear prize winner,
Acting on the instructions in your claims file with Reference number
PL44125645, I wish to inform you that payment of your Lottery Claims
amounting to £4,800,000.00 being prize money from prestigious lottery
U.K.
Cash 5 draws has been certified by all authorities involved.
Be informed that instruments of payment for the sum of £4,800,000.00
to you,
is already in our possession and shall be processed upon your meeting
the
requirements stated below. You are required to fill a "Lottery
Winnings
Claim Form" with all necessary details.
LOTTERY WINNING CLAIM FORM 7
REFERENCE NO: _____________ TICKET NO: _______________
FULL NAME:........................................
COMPANY NAME:.....................................
FULL ADDRESS:.....................................
.................................................
................................................
TEL: ...........................
FAX:............................
YOUR EMAIL: .............................
Reply to : foreignservicedirector7@world-widecashchange.net
ACCOUNT COORDINATES (Details of the account where you
want your funds transferred):
.....................................................
.....................................................
....................................................
BRIEF DESCRIPTION OF COMPANY/ INDIVIDUAL:
....................................................
....................................................
....................................................
________________ __________________
Signature Date
Carefully fill out this form and send back either by
fax or by email
You will also be required to pay a fee of £4,670.00 (Four thousand six
hundred and Seventy Great Britain Pounds), or its equivalent in your
local
currency. This payment is to cover transfer charges, Insurance of
vital
documents like prize claim certificate and other transfer documents,
handling and opening of account charges.
Note that your total prize claim of £4,800,000.00 has been insured to
the
real value and as such cannot be deducted from. This is in accordance
with
section 12(7) (b) of the national lottery act of the British Lottery
Affairs
Commission as adopted in 1996 and amended in 2001. This is to protect
winners and to avoid misappropriation of funds.
A certificate of prize claim certificate along side other vital
documents
will be sent to you via Courier service immediately transfer of your
winnings is effected.
Your winnings will be transferred within 24hrs after the receipt of
both
requirements stated above. Congratulations once more, I shall be
awaiting
your filled Lottery Winnings Claims Form.
Sincerely yours,
Mr. Gary Blackwell
WORLD WIDE CASH CHANGE LTD
TEL: +44 2000000177
+44 7005981869
FAX: +44 2075043761
+44 7005982095
EMAIL:foreignservicedirector7@world-widecashchange.net
WEBSITE: www.worldwidecashchange.net
NB: For further information about £4,670.00 (Four thousand six hundred
and
Seventy Great Britain Pounds) U.K, feel free to contact them directly;
LOTTERY COORDINATOR
PRESTIGIUOS LOTTERY U.K
73 BELGRAVE ROAD
LONDON
ENGLAND
SW1V 2BB
UNITED KINGDOM
TEL: 447005947683
FAX: 447005963708
WEBSITE: www.prestigiouslotteryuk.com
Received: from hotmail.com (bay23-f18.bay23.hotmail.com [64.4.22.68]) by
rly-xn01.mx.aol.com (v103.7) with ESMTP id MAILRELAYINXN110-62c41b6351b11a;
Tue, 07 Dec 2004 17:56:30 -0500
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
Tue, 7 Dec 2004 02:54:00 -0800
Message-ID: <BAY23-F180AA6B8B787DCEBFA9C02C0B50@phx.gbl>
Received: from 82.206.150.211 by by23fd.bay23.hotmail.msn.com with HTTP;
Tue, 07 Dec 2004 10:53:24 GMT
X-Originating-IP: [82.206.150.211]
X-Originating-Email: [foreignservicedirector7@world-widecashchange.net]
X-Sender: foreignservicedirector7@world-widecashchange.net
From: "FOREIGN SERVICE DIRECTOR" <foreignservicedirector7@world-widecashchange.net>
To: ################
Subject: payment instruction
Date: Tue, 07 Dec 2004 10:53:24 +0000
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_NextPart_000_67b4_1709_1947"
X-OriginalArrivalTime: 07 Dec 2004 10:54:00.0954 (UTC) FILETIME=[0F3D25A0:01C4DC4B]
X-AOL-IP: 64.4.22.68
------=_NextPart_000_67b4_1709_1947
Content-Type: text/plain; format=flowed
ATTENTION:surname firstname
Dear Prize Winner,
We are in receipt of your completed verification form and it has been
forwarded to our accounts department for verification and documentation.
You are advised to immediately make arrangements to pay our processing fees,
amounting £4,670.00 (Four thousand six hundred and Seventy Great Britain
Pounds), or its equivalent in United States dollars, via money gram money
transfer through our Claims representing officer in the United States. Find
below full details of receiver;
NAME OF RECEIVER: Mr. Francis Thompson
Address of receiver: 7222 Bellerive 2705
Houston, Texas 77036
Tel: 1-713-589-7041
Fax: 1- 832-550-2547
Email:fran_thomp@worldwidecashchangeltduk.net
Please note that you are to send the receipt of payment via email attachment
or fax immediately after making the payment.
We shall conclude arrangements and transfer your prize money into your
account upon confirmation of your processing fees.
A Pro Forma invoice for this payment is sent as an attachment with this
email. Please download it for your perusal.
