joewein.net   joewein.de LLC
fighting spam and scams on the Internet
Try our spam filter!
Free trial for 30 days
  jwSpamSpy

Home
About Us
Spam
419/Nigeria
Fraud
Contact

"419" Scam – Advance Fee / Fake Lottery Scam

The so-called "419" scam is a type of fraud dominated by criminals from Nigeria and other countries in Africa. Victims of the scam are promised a large amount of money, such as a lottery prize, inheritance, money sitting in some bank account, etc.

Victims never receive this non-existent fortune but are tricked into sending their money to the criminals, who remain anonymous. They hide their real identity and location by using fake names and fake postal addresses as well as communicating via anonymous free email accounts and mobile phones.

Keep in mind that scammers DO NOT use their real names when defrauding people.
The criminals either abuse names of real people or companies or invent names or addresses.
Any real people or companies mentioned below have NO CONNECTION to the scammers!

Read more about such scams here or in our 419 FAQ. Use the Scam-O-Matic to verify suspect emails.

Click here to report a problem with this page.

 

 

Some comments by the Scam-O-Matic about the following email:

Fraud email example:

From: MaestroMailer <>
Date: Thu, 02 Sep 2021 09:46:16 -0700
Subject: Message not delivered

Your message failed to be delivered to the following recipient:

Address
---------------------------
cancel@efax.co.uk

Reason
---------------------------
MAILBOX_IS_UNDELIVERABLE

>Received-SPF: softfail (in3l.electric.net: transitioning domain of monomedia.net does not designate 67.23.236.232 as permitted sender) client-ip=67.23.236.232; envelope-from=rsullivan@monomedia.net; helo=vps.retailvyapari.com;
>Received: from vps.retailvyapari.com ([67.23.236.232])
> by in3l.electric.net with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
> (Exim 4.94.2)
> (envelope-from <rsullivan@monomedia.net>)
> id 1mLpqx-0005RE-6J
> for cancel@efax.co.uk; Thu, 02 Sep 2021 09:46:16 -0700
>Authentication-Results: in3l.electric.net;
> iprev=pass (vps.retailvyapari.com) smtp.remote-ip=67.23.236.232;
> spf=softfail smtp.mailfrom=monomedia.net;
> dkim=pass header.d=teqloyalty.com header.s=default header.a=rsa-sha256;
> dmarc=skipped
>DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
> d=teqloyalty.com; s=default; h=Content-Transfer-Encoding:Content-Type:
> MIME-Version:Message-ID:Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:
> Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
> :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
> List-Subscribe:List-Post:List-Owner:List-Archive;
> bh=sXE+1Y+c9zy/bpVQe/FOgmem89kHBbw7fySzYtq8Who=; b=HJqjrAn0CknahFfUdcFY31sd3N
> 0/Rq5nJNlEJGCmS1ICVIJ0uPI6cGvf6FWCNJPQ/ZsdHTyRP/p0Jqwf3NtYA4AdTJzRuf4pmMuF5t2
> XH69lyBCriHDAln5PY6gb6678dUpcHLZydAJI/hbK4uBXQUgmHiUk2qDDArpsdVg2k9pfEWuPmHV/
> CiqHIqC7zKY6nUA0LVutRe3NwPlrqlJ71O+qsbErucxfhwToM6H8Rw8cYpGdxc4+l4vmby0k0Sqgv
> LIuV9GaCgV3Tt2KcStKoA0KdEjbn2EpHIXMoYPkyfnB501du+8xeICVHUZdL/9I+gpatDbURrGKn4
> gom3/+yQ==;
>Received: from ec2-34-220-254-253.us-west-2.compute.amazonaws.com ([34.220.254.253]:1045 helo=monomedia.net)
> by vps.retailvyapari.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
> (Exim 4.94.2)
> (envelope-from <rsullivan@monomedia.net>)
> id 1mLpql-0005fF-3v
> for cancel@efax.co.uk; Thu, 02 Sep 2021 22:16:02 +0530
>Reply-To: mrhabdullaq@gmail.com
>From: "Hesham A. Qassim"<rsullivan@monomedia.net>
>To: cancel@efax.co.uk
>Subject: Your Reply Is Import.
>Date: 02 Sep 2021 16:46:02 +0000
>Message-ID: <20210902164602.E794FEC634F0F14C@monomedia.net>
>MIME-Version: 1.0
>Content-Type: text/html;
> charset="iso-8859-1"
>Content-Transfer-Encoding: quoted-printable
>X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
>X-AntiAbuse: Primary Hostname - vps.retailvyapari.com
>X-AntiAbuse: Original Domain - efax.co.uk
>X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
>X-AntiAbuse: Sender Address Domain - monomedia.net
>X-Get-Message-Sender-Via: vps.retailvyapari.com: authenticated_id: smtpfox-yjc57@teqloyalty.com
>X-Authenticated-Sender: vps.retailvyapari.com: smtpfox-yjc57@teqloyalty.com
>X-Source:
>X-Source-Args:
>X-Source-Dir:
>X-FM-OS: Linux 2.2.x-3.x
>X-FM-GeoIP: US
>X-Proto: esmtps
>X-Revdns: vps.retailvyapari.com
>X-HELO: vps.retailvyapari.com
>X-TLS: TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256
>X-Authenticated_ID:
>X-Origin-IP: 67.23.236.232
>X-Env-From: rsullivan@monomedia.net
>X-DKIM: pass
>X-DMARC: none
>
><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.=
>w3.org/TR/html4/loose.dtd">
>
><HTML><HEAD>
><META name=3DGENERATOR content=3D"MSHTML 11.00.10570.1001"></HEAD>
><body style=3D"MARGIN: 0.5em">
><P><STRONG><EM>Greetings,</EM></STRONG></P>
><P><STRONG><EM>My name is Mr. Hesham Abdulla Qassim, i am the current Vice =
>Chairman of Emirates NBD Bank P.J.S.C. Dubai, U.A.E.&nbsp; I have spent alm=
>ost the last 2 months searching for someone with your last name, due to the=

Anti-fraud resources: