joewein.de LLC
Fighting spam and scams
on the Internet

Home / Blog / About us
Spam
419/Nigeria
Online fraud
jwSpamSpy
Contact

Email Spam Filter:
 jwSpamSpy
Try it for free!

Google

 

419 Scam Example: "NETXPRESS LOTTERY INTERNATIONAL / Mr.GEORGE WILLIAMS / George Williams & Associates / Netxpress Diplomatic Courier Services"

"NETXPRESS LOTTERY INTERNATIONAL / Mr.GEORGE WILLIAMS" are labels used by a gang in Nigeria and the UK for a fake lottery fraud (advance fee fraud, "419"). Emails sent by "Mr.GEORGE WILLIAMS", who uses a UK postal address and UK phone numbers, are actually sent from Nigeria. The scam involves a fake lottery, a fake lawyer and a fake courier company. The lawyer and courier company send emails from the same IP address. The courier company also sends mail from a different IP address used in the Greenwood Consultants Ltd fake lottery scam. Probably NETXPRESS and GREEENWOOD CONSULTANTS LTD are different labels for the same scam.

Several of these scams use the nonexistant postal address "7a Omiston Grove" in London and send emails from the same IP address 80.88.128.12.

jwSpamSpy
Are you sick of spam too? Do you want it stopped now?
Try jwSpamSpy, the spamfilter we use to track the spammers!
Free 30-day trial version available now!

Domains used in this scam:

The free website primelottery.7p.com in this scam is the equivalent of "www.4tunecitylottery.4t.com" in the Greenwood Consultants scam. Except for this site, all domains are hosted by MSN and were registered the same day.

Example of "NETXPRESS LOTTERY INTERNATIONAL" scam email:

From: "jonathan meyers" 
Sent: Saturday, 12 February, 2005 20:16
Subject: CONGRATULATIONS!!

NETXPRESS LOTTERY INTERNATIONAL
(affiliated to PRIME LOTTERY INT'L,AMSTERDAM & BRITISH GAMING 
BOARD.www.primelottery.7p.com)
173-183, Gloucester Place, London, NW1 6DX, UNITED KINGDOM.

Ref. Number: 132/756/4509
Batch Number: 538901527-Bc68
Ticket Number: 27522465896-6453

Dear Sir/Madam,

We are pleased to inform you of the result of the Winners in our 5-YEAR 
International Lottery Program held on the 11th Day of FEBUARY, 2005. Your 
e-mail address attached to ticket number 27522465896-6453 with serial number 
3772-554 drew lucky numbers 7-14-18-31-45 which consequently won in the 2ND 
category, you have therefore been approved for a lump sum pay out of 
1,250,000 EUROS
(ONE MILLION TWO HUNDRED AND FIFTY THOUSAND EUROS)

CONGRATULATIONS!
Due to mix up of some numbers and names, we ask that you keep your winning 
information confidential until your claims have been fully processed and 
your money Remitted to you. This is part of our security protocol to avoid 
multiple claims and unwarranted abuse of this program by some participants. 
All participants were selected through a computer ballot system drawn from 
over 20,000 company and 30,000,000 individual email addresses and names from 
all over the world. This promotional program takes place every five years.
This lottery was promoted and sponsored by a conglomerate of some 
multinational companies in Europe as part of their social responsibility to 
the citizens in the communities where they have operational bases. We hope 
with part of your winnings you will take part in our next year Ten million 
Euros international lottery. To file for your claim, please contact your 
solicitor/fiducial agent:MR GEORGE B.WILLIAMS (GEORGE WILLIAMS & 
ASSOCIATES)Email:[email protected])

Remember all winning must be claimed not later than 10th of MARCH, 2005. 
After this date all unclaimed funds will be included in the nextstake. 
Please note in order to avoid unnecessary delays and complications, remember 
to quote your reference number and batch numbers in all correspondence. 
Furthermore should there be any change of address do inform our agent as 
soon as possible. Congratulations once more from our members of staff and 
thank you for being part of our promotional program.

Yours Faithfully,
MR.JONATHAN MEYERS
INTERNATIONAL LOTTERY (COORDINATOR)

P.S:Anybody under the age of 18 is automatically disqualified.Any breach of 
confidentiality on the part of the winner will result to disqualification 
and render the result void.Contact your claims/fudiciary agent MR GEORGE 
WILLIAMS.Your winning prize has been assigned to him for processing.

Reponse from the claims agent:

ATTN:FIRSTNAME LASTNAME,

Thank you for the phone call.We hereby inform you that we have received the required informations. The services of a Certified Notary Public has been engaged to handle the Affidavit and Notarisation of your Papers Your payment is now being finally processed.Your cheque will soon be ready for disbursement,along with your winnings certificate.
In this regard you are to choose from the options below the one that best suites you on how you wish to receive your winning prize:

1. Come down in person to collect your winning prize at ThePromoters office:NETXPRESS LOTTERY INTERNATIONAL
(affiliated to the british lottery board and national lottery distribution fund) 173-183, Gloucester Place, London, NW1 6DX, UNITED KINGDOM.

2. Have our affiliate courier company send the cheque of your winning prize to you.

In consonance with our policy in this regard, be advised that if you opt for the cheque to be couriered,the cost of this service would be borne by you; this is a prerequisite for this option.You will be reffered to our affiliate courier company so that you can make enquires concerning their modalities.

We expect that you will notify us of your choice upon receipt of this message so that appropriate arrangement can be put in place.Also note that all winners in your catergory are expected to claim their winning prize within 21 working days,failure to which the payment will be recalled back as unclaimed lottery fund(u.l.f) and will be included in the next stake.This is to enable us time to also attend to winners in the other catergories.

Sincerely,
Mr.GEORGE WILLIAMS,
George Williams & Associates
(Legal Practitioners/Notary Public)
7a Omiston Grove,
London,EC3N 2PR
United Kingdom.
TEL+447040116180
FAX+448701300393
********************************************************
The information contained in this email and/or attachments is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. If you are not the intended recipient of this email, please delete the message and notify the sender. You must not copy, disclose, reproduce or disseminate in any way or act in reliance of the information
contained within it. Any views or opinions presented are solely those of the author, except where the individual is authorised to express views on behalf of George Williams & Associates.
********************************************************

Message headers: 

Received: from [80.88.128.12] by web42105.mail.yahoo.com
 via HTTP; Wed, 16 Feb 2005 10:46:31 PST
Date: Wed, 16 Feb 2005 10:46:31 -0800 (PST)
From: george williams <[email protected]>
Subject: YOUR WINNING PRIZE.

WHOIS details for sending network (IP 80.88.128.12):
The email was sent from a customer in West Africa of a satellite ISP in Denmark. This IP address is connected to a whole string of scams. 

     inetnum:      80.88.128.0 - 80.88.128.127
     netname:      EMP-MFG-NOC
     descr:        Central infrastucture for Emperion at Middelfartgade.
     descr:        Supports various NMS systems, IP DVB Encoders as well as one
     descr:        router pr. customer link.
     country:      DK
     admin-c:      KW6968-RIPE
     tech-c:       EMP5-RIPE
     status:       ASSIGNED PA
     notify:       [email protected]
     mnt-by:       EMP-NOC-MNT
     changed:      [email protected] 20010829
     changed:      [email protected] 20010903
     changed:      [email protected] 20010906
     changed:      [email protected] 20030210
     source:       RIPE
     
     route:        80.88.128.0/20
     descr:        DK-EMPERION-20010828-ROUTE
     origin:       AS21125
     mnt-by:       EMP-NOC-MNT
     changed:      [email protected] 20010906
     source:       RIPE
     
     role:         Emperion NOC Operator
     address:      Emperion A/S
     address:      Middelfartgade 7
     address:      2100 Koebenhavn Oe
     address:      DK
     phone:        +45 3929 3530
     e-mail:       [email protected]
     trouble:      [email protected]
     admin-c:      KW6968-RIPE
     tech-c:       KW6968-RIPE
     tech-c:       SRL7-RIPE
     tech-c:       AJ163-RIPE
     tech-c:       GB1283-RIPE
     tech-c:       FL497-RIPE
     nic-hdl:      EMP5-RIPE
     notify:       [email protected]
     mnt-by:       EMP-NOC-MNT
     changed:      [email protected] 20010906
     changed:      [email protected] 20020110
     changed:      [email protected] 20021107
     source:       RIPE
     
     person:       Kim Wohlert
     address:      Emperion A/S
     address:      Middelfartgade 7
     address:      2100 Koebenhavn Oe
     address:      DK
     phone:        +45 3929 3530
     e-mail:       [email protected]
     nic-hdl:      KW6968-RIPE
     mnt-by:       EMP-NOC-MNT
     changed:      [email protected] 20010807
     changed:      [email protected] 20010903
     changed:      [email protected] 20020110
     source:       RIPE

