Meta: Lottery Scams Taken Elsewhere

I get a lot of lottery scam spam and 419s, but I've been neglecting them lately due to the fact that they are so common, but require a fair bit of fiddling to document. I do want to make archived copies available to those who search for them, however, so I've come up with a more efficient approach. I've started a secondary blog called Lottery Scam Du Jour, and all my lottery scam spam just gets dumped there without further comment. If I really want to comment about a particular spam, I'll add a comment to the post, but in general I'll just provide the text without further comment. The only thing missing will be the source IP address: blog entry dates will reflect the time of arrival.

If this process works for me, I may do the same for 419s and Stock Spam.

Stock Spam: Roundup

Stock spam has been arriving in dribs and drabs recently. Now is an opportune moment to clear out the backlog, so let's get to it.

Stock	IP Address	Date Received
EDEX	58.83.42.169	Mon, 1 Aug 2005 06:50:34 -0000
EDEX	220.163.70.67	Mon, 1 Aug 2005 11:46:06 -0000
MWIS	221.192.8.166	Mon, 1 Aug 2005 23:08:22 -0000
MWIS	221.15.171.188	Tue, 2 Aug 2005 13:01:25 -0000
CGKY	222.84.17.11	Wed, 3 Aug 2005 18:19:06 -0000
CGKY	219.145.154.140	Sun, 7 Aug 2005 11:19:10 -0000
CGKY	60.181.32.170	Sun, 7 Aug 2005 12:15:25 -0000
CGKY	195.210.229.1	Sun, 7 Aug 2005 13:01:38 -0000
CWTD	218.69.216.198	Tue, 9 Aug 2005 01:13:33 -0000
CWTD	221.127.83.213	Tue, 9 Aug 2005 02:16:27 -0000
CWTD	61.149.129.61	Thu, 11 Aug 2005 08:51:19 -0000
CWTD	218.24.223.236	Thu, 11 Aug 2005 14:46:08 -0000
CWTD	220.176.23.10	Thu, 11 Aug 2005 17:09:39 -0000
CWTD	61.51.91.11	Tue, 16 Aug 2005 14:08:22 -0000
CWTD	69.245.172.98	Thu, 18 Aug 2005 03:07:08 -0000
CWTD	216.63.226.65	Thu, 18 Aug 2005 04:21:51 -0000
CWTD	204.60.98.187	Thu, 18 Aug 2005 19:49:03 -0000
CWTD	210.124.113.10	Thu, 18 Aug 2005 22:39:52 -0000
CWTD	62.89.101.11	Thu, 18 Aug 2005 22:46:59 -0000
CWTD	219.94.82.212	Fri, 19 Aug 2005 00:01:29 -0000
CWTD	200.74.165.63	Sat, 19 Aug 2005 21:09:23 -0000
CGKY	217.144.220.246	Sat, 20 Aug 2005 06:21:30 -0000
CGKY	220.71.190.51	Sun, 21 Aug 2005 07:32:26 -0000
CGKY	61.222.115.124	Sun, 21 Aug 2005 17:53:05 -0000
WWBP	221.2.121.15	Wed, 24 Aug 2005 03:03:59 -0000
WWBP	222.235.187.235	Sun, 28 Aug 2005 02:20:48 -0000
WWBP	219.251.101.9	Sun, 28 Aug 2005 02:27:38 -0000
WWBP	219.251.86.46	Sun, 28 Aug 2005 03:21:53 -0000
CGKY	222.105.4.85	Mon, 29 Aug 2005 05:20:24 -0000
CGKY	211.189.91.53	Mon, 29 Aug 2005 15:21:28 -0000
CWTD	207.173.229.70	Mon, 29 Aug 2005 22:14:03 -0000
CWTD	218.22.249.106	Mon, 29 Aug 2005 22:56:10 -0000
CWTD	218.51.221.241	Tue, 30 Aug 2005 12:22:04 -0000
CWTD	64.167.100.102	Wed, 31 Aug 2005 07:19:55 -0000
CWTD	62.81.241.140	Wed, 31 Aug 2005 11:55:46 -0000

Note that CGKY (Carnegie Cooke & Company, Inc.) is a "first sighting" so far as this blog is concerned, as is WWBP (Worldwide Biotech & Pharmaceutical Co). CGKY is a sub-dollar pinksheet-listed stock, probably being played for pump and dump purposes, whereas WWBP opened around the ten dollar mark on 23rd August, tanked and closed around six dollars on 24th August, and so on. A fairly volatile stock, that, so maybe it's another pump and dump. CWTD, on the other hand, is almost a permanent fixture so far as stock spam goes.

Some of the above spams post-date this blog entry. That's because this blog entry has been amended after posting to cover all stock spam to the end of August, UTC.

Meta: Pump and Dump becomes Stock Spam

I've been prefixing all my stock spam reports with "Pump and Dump", but it's become clear that not all instances of stock spam are pump and dump operations. The perennial CWTD spam is a prime example of this. So from now on, I'll use the more terse and generally applicable prefix "Stock Spam". Mind you, I'm losing interest in the whole stock spam thing, and will tend to let it accumulate a bit before reporting it, so don't count on me for real-time stock spam reports.

