Spam 419/Nigeria Online fraud jwSpamSpy Contact
Email Spam Filter: |
|
|
Beware of Fraud: Mailer order shipping to Nigeria
- Fraud: mailorder shipping to Nigeria
- ALABA STREET, MUSHIN, LAGOS
- Cheap mobile phones and laptops (cell phone scams)
- Fraud: Car buyer with large cashier's check
- Fraud: Bike seller uses bogus escrow service
- Fraud: Appartment rental with large cashier's check
- Fraud: Wedding photographer with large cashier's check
- Fraud: Violin teacher with large cashier's check
- Fraud: eBay purchase for Nigeria using BidPay (Western Union)
- About "419" scams
- Benin import scam
- Ghana gold scam
- USA AID spam
- "Tawa Enterprises" - attempted $98,600 fraud from Lagos, Nigeria
- officelineworld.com - Be careful with orders from Nigeria!
Beware when you receive sales inquiries such as the following, which don't mention any specific products and involve shipping to risky countries. Below are several examples of typical fraud emails from Nigeria.
|
Exhibit #1:
From: "tony smith" <[email protected]>Exhibit #2:
To: <someotheraddress>
Sent: Friday, 22 October, 2004 10:16
Subject: mail order,,,,,,,,,,,,,,
ATTENTION:SALES
Sir/madam,
It is my easrnest interest to write you,my clients saw your address on
the internet ,they have also visited your website and found your
products good to them.My company is a consultant in America here.my clients are interested in your products and they are situated in Nigeria.they are interested in buying your products I will be very glad if you will respond to my request as soon as possible to enable us start a good business relationship and also the payment option of my company is through credit card (not paypal) and my shipping method is via United Parcel Service (UPS) or fedex express. Looking forward to recieving from you soon.
Thanks.
From: "jose smith" <[email protected]>Exhibit #3:
To: <recipientaddress>
Sent: Friday, 22 October, 2004 9:57
Subject: mail order....
ATTENTION:SALES
Sir/madam,
It is my easrnest interest to write you,my clients saw your address on
the internet ,they have also visited your website and found your
products good to them.My company is a consultant in America here.my clients are interested in your products and they are situated in Nigeria.they are interested in buying your products I will be very glad if you will respond to my request as soon as possible to enable us start a good business relationship and also the payment option of my company is through credit card (not paypal) and my shipping method is via United Parcel Service (UPS) or fedex express. Looking forward to recieving from you
soon.
Thanks.
---------------------------------
Do you Yahoo!?
Y! Messenger - Communicate in real time. Download now.
From: "TERRY SMITH" <[email protected]>Exhibit #4:
To: <recipientaddress>
Sent: Wednesday, 27 October, 2004 9:24
Subject: MAIL ORDER.....
HELLO SALES, THIS GREETING IS FROM TERRY OWNER. WE BASED ON SELLING GOODS AND I WILL LIKE TO ORDER FOR SOME GOODS IN YOUR STORE I WILL LIKE YOU TO SHIP THEM TO ME IN LAGOS NIGERIA VIA FEDEX OR UPS EXPRESS AND I WILL LIKE TO MAKE MY PAYMENT BY MY CREDIT CARD DETAILS ISSUE IN MY COUNTRY,WHICH IS UNITED STATE AND PLS I WILL BE EXPECTING YOUR URGENT REPLY TO GIVE ME AN AUTHORITY TO GO AN CHOOSE AN PRODUCT NEEDED. THANKS AND REGARDS
From: tony smith <[email protected]>
To: <recipientaddress>
Sent: Friday, October 29, 2004 4:13 AM
Subject: MAIL ORDER.....
I want to purchase from your store to lagos nigeria, i will like to know if you ship to Nigeria and accept credit card as means of payment, kinldy get back to me as soon as possible for me to forward to you the items needed from you.
Regards,
Tony Smith.