I await your response.
Sincerely yours,
Mr. Gary Blackwell
WORLD WIDE CASH CHANGE LTD
TEL: +44 2070600695
TEL: +44 7040116624
FAX: +44 2070600698
EMAIL:
foreignservicedirector7@world-widecashchange.net
------=_NextPart_000_67b4_1709_1947
Content-Type: application/msword; name="Invoice.doc"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Invoice.doc"
0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAAPgAAAAAA
AAAAEAAAQAAAAAEAAAD+////AAAAAD0AAAD/////////////////////////////////////
////////////////////////////////////////////////////////////////////////
...
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAA=
------=_NextPart_000_67b4_1709_1947--
inetnum: 82.206.128.0 - 82.206.255.255
org: ORG-IA67-RIPE
netname: Uk-INTELSAT-20031126
descr: PROVIDER Local Registry
descr: Intelsat
country: GB
admin-c: IRA4-RIPE
tech-c: IRTC1-RIPE
tech-c: CQ37-RIPE
tech-c: AT1875-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: AS22351-MNT
mnt-routes: AS22351-MNT
notify: noc@intelsat.com
changed: hostmaster@ripe.net 20031126
changed: hostmaster@ripe.net 20040608
source: RIPE
organisation: ORG-IA67-RIPE
org-name: Intelsat
org-type: LIR
address: Intelsat
address: Chiswick Park, Building 3
address: 566 Chiswick High Road
address: London
address: W45YA
address: United Kingdom
phone: +44 208 899 6035
phone: +1 202 944 6792
phone: +1 202 944 6958
fax-no: +1 202 944 6955
e-mail: augustin.traore@intelsat.com
e-mail: chuan.qin@intelsat.com
admin-c: AT1875-RIPE
admin-c: IRA4-RIPE
admin-c: IRTC1-RIPE
admin-c: CQ37-RIPE
mnt-ref: AS22351-MNT
mnt-ref: RIPE-NCC-HM-MNT
mnt-by: RIPE-NCC-HM-MNT
changed: hostmaster@ripe.net 20040415
source: RIPE
registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Nameservers:
B.NS.INTERLAND.NET
A.NS.INTERLAND.NET
status: ACTIVE
expires: 13-mar-2004
Registrar Data:
Domain Name.......... internationalcontractingcompany.com
Creation Date........ 2003-03-14
Registration Date.... 2003-03-14
Expiry Date.......... 2004-03-14
Organisation Name.... international contracting
Organisation Address. 36 Ralston Rd
Organisation Address.
Organisation Address. atherton
Organisation Address. 94027
Organisation Address. CA
Organisation Address. UNITED STATES
Admin Name........... jubril omozozo
Admin Address........ 36 Ralston Rd
Admin Address........
Admin Address........ atherton
Admin Address........ 94027
Admin Address........ CA
Admin Address........ UNITED STATES
Admin Email.......... beniel1@yahoo.com
Admin Phone.......... 6503638926
Admin Fax............
Domain Name.......... sprintsecurities.com
Creation Date........ 2002-12-04
Registration Date.... 2002-12-04
Expiry Date.......... 2005-12-04
Organisation Name.... Jubril Omozozo
Organisation Address. 36 Ralston Rd
Organisation Address.
Organisation Address. Atherton
Organisation Address. 94027
Organisation Address. CA
Organisation Address. UNITED STATES
Admin Name........... Omozozo Jubril
Admin Address........ 36 Ralston Rd
Admin Address........
Admin Address........ Atherton
Admin Address........ 94027
Admin Address........ CA
Admin Address........ UNITED STATES
Admin Email.......... newton10@usa.net
Admin Phone.......... +1.6503638926
Admin Fax............
ATTENTION:
REFERENCE NO: PL44125645
Dear winner,
Acting on the instructions in your claims file with Reference number
PL44125645, I wish to inform
you that payment of your Lottery Claims amounting to £4,800,000.00 being
prize money from
PRESTIGIUOS LOTTERY U.K. Cash 5 draws has been certified by all authorities
involved.
Be informed that instruments of payment for the sum of £4,800,000.00 to you,
is already in our
possession and shall be processed upon your meeting the requirements stated
below. You are
required to fill a "Lottery Winnings Claim Form" with all necessary details.
Follow the link below to download the form
The form is also sent as attachment with this email. Kindly download
it.After download, print, fill, and send to us either by fax or as an email
attachment.
http://www.worldwidecashchange.net/form3.html
Click on the link above to download the form as .doc or .PDF documents.
OR
http://www.worldwidecashchange.net/claimsform3.html
You will also be required to pay a fee of £4,670.00 (Four thousand six
hundred and Seventy Great
Britain Pounds), or its equivalent in your local currency. This payment is
to cover transfer charges, Insurance of vital documents like prize claim
certificate and other transfer documents, handling and opening of account
charges. Note that your total prize claim of £4,800,000.00 has been insured
to the real value and as such cannot be deducted from. This is in accordance
with section 12(7) (b) of the national lottery act of the British Lottery
Affairs Commission as adopted in 1996 and amended in 2001. This is to
protect winners and to avoid misappropriation of funds.
A certificate of prize claim certificate along side other vital documents
will be sent to you via
Courier service immediately transfer of your winnings is effected.Your
winnings will be transferred within 24hrs after the receipt of both
requirements stated above. Congratulations once more, I shall be awaiting
your filled Lottery Winnings Claims Form.
Truly yours,
MR. GARY BLACKWELL
WORLD WIDE CASH CHANGE LTD
TEL: +44 2000000177
+44 7005981869
FAX: +44 2075043761
+44 7005982095
+44-20-7504-3761
EMAIL: foreignservicedirector3@world-widecashchange.com
NB: For further information about PRESTIGIUOS LOTTERY U.K, feel free to
contact them directly;
LOTTERY COORDINATOR
PRESTIGIUOS LOTTERY U.K
73 BELGRAVE ROAD
LONDON
ENGLAND
SW1V 2BB
UNITED KINGDOM
TEL: 447005947683
FAX: 447005963708
WEBSITE: www.prestigiouslotteryuk.com
=============== CLAIM FORM FORMAT ===============
LOTTERY WINNING CLAIM FORM3
REFERENCE NO: _____________ TICKET NO: _______________
FULL NAME:........................................
COMPANY NAME:.....................................
FULL ADDRESS:.....................................
.................................................
................................................
TEL: ...........................
FAX:............................
YOUR EMAIL: .............................
Reply to : foreignservicedirector3@world-widecashchange.com
ACCOUNT COORDINATES (Details of the account where you
want your funds transferred):
.....................................................
.....................................................
....................................................
BRIEF DESCRIPTION OF COMPANY/ INDIVIDUAL:
....................................................
....................................................
....................................................
________________ __________________
Signature Date
Carefully fill out this form and send back either by fax or by email
Received: from hotmail.com (bay21-f33.bay21.hotmail.com [65.54.233.122])
by mailapps2-int.prodigy.net (8.12.10 083104/8.12.10)
with ESMTP id j0EDKCx8309864
for <emailaddress>; Fri, 14 Jan 2005 08:20:16 -0500
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
Fri, 14 Jan 2005 05:20:11 -0800
Received: from 81.199.85.129 by by21fd.bay21.hotmail.msn.com with HTTP;
Fri, 14 Jan 2005 13:19:10 GMT
X-Originating-IP: [81.199.85.129]
X-Originating-Email: [foreignservicedirector15@worldwide-cashchangeltd.net]
X-Sender: foreignservicedirector15@worldwide-cashchangeltd.net
In-Reply-To: <20050113210752.759.qmail@web80104.mail.yahoo.com>
From: "FOREIGN SERVICE DIRECTOR"
<foreignservicedirector15@worldwide-cashchangeltd.net>
To: emailaddress
Subject: CLAIMS REQUIREMENTS/PROCESSING FORM
Date: Fri, 14 Jan 2005 13:19:10 +0000
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
X-OriginalArrivalTime: 14 Jan 2005 13:20:11.0554 (UTC) FILETIME=[C69F0020:01C4FA3B]
Content-Length: 1322
ATTN:
REFERENCE: PL44125645
Firstname Lastname
Acting on the instructions in your claims file with Reference number
PL44125645, I wish to inform you that payment of your Lottery Claims
amounting to £4,800,000.00 being prize money from prestigious lottery U.K.
Cash 5 draws has been certified by all authorities involved.
Be informed that payment for the sum of £4,800,000.00 to you shall be
processed upon your meeting the requirements stated below. You are required
to fill a "Lottery Winnings Claim Form" with all necessary details. Follow
the link below to download the form
http://www.worldwidecashchange.net/form15.html
Click on the link above to download the form as .doc or .PDF documents.
OR
http://www.worldwidecashchange.net/claimsform15.html
Click on the link above access the form as html document and print it.
After download, print, fill, and send to us either by fax or as an email
attachment.
You will also be required to pay a fee of £4,670.00 (Four thousand six
hundred and Seventy Great Britain Pounds), or its equivalent in your local
currency. This payment is to cover transfer charges; administrative cost,
opening of account charges, Insurance of vital documents like prize claim
certificate and other transfer documents, that will be sent to you via
Courier service immediately transfer of your winnings is effected.
Note that your total prize claim of £4,800,000.00 has been insured to the
real value and it is against the Gaming control rules here in Britain to
deduct the above fees from the prize money for any reason whatsoever.
You are required to respond and act without delay to all instructions
provided above to ensure a glitch free procedure that will facilitate the
transfer of you prize money.
Upon the reception of both requirements stated above, we shall send a mail
giving you specific instructions on how to remit the fees.
Congratulations once more, I shall be awaiting your filled Lottery Winnings
Claims Form.
