joewein.net   joewein.de LLC
fighting spam and scams on the Internet
Try our spam filter!
Free trial for 30 days
  jwSpamSpy

Home
About Us
Spam
419/Nigeria
Fraud
Contact

"419" Scam – Advance Fee / Fake Lottery Scam

The so-called "419" scam is a type of fraud dominated by criminals from Nigeria and other countries in Africa. Victims of the scam are promised a large amount of money, such as a lottery prize, inheritance, money sitting in some bank account, etc.

Victims never receive this non-existent fortune but are tricked into sending their money to the criminals, who remain anonymous. They hide their real identity and location by using fake names and fake postal addresses as well as communicating via anonymous free email accounts and mobile phones.

Keep in mind that scammers DO NOT use their real names when defrauding people.
The criminals either abuse names of real people or companies or invent names or addresses.
Any real people or companies mentioned below have NO CONNECTION to the scammers!

Read more about such scams here or in our 419 FAQ. Use the Scam-O-Matic to verify suspect emails.

Click here to report a problem with this page.

 

 

Some comments by the Scam-O-Matic about the following email:

Fraud email example:

From: Tim White <phantom421366@yahoo.com>
Date: Sun, 22 Aug 2010 15:59:24 -0700 (PDT)
Subject: CIA GENERATED HACKER SPAM


comapny selling emails
leads,smtp,mailer,webmail,cpanel and rdp,roaming number and cc.
Sunday, August
22, 2010 3:40 PM
From add
this..{{{ globalleads.sell }}} to chat do not allow email only chat Sun
Aug 22 21:40:19 2010




X-Apparently-To:



phantom421366@yahoo.com via
68.180.197.78; Sun, 22 Aug 2010 14:41:06 -0700

Return-Path:



<globallead4@optusnet.com.au>

Received-SPF:



pass (mta1125.mail.sk1.yahoo.com:
domain of globallead4@optusnet.com.au designates 211.29.132.185 as
permitted sender)

X-YMailISG:




2_eznVYcZAobaFqENBknPfn8IM9D.TRUAWbhHRBd8R9e8nNz
b92yhxY3vSToztiQDfHjf0yyC1E1aLE6M5en3DcWrRNe9xNGSwc4Sf7bXDOg
Qu5RHK4bVCnWt53d71dMxFnG87dFYX74LE6EUUE5v_gopmoJKFsxCgTETEBb
e25lINlxarWff1yc0Y4fRJnuEf_o2ZZ1IcTz6jAFIHbpFIveu5I8TLaZbEDN
_iXbKZYV5MFbcD7doGEpA.fsEOApMiVOes_dKz_QE7UbeZ4haqyHMAQ72yO1
9lAeyqtLTqTD5cFBPKahk15nhJi6R6CwTwxMjxFl7lxJeizhe1vmtWjwI7Yl
ErsCJh3x5C6tqLp5j3qBArBGA_uSyZWoiK.a6Cr_Km7AQ60RfTFOCcTYbEOD
GVVHndBkkj_qiSaqVu8VM0_0J6PDav4JwRuqvPrIP9.DSZ4d_Es8NtVzJs0m
hUyqpbKaQrWM852VcIXkF4hUtd_q7WQ38qpG9Trk4sns1vJhEdltXoJKJ88R
QQFz5.UNxLoKwAqRKsKU1T4Q4aZmtLtTyUhQzYI9N_dLqzE9.mAUWcambLhM
4DcXOWmOd.ZF3GyPwW8nvprFy1RTbSnw_2o1HnT3jB9a4vd_ilAxqbjj

X-Originating-IP:



[211.29.132.185]

Authentication-Results:



mta1125.mail.sk1.yahoo.com
from=optusnet.com.au; domainkeys=neutral (no sig);
from=optusnet.com.au; dkim=neutral (no sig)

Received:



from 127.0.0.1 (EHLO
mail04.syd.optusnet.com.au) (211.29.132.185)
by mta1125.mail.sk1.yahoo.com with SMTP; Sun, 22 Aug 2010 14:41:05
-0700

Received:



from User
(129.Red-88-29-30.staticIP.rima-tde.net [88.29.30.129])
(authenticated sender globallead4@optusnet.com.au)
by mail04.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id
o7MLcIjK026514;
Mon, 23 Aug 2010 07:38:26 +1000

Message-Id:




<201008222138.o7MLcIjK026514@mail04.syd.optusnet.com.au>

From:



"add this..{{{
globalleads.sell }}} to chat do not allow email only
chat"<globallead4@optusnet.com.au>  
Add sender to Contacts

Subject:



comapny selling emails
leads,smtp,mailer,webmail,cpanel and rdp,roaming number and cc.