Job Scam: FIAS

Another job scam, while I'm about it. This is a nasty little bugger, as we'll see. The spam targets Australians, and was sent to a ".au" address. It was received from 201.18.113.31 on Sun, 28 Aug 2005 13:58:43 -0000.

Exciting offer,
Open jobs:
Manager working at home;
What we need:
Are you smart and honest? We are looking for people like you!
Our worker is:
Adults only;
Permanent resident of Australia;
Computer and e-mail owner;
Free time - 2-3 hours;
Details:
Being our company representative in your country before we open an office there.
Your line of work will be tied to banks and the banking system.
Opening a business account takes 2 weeks.
Therefore work will use your personal account.
If you dont have a personal account - thats not a problem.
An account can be opened in just one day in any bank.
10% is what you will make from every transaction for letting us use your account.
You will make from 250$ to 2500$, since every transaction is over 5000$.
Agree that this isn't bad, considering, that you will be using only 2-3 hours of your time daily!
Attention! 
Grab this job opportunity today, or else someone else will!
If you want to work for us and you meet our requirements - you need to fill out the following form.
http://charityrestministry.org/info.html

So what's with "charityrestministry.org"? If you go to the linked page, it actually claims to be something called "FIAS" and has another rendition of their job advertisement, plus a link to "f-i-a-s.com". The only link with "charityrestministry.org" is that their website has been compromised. So far as I can tell, "charityrestministry.org" is completely unconnected with this scam, and is guilty only of lax security and consequent use by evildoers. Most distressing for them, I'm sure. To clarify, note that the URL has "/info.html" tacked on the end of it. If you remove that part and go to their root page, the site is completely different. The spammers have simply added one page to the site, and linked to it.

Meanwhile, the "f-i-a-s.com" domain name has been registered since 2005-05-11, and last modified on 2005-08-28 (today), so the evildoer behind it is going to some lengths to keep it operating -- and the registrar obviously doesn't see it as their duty to do anything about it. The real FIAS knows about the issue for long enough that they've published a warning on their front page.

Job Scam: Finance Mover

I've been slacking off a great deal lately: an endless stream of 419 sob-stories and lottery wins can get tedious after a while. This one is an employment scam, which is also nothing new, but I really hate them for their particular insidiousness, so I'll shirk off the laziness and report it. For those of you not familiar with the scam, the spammer intends to use the "employee" as a money launderer. Stolen money is sent to the "employee", and the "employee" sends it back via Western Union, thereby making it hard to trace. The "employee" is easy enough to trace, of course, and can expect a visit from the local authorities sooner or later.

This spam was received from 69.248.189.93 (pcp0011492806pcs.eatntn01.nj.comcast.net) on Sun, 28 Aug 2005 05:33:59 +0000.

Date: Sun, 28 Aug 2005 00:34:03 -0500
From: Finance Mover INC. <shorty@u2club.com>
Subject: Hiring Monster.com Job Offer.

Finance Mover INC.

Our vacancies 

We are a company that specializes in sales since
2001.We are looking for financial assistants that will
be responsible to accept payments from clients through
Paypal since it is one of the most popular methods of
payment, but is not available in several regions of
Europe. Paypal protects sensitive information using
state-of-the-art encryption, so your data is not
available to anyone Paypal's risk models help detect
and predict fraudulent transactions-before they affect
the business. PayPal also fights chargebacks. You can
make 10% commission from every transfer you will
receive through your Paypal account in relation to our
business. The rest needs to be transferred to our
company's representative by Western Union, all Western
Union fees are paid by us.On average you will be
making 1500USD a week. To begin working together we
will need your resume and contact information, sent to
financemover@msn.com

Finance Mover INC.

Lottery Scam: Netherlands, Various

I've had a minor deluge of lottery wins -- the fake kind -- so I'll momentarily shrug off my laziness and report them. I'm not going to bother with nice formatting, sorry -- I'm just going to dump the text here for the benefit of those who search. If you're here because you got a message like this and you thought it sounded a little odd, so you did a little research, congratulations. Yes, it's a scam. Delete it. There's no money to be had, except maybe forged money in some cases, or rubber cheques in others. All of these were sent to the contact address for this blog, and all provide contact addresses in the Netherlands.

The first was sent through the webmail system at mail.go.com. Received from 199.181.134.42 on Sat, 13 Aug 2005 08:20:21 -0000. Please excuse the unformatted text.

