Spam 419/Nigeria Online fraud jwSpamSpy Contact
Email Spam Filter: |
|
|
419 Scam – "ROYAL GAMES LOTTERY / BOND TRUST LIMITED / Steve Henman / Martin Gardner"
- About the 419 (Advance Fee) scam
- Email addresses used by 419 scammers
- Phone numbers used by 419 scammers
- How to report 419 spam to us
- Domains registered by 419 scammers
- Company names mentioned in 419 spam
- What can you do when you receive 419 spam
- Google search: "BOND TRUST LIMITED"
"BOND TRUST LIMITED" is the fake identity used by a gang of advance fee fraud ("419") scammers operating in South Africa. It's a fraud. (see one example scam email here).
This scam appears to be related to the "SOUTHTRUST INVESTMENT PTY. / GOLDEN REEF LOTTERY" as well as the "CASHFLO FINANCIAL SERVICES LTD / IMPERIAL LOTTERY UK" and "WORLD WIDE CASH CHANGE LTD / PRESTIGIUOS LOTTERY UK" scams.
|
The scammers have registered these domains, which - like the majority of domains registered for 419 fraud - are hosted by Microsoft's MSN service:
- bond-trust.net
- bondonline-site.com
- bondtrusltd.com (complaints to: [email protected])
- bondtrustltd.net (complaints to: [email protected])
- bond-trust.com (complaints to: [email protected])
- bondtrustlimited.com (complaints to: [email protected])
Email addresses used for the scam:
- [email protected]
The scammers use UK phone numbers to give the victim the impression he/she is dealing with a bona-fide British company, but the +44 70... numbers are premium rate personal numbers that can forward calls to anywhere in the world and which are very costly to call. We assume that the calls will be answered in South Africa or maybe Nigeria.
- +44 7005804427
- +44 7040118013
- +44 7005805159
- +44 7040118829
Sample "winning notification":
To: [email protected] Subject: WINNING NOTIFICATION!!!! From: RoyalGames <[email protected]> X-Priority: 3 (Normal) Cc: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Mailer: RLSP Mailer Message-Id: <[email protected]> Date: Mon, 14 Feb 2005 01:03:24 +0100 THE ROYAL GAMES LOTTERY UK HEAD OFFICE 10 Cabot Square London H146QR,UK. ENGLAND. Dear Sir/Madam, We are pleased to announce you as one of the 3 lucky winners in the ROYAL GAMES LOTTERY draw held on 10th of February. All 3 winning addresses were selected randomly from a batch of 5,000,000 international and local emails. Your email address emerged alongside 2 others as a 3rd category winner in this month's draw. you have therefore been approved for a total pay out of £2,000,000 Pounds ( Two million pounds) only. These details are attached to your lotto payment order: (i) Winning numbers: 09, 10, 25, 33, 42, 45 (ii) Email ticket number: 273-1-3221 (iii) Lotto batch number: RG-916 (iv) File Ref. number: BT-512-8 Please contact the underlisted claims officer as soon as possible for the immediate payout of your winnings: Mr.Steve Henman Claims Department Manager BOND TRUST LIMITED. Email: [email protected] Tel:Fax +44 7005804427 Congratulations once again on behalf of all our staff, Sincerely, Martin Gardner Promotions Manager Tel: +44 7040118013 Fax: +44 7005805159 N.B: 1.All claims are nullified after 10 working days from today. 2.Your Ref number must be in all your mails with the claims officer. 3.Inform your claims officer of any change of names or addresses. 4.All winners under the age of 18 are automatically dis-qualified. 5.Please do not reply to this email. Contact your claims agent. ____________________________________________________________ The Royal Games Lottery Awards is proudly sponsored by financialCorp's,the royal group and a conglomeration of other international IT companies. ROYAL GAMES internet draw is held monthly, and is organized to encourage the use of the internet and computers worldwide. We are proud to say that over 200 Million Pounds are won annually in more than 150 countries worldwide. ___________________________________________________________________________ Geschickt über www.Retropoly.de Dem Portal für kultige Computer und Videospiele
Sample reply from the "claims agent":
The email above was sent from South Africa.
WHOIS details for sending IP address 155.239.67.95:
The claims form is called LWCF.doc, just like in the "SOUTHTRUST LTD" scam. It was last saved by "PC2" and the author is set to "Your User Name".
