The "company representative" scam - check fraud by Nigerian gangs

• The "company representative" scam
  
• List of names and sender addresses from "representative" spam
  
• Sender addresses and subject lines
  
• Contact addresses listed in spam emails
  
• By IP address
  
• Networks from which rep scam emails have been sent
  
  
• About "419" fraud
  
• IP addresses used for "419" fraud
  

We have received some many unsolicited emails from companies, often claiming to be in China, looking for representatives to establish a business presence in other countries and for transferring payments. Recipients of such mails are typically promised 10% of those payments from customers. In reality, this is a check fraud scam that can work on a massive scale, causing damages from thousands to hundreds of thousands of dollars. In some cases, names of legitimate companies are abused for the scam. In other cases no real company by that name exists.

The scammers are not Chinese (or even Asian) but Nigerian. They mail their "representatives" fake checks from "customers" to deposit in their personal or business accounts. Often these are written on blank check forms stolen from legitimate businesses. Provided the business whose check is abused has sufficient funds in its account, the check will initially clear (it will usually only bounce when the business receives the deposited check that it never wrote). When the check clears the "representatives" wire the amount to a bank account in another country, such as Japan, Taiwan, China, the Netherlands or the UK. By the time the fake check bounces (which can take a month), the money is already out of the country and the representative is left to pick up the losses, often tens of thousands of dollars.

Are you sick of spam too? Do you want it stopped now? Try jwSpamSpy, the spamfilter we use to track the spammers! Free 30-day trial version available now!

Date: Tue, 21 Mar 2006 12:08:40 +0800 (CST)
From: =?gb2312?q?china=20artscene?= <[email protected]>
Reply-To: [email protected]
Subject: WORK WITH US!!!

???????????!

?????????????:[email protected]

Hello,


I am Mrs,Chen Shuxi, marketing manager of ART SCENE CHINA ARTS AND CRAFTS IMPORT / EXPORT in China. we are a group of business men and women who deal on Chinese Arts and Crafts, and we want to expand our business into United State,Canada and some part of Europe We are searching for reliable representatives who can Help us establish a medium of getting to our customers and receiving payment from our customers who are indebted to the company in Your respective country. Please if you are interested in this lucrative business with us,we will be very glad.


Please if you are intrested in this offer do send to us your full names, contact address, phone and fax numbers for easier communication.contact our Administrative department via

Email: [email protected]



On your response to our proposal you shall be given all neccessary informations on how we operate and on how Payment are made from Customers to our representative as well as how we pay for services rendered to the company as A representative.


Thanks In advance,

Mrs.Chen Shuxi,

Marketing Manager,

South Art Scene China.



- china artscene

Hello Ref no. 0101


First i must thank you for picking up the consideration to be our payment officer via our costumers who are already and able to pay some of the outstanding bills,surprise to say that your role in this endeavoure is to serve as our agent to get to our customers who buys our product and helping us collecting their outstanding money which they owe to our comapany,you will be be given a commission of 10% for any payment made to you and you will be given instruction on how to remitte the balance funds to us in turn.


Importantly,we are a coporate company and we do not require your out of pocket money instead we pay you for your servicies hence this partnership.

Please be adviced that we will have to begin the necessary process of approving you as our agent/partner on our receipt of your understanding and your sincere abilities.


On our receipt of your mail we will inform you on the next step to follow as regards our approval for you to being our representative in your province.
Please send to us your,

(1)Full names

(2)Phone & Fax Number...............

(3)Detailed Mailing Address.........

(4)Occupation ...............

Note:Endeavour to indicate your reference number as above in all of your correspondence with us.


Thanks in advance,
Mr. Wu Yang.
Admin. Manager.


--------------------------------------------------------------------------------
???????????????????????

Message headers:

Received: from [80.88.140.210] by web15010.mail.cnb.yahoo.com via HTTP; Thu, 23 Mar 2006 18:46:11 CST
Date: Thu, 23 Mar 2006 18:46:11 +0800 (CST)
From: artscene china <[email protected]>
Subject: Project Mail Ref no. 0101

Dear Firstname Lastname

Streetaddress
City, State, Zipcode


We have been instructed by ART SCENE CHINA ARTS AND CRAFTS IMPORT AND
EXPORT CO to make payment to you.
Please confirm the above information's and advise on how you would
like your name or your company name and mailing address to appear
on the Cheques. What bank do you bank with?

What is the best time to reach you on phone ?

Thanks as we awaite your respond.

Sincerely,

Wellington Richardson
Tel: 1 416 731 5747



--
___________________________________________________
Play 100s of games for FREE! http://games.mail.com/

Message headers:

From: "wellington Richardson" <[email protected]>
To: emailaddress
Date: Thu, 23 Mar 2006 13:44:47 -0500
Subject: PAYMENT ON BEHALF OF WU YANG
Received: from [69.198.89.133] by ws3-4.us4.outblaze.com with http for
 [email protected]; Thu, 23 Mar 2006 13:44:47 -0500
X-Originating-Ip: 69.198.89.133
X-Originating-Server: ws3-4.us4.outblaze.com

Dear Firstname Lastname,

This is to advise you that cheque no. 29786 is (Bad please don't
deposit), have a typographical error and re-placement was sent to you
immediately cheque no 29882 is (Good please deposit).

You mint receive both at the same day please check carefully.

Sorry for the inconvenience.

Regards,

W. Richardson


--
___________________________________________________
Play 100s of games for FREE! http://games.mail.com/

Message headers:

From: "wellington Richardson" <[email protected]>
To: emailaddress
Date: Thu, 06 Apr 2006 10:22:50 -0500
Subject: Cheque Correction
Received: from [69.198.88.83] by ws3-4.us4.outblaze.com with http for
 [email protected]; Thu, 06 Apr 2006 10:22:50 -0500
X-Originating-Ip: 69.198.88.83
X-Originating-Server: ws3-4.us4.outblaze.com

Dear Firstname Lastname,

This is to advise you that cheque no. 29786 is (Bad please don't
deposit), have a typographical error and re-placement was sent to you
immediately cheque no 29882 is (Good please deposit).

You mint receive both at the same day please check carefully.

Sorry for the inconvenience.

Regards,

W. Richardson


--
___________________________________________________
Play 100s of games for FREE! http://games.mail.com/


--

Message headers:

From: "wellington Richardson" <[email protected]>
To: emailaddress
Date: Thu, 06 Apr 2006 10:22:50 -0500
Subject: Cheque Correction
Received: from [69.198.88.83] by ws3-4.us4.outblaze.com with http for
 [email protected]; Thu, 06 Apr 2006 10:22:50 -0500
X-Originating-Ip: 69.198.88.83
X-Originating-Server: ws3-4.us4.outblaze.com

Hello Firstname,
Have you deposited the check payment? Please let us know when the bank says funds will be available for pick.
Regards,
Wu Yang.


--------------------------------------------------------------------------------
????????,??????,????,????!

Message headers:

Received: from [81.23.193.89] by web15001.mail.cnb.yahoo.com via HTTP; Sat, 08 Apr 2006 16:54:25 CST
Date: Sat, 8 Apr 2006 16:54:25 +0800 (CST)
From: artscene china <[email protected]>
Subject: UPDATE.

WHOIS details for sending network (IP 81.23.193.89):
This ISP is a satellite uplink provider in Ireland that hooks up customers in Africa:

inetnum:      81.23.193.80 - 81.23.193.95
netname:      WEB-SAT-ISP-NETBLK1
descr:        Web-Sat ISP services - dmz
country:      IE
admin-c:      MS4605-RIPE
admin-c:      AG1614-RIPE
tech-c:       WSO2-RIPE
status:       ASSIGNED PA
mnt-by:       WEB-SAT-MNT
source:       RIPE # Filtered

