419 Scam – Mails from ns.sign-on-africa1.net / 66.227.5.177

joewein.de LLC
Fighting spam and scams
on the Internet

Home / Blog / About us
Spam
419/Nigeria
Online fraud
jwSpamSpy
Contact

Email Spam Filter:

Try it for free!

419 Scam – Mails from ns.sign-on-africa1.net / 66.227.5.177

The following typical "419" fraud email (advance fee scam) was received on August 7, 2004. The domain was not a typical ISP domain for this type of domain but specifically registered. It was hosted by SignOnAfrica.net, a web hosting company in Lagos, Nigeria. This webhoster has a history of hosting fraud sites used by 419 fraudsters, for example wesselheijden.com.

Fraud email from [email protected]:

Message-ID: <[email protected]>
Date: Sat, 7 Aug 2004 09:43:14 -0400 (EDT)
Subject: FROM IRAN
From: [email protected]
To: [email protected]
User-Agent: SquirrelMail/1.4.0
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Importance: Normal

Dear Friend,

As you read this, I don't want you to feel sorry for
me, because, I believe everyone will die someday.
My name is MR BARUKH MELLAMED a Crude Oil merchant in IRAN,i
have been diagnosed with Esophageal cancer .
It has defiled all forms of medical treatment, and
right now I have only about a few months to live,
according to medical experts.
I have not particularly lived my life so well, as I
never really cared for anyone(not even myself)but my
business. Though I am very rich, I was never
generous, I was always hostile to people and only
focused on my business as that was the only thing I
cared for. But now I regret all this as I now know
that there is more to life than just wanting to have
or make all the money in the world.
I believe when God gives me a second chance to come
to this world I would live my life a different way
from how I have lived it. Now that God has called
me, I have willed and given most of my property
and assets to my immediate and extended family
members as well as a few close friends.
I want God to be merciful to me and accept my soul
so, I have decided to give alms to charity
organizations, as I want this to be one of the last
good deeds I do on earth. So far, I have distributed
money to some charity organizations in Austra, cameroun,
liberia,Algeria and Malaysia. Now that my health has
deteriorated so badly, I cannot do this myself
anymore. I once asked members of my family to close
one of my accounts and distribute the money which I have
there to charity organization in Bulgaria and
Pakistan, they refused and kept the money to
themselves. Hence, I do not trust them anymore, as
they seem not to be contended with what I have left
for them.

The last of my money which no one knows of is the
huge cash deposit of fifteen million dollars
$15,000,000,00 that I have with a finance/Security
Company abroad. I will want you to help me collect this
deposit and dispatched it to charity organizations.

I have set aside 10% for you and for your time.

God be with you.

MR BARUKH MELLAMED

The name Baruk Mellamed shows up with a different email address in some guestbook postings:

Here's one of them:

Name: Barukh Mellamed 
E-Mail: [email protected] 
Entry Date: Thu Feb 19 15:40:42 2004 
Comments...
Religion is the sole remedy for the world

The name is also mentioned here.

WHOIS record for domain mellamed.com:

     Registrant:
        Signonafrica Inc
        156, Awolowo way
        Ikeja 23401
        Nigeria
     
        Registered through: Goodoldomains
        Domain Name: MELLAMED.COM
           Created on: 04-Aug-04
           Expires on: 04-Aug-05
           Last Updated on: 04-Aug-04
     
        Administrative Contact:
           Okafor, Godwin  [email protected]
           Signonafrica Inc
           156, Awolowo way
           Ikeja 23401
           Nigeria
           4723065      Fax -- 
        Technical Contact:
           Okafor, Godwin  [email protected]
           Signonafrica Inc
           156, Awolowo way
           Ikeja 23401
           Nigeria
           4723065      Fax -- 
     
        Domain servers in listed order:
           NS.SIGN-ON-AFRICA1.NET
           NS2.SIGN-ON-AFRICA1.NET

The domain wesselheijden.com used by another 419-scammer in late March (see http://brucelawson.co.uk/spam.htm) was also registered with this web hoster and was still active on August 8, 2004 (it was suspended when we checked again in September 2004, but it had been active for criminal purposes for at least 4 1/2 months).

     Registrant:
        Signonafrica
        156, Awolowo way ikeja
        Lagos, Lagos 234
        Nigeria
     
        Registered through: Goodoldomains
        Domain Name: WESSELHEIJDEN.COM
           Created on: 27-Feb-04
           Expires on: 27-Feb-05
           Last Updated on: 27-Feb-04
     
        Administrative Contact:
           Okafor, Godwin  [email protected]
           Signonafrica
           156, Awolowo way ikeja
           Lagos, Lagos 234
           Nigeria
           2344723065      Fax -- 
        Technical Contact:
           Okafor, Godwin  [email protected]
           Signonafrica
           156, Awolowo way ikeja
           Lagos, Lagos 234
           Nigeria
           2344723065      Fax -- 
     
        Domain servers in listed order:
           NS.SIGN-ON-AFRICA1.NET
           NS2.SIGN-ON-AFRICA1.NET

Another spam mail ("SWISSLOTTO ONLINE") from ns.sign-on-africa1.net is found here:
http://www.talkaboutspam.com/group/alt.kill.spammers/messages/11057.html

Return-Path: 
Received: from unknown (HELO ns.sign-on-africa1.net) (66.227.5.177)
  by ns1.raycomm.com with SMTP; 17 Jun 2004 00:58:34 -0000
Received: from nobody by ns.sign-on-africa1.net with local (Exim 4.34)
	id 1BamCj-0007Wr-7s
	for some email address; Wed, 16 Jun 2004 22:00:37 -0400
To: some email address
Subject: Congratulations/winning notification
Content-Type: text/plain; charset="iso-8859-1"
From:"Swiss Lotto" <[email protected]>
Reply-To:"Swiss Lotto" <[email protected]>
Message-Id: <[email protected]>
Date: Wed, 16 Jun 2004 22:00:37 -0400

SWISSLOTTO ONLINE
BURDENSTRAAT 22 1053 DS LUGANO.
LUGANO (SWITZERLAND)

FROM THE DESK OF THE DIRECTOR INTERNATIONAL
PROMOTION/PRIZE AWARD DEPT.
REF:WR/2311786008/01 BATCH:14/011/IPD AGENT 04

RE:WINNING NOTIFICATION/FINAL NOTICE.

We are pleased to inform you of the release on the
15th of June 2004,of the SWISSLOTTO ONLINE
Sweepstakes International program held on the 1st of
June 2004. Your personal or company email address
attached to ticket number 205-11465886-629 with serial
number 3772-99 drew lucky numbers 7-14-17-23-31-44
which consequently won the lottery in the 2nd
category. You have therefore been approved for a lump
sum payout of $1,000,000.00(one million dollars) in
cash credited to file Ref.No ELG/2311786008/02.This is
from a total cash prize of U.S.$11million shared among
several international lucky winners in this category.

CONGRATULATIONS. Your fund is now deposited with the
Security Department of the swisslotto to your name and
due to mix up of some numbers and names, we ask that
you keep this winning private from public notice until
your claim has been processed and your money remitted
to your designated account.This is part of our
security protocol to avoid double claim and
unwarranted taking advantage of this programme by
participants. 

All participants were selected through a computer
ballot system drawn from over 500,000 company and
individual email addresses from all over the world as
part of the swisslotto international promotions
programme,which takes place every year.We are
international lotto agents connected to swisslotto as
agent swisslotto agent04 we were the ones that
submitted your email amongst other email that was
randomly selected but your email address drew lucky
numbers.We wish to inform you that we charge a
commision of 10% payable to us after you have recieved
you winnings if this is ok with you then we can
proceed and we will instuct you on how to go about
getting your prize

We hope, with part of your winning, you will take part
in our july stake of U.S $10million international
lottery. Remember,all winning must be claimed not
later than may 30th 2004. After this date all
unclaimed fund will be returned to the pool as
unclaimed.

NOTE:In order to avoid unnecessary delays and
complications please remember to quote your refrence
and batch numbers in all correspondence with your
lotto firm. Furthermore, should there be any change of
address, do inform our agency as soon as possible.
Anybody under the age of 18 years is automatically
disqualified. Congratulations once more from our
members of staff and thank you for being part of our
promotional programme.

Please contact the claiming department with your ticket number and 

contact details at
[email protected]

Sincerely,

MR.Kelvin Andrap

The WHOIS record for "accessco.org", the website of fake Channel Islands securities company lists "Signonafrica Inc":