Congratulation You Have Won... LUCKYDAY LOTTERY INTERNATIONAL Ref. Number: 132/756/4007 Batch Number: 538901527-BB67 Tel/fax:0031-611-146-930 Email: trustgroupagent@netscape.net Sir/Madam. We are pleased to inform you of the result of The Lottery Winners International programs held on the 6th of AUGUST 2005. Your e-mail address attached to ticket number 27511465896-6410 with serial number 3772-510 drew lucky numbers 7-14-88-23-31-45 which consequently won in the 1st category, you have therefore been approved for a lump sum pay of ERS 1,000,000.00 (One Million EUROS) CONGRATULATIONS!!! Due to mix up of some numbers andnames, we ask that you keep your winning information confidential until your claims has been processed and your money Remitted to you. This is part of our security protocol To avoid double claiming and unwarranted abuse of this program by some participants. All participants were selected through a computer ballot system drawn from over 20,000 company and 30,000,000 individual email addresses and names from all over the world we hope with part of your winning you will take part in our next year EUS50 million international lottery. To file for your claim, please contact our fiducial agent(MR.PERRY VAN BROOK) please riply to this Email Address: trustgroupagent@netscape.net of the trust Group Agency TEL:0031-611-146-930 Email: trustgroupagent@netscape.net Please Remember, all winning must be claimed not later than 31ST of AUGUST 2005. After this date,all unclaimed funds will be included in the next stake. Please note in order to avoid unnecessary delays and complications please remember to quote your reference number and batch numbers in all correspondence. Furthermore, should there be any change of address do inform our agent as soon as possible. Congratulations once more from our members of staff and thank you for being part of our promotional program. Note: Anybody under the age of 18 is automatically disqualified. Sincerely yours, Mr.mike jose. Lottery Coordinator.

Next up, more of the same. Received from 199.181.134.40 (just two IP addresses down from the previous one) on Sat, 13 Aug 2005 09:24:20 -0000.

COMBIPLAY LOTTERY INTERNATIONAL COMBIPLAY LOTTERY-WHEEL E-GAME 2005 INTERNATIONAL PROMOTION PROGRAM ADMIRAALSTRAAT 104 1053 GW AMSTERDAM THE NETHERLANDS FROM:THE DIRECTOR OF PROMOTIONS INTERNATIONAL PROMOTION DEPT. REF: CMBNL/4240039609/RFE BATCH: CMP/12863/XZ ATTN:WINNER, AWARD PRIZE NOTIFICATION!! ---------------------------------------------------------- COMBIPLAY LOTTERY INTERNATIONAL Netherlands;international lotto e-game organizers and sponsors,officially notify you of the final draw result of the COMBIPLAY LOTTERY - Wheel E-game draw held on 10th August,2005. All draws where conducted at our international corporate office complex in The Netherlands.We wish to congratulate you on the selection of your email coupon number which was selected among the 10 lucky consolation prize winners.Your email ID identity was entered as dependent clients with:Reference Number:FYL/BG772045/SY02,and Batch Number CBP/204861/HLP and Security File Number CMBPL00018970/07.Your email address attached to the ticket number:00009/XXPL and was selected by Electronic Random Selection System (ERSS)with entries from the 50,000 different email addresses enrolled for the Combiplay Lottery-Wheel E-game. Your email ID included among the 50,000 different email addresses where submitted by our partner international email provider companies. You have won a consolation cash prize of €500,000.00 (Five Hundred Thousand Euros Only).You have been approved for a payment of 500,000.00euros (FIVE HUNDRED THOUSAND EUROS.)in cash credited to file reference number:CMBNL/6411059620/BG2.This is from a total cash prize of (FIVE MILLION EUROS) Shared among the ten international winners in second categories.The payout of your consolation cash prize will be remunerated directly to you by the official Payment Agency Board upon your preferred option.Our DUE PROCESS UNIT (DPU) will render you complete assistance and provide additional informations and processes for the claims of your consultation prize. For more informations on how to claim your prize,please contact the DPU Information Officer: MR.ROLAND BOSMAN. COMBIPLAY LOTTERY SECURITY AGENCY, DUE PROCESS UNIT (DPU). Tel:+31-626-248-172. FAX:+31-847-306-332. Email: combiplayagent@netscape.net combiplayagent1@walla.com Note that winnings must be claimed not latter than 30th August 2005.Congratulations once again from all our staffs on your consolation prize winning,{COMBIPLAY LOTTERY}. Regards, Mrs.Veronica Van Basten, (Lottery Coordinator) ---------------------------------------------------------- NB: In accordance with the COMBIPLAY LOTTERY -WHEEL E-GAMES policy and regulations,this notification is dispatched directly to only the 10 lucky consolation prize Winners.This notification also contains information that is proprietary,privileged or confidential or otherwise legally exempt from disclosure.If you are not the right recipient whose email address attached to the lucky numbers along with the winning information as you are not authorized to read, print,retain,copy or disseminate this notice or any part of it.

I love those disclaimer blocks. Anyway, there's more to come. The next one wasn't sent via go.com, but from 200.148.228.170 (in Brazil) on Mon, 15 Aug 2005 07:01:46 -0000. This one has an Australian theme, which is new to me. In a slight stretch of credulity, the winnings are in the Netherlands -- a location which comes as no surprise to scamwatchers.

South Australia Lotteries, 23 Rundle Mall, Adelaide, South Australia. (South Australia Lottories is an affiliate of Overseas Subscriber Agents). Arena Complex 14 Donegall Square West, United Kingdom. From: Ariel Bertis e-mail : arielsbertis@yahoo.com.au (Lottery Coordinator) Sir/adam, CONGRATULATIONS!!! We are pleased to inform you of the result of the South Australia Lotteries Winners International programs held on the 12th, August, 2005. Your e-mail address attached to ticket #: 00903228100 with prize # 778009/2 drew €1,000,000.00 which was first in the 2nd class of the draws. you are to receive €1,000,000.00 (One Million Euros). Because of mix up in cash pay-outs, we ask that you keep your winning information confidential until your money (€1,000,000.00) has been fully remitted to you by our accredited pay-point bank. This measure must be adhere to avoid loss of your cash prize - winners of our cash prizes are advised to adhere to these instructions to forestall the abuse of this program by other participants. It's important to note that this draws were conducted formally, and winners are selected through an internet ballot system from 60,000 individual and companies e-mail addresses - the draws are conducted around the world through our internet based ballot system. The promotion is sponsored and promoted by South Australia lotteries. We congratulate you once again. We hope you will use part of it in our next draws; the jackpot winning is €85million. Remember, all winning must be claimed not later than 20 days. After this date all unclaimed cash prize will be forfeited and included in the next sweepstake. Please, in order to avoid unnecessary delays and complications remember to quote personal and winning numbers in all correspondence with us. Congratulations once again from all members of South Australia Lotteries. Thank you for being part of our promotional program. For immediate release of your cash prize to you, please kindly contact our Paying Bank ( Deutsche Bank, Amsterdam.) Send them the following: (i). Your names, (ii) Contact telephone and fax numbers (iii) Contact Address (iv) your winning numbers (v) Quote amount won. Contact the paying bank with the following: Contact person: Mr. Water Williams, Deutsche Bank, Amsterdam, Netherlands. E-mail:custservicess@netscape.net Tel: 31 647-210-426 Fax: 31-847-504-566 Congratulations once again. Yours in service, Ariel Bertis (Lottery director)

But we're not done yet. One more lottery win to go -- for now. This one arrived from 193.43.17.8 on Mon, 15 Aug 2005 11:20:47 -0000. The IP address is Italy, but the contact address is in the Netherlands again.

Plus Netherlands Lottery. Max Euweplein 62 - 1017 MB Amsterdam- The Netherlands TEL+31647152377. FAX+31847174439 FROM: THE DESK OF THE PROMOTION MANAGER INTERNATIONAL PROMOTIONS/PRICE AWARD DEPARTMENT. REFERENCE Nº: PLC/ 74741250/ 05. BATCH Nº: ES 13059 . RE: AWARD WINNING NOTIFICATION/ FINAL NOTICE Plus Lottery Netherlands wishes to inform you the results of the E-mail address ballot lottery international program by Plus Netherlands Lottery held on 3rd March, 2004. Your email address was attached to ticket number 564 75600545-188, with serial number 5388/02 drew with lucky numbers 43-11-44-37-10-43, and consequently you Won the lottery in the (A) category.All participants were selected through a computer ballot system drawn from Microsoft users from company and individual email addresses. You have therefore been approved a lump sum of $706,250.00 ( SEVEN HUNDRED AND SIX THOUSAND, TWO HUNDRED AND FIFTY DOLLARS ) Be advice to keep your winning information confidential until your claims has been processed and your money remitted to you. This is part of our security protocol to avoid double claiming and unwarranted abuse of this program, To begin your claim, please contact your claim agent, RAMON FELIX the Foreign Service Manager of FACIL CREDIT COMMISSION BV, Amsterdam-Netherlands on Mr. RAMON FELIX, Tel: +31 647 152 377. Fax: +31 847 174 439. Email: ramon_felix77@yahoo.com Our agent will immediately commence the process to facilitate the Release of your funds as soon as you contact him and you are to quote your lucky number for confirmation on your winning in every correspondences with claims agent. All winning must be claimed not later than 30th August, 2005. After this date all unclaimed funds will be retured to European Union Treasury as unclaimed. Furthermore, should there be any Change of your address; do inform your claims agent as soon as possible.Congratulations once again !! from all our staffs and thanks for being part of our promotional lottery program. Yours faithfully, Mrs. Carol Anderson (Zonal Co-ordinator)

Lottery Scam: National Lottery International

From the "fake lotteries with stupid names" department, this spam was sent directly to the contact address for this blog, from 82.159.2.235 on Sat, 06 Aug 2005 20:22:56 -0000.

DATE: 6th August, 2005.
FROM: MRS ANGELA MANNI THE DESK OF THE PRESIDENT.
THE NATIONAL LOTTERY INTERNATIONAL PROMOTIONS/PRIZE
AWARD.

REF Nº:EGS/3662367114/13: BATCH : 15/0018/IPD


RE: AWARD NOTIFICATION.