role:         Web-Sat ISP Operations
address:      Unit 3, Bluebell Industrial Estate
address:      Dublin 12
address:      Ireland
phone:        +353 1 4501711
admin-c:      CM2772-RIPE
admin-c:      AG1614-RIPE
tech-c:       CM2772-RIPE
tech-c:       AG1614-RIPE
e-mail:       [email protected]
nic-hdl:      WSO2-RIPE
source:       RIPE # Filtered

person:       Mike Smith
address:      Unit 3, Bluebell Industrial Estate
address:      Dublin 12
address:      Ireland
phone:        +353 1 4501711
e-mail:       [email protected]
nic-hdl:      MS4605-RIPE
mnt-by:       WEB-SAT-MNT
source:       RIPE # Filtered

person:       Anton Gavrik
address:      Unit 3, Bluebell Industrial Estate
address:      Dublin 12
address:      Ireland
phone:        +353 1 4501711
e-mail:       [email protected]
nic-hdl:      AG1614-RIPE
mnt-by:       WEB-SAT-MNT
source:       RIPE # Filtered

% Information related to '81.23.192.0/20AS12488'

route:        81.23.192.0/20
descr:        Web-Sat ISP services
origin:       AS12488
mnt-by:       WEB-SAT-MNT
source:       RIPE # Filtered

Email history for IP address:

81.23.193.89
2004-12-29 15:24:20 UTC	[email protected]
2005-01-05 17:00:54 UTC	[email protected]
2005-04-16 21:51:59 UTC	[email protected]
2005-05-20 18:45:17 UTC	[email protected]
2005-05-21 13:55:05 UTC	[email protected]
2005-06-02 11:24:53 UTC	[email protected]
2005-06-11 18:14:56 UTC	[email protected]
2005-08-27 14:36:42 UTC	[email protected]
2005-09-19 15:55:24 UTC	[email protected]
2005-09-22 14:02:11 UTC	[email protected]
2005-09-22 14:04:23 UTC	[email protected]
2005-10-03 13:06:25 UTC	[email protected]
2005-10-03 17:36:22 UTC	[email protected]
2005-10-06 12:35:50 UTC	[email protected]
2005-10-10 12:34:24 UTC	[email protected]
2005-10-12 09:21:15 UTC	[email protected]
2005-10-12 15:44:24 UTC	[email protected]
2005-10-14 00:37:15 UTC	[email protected]
2005-10-28 11:24:33 UTC	[email protected]
2005-11-01 21:53:02 UTC	[email protected]
2005-11-05 00:41:16 UTC	[email protected]
2005-11-05 02:03:23 UTC	[email protected]
2005-11-09 17:37:03 UTC	[email protected]
2005-11-11 09:37:10 UTC	[email protected]
2005-11-11 09:42:18 UTC	[email protected]
2005-11-12 10:56:33 UTC	[email protected]
2005-11-17 00:00:28 UTC	[email protected]
2005-11-29 19:15:32 UTC	[email protected]
2005-12-12 09:09:42 UTC	[email protected]
2005-12-12 18:20:54 UTC	[email protected]
2005-12-17 19:55:37 UTC	[email protected]
2005-12-24 04:44:37 UTC	[email protected]
2005-12-27 11:09:11 UTC	[email protected]
2005-12-27 12:01:53 UTC	[email protected]
2005-12-28 12:09:33 UTC	[email protected]
2006-01-03 11:18:52 UTC	[email protected]
2006-01-03 11:21:02 UTC	[email protected]
2006-01-05 19:16:30 UTC	[email protected]
2006-01-06 17:31:37 UTC	[email protected]
2006-01-06 17:41:54 UTC	[email protected]
2006-01-07 13:43:15 UTC	[email protected]
2006-01-19 13:06:01 UTC	[email protected]
2006-02-02 09:35:29 UTC	[email protected]
2006-02-02 15:18:29 UTC	[email protected]
2006-02-16 07:59:34 UTC	[email protected]
2006-02-17 08:25:44 UTC	[email protected]
2006-02-20 10:49:39 UTC	[email protected]
2006-02-22 08:56:23 UTC	[email protected]
2006-04-11 09:38:35 UTC	[email protected]