     Domain ID:D104883381-LROR
     Domain Name:ACCESSCO.ORG
     Created On:13-Sep-2004 17:09:07 UTC
     Last Updated On:16-Nov-2004 10:03:09 UTC
     Expiration Date:13-Sep-2005 17:09:07 UTC
     Sponsoring Registrar:Wild West Domains, Inc. (R120-LROR)
     Status:CLIENT DELETE PROHIBITED
     Status:CLIENT RENEW PROHIBITED
     Status:CLIENT TRANSFER PROHIBITED
     Status:CLIENT UPDATE PROHIBITED
     Registrant ID:GODA-08073130
     Registrant Name:Godwin Okafor
     Registrant Organization:Signonafrica Inc
     Registrant Street1:5075 Nighthawk Way
     Registrant Street2:
     Registrant Street3:
     Registrant City:Oceanside
     Registrant State/Province:California
     Registrant Postal Code:92056
     Registrant Country:US
     Registrant Phone:+1.7607267001
     Registrant Phone Ext.:
     Registrant FAX:
     Registrant FAX Ext.:
     Registrant Email:[email protected]
     Admin ID:GODA-28073130
     Admin Name:Godwin Okafor
     Admin Organization:Signonafrica Inc
     Admin Street1:5075 Nighthawk Way
     Admin Street2:
     Admin Street3:
     Admin City:Oceanside
     Admin State/Province:California
     Admin Postal Code:92056
     Admin Country:US
     Admin Phone:+1.7607267001
     Admin Phone Ext.:
     Admin FAX:
     Admin FAX Ext.:
     Admin Email:[email protected]
     Tech ID:GODA-18073130
     Tech Name:Godwin Okafor
     Tech Organization:Signonafrica Inc
     Tech Street1:5075 Nighthawk Way
     Tech Street2:
     Tech Street3:
     Tech City:Oceanside
     Tech State/Province:California
     Tech Postal Code:92056
     Tech Country:US
     Tech Phone:+1.7607267001
     Tech Phone Ext.:
     Tech FAX:
     Tech FAX Ext.:
     Tech Email:[email protected]
     Name Server:NS.SIGN-ON-AFRICA1.NET
     Name Server:NS2.SIGN-ON-AFRICA1.NET
     Name Server: 
     Name Server: 
     Name Server: 
     Name Server: 
     Name Server: 
     Name Server: 
     Name Server: 
     Name Server: 
     Name Server: 
     Name Server: 
     Name Server:

From: "HAVANALOTTO" <[email protected]>
Sent: Friday, 04 March, 2005 22:30
Subject: Lotto Winning Notification

HAVANA PROMO LOTTERY.
Ref. Number: 359/306/25921
Batch Number: 645338152-AD67

Sir/Madam,

We are pleased to inform you of the result of the Lottery Winners 
International programs held on the January2005.Your e-mail address
attached to ticket number 27954414659990-4872 with serial Number 
1772-545 drew lucky numbers 2-15-19-21-23-29 which consequently won in 
the 1st category, you have therefore been approved for a lump
sum pay out of US$1,000,000 (One Million United States Dollars) 
CONGRATULATIONS!!!

All participants were selected through a computer ballot system drawn 
from
over 20,000 company and 30,000,000 individual email addresses and names 
from all over the World. This promotional program takes place every 
year.
This lottery was promoted and sponsored by some eminent personalities 
who do not wish to declare their identity for security reasons. To file 
for your claim,
please contact our fiducial Agent:

Mr Edmond Christopher
Bevan House,
51 Bevan Avenue
Conwy LL28 5AF
United Kingdom
Email: [email protected]

Tel: 44 7092812956
Tel: 44 7092812957

Due to regulations and privacy policy, we ask that you keep your 
winning information confidential until you file for your claim. This is 
part of our security
protocol to avoid double claiming and unwarranted abuse of this program 
by some participants.

Remember, all winning must be filed  not later than 2weeks of reciept 
of this mail or when authentic proof is given for the delay of 
filing.Please note in order to avoid unnecessary delays and 
complications, remember to quote your reference number and batch 
numbers in all correspondence. Furthermore, should there be any change 
of address do inform our
agent as soon as possible. 

Congratulations once more from our members of staffand thank you for 
being a Winner in our promotional programme.

Note: Anybody under the age of 18 is automatically
disqualified.

Sincerely yours,

Mrs Precious Daniels.
Havana PromoLottery Co-ordinator.

email- [email protected]

WHOIS details for domain "havanapromolottery.com":

Registrant:   Godwin Okafor
   opebi allen avenue
   Ikeja 23401
   Nigeria
   Registered through: Goodoldomains
   Domain Name: HAVANAPROMOLOTTERY.COM
      Created on: 15-Nov-04
      Expires on: 15-Nov-05
      Last Updated on: 23-Feb-05
   Administrative Contact:
      Okafor, Godwin  [email protected]
      opebi allen avenue
      Ikeja 23401
      Nigeria
      8112882
   Technical Contact:
      Okafor, Godwin  [email protected]
      opebi allen avenue
      Ikeja 23401
      Nigeria
      8112882
   Domain servers in listed order:
      NS1.SEEMESUCCEED.COM
      NS2.SEEMESUCCEED.COM