Sincerely yours,
Mr. Gary Blackwell
WORLD WIDE CASH CHANGE LTD
TEL: +44 2070600695
TEL: +44 7040116624
FAX: +44 2070600698
FAX: +44 2075043761
EMAIL:foreignservicedirector15@worldwide-cashchangeltd.net
www.worldwidecashchange.net
NB: NB: For further information about PRESTIGIOUS LOTTERY U.K, feel free to
contact them directly;
LOTTERY COORDINATOR
PRESTIGIOUS LOTTERY U.K
73 BELGRAVE ROAD
LONDON
ENGLAND
SW1V 2BB
UNITED KINGDOM
TEL: 44 2070601803
FAX: 44 7005963708
www.prestigiouslotteryuk.com
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
Sat, 29 Jan 2005 05:06:00 -0800
Received: from 81.199.85.129 by by21fd.bay21.hotmail.msn.com with HTTP;
Sat, 29 Jan 2005 13:05:55 GMT
X-Originating-IP: [81.199.85.129]
X-Originating-Email: [foreignservicedirector15@worldwide-cashchangeltd.net]
X-Sender: foreignservicedirector15@worldwide-cashchangeltd.net
In-Reply-To: <20050129051925.13191.qmail@web14127.mail.yahoo.com>
From: "FOREIGN SERVICE DIRECTOR"
inetnum: 81.199.84.0 - 81.199.87.255
netname: CIDR-COMMUNICATION-01
descr: Internet service provider
country: NG
admin-c: TECH7-RIPE
tech-c: TECH7-RIPE
status: ASSIGNED PA
notify: lir@ipplanet.net
mnt-by: AS12491-MNT
changed: lir@ipplanet.net 20040902
source: RIPE
person: Tech Supernet300
address: 21 Mobolaji Bank
address: Anthony Way Ikeja
address: Lagos
address: Nigeria
phone: + 234 1 4976493
e-mail: admin@supernet300.com
nic-hdl: TECH7-RIPE
changed: lir@ipplanet.net 20040902
source: RIPE
Dear Prize Winner,
Thanks for your prompt response, our accounts department has verified your
claims form and you can now go ahead and make the payment of the processing
fees.
However I insist you make the payment via telegraphic transfer, as we do not
accept demand draft as means of payment of the processing fees.
Also if it is possible to make the payment of the fees via western union
money transfer that would be very much preferable find details of our
account officer who you can make payment of the fees to via western union
money transfer.
Name of receiver: Mr. Thomas Houser.
Address of receiver: 40 GROSVENOR SQUARE
W1A 1AE LONDON
UNITED KINGDOM
In the event of this method of payment been unavailable in your country,
stick to the telegraphic transfer and make the payment of the fees on
Tuesday and send immediately the receipt of payment of the processing fees.
Thanks for your cooperation and understanding.
Truly yours,
MR. GARY BLACKWELL
WORLD WIDE CASH CHANGE LTD
Foreign Service Number:+88216 4665 5376
FAX: +44 2075043761
www.worldwidecashchange.net
The following money demand was sent through satellite ISP Gilat / Golden Lines in Israel, probably from a customer of theirs in Benin, West Africa, next door to Nigeria.
Message-ID: <BAY23-F35BBBCC6472CBADF30581CE88C0@phx.gbl>
Received: from 212.199.108.234 by by23fd.bay23.hotmail.msn.com with HTTP;
Sat, 15 Jan 2005 15:10:47 GMT
X-Originating-IP: [212.199.108.234]
X-Originating-Email: [foreignservicedirector10@worldwide-cashchange.com]
X-Sender: foreignservicedirector10@worldwide-cashchange.com
From: "FOREIGN SERVICE DIRECTOR" <foreignservicedirector10@worldwide-cashchange.com>
To: emailaddress
Subject: Payment Instruction
Date: Sat, 15 Jan 2005 15:10:47 +0000
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_NextPart_000_67fe_4337_7430"
X-OriginalArrivalTime: 15 Jan 2005 15:11:04.0281 (UTC) FILETIME=[6E5E5490:01C4FB14]
X-Virus-Scanned: At asap-asp.net.
This is a multi-part message in MIME format.
------=_NextPart_000_67fe_4337_7430
Content-Type: text/plain; format=flowed
Content-Transfer-Encoding: Quoted-Printable
ATTENTION:Mrs. Firstname Lastname
Dear Prize Winner,
We are in receipt of your completed verification form and it has been=20
forwarded to our accounts department for verification and documentation.
You are advised to immediately make arrangements to pay our processing fe=
es,=20
amounting =A34,670.00 (Four thousand six hundred and Seventy Great Britai=
n=20
Pounds), or its equivalent in your local currency. Via western union mone=
y=20
transfer through our accounts officer, with the information provided belo=
w.
Name of receiver: Mr. Richard Kelly.
Address of receiver: 40 GROSVENOR SQUARE
W1A 1AE LONDON
UNITED KINGDOM
Please note that you are to send the receipt of payment via email attachm=
ent=20
or fax immediately after making the payment.
Please note that it is against the Gaming control regulations here in=20
Britain to deduct fees from the prize money.
A Pro Forma invoice for this payment is sent as an attachment with this=20
email. Please download it for your perusal.
I await your response.