Date:



Sun, 22 Aug 2010 22:40:19 +0100

MIME-Version:



1.0

Content-Type:



text/plain;
charset="Windows-1251"

Content-Transfer-Encoding:



7bit

X-Priority:



3

X-MSMail-Priority:



Normal

X-Mailer:



Microsoft Outlook Express
6.00.2600.0000

X-MimeOLE:



Produced By Microsoft MimeOLE
V6.00.2600.0000

Content-Length:



1714
Compact
Headersadd this...     globalleads.sell     
   ..  to chat  do not allow email only chat


comapny selling
emails leads,smtp,mailer,webmail,cpanel and rdp,roaming number and cc.

usa,uk,canada,australia,germany,sweeden.switzerland,austral,france,italy,norway,island,mexico,agentina,brazil,hong
kong,china,malaysia,uae,saudi
arabia,iran,iraq,indonesia,cambodia,india,nepal,turkey,quatar,oman,pakistan,japan,korea,all
africa,thrinida and tobacco,cyprus,holland
spain,demark,paraguay,colombia,bulgeria,gorgia,hungary,finland,kuwait,latfia,scortland,greece,adelaide,portugal
and more countries you need.


If you also buy leads i help
you to blast Sell cpanel last 6 months umlimted send 1000 and 500 at a
send

Smtp all domain like cityweb,igrin,wadoo,freenet and
btconnect with good configuration name company and costomiZed smtp

 
Webmail  last 3/6months with personal use and name of your company
unlimited also if you buy emails leads take free tools to blast instant
replies.

Emails links with special user name and password
everyday  updated and email and password hacked.

All
asian,usa,uk,russia rdp last 3/6 months both scanner and smtp scanner

Sms
bulk with credit airtime with software  and spyware email
finder/advance emails finder,power email list harvester with key and
details hacked.

UK/USA/EURO/GERMANY/ITALY/FRANCE/MEXICO/UAE/CHINA
SERIES CC and paypal acount sell inbulk with good balance.



 
Exchange western union/money gramme to libertyreserve

PLS DO NOT
ASK ME TRY AND TEST DONT ASK ME WESTERN UNION INFORS...IF THEY HAVE RIP
YOU BEFORE DONT ADD AND ASK TEST FREE TOOLS PLS
   
6th floor,
Delano Center No. 205, Street
120 Sangkat Veal Vong Khan 7 Makara,
Phnom
Penh, Cambodia.
+855765036664

===================================

WHOIS - 88.29.30.129
Location: Spain [City: Madrid, Madrid]

Using 0 day old cached answer (or, you can get fresh results).
Displaying E-mail address (use sparingly -- this will make it more likely that you will trigger our rate limiting system).

% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Information related to '88.28.0.0 - 88.31.255.255'

inetnum: 88.28.0.0 - 88.31.255.255
netname: TME
descr: TELEFONICA MOVILES ESPANA (NCC#2007041930)
remarks: For Security Incidents
remarks: PLEASE CONTACT THROUGH LINK
remarks: seguridad@movistar.es
remarks:
any mail to other contact will be ignored
descr: Internet Public Addresses
country: ES
admin-c: FAC4-RIPE
tech-c: FAC4-RIPE
remarks: rev-srv: minerva.ttd.net
remarks: rev-srv: artemis.ttd.net
status: ASSIGNED PA
mnt-by: MAINT-AS3352
changed: administracion.ripe@telefonica.es 20070505
source: RIPE
remarks: rev-srv attribute deprecated by RIPE NCC on 02/09/2009

person: Francisco Arana Camara
address: TELEFONICA MOVILES ESPA�A
address: Camino Cerro de los Gamos, 1. Edificio 4, Planta 2
address: 28224 Pozuelo de Alarcon (Madrid)
address: SPAIN
notify: sietesiete7@gmail.com
e-mail: francisco.aranacamara@telefonica.es
phone: +34 680 01 35 70
fax-no: +34 680 01 73 72
nic-hdl: FAC4-RIPE
changed:
administracion.ripe@telefonica-data.com 20020304
changed: administracion.ripe@telefonica-data.com 20030605
changed: administracion.ripe@telefonica-data.com 20060428
source: RIPE

% Information related to '88.29.0.0/16AS3352'

route: 88.29.0.0/16
descr: RIMA (Red IP Multi Acceso)
origin: AS3352
mnt-by: MAINT-AS3352
changed: adminis.ripe@telefonica.es 20050713
source: RIPE


[The following lines added by www.dnsstuff.com per requirement by RIPE]
This service is subject to the terms and conditions stated in the RIPE NCC Database Copyright Notice.
Contact dnsstuff.com's 'info2@' address to report problems regarding the functionality of the service.




Anti-fraud resources: