Spam 419/Nigeria Online fraud jwSpamSpy Contact
Email Spam Filter: |
|
|
419 Scam – "UNIVERSAL TRUST WORLDWIDE LOTTERY / SPEEDFAST WORLDWIDE"
- About the 419 (Advance Fee) scam
- Email addresses used by 419 scammers
- Phone numbers used by 419 scammers
- How to report 419 spam to us
- Domains registered by 419 scammers
- Company names mentioned in 419 spam
- What can you do when you receive 419 spam
"UNIVERSAL TRUST WORLDWIDE LOTTERY / SPEEDFAST WORLDWIDE" are labels used by a fake lottery and fake "claims agent" in Nigeria and the UK.
This scam is part of the same cluster as the "Dgcourier (Edward Pinto)" fake lottery scam.
|
FROM: MR SIMON CROFT. THE COORDINATOR, EGLOBAL LOTTERY UK. INTERNATIONAL PROMOTIONS / PRIZE AWARD DEPARTMENT. EGLOBAL LOTTERY, UK. UNIVERSAL TRUST WORLDWIDE PROMOTION LOTTERY 138 EDWARD STREET, 4TH FLOOR BARINOR BUILDING UK LONDON, ENGLAND Ref: UT/941OY2/02 Batch: 12/25/DC34 13/12/2004 WINNING NOTIFICATION: We happily announce to you the draw of the Euro - Afro Asian SweepstakeInternational programs held on the 30th of october 2004 in cairo Egypt.Your e-mail address attached to ticket number: 56475600545-288 with Serial number 5388/02 drew the lucky numbers 31-6-26-13-35-7, which subsequently won you the lottery in the 3RD category You have therefore been approved to claim a total sum of US$2,500,00000 (Two million, five hundred Thousand,United States Dollars) in cash credited to file PC/9080118308/02. This is from a total cash prize of US $25Million dollars, shared amongst the first Fifty (50) lucky winners in this category.Please note that your lucky winning number falls within our European booklet representative office in Europe as indicated in your playcoupon. Inview of this, your US$2,500,000.00 (Two million, five hundred thousand,United States Dollars) would be released to you by our security firm in Europe. OurEuropean agent will immediately commence the process to facilitate the release of your funds as soon as you contact him. All participants were selected randomly from World Wide Web site through computer draw system and extracted fromover 100,000 companies. This promotion takes place annually. For security reasons, you are advised to keep your winning information confidential till your claims is processed and your money remitted to you in whatever manner you deem fit to claim your prize This is part of our precautionary measure to avoid double claiming and unwarranted abuse of this program by some unscrupulous elements. To file for your claim, please contact our fiduciary agent: Mr Thomas Walter. Email: thomasw_alter To avoid unnecessary delays and complications, please quote your reference/batch numbers in any correspondences withus or our designated agent. Congratulations once more from all membersand staffs of this program. Thank you for being part of our promotional lottery program. Sincerely, SIR H.J.PONFA UNIVERSAL TRUST WORLDWIDE LOTTERY Coordinator. EMAIL: thomasw_alter@safe-mail.net
Message headers:
Received: from host81-136-109-4.in-addr.btopenworld.com ([81.136.109.4] helo=onmo3395.com) by emailhost with smtp (Exim 4.43) id 1CdoVq-0007xk-8m for emailaddress; Mon, 13 Dec 2004 12:37:10 +0100 From: "UNIVERSAL TRUST" <thomsaw_aler@safe-mail.net> Reply-To: thomasw_alter@safe-mail.net To: emailaddress Date: Mon, 13 Dec 2004 11:37:11 +0000 Subject: LOTTERY WINNER
WHOIS details for sending network (IP 81.136.109.4):
inetnum: 81.136.60.0 - 81.136.119.255
remarks: *******************************************************
remarks: * Please send abuse reports to abuse@btopenworld.com *
remarks: *******************************************************
netname: BT-ADSL
descr: IP Pools
country: GB
admin-c: BTOW1-RIPE
tech-c: BTOW1-RIPE
status: ASSIGNED PA
mnt-by: BTNET-MNT
mnt-lower: BTNET-MNT
mnt-routes: BTNET-MNT
changed: preston.dialip@bt.com 20040121
source: RIPE
route: 81.128.0.0/11
descr: BT Public Internet Service
origin: AS2856
mnt-by: BTNET-MNT
changed: support@bt.net 20030615
source: RIPE
role: BT OPENWORLD OPERATIONAL SUPPORT
remarks: ********************************************************
remarks: * Please send abuse reports to abuse@btopenworld.com *
remarks: * *
remarks: ********************************************************
address: BT
address: Openworld
address: UK
e-mail: ims.adastral@btopenworld.com
admin-c: IT337-RIPE
tech-c: RJG3-RIPE
nic-hdl: BTOW1-RIPE
mnt-by: BTNET-MNT
changed: preston.dialip@bt.com 20030520
source: RIPE
WHOIS details for sending network (IP 81.136.109.4):
inetnum: 81.136.152.0 - 81.136.199.255
remarks: Please send abuse notification to abuse@btopenworld.com
netname: BT-ADSL
descr: IP Pools
country: GB
admin-c: BTOW1-RIPE
tech-c: BTOW1-RIPE
status: ASSIGNED PA
mnt-by: BTNET-MNT
mnt-lower: BTNET-MNT
mnt-routes: BTNET-MNT
changed: preston.dialip@bt.com 20030426
changed: preston.dialip@bt.com 20040205
source: RIPE
route: 81.128.0.0/11
descr: BT Public Internet Service
origin: AS2856
mnt-by: BTNET-MNT
changed: support@bt.net 20030615
source: RIPE
role: BT OPENWORLD OPERATIONAL SUPPORT
remarks: ********************************************************
remarks: * Please send abuse reports to abuse@btopenworld.com *
remarks: * *
remarks: ********************************************************
address: BT
address: Openworld
address: UK
e-mail: ims.adastral@btopenworld.com
admin-c: IT337-RIPE
tech-c: RJG3-RIPE
nic-hdl: BTOW1-RIPE
mnt-by: BTNET-MNT
changed: preston.dialip@bt.com 20030520
source: RIPE
Response from "Mr. Thomas Walter" (see also Edward Pinto for another version of the scam):
ATTENTION: I am Dr Thomas Walter the fiduciary agent assigned to your case. I wish to Congratulate you on your victory,you are lucky person to have won this lottery. Your email address is amongst those chosen this quarter from our new java-based software that randomly selects email addresses from the web from which winners are selected. You are required to forward the following details to help facilitate the processing of your claims and certificate which will facilitate the release of your winnings. 1. Full names. 2. Residential address. 3. Phone number. 4. Fax number. 5. Occupation. 6. Sex. 7. Age. 8. Nationality. You are advised to forward these informations as soon as possible to enable us attend to your file.Please note that your funds have been deposited safely in a security firm in Europe,and your information will be forwarded to them before they can release your winnings. After you have sent down these information, a certificate will be prepared for you. This is to be your proof of winning from this office to the payment center before they release your funds.You are adviced to keep your winning numbers secret to avoid unscripulous elements from taking advantage of the situation. Once again, congratulations. Regards, Dr Thomas Walter
Message headers:
Received: from pc ([81.136.191.249]) by SAFe-mail.net with https Subject: CLAIMS VERIFICATION Date: Thu, 10 Mar 2005 07:28:30 -0500 From: thomasw_alter@SAFe-mail.net
ATTENTION: We hereby inform you that we have processed your payment and your cheque is ready for disbursement,along with your winning certificate. In this regard you are to choose from the options below the one that best suites you on how you wish to receive your funds. Also your funds deposited with us is not in liquid form but in Bank Cheque, this advice complies with the Anti-Fraud section 2,sub section (iv) of the procedural manual of the funds disbursement agreement existing between courier companies and the British Government. The options to receive your winnings are: 1.You come down to our office in London to collect your certificate and also your certified bank cheque and take it to our payment centre in person to redeem your winning sum. ADDRESS OF OFFICE:10 NORTHUMBERLAND AVENUE, LONDON WC2N 5BX, THE UNITED KINGDOM 2. Have our affiliate courier company send the cheque to you. In consonance with our policy in this regard,be advised that if you opt for the cheque to be couriered, we however exempts ourself from all liability related to this service. The cost of this service would be borne by you; this is a prerequisite for this option. You will be referred to our affiliate courier company so that you can make enquires concerning modalities, and charges. The reason for the courier option is for the fact of double taxation, that is if you are to come over to sign for the release of your winnings personally, you would have to pay taxes on the winnings in Britain and then go and pay taxes on the same winnings in your country once the funds get there. 3.Thirdly your winnings will be electronically transfered to your bank of choice through our payment center.You will be contacted by them immediately and we advise you adhere to their instructions so as to enable you receive your winnings soonest,If for any reasons you prefer our other options you are to inform us immediately. This is the main reason why we would advise that you take the courier option, you have not collected the winnings until you sign for it and the only way you can sign for it via courier is when you have taken delivery of the parcel containing the winnings cheque and certificate of winning. This would be in your country, the options are open to you and we are there to serve you, no matter the option taken. We expect that you will notify us of your choice upon receipt of this message so that appropriate arrangement can be put in place.Also you are to get back to us once you have been contacted. Regards, Dr THOMAS WALTER
Message headers:
Received: from pc ([81.136.127.173]) by SAFe-mail.net with https Subject: CLAIMS VERIFICATION Date: Fri, 11 Mar 2005 04:53:24 -0500 From: thomasw_alter@SAFe-mail.net
The "winner" asked some questions about the courier company. Notice how "Dr Thomas Walter" in his reply started using a virus scanner, which he didn't have before? That's because this email is from a different source. The victim has already been passed on to the enxt stage in the scam. This email originates from Nigeria, not the UK. This "Thomas Walter" is actually the same person as the "Paul Reid" of "Speedfast Worldwide Services" mentioned in this email. The postal address is the same as for "Dgcourier Service" in another version of the scam.