Regards,
MR. GARY BLACKWELL
WORLD WIDE CASH CHANGE LTD
Tel +44 2000000177
FAX: +44 2075043761
inetnum: 212.199.108.128 - 212.199.108.255
netname: Gilat-ISP-Benin1
descr: Please Send Abuse/SPAM complaints to Abuse-gilat@012.net.il
country: GB
admin-c: DR5299-RIPE
tech-c: DR5299-RIPE
status: ASSIGNED PA
notify: lir@linux.goldenlines.net.il
changed: lir@linux.goldenlines.net.il 20030617
mnt-by: AS9116-MNT
mnt-lower: AS9116-MNT
source: RIPE
route: 212.199.0.0/16
descr: Golden Lines
origin: AS9116
mnt-by: AS9116-MNT
changed: lir@linux.goldenlines.net.il 20010807
source: RIPE
role: DNS REG
address: 25 Hsivim st. Petach-Tiikva, Israel
e-mail: dnsreg@012.net.il
trouble: abuse@012.net.il
admin-c: GE2074-RIPE
tech-c: IB737-RIPE
tech-c: AG914-RIPE
nic-hdl: DR5299-RIPE
notify: lir@linux.goldenlines.net.il
changed: lir@linux.goldenlines.net.il 20030715
mnt-by: AS9116-MNT
source: RIPE
| 2005-01-15 15:10:47 UTC | foreignservicedirector10@worldwide-cashchange.com |
| 2005-01-17 08:43:40 UTC | foreignservicedirector7@world-widecashchange.net |
Email addresses used with IP 212.199.108.236:
| 2005-02-09 07:48:14 UTC | foreignservicedirector9@worldwide-cashchange.com |
| 2005-02-09 09:09:43 UTC | fin_dire@hotmail.com |
| 2005-02-09 15:11:29 UTC | foreignservicedirector9@worldwide-cashchange.com |
| 2005-03-05 12:37:20 UTC | queen112peters@jumpy.it |
| 2005-03-07 23:16:20 UTC | huichang@zipmail.com.br |
| 2005-03-14 23:53:03 UTC | huichang_ikk@terra.com.mx |
| 2005-03-14 23:54:58 UTC | huichang_ikk@terra.com.mx |
| 2005-03-14 23:55:32 UTC | huichang_ikk@terra.com.mx |
| 2005-03-15 18:51:31 UTC | hui_chang1@terra.com.mx |
| 2005-03-27 22:28:35 UTC | hui_chang45@zipmail.com.br |
| 2005-03-28 10:42:17 UTC | hui_chang50@zipmail.com.br |
| 2005-04-01 02:26:27 UTC | olsberghart@yahoo.com |
| 2005-04-01 03:33:33 UTC | royalgameslottery@yahoo.co.uk |
| 2005-04-01 03:33:46 UTC | royalgameslottery@yahoo.co.uk |
| 2005-04-01 11:08:58 UTC | deborahmark@zipmail.com.br |
| 2005-04-06 03:40:57 UTC | joachbing@echina.com |
| 2005-04-07 04:17:12 UTC | deborahmark@zipmail.com.br |
| 2005-04-11 19:02:06 UTC | pres_lot_uk@terra.com.mx |
| 2005-04-12 14:16:39 UTC | huichang_6@terra.com.mx |
| 2005-04-12 14:32:26 UTC | dumebiwole40@tiscali.dk |
| 2005-04-16 13:51:55 UTC | prltuk@surefish.co.uk |
| 2005-04-18 09:24:45 UTC | dumebi31@tiscali.dk |
| 2005-04-18 11:56:38 UTC | dumebi31@tiscali.dk |
| 2005-04-18 12:47:17 UTC | dumebi31@tiscali.dk |
| 2005-04-18 13:24:04 UTC | dumebi31@tiscali.dk |
| 2005-04-22 22:37:29 UTC | amos_wuzia1@yahoo.com |
| 2005-05-01 03:42:52 UTC | drokechukwu@univtech.ac.za |
| 2005-05-10 00:12:44 UTC | la-sos5555@jmail.co.za |
| 2005-05-22 03:22:56 UTC | stevenlee04@univtech.ac.za |
| 2005-05-23 14:58:40 UTC | mariamabacha2@fish.co.uk |
| 2005-05-28 05:08:14 UTC | donaldjones@tsamail.co.za |
| 2005-06-01 13:46:20 UTC | amdalah@univtech.ac.za |
| 2005-06-04 12:21:32 UTC | promotionmanager2005@surefish.co.uk |
| 2005-06-17 23:03:16 UTC | danboyijohn0@walla.com |
| 2005-06-21 13:37:50 UTC | cheungpui@surefish.co.uk |
| 2005-06-22 13:31:59 UTC | cheungpui@surefish.co.uk |
X-from: From ukpromo@internux.web.id
Thu Apr 15 21:12:00 2004 [2004-04-15 21:12:01 69137]
Received: from iNterNUX.web.id (iNterNUX.web.id [202.43.173.55])
by www.munged.ext (8.11.6/8.11.6) with SMTP id i3G1Bj628711
for <nts-ubsijhwd04d11u50@munged.ext>; Thu, 15 Apr 2004 21:11:53 -0400
Received: (qmail 30680 invoked from network); 15 Apr 2004 22:58:41 -0000
Received: from localhost (HELO internux.web.id) (127.0.0.1)
by iNterNUX.web.id with SMTP; 15 Apr 2004 22:58:41 -0000
Received: from 212.199.108.234 (proxying for unknown, 212.199.108.234)
(SquirrelMail authenticated user ukpromo)
by internux.web.id with HTTP;
Fri, 16 Apr 2004 06:58:41 +0800 (CIT)
Message-ID: <59098.212.199.108.234.1082069921.squirrel@internux.web.id>
Date: Fri, 16 Apr 2004 06:58:41 +0800 (CIT)
Subject: GRAND FINALE WINNER
From: <ukpromo@internux.web.id>
To: <ukpromo@internux.web.id>
X-Priority: 3
Importance: Normal
X-MSMail-Priority: Normal
X-Mailer: SquirrelMail (version 1.2.5)
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-spamfilt: Chienworks* SpamFilt - 2004-04-15 21:12:01 - [69137]
X-spamfilt: Large words found: 1
X-spamfilt: bay hits: +0 -1
X-spamfilt: bay head: +15.4 -4.7
X-spamfilt: bay body: +285.4 -387.3
X-spamfilt: bay html: + -
X-spamfilt: bay index: 0.566443746216598
X-spamfilt: #0 +0 -1 =0
From: The Lottery Coordinator,
International Promotions/Prize Award Department
Dear Winner,
RESULTS FOR CATEGORY "A" DRAWS
Congratulations To You As We Bring To Your Notice, The Results Of The
Category "A" Draws Of Golden Lottery U.K. We Are Happy To Inform You That
You Have Emerged A Winner Under The First Category, Which Is Part Of Our
Promotional Draws. The Draws Were Held On The 8th April 2004 And Results
Are Being Officially Announced Today.
Participants Were Selected Through A Computer Ballot System Drawn From
4,000,000 Names/Email Addresses Of Individuals And Companies From Africa,
America, Asia, Australia, Canada, Europe, Middle East, And New Zealand As
Part Of Our International Promotions Program.
You/Your Company, Attached To Ticket Number 3322/6181-22, With Serial
Number 92-71 Drew The Lucky Numbers 19, 21, 25, 30, 41, 44 (22), And
Consequently Won In The Category "A".You Have Therefore Been Awarded A Lump
Sum Pay Out Of £6,500,000.00 (Six Million Five Hundred Thousand Great
Britain Pounds) In Cash, Which Is The Winning Payout For Category "A"
Winners. This Is From The Total Prize Money Of £13,000,000.00 Shared Among
The 2 International Winners In This Category.
Congratulations!
Your Funds Are Now Deposited With Global Link Cash Change U.K Ltd, A
Reputable Finance Firm In The U.K., Insured In Your Name. In Your Best
Interest And Also To Avoid Mix Up Of Numbers And Names Of Any Kind, We
Request That You Keep The Entire Details Of Your Award Strictly From Public
Notice Until The Process Of Transferring Your Claims Has Been Completed,
And Your Funds Remitted To Your Account. This Is Part Of Our Security
Protocol To Avoid Double Claiming Or Unscrupulous Acts By
Participants/Nonparticipants Of This Program.
We Also Wish To Bring To Your Notice Our Mid Year (2004) High Stakes Where
You Stand A Chance Of Winning Up To £40.Million, We Hope That With A Part
Of Your Prize You Will Participate.
Please Contact Your Claims Agent Immediately, To Begin Your Claims Process;
Mr. Felix Clifford Peterson.
Financial Director
Global Link Cash Change U.K Ltd
Foreign Service Number: + 88216 4665 5376
Fax: +442079006379
Email:Findire15@Globallinkscashchange.Com
For Due Processing And Remittance Of Your Prize Money To A Designated
Account Of Your Choice. Remember, You Must Contact Your Claim Agent Not
Later Than Two Weeks After The Day Announced . After This Date, All Funds
Will Be Returned As Unclaimed.
Note:
For Easy Reference And Identification Find Below Your Reference And Batch
Numbers. Note That You Are To Forward This Email To The Finance Firm In
Your First Correspondence With Them, Whether By Email Or Fax.
Reference Number: Gluk/6181/11-02/04
Batch Number: 1811-Th
Congratulations Once Again From All Our Staff And Thank You For Being Part
Of Our Promotions Program.
Sincerely,
The Lottery Coordinator,
Golden Lottery Uk,
1 Bridge Street
Staines
Middlesex Tw18 4tp
United Kingdom
Tel/Fax: 44 7092808613
N.B. Any Breach Of Confidentiality On The Part Of The Winners Will Result
To Disqualification. Please Contact Your Claims Agent.
=====================================================================
Kalau mau koneksi internet dengan biaya murah,
gunakan iNterNUX w-lan On Demand.
Tarifnya cuman Rp. 55 sampai Rp. 125 per menit. Bebas pulsa telepon.
The following money demand forwarded to us on 2004-01-25 uses a bank account in Italy for receiving funds from victims:
Dear Prize Winner,
We are in receipt of your completed verification form and it has been forwarded to our accounts department for verification and documentation. You are advised to immediately make arrangements to pay our processing fees, amounting £4,670.00 (Four thousand six hundred and Seventy Great Britain Pounds), or its equivalent in your local currency. Via accounts the information provided below. Note that the account information below is our account coordinates zoned to winners from your region.
Banca Intesa BCI.Filiale
NO.123 FREGENE ROMA, ITALY,
SWIFT:BCI TIT 22123
IBAN NO:IT 40 D030 6949 6310 0000 0048 008
A/C NO:48008-79.
BENEFICIARY:UBALDI RENZO
Please note that you are to send the receipt of payment via email attachment or fax immediately after making the payment.
Also this above mode of making the payment is what is acceptable to us as we do not accept payments directly at our office so endeavour to send the fee through your bank to our bank information above and we shall conclude arrangements and transfer your prize money into your account upon receiving the processing fees.
I await your response.
Regards,
MR. GARY BLACKWELL
WORLD WIDE CASH CHANGE LTD
Foreign Service Number:+88216 4665 5376
FAX: +44 2075043761
WHOIS record for "globallinkscashchange.com" (2004-02-04). It uses almost the same (fake) postal address as internationalcontractingcompany.com, another related fraud site.
Request: globallinkscashchange.com connected to whois.melbourneit.com [203.27.227.114:43] ... Domain Name.......... globallinkscashchange.com Creation Date........ 2004-02-04 Registration Date.... 2004-02-04 Expiry Date.......... 2005-02-04 Organisation Name.... Joseph Fletcher Organisation Address. 38 ralstons rd Organisation Address. Organisation Address. atherton Organisation Address. 94027 Organisation Address. CA Organisation Address. UNITED STATES Admin Name........... Joseph Fletcher Admin Address........ 38 ralstons rd Admin Address........ Admin Address........ atherton Admin Address........ 94027 Admin Address........ CA Admin Address........ UNITED STATES Admin Email.......... josephfletcher2004@yahoo.com Admin Phone.......... +1.6503638926 Admin Fax............ Tech Name............ YahooDomains TechContact Tech Address......... 701 First Ave. Tech Address......... Tech Address......... Sunnyvale Tech Address......... 94089 Tech Address......... CA Tech Address......... UNITED STATES Tech Email........... domain.tech@YAHOO-INC.COM Tech Phone........... +1.6198813096 Tech Fax............. +1.6198813010 Name Server.......... yns1.yahoo.com Name Server.......... yns2.yahoo.com
Here is the WHOIS record for another older domain (2004-07-12):
Request: cashchangeukltd.net connected to whois.crsnic.net [198.41.3.54:43] ... connected to whois.enom.com [66.151.151.170:43] ... Registration Service Provided By: Microsoft Contact: pdenomcs@microsoft.com Visit: http://support.msn.com/contactus.aspx?pk=PersonalAddress Domain name: cashchangeukltd.net Registrant Contact: Jonathan Smith Jonathan Smith (info@cashchangeukltd.net) +1.8187161519 Fax: none 64 vassar avenue canoga park, CA 91304 US Administrative Contact: Jonathan Smith Jonathan Smith (info@cashchangeukltd.net) +1.8187161519 Fax: none 64 vassar avenue canoga park, CA 91304 US Technical Contact: NOC MSN NOC MSN (MSN-PA-TECH@msn.com) +1.4258828080 Fax: none One Microsoft Way Redmond, WA 98052 US Billing Contact: NOC MSN NOC MSN (MSN-PA-BILL@MSN.COM) +1.4258828080 Fax: none One Microsoft Way Redmond, WA 98052 US Status: Locked Name Servers: pdomns1.msn.com pdomns2.msn.com Creation date: 12 Jul 2004 11:36:37 Expiration date: 12 Jul 2005 11:36:37
WHOIS record for "world-widecashchange.net" (2004-11-07):
Request: world-widecashchange.net connected to whois.crsnic.net [198.41.3.54:43] ... connected to whois.enom.com [66.151.151.170:43] ... Registration Service Provided By: Microsoft Contact: pdenomcs@microsoft.com Visit: http://support.msn.com/contactus.aspx?pk=PersonalAddress Domain name: world-widecashchange.net Registrant Contact: Emerson Robinson jr Emerson Robinson jr (info@world-widecashchange.net) +1.6012316245 Fax: none 49 Eastbrooke Street, jackson, MS 39216 US Administrative Contact: Emerson Robinson jr Emerson Robinson jr (info@world-widecashchange.net) +1.6012316245 Fax: none 49 Eastbrooke Street, jackson, MS 39216 US Technical Contact: NOC MSN NOC MSN (MSN-PA-TECH@msn.com) +1.4258828080 Fax: none One Microsoft Way Redmond, WA 98052 US Billing Contact: NOC MSN NOC MSN (MSN-PA-BILL@MSN.COM) +1.4258828080 Fax: none One Microsoft Way Redmond, WA 98052 US Status: Locked Name Servers: pdomns1.msn.com pdomns2.msn.com Creation date: 07 Nov 2004 10:15:24 Expiration date: 07 Nov 2005 10:15:24
WHOIS record for "worldwide-cashchange.net" (2004-11-08):