This is to inform you of the release of THE NATIONAL LOTTERY INTERNATIONAL PROMOTIONS PRIZE DRAW, held on the 2nd of August 2005, but owing to some mix up of numbers and addresses and the holidays, the results were released on the 6th August, 2005.Your name was attached to ticket number 085-12876077-09 with serial number 51390-0 that drew the lucky numbers of 03-05-12-14-28-38, which consequently won the lottery in the 5th category. You have therefore been approved for a lump sum pay of £500,000.00. (FIVE HUNDRED THOUSAND BRITISH POUNDS ONLY), in cash credited to file with REF: Nº.EGS/3662367114/13. This is from a total cash prize of £70,020.225.00, shared among the (25) twenty-five international winners in this category.

CONGRATULATIONS!!!

Your fund is now deposited with our Security Company and insured in your name. Due to mix up of some numbers and names, we ask that you keep this
award from public notice until your claim has been processed, and the money remitted to your account, as this is part of our security protocol, to avoid double claiming and unwarranted taking of advantage of this program by participants, as has happened in the past.

All participants were selected through a computer ballot system drawn from 25,000 names, email addresses & official addresses, from Asia, Australia, New Zealand, Europe, North and South America, Middle East and Africa, as part of our International Promotions Program.

We hope your lucky name will draw a bigger cash prize in the subsequent programs. To begin your lotteryclaims, please contact your Claims Agent below with the following information for prompt processing of your claims

FULL NAME
ADDRESS
COUNTRY
AGE
PROFESSION/OCCUPATION
TELEPHONE
FAX

DR LUIS FERNANDEZ, FOREIGN OPERATION MANAGER,
GLOBAL SECURITY & FINANCE COMPANY SPAIN, EMAIL:(drluisfernandez@fsmail.net )TELEPHONE: 0034 67 7256839
Remember, all prize money must be claimed not later than 25th of August, 2005. Any claim not made by this date will be returned to the DEPARTMENT OF THE TREASURY.

NOTE: In order to avoid unnecessary delays and complications, please
remember to quote your reference and batch numbers in all correspondences
with us; or your Claim Agent. Furthermore, should there be any change of
address, please do inform your Claim Agent as soon as possible. An
original copy of your lucky winning ticket and your deposit certificate
will be sent to you by your Claim Agent, DR LUIS FERNANDEZ.

CONGRATULATIONS!!!!

Once again from all members of our staff and thank you for being a part of our International Promotions program. We wish you continued good fortunes.

Sincerely,

ANGELA MANNI (MRS)
PRESIDENT.

N.B. PLEASE CONTACT YOUR CLAIMS AGENT. ANYBODY BELOW 18YEARS IS AUTOMATICALLY DISQUALIFIED.

Job Scam: Girtex

This looks like the common "help theives transfer stolen money out of the country" job scam. It targets Australians, and was sent to a ".au" address. The message was sent from 209.124.114.200 on Sun, 7 Aug 2005 22:07:18 -0000. The FORM data in the message was being POSTed to http://rozmova.if.ua/dating/upload/pic/west/info.php. A cursory inspection suggests that this is a third-party online dating site that has been compromised for the purposes of data collection.

EMPLOYMENT FOR FOREIGN COMPANY Dear Sir/Madam, Girtex inc. is a German company looking for people who will help us to establish a new distribution network in Australia to sell electronic goods. We have reached big sales volume of goods in US and now are trying to penetrate the Australian market. We need agents to receive payment for our products (wire transfers) and to send the money to us this way we will save money because of the tax decreasing. Tax for international money transfer made by legal entity (company) in Germany is 25%. There is no sense for us to work this way, but tax for international money transfer made by a private individual is 7% - Thats why we need You! Soon we will open representative offices and pharmacies or authorized sales centers in Australia and the employees who will make efforts and work hard have a chance to become managers. Anyway we will not loose our employees. The fact that despite the Australian market is new for us we already have regular clients also speaks for itself. HOW MUCH WILL YOU EARN? 250AUD from each transfer operation! You will work as an independent contractor right from your home office. Your job is absolutely legal. You can earn up to $2000-3000 depending on time you will spend for this job. You do not need any capital to start. If you are interested, please feel free to ask for the general provisions. Name: City: Age: Your e-mail:

Advance Fee Fraud: Ching Jin Yuen

This 419 is the standard plea for help in the transfer of funds, but with an Indonesian slant instead of an African one. As is also popular, it makes reference to real-world events, without being verifiably attached to those events in any way, shape, or form. It was sent to the contact address for this blog from 65.54.185.26 (bay15-f26.bay15.hotmail.com) on Fri, 05 Aug 2005 11:05:22 -0000.