Another version of the scam email using a different domain but otherwise identical details (postal address, winning numbers, etc.):
"bondtrustltd.net" (complaints to: [email protected])
WHOIS record for 419-scam domain "bondtrustltd.net"
"bondtrustlimited.com" (complaints to: [email protected])
WHOIS record for 419-scam domain "bondtrustlimited.com"
WHOIS record for 419-scam domain "bondtrusltd.com"
WHOIS record for 419-scam domain "bond-trust.com"
WHOIS details for sending network (IP 64.213.70.208):
WHOIS details for 419 fraud domain "bondonline-site.com":
WHOIS details for 419 fraud domain "bond-trust.net":
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
Tue, 15 Feb 2005 07:53:02 -0800
Message-ID: <[email protected]>
Received: from 155.239.67.95 by by21fd.bay21.hotmail.msn.com with HTTP;
Tue, 15 Feb 2005 15:52:03 GMT
X-Originating-IP: [155.239.67.95]
X-Originating-Email: [[email protected]]
X-Sender: [email protected]
From: "Claims Department"
OrgName: Telkom
OrgID: TELKOM
Address: Soekor Building
Address: 151 Frans Conradie Ave
City: Parow
StateProv: Western Cape
PostalCode: 7500
Country: ZA
NetRange: 155.239.0.0 - 155.239.255.255
CIDR: 155.239.0.0/16
NetName: TELKOM
NetHandle: NET-155-239-0-0-1
Parent: NET-155-0-0-0-0
NetType: Direct Assignment
NameServer: IGUBU.SAIX.NET
NameServer: SANGOMA.SAIX.NET
Comment: Please contact [email protected] for abuse queries
RegDate: 1992-03-25
Updated: 2003-08-27
AbuseHandle: TIA-ARIN
AbuseName: Telkom IPNet Abuse
AbusePhone: +27 12 6807561
AbuseEmail: [email protected]
NOCHandle: TIN2-ARIN
NOCName: Telkom IPNet NNOC
NOCPhone: +27 12 6800224
NOCEmail: [email protected]
TechHandle: JDU24-ARIN
TechName: Du Preez, Johan
TechPhone: 012 6800067
TechEmail: [email protected]
OrgAbuseHandle: TIA-ARIN
OrgAbuseName: Telkom IPNet Abuse
OrgAbusePhone: +27 12 6807561
OrgAbuseEmail: [email protected]
OrgTechHandle: TIN2-ARIN
OrgTechName: Telkom IPNet NNOC
OrgTechPhone: +27 12 6800224
OrgTechEmail: [email protected]
Date: Thu, 17 Feb 2005 10:37:03 +0200
From: [email protected]
Reply-To: [email protected]
Subject: WINNING NOTIFICATION!
To: [email protected]
THE ROYAL GAMES LOTTERY
UK HEAD OFFICE
10 Cabot Square
London H14 6QR,UK.
ENGLAND.
Dear Winner,
We are pleased to announce you as one of the 3 lucky winners in the ROYAL
GAMES LOTTERY draw held on 7th of February. All 3 winning addresses were
randomly selected from a batch of 5,000,000 international emails. Your email
address emerged alongside 2 others as a 3rd category winner in this month's
draw.
Consequently,you have therefore been approved for a total pay out of �2,000,000
Pounds ( Two million pounds) only. The following particulars are attached
to your lotto payment order:
(i) Winning numbers: 09, 10, 25, 33, 42, 45
(ii) Email ticket number: 273-1-3221
(iii) Lotto batch number: RG-916
(iv) File Ref. number: BT-512-11
Please contact the underlisted claims officer as soon as possible for the
immediate release of your winnings:
Mr.Steve Henman
Claims Department Manager
BOND TRUST LIMITED.
Email: [email protected]
Tel/Fax: +44 7005804427
Once again on behalf of all our staff,CONGRATULATIONS!!!
Sincerely,
Martin Gardner
Promotions Manager
Tel: +44 7040118013
Fax: +44 7005805159
N.B:
1.All claims are nullified after 10 working days from today.
2.Your Ref number must be in all your mails with the claims officer.
3.Do inform the claims officer of any change of names or addresses.
4.All winners under the age of 18 are automatically dis-qualified.
5.Please do not reply to this email. Contact your claims agent.
___________________________________________________________
The Royal Games Lottery Awards is proudly sponsored by financial Corp's,the
royal group and a conglomerationof other international IT companies. ROYAL
GAMES internet draw is held monthly, and is organized to encourage the use
of the internet and computers worldwide. We are proud to say that over 200
Million Pounds are won annually in more than 150 countries worldwide.
___________________________________________________________
Book yourself something to look forward to in 2005.