_________________________________________________________________
Don't just search. Find. Check out the new MSN Search!
http://search.msn.com/
From: Benedict James <[email protected]>
To: [email protected]
Sent: Thursday, 18 November, 2004 2:00
Subject: Urgent Order....
Dear Sir/Madam
My name is Benedit James a citizen of NYC but i have a store in nigeria which i would like the items to be shippied toand i came across your product which i am
interested in purchasing your product . I will like you to please get back to me
if it is still available in stock or not?. If it is,please be sure to
provide us
with the following
informations.
Seller's full name
Seller's full contact address and phone number.
We will be very happy if you can provide us with the above
requested informations.We will also like to state here that payment for the items would be made via credit card
Regards
benedict james
Several things are odd about these messages:
- In #1 and #5, mail was not addressed to the recipient. Actually, it has been sent to many recipients via Bcc (blind carbon copy), which normally produces a "Recipient list suppressed" message or shows "None" as the recipient, unless one specific recipient is listed.
- Sender #1 and #3 use a free webmailer hosted in the Czech Republic used by many Nigerian 419 scammers. We have over 140 email addresses for the 419 fraud in our files for this provider. Sender #2 is also a free webmailer popular with Nigerian scammers.
- Sender #5 used a very recently registered domain. It was hosted by Rediffmailpro.com, a web hoster in India which is often used by Nigerian scammers (see examples).
- Emails #1 and #2 are almost identical, except for the sender address and the first name used. Mails #1, #2 and #3 use the same common surname. There are probably more of these going around.
- Sender discloses no postal address or even location.
- Sales involving shipping to an address other than the person who places the order.
- All messages make a point of mentioning payment by credit card. These buyers are not interested in using any other form of payment. This is odd, considering that some of the buyers claim to be in the USA, where cheques (checks) are quite commonly used for payment.
- Mail was sent to a personal email address, not to a business. Ricipient #3 is a spamtrap address not currently used for any valid email.
- "Benedit James" (#5) is so unfamiliar with his own name that he manages to misspell it.
Even though the sender in #1, #2 and #5 claim to be US-based, the IP address in #2 (81.23.193.88) traces to an Irish satellite ISP that provides connectivity for Nigeria:
inetnum: 81.23.193.80 - 81.23.193.95
netname: WEB-SAT-ISP-NETBLK1
descr: Web-Sat ISP services - dmz
country: IE
admin-c: MS4605-RIPE
admin-c: AG1614-RIPE
tech-c: WSO2-RIPE
status: ASSIGNED PA
mnt-by: WEB-SAT-MNT
notify: [email protected]
changed: [email protected] 20021031
source: RIPE
route: 81.23.192.0/20
descr: Web-Sat ISP services
origin: AS12488
mnt-by: WEB-SAT-MNT
changed: [email protected] 20031001
source: RIPE
role: Web-Sat ISP Operations
address: Unit 3, Bluebell Industrial Estate
address: Dublin 12
address: Ireland
phone: +353 1 4501711
admin-c: MS4605-RIPE
admin-c: AG1614-RIPE
tech-c: MS4605-RIPE
tech-c: AG1614-RIPE
e-mail: [email protected]
nic-hdl: WSO2-RIPE
notify: [email protected]
changed: [email protected] 20021011
source: RIPE
person: Mike Smith
address: Unit 3, Bluebell Industrial Estate
address: Dublin 12
address: Ireland
phone: +353 1 4501711
e-mail: [email protected]
nic-hdl: MS4605-RIPE
notify: [email protected]
mnt-by: WEB-SAT-MNT
changed: [email protected] 20040818
source: RIPE
It's similar for #5: Despite the sender claiming to be in New York City, the IP address logged by Rediffmailpro for webmail posting belongs to a business in Abuja, Nigeria connected via a satellite uplink:
OrgName: Microcity Computers
OrgID: MICRO-50
Address: 1579 Kayes st
City: Abuja
StateProv: Nigeria
PostalCode:
Country: NG
NetRange: 66.178.80.176 - 66.178.80.183
CIDR: 66.178.80.176/29
NetName: MICROCITY-COMPUTERS
In one of these cases an order was placed. The shipping address provided to the (fortunately scam-aware) business was:
ANTHONY SMITH 142 Isolo road , Mushin , Lagos 23401, Nigeria.