Dear friend,

My name is Mr. Ching Jin Yuen, and my home address is PONDOK JATI CR-1, 
SIDOARJO-61251, EAST JAVA, INDONESIA. I am writing to you to help me on both 
humanitarian and mutually benefiting interest grounds. I am relying on your 
help; in return, I will compensate you most generously. My story is not 
quite unique or new, but I believe this approach will bring a solution to my 
family ordeal. Please forgive me for invading your privacy. I specifically 
chose free, opensocieties, which we can only dream of. Because I believe you 
are a busy person, please let me briefly outline my agenda, and then, I will 
proceed to give you details. I am an orthodox Christian and a minority 
ethnic Chinese of Indonesia, and though we as a people have suffered 
Official and private persecution for years, but recently the economic 
downturn of Indonesia has been blamed on us and we have become the 
scapegoats please check the following Websites on Attrocities in Indonesia:

http://www.pacificnet.net/jue/idontknow/indonesia/indonesian_attrocities.html
http://www.huaren.org/editorial/id/080498.html
http://wcar.alrc.net/mainfile.php/Statements/41/

You will find countless articles on the subject, and it is sobering to say 
the last in the light of the foregoing, I took precautionary steps years ago 
and established a numbered Account in United Kingdom, Funds on current 
Deposit 9,375,406.98GBP. As it turned out, it was my wisest and best 
decision yet, and the future of my family is now centered on this money. 
How? Since the Riots broke out, the ethnic Chinese, particularly the rich 
and middle class have been restricted from emigrating to other countries 
with their wealth. The Secret Police trail and watch yourevery move; even as 
I write to you, my telephone is bugged and my family and I are virtually on 
house arrest. A Visa application by the unwary is an invitation for trouble 
and the Secret Police will instantly be at your door and your bank Account 
frozen these are the sordid details and our dear President Susilo Bambang 
Yudhoyonodoes not want the world to know about! On a practical side, I have 
tried both openly and also clandestinely to obtain visas for myself and my 
family at the American Embassy, Address: JI. Merdeka Selatan 4-5, Jakarta 
10110, Indonesia, Phone (62-21) 3435-9000; Fax: (62-21) 385-7189, and my 
efforts proved fruitless; even an application on humanitarian grounds to the 
American Ambassador, Mr. B. Lynn Pascoe, was turned down for "want of
merit", an official language meaning that a grant of visa will be against 
the interest of the State of Indonesia! In summary therefore, I am planning 
to emigrate to America or Canada or any other Western Country, and I need 
your help. I cannot do it from Indonesia.

As a wealthy man I have some means and help, but because of the prying eyes 
of the Secret Police, I am greatly handicapped. I have made a lot of 
research and I have a plan that will work, with your cooperation will 
require your help to retain immigration Attorney who will prepare the basic 
paperwork for me; I will thereafter arrange with a contact Mr. Chin Chun 
Chang who resides in Malaysia and works as a Clerk Assistant and he will 
help me in processing visas and passports for me and my family from 
Malaysia. This contact will, at the appropriate time arrange passage for me 
and m y family to your residing country. Once in your country of residence, 
I will be free toinvest my money in any profitable business in your country.

Meanwhile, I have given the bank in UK currently with my funds instructions 
to follow my NEXT OF KIN in order to avoid anyone or the Secret Police 
forcing me under coercion to wire the funds back to Indonesia or anywhere; 
it is my greatest security. If you are willing to assist me you will please 
do the following for me: -

(1) You will have to contact the bank in UK with my instructions to make all 
necessary arrangement/transactions with them in order to effect my entire 
funds 9,375,406.98GBP into your specified bank account as my NEXT OF KIN.

(2) Upon receiving the money of 9,375,406.98GBP into your account, you will 
use part of the money to retain an immigration Attorney to advise me 
(though, from my researches, my emigration to Canada/America or any Western 
Countries is assured because of my SUBSTANTIAL UK HOLDINGS.

(3) You will please also arrange air charter transportation for me and my 
family from Malaysia to your country of residence details will follow later. 
If you are willing to help me, please reply ONLY by email, and we will 
establish our game plan.

However, in response to this email please forward to me the below 
information to enable my bank in UK to enable all necessary contact with 
you.

i.Your full names
ii.Contact address (Office/Residence)
iii.Telephone/Fax numbers (Office/Residence)

As soon as I receive the above information from you I shall forward to you 
immediately the complete details of my Bank in UK with my funds to commence 
the processing of transfer to your Bank with my instruction. Because, I made 
it known to my Bank in UK that I will provide my NEXT OF KIN in response of 
my funds transfer.

Thank you for your cooperation. I am looking forward to hearing from you 
soonest. Please, forward your reply to my email address below.

Your friend,
MR. CHING JING YUEN
E-MAIL: info_yuen2010@yahoo.co.id

Advance Fee Fraud: Ms. Kimaeva Lioudmila

This isn't the first time we've seen the name of Mikhail Khodorkovsky invoked in a 419 fraud. This one was addressed to the contact address for this blog, and was received from 66.219.103.122 on Fri, 05 Aug 2005 04:29:53 -0000. It's not entirely clear whether this was a webmail exploit or something else.