Cheap flights - http://www.tiscali.co.uk/travel/flights/
Bargain holidays - http://www.tiscali.co.uk/travel/holidays/
Date: Wed, 23 Feb 2005 07:09:02 +0800
From: Royalgames_Coordinator
As you can see from the record below, this supposedly British company is registered using a (probably bogus) residential address in the USA only two weeks ago. The admin email address starts with "claimsmanager@..." as in the southtrustltd.net domain.
Request: bondtrustltd.net
from whois.crsnic.net:43 [cached Wed Feb 16 01:41:25 2005 UTC]
from whois.melbourneit.com:43 [cached Wed Feb 16 01:41:26 2005 UTC]
Domain Name.......... bondtrustltd.net
Creation Date........ 2005-02-03
Registration Date.... 2005-02-03
Expiry Date.......... 2006-02-03
Organisation Name.... Benjamin Berkowitz
Organisation Address. 1400 Laurel Avenue
Organisation Address.
Organisation Address. Minneapolis
Organisation Address. 55403
Organisation Address. MN
Organisation Address. UNITED STATES
Admin Name........... Benjamin Berkowitz
Admin Address........ 1400 Laurel Avenue
Admin Address........
Admin Address........ Minneapolis
Admin Address........ 55403
Admin Address........ MN
Admin Address........ UNITED STATES
Admin Email.......... [email protected]
Admin Phone.......... +1.6123331210
Admin Fax............
Tech Name............ MSN NOC
Tech Address......... One Microsoft Way
Tech Address.........
Tech Address......... Redmond
Tech Address......... 98052
Tech Address......... WA
Tech Address......... UNITED STATES
Tech Email........... [email protected]
Tech Phone........... +1.4258828080
Tech Fax.............
Name Server.......... pdomns1.msn.com
Name Server.......... pdomns2.msn.com
The .com version of the domain was created the day before its .net sibling using the same name but a different bogus street address in the USA. Street addresses on "Vassar Avenue" in "Canoga Park" were also used in domains registered for the "CASHFLO FINANCIAL SERVICES LTD / IMPERIAL LOTTERY UK" and "WORLD WIDE CASH CHANGE LTD / PRESTIGIUOS LOTTERY UK" scams.
Request: bondtrustlimited.com
connected to whois.crsnic.net [198.41.3.54:43] ...
connected to whois.enom.com [66.151.151.170:43] ...
Registration Service Provided By: Microsoft
Contact: [email protected]
Visit: http://support.msn.com/contactus.aspx?pk=PersonalAddress
Domain name: bondtrustlimited.com
Registrant Contact:
Benjamin Berkowitz
Benjamin Berkowitz ([email protected])
+1.8186234544
Fax: none
116 vassar avenue
canoga park, CA 91304
US
Administrative Contact:
Benjamin Berkowitz
Benjamin Berkowitz ([email protected])
+1.8186234544
Fax: none
116 vassar avenue
canoga park, CA 91304
US
Technical Contact:
NOC MSN
NOC MSN ([email protected])
+1.4258828080
Fax: none
One Microsoft Way
Redmond, WA 98052
US
Billing Contact:
NOC MSN
NOC MSN ([email protected])
+1.4258828080
Fax: none
One Microsoft Way
Redmond, WA 98052
US
Status: Locked
Name Servers:
pdomns1.msn.com
pdomns2.msn.com
Creation date: 02 Feb 2005 16:13:30
Expiration date: 02 Feb 2006 16:13:30
Request: bondtrusltd.com
connected to whois.melbourneit.com [203.27.227.114:43] ...
Domain Name.......... bondtrusltd.com
Creation Date........ 2005-02-08
Registration Date.... 2005-02-08
Expiry Date.......... 2006-02-08
Organisation Name.... George Duncan
Organisation Address. 122, griven avenue,
Organisation Address.
Organisation Address. excel
Organisation Address. 36439
Organisation Address. AL
Organisation Address. UNITED STATES
Admin Name........... George Duncan
Admin Address........ 122, griven avenue,
Admin Address........
Admin Address........ excel
Admin Address........ 36439
Admin Address........ AL
Admin Address........ UNITED STATES
Admin Email.......... [email protected]
Admin Phone.......... +1.2023417989
Admin Fax............
Tech Name............ MSN NOC
Tech Address......... One Microsoft Way
Tech Address.........
Tech Address......... Redmond
Tech Address......... 98052
Tech Address......... WA
Tech Address......... UNITED STATES
Tech Email........... [email protected]
Tech Phone........... +1.4258828080
Tech Fax.............
Name Server.......... pdomns1.msn.com
Name Server.......... pdomns2.msn.com
Request: bond-trust.com
connected to whois.enom.com [66.151.151.170:43] ...
Registration Service Provided By: Microsoft
Contact: [email protected]
Visit: http://support.msn.com/contactus.aspx?pk=PersonalAddress
Domain name: bond-trust.com
Registrant Contact:
williams Jones
williams Jones ([email protected])
+1.7186123124
Fax: none
6567 baisely blvd
jamaica, NY 11434
US
Administrative Contact:
williams Jones
williams Jones ([email protected])
+1.7186123124
Fax: none
6567 baisely blvd
jamaica, NY 11434
US
Technical Contact:
NOC MSN
NOC MSN ([email protected])
+1.4258828080
Fax: none
One Microsoft Way
Redmond, WA 98052
US
Billing Contact:
NOC MSN
NOC MSN ([email protected])
+1.4258828080
Fax: none
One Microsoft Way
Redmond, WA 98052
US
Status: Locked
Name Servers:
pdomns1.msn.com
pdomns2.msn.com
Creation date: 21 Feb 2005 14:42:22
Expiration date: 21 Feb 2006 14:42:22
ATTN: Firstname Lastname
Dear Winner,
Acting on the instructions in your claims file with the below Lotto payment
order:
Winning numbers: 02, 12, 19, 23, 40, 49
Email ticket number: 273-1-3221
Lotto batch number: RG-916
File Ref. number: BT-512-09
I wish to inform you that payment of your Lottery Claims amounting to
�2,000,000.00 being prize money from Royal Games lottery 3rd Category draws
has been certified by all authorities involved. You are required to fill a
"Lottery Winnings Claim Form" with all necessary details. Follow the link
below to download the form as .doc or .PDF documents.
http://www.bondonline-site.com/lottery_page_2.htm
After download, print, fill, and send to us either by fax or as an email
attachment. You will also be required to pay a fee of �4,550.00 (Four
thousand five hundred and fifty Great Britain Pounds), or its equivalent in
your local currency. This payment is to cover transfer charges,
administrative cost, opening of account charges, Insurance of vital
documents like prize claim certificate and other transfer documents, that
will be sent to you via Courier service immediately transfer of your
winnings is effected. Note that your total prize claim of �2,000,000.00 has
been insured to it's real value and it's against the Gaming control rules
here in Britain to deduct the above fees from the prize money for any reason
whatsoever. You are required to respond and act without delay to all
instructions provided above to ensure a glitch free claims process that will
facilitate the transfer of your prize money.
Note that your winnings will be transferred to your stipulated Bank account
within 24hours after receipt of all requirements. I shall send you
remittance instruction for the required fee, once I recieve your filled
lottery winning claims form.
Congratulations once more, and thanks for your cooperation.
Truly yours,
Mr.Steve Henman
Claims Department Manager
BOND TRUST LIMITED.
Email: [email protected]
Tel: +44 7040118829
Fax: +44 7005804427
NB: We also encourage you to visit ROYAL GAMES LOTTERY website at
www.rgs-page.org and take your chance to play and become part of thier
monthly winners. Millions are won on a monthly basis on one of the world's
most famous free lotto service.
Firstname Lastname <emailaddress>
Received: from 64.213.70.208 by by15fd.bay15.hotmail.msn.com with HTTP;
Fri, 01 Apr 2005 13:22:48 GMT
X-Originating-IP: [64.213.70.208]
X-Originating-Email: [[email protected]]
X-Sender: [email protected]
OrgName: Global Crossing
OrgID: GBLX
Address: 14605 South 50th Street
City: Phoenix
StateProv: AZ
PostalCode: 85044-6471
Country: US
ReferralServer: rwhois://rwhois.gblx.net:4321
NetRange: 64.212.0.0 - 64.215.255.255
CIDR: 64.212.0.0/14
NetName: GBLX-11D
NetHandle: NET-64-212-0-0-1
Parent: NET-64-0-0-0-0
NetType: Direct Allocation
NameServer: NAME.ROC.GBLX.NET
NameServer: NAME.PHX.GBLX.NET
NameServer: NAME.SNV.GBLX.NET
NameServer: NAME.JFK1.GBLX.NET
Comment: rwhois.gblx.net:4321 - THESE ADDRESSES ARE
Comment: NON-PORTABLE
RegDate:
Updated: 2003-10-31
TechHandle: IA12-ORG-ARIN
TechName: GBLX-IPADMIN
TechPhone: 800-404-7714
TechEmail: [email protected]
OrgAbuseHandle: GBLXA-ARIN
OrgAbuseName: GBLX-Abuse
OrgAbusePhone: 800-404-7714
OrgAbuseEmail: [email protected]
OrgNOCHandle: GBLXN-ARIN
OrgNOCName: GBLX-NOC
OrgNOCPhone: 800-404-7714
OrgNOCEmail: [email protected]
OrgTechHandle: IA12-ORG-ARIN
OrgTechName: GBLX-IPADMIN
OrgTechPhone: 800-404-7714
OrgTechEmail: [email protected]
Request: bondonline-site.com
from whois.crsnic.net:43 [cached Sat Apr 2 14:24:54 2005 UTC]
from whois.schlund.info:43 [cached Sat Apr 2 14:24:55 2005 UTC]
% The data in the WHOIS database of Schlund+Partner AG is provided by
% Schlund+Partner for information purposes, and to assist persons in
% obtaining information about or related to a domain name registration
% record. Schlund+Partner does not guarantee its accuracy. By submitting
% a WHOIS query, you agree that you will use this data only for lawful
% purposes and that, under no circumstances, you will use this data to
% (1) allow, enable, or otherwise support the transmission of mass
% unsolicited, commercial advertising or solicitations via E-mail
% (spam); or
% (2) enable high volume, automated, electronic processes that apply to
% Schlund+Partner or its systems.
% Schlund+Partner reserves the right to modify these terms at any time.
% By submitting this query, you agree to abide by this policy.
domain: bondonline-site.com
created: 22-Feb-2005
last-changed: 22-Feb-2005
registration-expiration: 22-Feb-2006
nserver: ns29.1and1.com 217.160.224.2
nserver: ns30.1and1.com 217.160.228.2
status: CLIENT-TRANSFER-PROHIBITED
registrant-firstname: Derby
registrant-lastname: Hackney
registrant-street1: 1188 baisley blvd
registrant-pcode: 11434
registrant-state: NY
registrant-city: Jamaica
registrant-ccode: US
registrant-phone: +1.7185167810
registrant-email: [email protected]
admin-c-firstname: Derby
admin-c-lastname: Hackney
admin-c-street1: 1188 baisley blvd
admin-c-pcode: 11434
admin-c-state: NY
admin-c-city: Jamaica
admin-c-ccode: US
admin-c-phone: +1.7185167810
admin-c-email: [email protected]
tech-c-firstname: Hostmaster
tech-c-lastname: ONEANDONE
tech-c-organization: 1&1 Internet Inc.
tech-c-street1: 701 Lee Rd.
tech-c-street2: Suite 300
tech-c-pcode: 19087
tech-c-state: PA
tech-c-city: Chesterbrook
tech-c-ccode: US
tech-c-phone: +1.8774612631
tech-c-fax: +1.6105601501
tech-c-email: [email protected]
bill-c-firstname: Hostmaster
bill-c-lastname: ONEANDONE
bill-c-organization: 1&1 Internet Inc.
bill-c-street1: 701 Lee Rd.
bill-c-street2: Suite 300
bill-c-pcode: 19087
bill-c-state: PA
bill-c-city: Chesterbrook
bill-c-ccode: US
bill-c-phone: +1.8774612631
bill-c-fax: +1.6105601501
bill-c-email: [email protected]
Request: bond-trust.net
from whois.crsnic.net:43 [cached Sat Apr 2 14:21:45 2005 UTC]
from whois.melbourneit.com:43 [cached Sat Apr 2 14:21:46 2005 UTC]
Domain Name.......... bond-trust.net
Creation Date........ 2005-03-30
Registration Date.... 2005-03-30
Expiry Date.......... 2006-03-30
Organisation Name.... James Conolly
Organisation Address. 20 Paradise lane
Organisation Address.
Organisation Address. Houston
Organisation Address. 77535
Organisation Address. TX
Organisation Address. UNITED STATES
Admin Name........... James Conolly
Admin Address........ 20 Paradise lane
Admin Address........
Admin Address........ Houston
Admin Address........ 77535
Admin Address........ TX
Admin Address........ UNITED STATES
Admin Email.......... [email protected]
Admin Phone.......... +1.3162210233
Admin Fax............
Tech Name............ MSN NOC
Tech Address......... One Microsoft Way
Tech Address.........
Tech Address......... Redmond
Tech Address......... 98052
Tech Address......... WA
Tech Address......... UNITED STATES
Tech Email........... [email protected]
Tech Phone........... +1.4258828080
Tech Fax.............
Name Server.......... pdomns1.msn.com
Name Server.......... pdomns2.msn.com
|