WHOIS details for "georgewilliamchambers.com" (created 2005-10-26):
The domain "georgewilliamchambers.com" was only registered in October 2004 using a postal address in the USA. It is hosted by MSN, like most other advance fee fraud domains at the moment: 

Request: georgewilliamchambers.com
connected to whois.enom.com [66.151.151.170:43] ...

Registration Service Provided By: Microsoft
Contact: [email protected]
Visit: http://support.msn.com/contactus.aspx?pk=PersonalAddress

Domain name: georgewilliamchambers.com

Registrant Contact:
   george williams
   george williams ([email protected])
   +1.3104554777
   Fax: none
   887 glenway drive #4 inglewood
   inglewood, CA 90302
   US

Administrative Contact:
   george williams
   george williams ([email protected])
   +1.3104554777
   Fax: none
   887 glenway drive #4 inglewood
   inglewood, CA 90302
   US

Technical Contact:
   NOC MSN
   NOC MSN ([email protected])
   +1.4258828080
   Fax: none
   One Microsoft Way
   Redmond, WA 98052
   US

Billing Contact:
   NOC MSN
   NOC MSN ([email protected])
   +1.4258828080
   Fax: none
   One Microsoft Way
   Redmond, WA 98052
   US

Status: Locked

Name Servers:
   pdomns1.msn.com
   pdomns2.msn.com

Creation date: 26 Oct 2004 05:32:22
Expiration date: 26 Oct 2005 05:32:22

Then the fake lawyer passes the victim on to the fake courier company, who are the ones who demand cash from the victim. Emails from the "lawyer" and the "courier service" are actually sent from the Emperion IP address in West Africa, i.e. are probably sent from the same Internet cafe in Nigeria by the same gang. 

Attention:FIRSTNAME LASTNAME,

Congratulations! The Notarisation of your your papers have been completed by 
the elected Certified Notary Public.Your Winning cheque and Certificate are 
now ready,and will be dispatched to the Courier company for onward delivery 
to your specified address.Bear in mind that the checks have been made out in 
two instalments of 625,000 euros each.This according to the promoters is to 
ensure that all winners get part of their payment at a time instead of one 
winner having 1.250m euros while others have nothing.So,the courier company 
will deliver the first instalment to you In your mail,you elected the 
courier service option,in this vein you are advised to contact NETXPRESS 
DIPLOMATIC COURIER SERVICES LONDON; find hereunder their contact 
information:   NETXPRESS DIPLOMATIC COURIER SERVICES,JERMYN STREET LONDON 
SW1Y 4UH, UNITED KINGDOM.

Communication with the courier company in this regard should be addressed to 
The Customer Relations Officer, MRS JANET HARRISON through her email: 
[email protected]

It is necessary that you formaly notify her that you want the courier firm 
to deliver your cheque winnings along with the winnings certificate,and what 
it will cost you. Attached is a scanned copy of your winning Certificate.I 
cannot not send you a copy of your cheque for obvious security 
reasons.Please call to confirm if indeed you receive it.

Note that it is necessary that you update us on developments with regards to 
the courier firm,be sure to give the address you want the parcel delivered 
to.Your winning may also be taxable in your country of origin.The taxes 
however vary from one country to another.We just taught you should know all 
these.We also hope you spend your winning wisely and donate some to charity.

Sincerely,
Mr.GEORGE WILLIAMS,
George Williams & Associates
(Legal Practitioners/Notary Public)
7a Omiston Grove,
London,EC3N 2PR
United Kingdom.
TEL+447040116180
FAX+448701300393
************************************************************************
The information contained in this email and/or attachments is intended only 
for the person or entity to which it is addressed and may contain 
confidential and/or privileged material. If you are not the intended 
recipient of this email, please delete the message and notify the sender. 
You must not copy, disclose, reproduce or disseminate in any way or act in 
reliance of the information
contained within it. Any views or opinions presented are solely those of the 
author, except where the individual is authorised to express views on behalf 
of George Williams & Associates.


Return-Path: <[email protected]>
Received: from 64.4.22.54  (EHLO hotmail.com) (64.4.22.54)
  by mta109.mail.dcn.yahoo.com with SMTP; Thu, 17 Feb 2005 08:09:03 -0800
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
	 Thu, 17 Feb 2005 08:09:00 -0800
Received: from 83.170.12.18 by by23fd.bay23.hotmail.msn.com with HTTP;
	Thu, 17 Feb 2005 16:08:47 GMT
X-Originating-IP: [83.170.12.18]
X-Originating-Email: [[email protected]]
X-Sender: [email protected]
From: "jonathan meyers" <[email protected]>
To: emailaddress
Subject: YOUR CHECK AND WINNING CERTIFICATE.
Date: Thu, 17 Feb 2005 16:08:47 +0000
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
X-OriginalArrivalTime: 17 Feb 2005 16:09:00.0966 (UTC) FILETIME=[FE441C60:01C5150A]
Content-Length: 420

ATTENTION: FIRSTNAME LASTNAME,

THIS IS TO INFORM YOU THAT YOUR WINNING CERTIFICATE AND PRIZE MONEY HAS BEEN 
PROCESSED FOR DELIVERY TO YOU.PLEASE CONTACT YOUR CLAIMS/FUDICIARY AGENT FOR 
ONWARD DELIVERY TO YOU.THANK YOU FOR BEING PART OF OUR INTERNATIONAL 
PROMOTIONS PROGRAM.WE HOPE YOU WILL TAKE PART IN NEXT YEAR'S SWEEPSTAKE.
CONGRATULATIONS ONCE MORE.

YOUR FAITHFULLY,

JONATHAN MEYERS
FOR NETXPRESS INTERNATIONAL.

WHOIS details for sending network (IP 83.170.12.18):

     inetnum:      83.170.12.0 - 83.170.13.255
     netname:      DE-IABG-TELEPORT-COBRANET-ISP
     descr:        IABG - Teleport customer CobraNet
     country:      LB
     admin-c:      HM1517-RIPE
     tech-c:       ED740-RIPE
     status:       ASSIGNED PA
     notify:       [email protected]
     mnt-by:       IABG-MNT
     changed:      [email protected] 20040616
     source:       RIPE
     
     route:        83.170.0.0/18
     descr:        IABG mbH
     origin:       AS29259
     notify:       [email protected]
     mnt-lower:    IABG-MNT
     mnt-routes:   IABG-MNT
     mnt-by:       IABG-MNT
     changed:      [email protected] 20040420
     source:       RIPE
     
     person:       Hikmat Mardo
     address:      Lagos-Nigeria
     address:      Lekki Phase 1
     address:      rafiu babatunde street plot 8
     phone:        +23417767720
     phone:        +234802 832 2133
     phone:        +23415555656
     phone:        +9613666325
     e-mail:       [email protected]
     nic-hdl:      HM1517-RIPE
     notify:       [email protected]
     mnt-by:       IABG-MNT
     changed:      [email protected] 20040617
     source:       RIPE
     
     person:       Elie Dib
     address:      Lagos-Nigeria
     address:      Lekki Phase 1
     address:      rafiu babatunde street plot 8
     phone:        +9613235266
     e-mail:       [email protected]
     nic-hdl:      ED740-RIPE
     notify:       [email protected]
     mnt-by:       IABG-MNT
     changed:      [email protected] 20040617
     source:       RIPE

WHOIS details for domain "netxpresslottery.com" (created 2004-10-26):

Request: netxpresslottery.com
connected to whois.enom.com [66.151.151.170:43] ... 

Registration Service Provided By: Microsoft
Contact: [email protected]
Visit: http://support.msn.com/contactus.aspx?pk=PersonalAddress
	
Domain name: netxpresslottery.com

Registrant Contact:
   louis gomez
   louis gomez ([email protected])
   +1.3104554777
   Fax: none
   887 glenway drive #4 inglewood
   inglewood, CA 90302
   US

Administrative Contact:
   louis gomez
   louis gomez ([email protected])
   +1.3104554777
   Fax: none
   887 glenway drive #4 inglewood
   inglewood, CA 90302
   US

Technical Contact:
   NOC MSN
   NOC MSN ([email protected])
   +1.4258828080
   Fax: none
   One Microsoft Way
   Redmond, WA 98052
   US

Billing Contact:
   NOC MSN
   NOC MSN ([email protected])
   +1.4258828080
   Fax: none
   One Microsoft Way
   Redmond, WA 98052
   US

Status: Locked

Name Servers:
   pdomns1.msn.com
   pdomns2.msn.com
   
Creation date: 26 Oct 2004 04:43:51
Expiration date: 26 Oct 2005 04:43:51

Email from the fake courier company:

Attn: FIRSTNAME LASTNAME,

We are in receipt of your mail,requesting our services in delivering your 
Lottery winning Certificate and Cheque to you.We extend our warm and sincere 
congratulations on your winning.You must be a lucky person to have won this 
lottery. The total amount you won is 1.250. million euros which will be paid 
in 2 instalments of 625.000.euros (BARCLAYS BANK OF ENGLAND INTERNATIONAL 
BANK DRAFT) each.The first package is ready for delivery.

Ours is not the conventional run of the mill courier delivery.We are a 
diplomatic courier service.We specialise in the delivery of "diplomatic 
items and sensitive materials" hence the obvious choice by the promoters of 
this lottery for the delivery of your package.

It will cost you a total of 250.00 Pounds for the Cheque and the Certificate 
which are going to be sent to you as seperate packages. The packages will be 
delivered to you within 4 working days after receipt of courier 
charges(250.00 Pounds) to be paid via Western Union Money 
Transfer(www.westernunion.com ) to expediate action.

You are advised to make the payment with the following information:
NAME OF RECEIVER: CHRIS WILLIAMS
ADDRESS: LONDON, UNITED KINGDOM.

CHRIS WILLIAMS  is the Head of Accounts Department.

forward to him the full payment information as soon as the payment is made 
on his e-mail: [email protected] will attach a tracking no to 
your package.
Notify my office as soon as you do this for proper documentation.Also send 
to us the address where you want the packages to be delivered to.You shall 
have your full receipt and tracking nos sent to you upon comfirmation of 
your payment from the accounts dept so that you can track the  movement of 
the package.Please remember to include your mobile phone nos incase our 
official do not meet you at the point of delivery.Bear in mind he cannot 
deliver to anyone else except you.Keep proper indentification please.

Best Regards,
JANET HARRISON,
Netxpress Diplomatic Courier Services
NO 1 JERMYN STREET LONDON
SW1Y
4UH, UNITED KINGDOM

Message headers: 

Received: from 80.88.128.12 by by23fd.bay23.hotmail.msn.com with HTTP;
	Fri, 18 Feb 2005 15:51:52 GMT
X-Originating-IP: [80.88.128.12]
X-Originating-Email: [[email protected]]

WHOIS details for 419 fraud domain "netxpresscourier.com" (created 2004-10-26)
As you can see, the fake courier domain was created the same day as the fake lawyer domain, October 26, 2004, and is hosedt with the same comapny, MIcrosoft's MSN: 

Request: netxpresscourier.com
connected to whois.melbourneit.com [203.27.227.114:43] ... 

Domain Name.......... netxpresscourier.com
  Creation Date........ 2004-10-26
  Registration Date.... 2004-10-26
  Expiry Date.......... 2005-10-26
  Organisation Name.... billy bush
  Organisation Address. 887 glenway drive #4 inglewood
  Organisation Address. 
  Organisation Address. inglewood
  Organisation Address. 90302
  Organisation Address. CA
  Organisation Address. UNITED STATES

Admin Name........... billy bush
  Admin Address........ 887 glenway drive #4 inglewood
  Admin Address........ 
  Admin Address........ inglewood
  Admin Address........ 90302
  Admin Address........ CA
  Admin Address........ UNITED STATES
  Admin Email.......... [email protected]
  Admin Phone.......... +1.3104554777
  Admin Fax............ 