 I am Ms.KIMAEVA LIOUDMILA personal secretary to
Mikhail Khodorkovsky the richest man in Russia and
owner of the following companies: Chairman CEO: YUKOS OIL (a
Russian oil company) and
Menatep SBP Bank (A reputable financial institution)
who got arrested for his involvement in politics in
financing opposition political parties (the Union of Right
Forces, led by Boris Nemtsov, and Yabloko, a liberal/social
democratic party led by Gregor Yavlinsky) which poses a
treat to President Vladimir Putin second tenure as
Russian president.
More information are available on:
http://news.bbc.co.uk/1/hi/business/3213505.stm and
http://newsfromrussia.com/main/2003/11/13/51215.html.
I got your contact in my search for a reliable and
trustworthy entity who could handle this confidential
transaction.
You will be entitled to 30% of the sum once everything gets
concluded. Please take this seriously as it is not a hoax.
All I need from you is to stand as a beneficiary to the
funds in one of his accounts that has not yet been
discovered by the authorities.
The account holds the sum of 50.2 million dollars($50.2m).
All modalities necessary for the successful transfer of this
money have been worked out and I wish to relocate out of
here quietly once we are through.
Please if you are interested, provide your details such as
full name, business name, if you have a business and
telphone number so that we can commence immediately. The
transaction has to be concluded in 2 weeks As soon as I get
your willingness to comply through
my most private email address( kmila1@myway.com ]
I will give you more details.

Regards,
Ms.KIMAEVA LIOUDMILA

Advance Fee Fraud: Jacob Moboyo

This is a plain 419, notable only for the fact that it was sent to my legacy address rather than the usual approach of web-scraping. Also, it arrived twice. Both instances came from 196.39.9.66 (in Africa), one on Thu, 04 Aug 2005 22:56:10 +0000, the other on Thu, 04 Aug 2005 23:51:26 +0000.

From Mr. Jacob Moboyo.
Telephone + 27 72 135 8631.

Greetings,

My name is Jacob Moboyo, the elder son of Mr. Tami Moboyo of Zimbabwe.
This might be a surprise to you about where I got your contact address. I got your address from the South African Chamber of Commerce in Johannesburg, South Africa.

During the current war against the farmers in Zimbabwe
from the supports of our President Robert Mugabe to
claim all the white-owned farms to his party members
and his followers, he ordered all white farmers to
surrender all farms to his party members and his
followers.

My father is One of the best farmers in our country
and because he did not support Mugabes ideas,Mugabes
supports invaded my fathers farm and burnt everything
in the farm,killing my father and made away with a lot
of items in my fathers farm.

Before his death, my father had deposited with of the
Security Company in Johannesburg, South Africa the sum
of US$25,5 MILLION (TWENTY FIVE MILLION FIVE HUNDERD
THOUSAND UNITED STATES DOLLARS). After the death of my
father, we decided to move to the Republic of South
Africa where he had deposited the money in the
Security Company as valuables.

So I decided to contact overseas firm or a private Individual
that will assist me to move this money out of South Africa because
as asylum seekers we are not allowed to operate any Bank Account within South Africa.
We have agreed to offer you 25% of the total sum for your assistance, while 75% will
be for me and my family to invest in your country.

You can reach my Mother on this number but please note that she does not speak much of English.please do email us through the below email address.

Tel+ 27 72 135 8631
jacobmoboyo@zwallet.com

Thanks and God bless.

Best Regards
Mr. Jacob Moboyo.

Advance Fee Fraud: Thomas Graham

Here is one common or garden variety 419 scam, telling lies about otherwise true stories in order to lend itself credibility. As is common with 419s of late, this message was sent through a poorly configured webmail system, this time at www.MyFamily.com. Hint to webmasters: the Internet is an unfriendly place, and having your site exploited by miscreants such as this is bad for your reputation, so be careful out there. The shamed IP address in this case is 66.43.25.158.

From The Desk of: Thomas Graham
Head of Trustee and Depository
Institutional Fund Services.
HSBC Bank Plc 24th Floor
8 Canada Square
London E14 5hq.
3rd Of Aug 2005.

   Compliment to you and your family.

 DearSir,

 I am Thomas Graham the Head of Trustee and Depository Institutional
 Fund Services HSBC Bank Plc London. I am writing following an opportunity
 in my office that will be of immense benefit to both of us.
 In my department we discovered an abandoned sum of 14.5million
 British Pounds Sterling (Fourteen million five hundred thousand British
 Pounds) in an account that belongs to one of our foreign customers Late
 Mr. Morris Thompson an American who unfortunately lost his life in the
 plane crash of Alaska Airlines Flight 261 which crashed on January 31
 2000, including his wife and only daughter. You shall read more about
 the crash on visiting this site.
 http://www.cnn.com/2000/US/02/01/alaska.airlines.list/ and
 http://www.nativefederation.org/history/people/mThompson.htm
l
 Since we got information about his death, we have been expecting his
 next of kin or relatives to come over and claim his money because we
 cannot release it unless somebody applies for it as next of kin or 
 relation
 to the deceased as indicated in our banking guidelines. Unfortunately I
 learnt that his supposed next of kin being his only daughter died along
 with him in the plane crash leaving nobody with the knowledge of this
 fund behind for the claim. It is therefore upon this discovery that I
 and two other officials in this department now decided to make   business
 with you and release the money to you as the next of kin or
 beneficiary of the funds for safety keeping and subsequent disbursement 
 since
 nobody is coming for it and we don't want this money to go back into
 Government treasury   as unclaimed bill.
 The banking law and guidelines here stipulates that such money
 remained after five years the money will be transferred into banking
 treasury as unclaimed funds.