Found at http://www.geek.com/news/geeknews/2001oct/bch20011025008521.htm:
Product enquiry (8:23am EST Mon Oct 04 2004)
Hello Sales,
I am Mandy,the CEO of mandywoodconsularstore ltd,I brows through your website and i found it interesting and i saw some items need to supply some of my clients. Please try and get back to me with the price list of your product including the shipping cost to the following address below
SHIPPING TO
Name : Mandy wood
Address : 12 KOGBEREGBE STREET
City : ISOLO
State : LAGOS STATE
Zip code : 23401
Country : NIGERIA.
As soon as possble, so that i can proceed with selecting and payment via credit card (VISA CARD OR MASTERCARD) AND IF YOU WISH, I ACN ALSO AFFORD YOU INTERNATIONAL CHEQUE OR MONEY ORDER,wish to hear from you soon.
Regards.
Mrs Mandy. [email protected] - by madny wood
Red flags: Starts with "Hello Sales" or "Dear Sales", from Webmailer address, no phone number, typo in sender's name, no specific products mentioned, posting in inappropriate forum.
From: "alexandria davis" <[email protected]> To: <[email protected]> Sent: Sunday, 27 February, 2005 23:39 Subject: ORDERING ENQUIRIES!!!!!!!!! DEAR SELLER, WITH CLASSIFIED AD MADE ON INTERNET ,I WISH TO MAKE AN ORDER FOR BLOCK TIES.,KINDLY GIVE ME THE PRICE QUOTATION IF YOU YOU HAVE.I WISH TO MAKE AN ORDER AS SOON AS POSSIBLE.HOPE TO READ FROM YOU SOONEST. FROM, ALEX DAVIS, BRAILE WORKSHOP STORE
Despite the South African webmail service that email came from Nigeria:
WHOIS details for sending network (IP 66.178.81.106):Received: from [66.178.81.106] (account [email protected]) by mail01.infosat.net (CommuniGate Pro WebUser 4.1.8) with HTTP id 652945809; Sun, 27 Feb 2005 16:39:01 +0200
OrgName: INTERFINISH COMMUNICATIONS GROUP
OrgID: ICG-43
Address: 66, BODE THOMAS ST
City: Lagos
StateProv: Lagos
PostalCode:
Country: NG
NetRange: 66.178.81.104 - 66.178.81.111
CIDR: 66.178.81.104/29
NetName: INTERFINISH
NetHandle: NET-66-178-81-104-1
Parent: NET-66-178-0-0-1
NetType: Reassigned
Comment:
RegDate: 2004-07-22
Updated: 2004-07-22
OrgTechHandle: YOS-ARIN
OrgTechName: OSHIKOYA, YOMI
OrgTechPhone: 234-803-330 8688
OrgTechEmail: [email protected]
Nigeria is but one of several high risk countries for accepting mail order business from. Other countries in that category (with varying degrees of risk) are: Indonesia, Romania, Ukraine, Yugoslavia, Lithuania, Egypt, Bulgaria, Turkey and Russia.
Many mail order businesses refuse to ship to these countries or take precautions to verify the identity of the buyer vs. the credit card. Ask for the 3 or 4-digit security code at the back of the card. You have to make absolutely sure that the shipping address for the order matches the billing address for the credit card or you could lose your merchandise and be stuck with a fee by the credit card company, even if the amount of the transaction is confirmed by the card company. If anything looks odd, don't take the risk.
Please read the recommendations at the following websites:
|