Tech Name............ MSN NOC
  Tech Address......... One Microsoft Way
  Tech Address......... 
  Tech Address......... Redmond
  Tech Address......... 98052
  Tech Address......... WA
  Tech Address......... UNITED STATES
  Tech Email........... [email protected]
  Tech Phone........... +1.4258828080
  Tech Fax............. 
  Name Server.......... pdomns1.msn.com
  Name Server.......... pdomns2.msn.com

Fake lottery website http://www.primelottery.7p.com/contact.html

AFRICA  
Franklin Giyamo,  
South Africa.  
[email protected]  

ASIA  
Oyibo Yunamugu  
Japan  
[email protected]  

AUSTRALIA  
Caroline Bryan  
Sydney  
[email protected]  

CANADA  
Jefferson O'Connor  
Toronto  
[email protected]  

EUROPE  
Todd Hendricks  
Finland  
[email protected]  

MIDDLE EASTERN REGIONS  
Ali Al-Mudibh  
Iran  
[email protected]  
  
USA  
Michael Andrews  
New York  
[email protected]  


Past Winner Comments 
"This lottery is stunning!. They have completely changed my 
life forever.. One day I just received a rather mysterious 
email stating that I had won $2 million dollars in some 
lottery I never even entered for. At first I thought it was 
all some  mischievous prank, but my curiosity got the better 
of me and I decided to follow it through to the end since 
I had nothing to lose...and I couldn't believe my ears when 
my bank called to confirm that the transfer had been made... 
I've actually just paid for  my dream house in Jamaica and 
I think I might decide to take a cruise around the world or 
something...I'm still yet to recover from the shock!  
-Marilyn Zwelter, Oldville, Ontario, Canada.  2002 Winner

The following is a reply from the claims agent of a fake lottery. The winning notification was sent by "Mrs. Grace smith": 

To file for your claim, please contact our fiducial agent: 
Mr. NEWTON O. GREEN at:Reply 
Email:[email protected]

Here is the reply: 

From: "Newton Green" <[email protected]>
To: Firstname Lastname <emailaddress>
Sent: Thursday, 03 March, 2005 1:49
Subject: Re: PRIZE

ATTENTION: Sir/Ma,

I am Mr.Newton Green the fiduciary agent assigned to
your case. I wish to Congratulate you on your victory,
you are a lucky person to have won this lottery. Your
email address was amongst those chosen this quarter
from our new java-based software that randomly selects
email addresses from the web from which winners are
selected.

You are required to forward the following details to
help facilitate the processing of your claims and
certificate which will facilitate the release of your
winnings.

1. Full names.
2. Phone number.
3. Fax number.
4. Occupation.
5. Sex.
6. Age.
7. Nationality.

You are advised to forward this information as soon as
possible to enable us attend to your winnings.  Our
firm has been contracted to handle payments on your
behalf, once we confirm your information, 
your payments would be processed.

Everything was done in such a way that our payments
mode would meet the standards set by the Lottery
boards. After you have sent down these information, a
certificate will be prepared for you. This is to be
your proof of winning from this office to the payment
center before they release your funds. Be advised that
your winnings would be paid to you in Four(4)
installments of 500,000.00 Pounds {Five Hundred
Thousand Pounds}. This is done because of the amount
won by you. You are advised to keep your winning
numbers secret to avoid unscrupulous elements
fromtaking advantage of the situation.

Once again, congratulations.

Sincerely,

Mr. Newton Green
Newton Green & associates
7a Omiston Grove,
London,EC3N 2PR
United Kingdom
...........................................................
This email and its attachments are confidential and
intended for the exclusive use of the
addressee(s).This email and its attachments may also
be privileged or protected by legal rules. If you have
received this by mistake please let us know by reply
immediately and destroy the email and its attachments
without reading, copying or forwarding the contents.

This scam email was sent from the same address as the email by "JANET HARRISON, Netxpress Diplomatic Courier Services": 

Received: from [] by web26503.mail.ukl.yahoo.com
 via HTTP; Wed, 02 Mar 2005 16:49:45 GMT
Date: Wed, 2 Mar 2005 16:49:45 +0000 (GMT)
From: Newton Green [email protected]>
Subject: Re: PRIZE

jwSpamSpy
Are you sick of spam too? Do you want it stopped now?
Try jwSpamSpy, the spamfilter we use to track the spammers!
Free 30-day trial version available now!