Request: worldwide-cashchange.net connected to whois.crsnic.net [198.41.3.54:43] ... connected to whois.melbourneit.com [203.27.227.114:43] ... Domain Name.......... worldwide-cashchange.net Creation Date........ 2004-11-08 Registration Date.... 2004-11-08 Expiry Date.......... 2005-11-08 Organisation Name.... john duala Organisation Address. 67 vassar avenue Organisation Address. Organisation Address. canoga park Organisation Address. 91304 Organisation Address. CA Organisation Address. UNITED STATES Admin Name........... john duala Admin Address........ 67 vassar avenue Admin Address........ Admin Address........ canoga park Admin Address........ 91304 Admin Address........ CA Admin Address........ UNITED STATES Admin Email.......... contact@worldwide-cashchange.net Admin Phone.......... +1.8186234540 Admin Fax............ Tech Name............ MSN NOC Tech Address......... One Microsoft Way Tech Address......... Tech Address......... Redmond Tech Address......... 98052 Tech Address......... WA Tech Address......... UNITED STATES Tech Email........... MSN-PA-TECH@msn.com Tech Phone........... +1.4258828080 Tech Fax............. Name Server.......... pdomns1.msn.com Name Server.......... pdomns2.msn.com
WHOIS record for "prestigiouslottuk.com" (2004-11-28):
(This domain was disabled by 1and1.com because we reported the fraud)
Request: prestigiouslottuk.com connected to whois.crsnic.net [198.41.3.54:43] ... connected to whois.schlund.info [195.20.224.146:43] ... domain: prestigiouslottuk.com created: 28-Nov-2004 last-changed: 18-Dec-2004 registration-expiration: 28-Nov-2005 nserver: ns29.1and1.com 217.160.224.2 nserver: ns30.1and1.com 217.160.228.2 registrant-firstname: Mercy registrant-lastname: Sloan registrant-street1: 260 Chapman Rd registrant-pcode: 19702 registrant-state: DE registrant-city: Newark registrant-ccode: US registrant-phone: +1.3025657654 registrant-email: fraud@1and1.com admin-c-firstname: Mercy admin-c-lastname: Sloan admin-c-street1: 260 Chapman Rd admin-c-pcode: 19702 admin-c-state: DE admin-c-city: Newark admin-c-ccode: US admin-c-phone: +1.3025657654 admin-c-email: fraud@1and1.com
WHOIS record for "prestigiouslotteryuk.com" (2004-09-10):
Request: prestigiouslottuk.com
Request: prestigiouslotteryuk.com
connected to whois.crsnic.net [198.41.3.54:43] ...
connected to whois.register.com [216.21.229.106:43] ...
Organization:
MORGAN FELIX
MORGAN FELIX
260 Chapman Rd
newark, de 19702
US
Phone: 302 565 4064
Email: morgfelix2004@yahoo.com
Registrar Name....: Register.com
Registrar Whois...: whois.register.com
Registrar Homepage: http://www.register.com
Domain Name: PRESTIGIOUSLOTTERYUK.COM
Created on..............: Fri, Sep 10, 2004
Expires on..............: Sat, Sep 10, 2005
Record last updated on..: Fri, Sep 10, 2004
Administrative Contact:
MORGAN FELIX
MORGAN FELIX
260 Chapman Rd
newark, de 19702
US
Phone: 302 565 4064
Email: morgfelix2004@yahoo.com
Technical Contact, Zone Contact:
Register.Com
Domain Registrar
575 8th Avenue - 11th Floor
New York, NY 10018
US
Phone: 902-749-2701
Fax..: 902-749-5429
Email: domain-registrar@register.com
Domain servers in listed order:
DNS19.REGISTER.COM 216.21.234.80
DNS20.REGISTER.COM 216.21.226.80
WHOIS record for "prestigiouslotteryuk.com" (2004-09-15):
Request: worldwidecashchange.net connected to whois.crsnic.net [198.41.3.54:43] ... connected to whois.enom.com [66.151.151.170:43] ... Registration Service Provided By: Betteroff Networks Contact: domains@betteroff.net Visit: Domain name: worldwidecashchange.net Administrative Contact: Betteroff Networks Craig Halliday (domains@betteroff.net) +61.61500844111 Fax: +61.1300551201 Suite 239 421 Brunswick Street Fortitude Valley, QUEENSLAND 4006 AU Billing Contact: Betteroff Networks Craig Halliday (domains@betteroff.net) +61.61500844111 Fax: +61.1300551201 Suite 239 421 Brunswick Street Fortitude Valley, QUEENSLAND 4006 AU Technical Contact: Betteroff Networks Craig Halliday (domains@betteroff.net) +61.61500844111 Fax: +61.1300551201 Suite 239 421 Brunswick Street Fortitude Valley, QUEENSLAND 4006 AU Registrant Contact: Betteroff Networks Craig Halliday (domains@betteroff.net) +61.61500844111 Fax: +61.1300551201 Suite 239 421 Brunswick Street Fortitude Valley, QUEENSLAND 4006 AU Status: Locked Name Servers: ns1.troublefreehosting.com ns2.troublefreehosting.com Creation date: 15 Sep 2004 08:07:10 Expiration date: 15 Sep 2005 08:07:10
|