 We agreed that 30% of this money will be for you as foreign partner,
 while the balance will be for me and my colleagues.
 I will visit your country for the disbursement according to the
 percentages indicated above once this money gets into your account. 
 Please  be honest to me and trust is our watchword in this transaction.
 Note this transaction is confidential and risk free.   As soon as you
receive this mail you should contact me by return mail.

Please   all necessary arrangement for the smooth release of these funds
to you has been finalised. We will discuss much in details when I do receive
your response.Please in your response include your telephone number for easy
communication between us.
Best regards,

 Mr. Thomas Graham


_____________________________________________________________________
Get your own family web site at www.MyFamily.com!

Pump and Dump: Odds and Ends

There have been a few seen-it-all-before type pump and dumps arrive in the last few days. I won't bother with full text or linking to all past instances -- just a quick summary of stocks and sources. The PSIV and EDEX were sent to "address X", and the PGCN to my legacy address.

Stock	IP Address	Date Received
PSIV	82.230.217.89	Fri, 29 Jul 2005 01:41:40 -0000
PGCN	61.207.157.134	Fri, 29 Jul 2005 03:44:14 +0000
PSIV	60.10.84.159	Fri, 29 Jul 2005 04:37:54 -0000
EDEX	218.23.66.95	Sat, 30 Jul 2005 19:48:32 -0000
EDEX	208.199.20.196	Sun, 31 Jul 2005 17:12:14 -0000
PGCN	210.213.224.9	Mon, 01 Aug 2005 01:24:30 +0000

Advance Fee Fraud: Philip Eze

For the record, one common or garden variety 419 sent to the blog's contact address, received from 203.200.89.200 on Mon, 01 Aug 2005 10:39:14 -0000. The source address is in India, according to WHOIS, and it's the only IP address listed in the headers. There are no obvious signs as to whether this was injected from a webmail system (typical 419 modus operandi at the moment) or not, but the evidence is at least compatible with that theory.

I am Mr PHILIP EZE
secratary to the operation manager
Equity Trust  Bank,Lagos, Nigeria.

ATTN SIR 

I have urgent and very confidential business proposition for you. On 
June 6, 2000, 
a Foreign Oil consultant/contractor with the Nigerian National 
Petroleum Corporation, 
Mr.Barry Kelly made a numbered time (Fixed) Deposit for twelve calendar 
months, 
valued at US$26,500,000.00, (Twenty-six Million, five hundred thousand 
Dollars) 
in my branch.

Upon maturity, my boss sent a routine notification to his forwarding 
address but got 
no reply. After a month,we sent a reminder and finally we discovered 
from his contract 
employers, the Nigerian National Petroleum Corporation that Mr. Barry 
Kelly died from 
an automobile accident. On further investigation, we found out that he 
died without 
making a WILL, and all attempts to trace his next of kin was fruitless. 
The bank 
therefore made further investigation and discovered that Mr. Barry 
Kelly did not 
declare any kin or relations in all his official documents, including 
his Bank Deposit 
paperwork in my Bank. No one will ever come forward to claim it. 
According to Nigerian 
Law, at the expiration of 5 (five) years, the money willrevert to the 
ownership of the 
Nigerian Government if nobody applies to claim the fund.


Consequently, my proposal is that I will like you as an Foreigner to 
stand as next of 
kin to late Mr.Barry Kelly so that the fund US$26,500,000.00 will be 
released and paid 
into your account as the next of kin. I have All documents and proves 
to enable get 
this fund has been carefully worked out by me because of my position as 
the secratary 
to the operation manager .So if you are interested in this deal, 
quickly furnish me 
with your full names as it will appear in the claims doccuments to the 
bank, your full 
address, telephone and fax number. I am writing you because I as a 
public servant
(Junior staff with the bank),i cannot operate a foreign account or have 
an account 
that is more than $200,000.00 USD.

The money will be moved out for us to share in the ratio of 50% for me 
30% for you, 
10% for all expensis and 10% for orphanage After getting this fund 
accross to you, 
i intend to invest my share of this fund in your country, under your 
supervission as 
i can not take them all to my country.If you are interested, please 
reply immediately 
via my email address . 

Upon your response, I shall then provide you with more details and 
relevant documents 
that will help you understand the transaction. Please observe utmost 
confidentiality, 
and rest assured that this transaction would be most profitable for 
both of us because 
I shall require your assistance to invest my share in your 
country.(Buying of properties 
like houses, hotels etc) 

Please do send me your private/mobile telephone fax number so that we 
can have a smooth 
communication.

Awaiting your urgent reply 

Thanks and regards.
PHILIP   EZE