Hello Surname, I am happy for your prompt reply but i wold rather that you get the information you asked for from the courier company because there would be in a better position to let you on on it. We have sent your details as well as your cheque to them thi morning so we believe that there are in control now and will attend to you once you can reach them with your information. You are to contact the courier at once on the requirements to sending your to you. Below are their contact details: SpeedFast Worldwide Services Rovex House, Hay Hall Rd., Tyseley, Birmingham. B11 2AG. England Handling Officer: Mr Paul Reid email:speedfast@mail2consultant.com Once again congratulations. Dr Thomas Walter -- No virus found in this incoming message. Checked by AVG Anti-Virus. Version: 7.0.308 / Virus Database: 266.7.2 - Release Date: 3/11/2005
Message headers:
Received: from pc ([213.181.83.2]) by SAFe-mail.net with https Subject: DETAILS AGAIN Date: Mon, 14 Mar 2005 13:58:26 -0500 From: thomasw_alter@SAFe-mail.net
WHOIS details for sending network (IP 213.181.83.2):
inetnum: 213.181.64.0 - 213.181.95.255
org: ORG-BL4-RIPE
netname: NG-BROADBANDTECH-20000327
descr: BT Limited
descr: PROVIDER Local Registry
country: NG
admin-c: IO243-RIPE
tech-c: IO243-RIPE
status: ALLOCATED PA
notify: bt@micro.com.ng
mnt-by: RIPE-NCC-HM-MNT
mnt-routes: BT-LIMITED-MNT
mnt-lower: BT-LIMITED-MNT
changed: hostmaster@ripe.net 20000327
changed: hostmaster@ripe.net 20001003
changed: hostmaster@ripe.net 20010507
changed: hostmaster@ripe.net 20010704
changed: lir-help@ripe.net 20011214
changed: hostmaster@ripe.net 20020419
changed: hostmaster@ripe.net 20020423
changed: hostmaster@ripe.net 20020613
changed: hostmaster@ripe.net 20030211
changed: hostmaster@ripe.net 20040406
source: RIPE
organisation: ORG-BL4-RIPE
org-name: BT Limited
org-type: LIR
address: BT Limited
address: 8B Ademola Street,
address: Off Awolowo Road,
address: S. W. Ikoyi,
address: Lagos, Nigeria.
phone: +234 1 2693192
fax-no: +234 1 2693192
e-mail: bt@micro.com.ng
admin-c: IO243-RIPE
admin-c: IO243-RIPE
mnt-ref: BT-LIMITED-MNT
mnt-ref: RIPE-NCC-HM-MNT
mnt-by: RIPE-NCC-HM-MNT
changed: hostmaster@ripe.net 20040415
source: RIPE
person: Israel Oyeleke
address: BT Limited
address: 8B Ademola Street
address: Ikoyi S.W.
address: Lagos, Nigeria
phone: +234 1 2673532
fax-no: +234 1 2673203
e-mail: i.oyeleke@moneynett.com
nic-hdl: IO243-RIPE
notify: i.oyeleke@moneynett.com
changed: ifiok@btlimited.com 20010605
changed: ifiok_moses@yahoo.com 20030917
source: RIPE
Here is a message from "Paul Reid" of the delivery service. The message is sent from the same IP address Nigeria as the last message by "Thomas Walter" and they both use the same version of the virus scanner ;-) The following message was sent twice because the first time it was addressed to the name of another lottery scam victim.
Hello Wrongfirstname Wronglastname, All arrangements have now been finalised and we are waiting on proof of payment of the required charges so that we may courier your winning check and certificate of winnings to you.Below are the charges that you required to pay to enable us courier your certificate of winnings as well as your certified bank check of US$2.5 million to you. We will despatch as soon as we get confirmation of payment of the required charges. It will take twenty-four hours to get them across to you: We have received the sent informations and confirmed it to be true. Description Of Parcel to be couriered. An original certificate of Winning....................0.35kg Bank Cheque .............................0.17kg Total weight of parcel ...............................0.52kg Colour of parcel .....................................Brown Lenght of Days .......................................Nextday Destination of delivery: NAME: ADDRESS: PLEASE RE CONFIRM FULL NAMES AND ADDRESS Please find below our charges: Courier charges .............................US$193.00 Administrative ............................. US$175.00 Taxes ..................................... US$167.00 Insurance .................................. US$194.00 TOTAL ......................................US$729.00 You are to make the payment through western union money transfer so as to speed up the process of sending your winnings. You are to make the payment through the name of our accounts officer below: Mr Simin William 25 HILLSIDE DRIVE, EDGWARE,LONDON HA8 7PF UNITED KINGDOM After payment, you are to send us the following information which you will find on the receipt of the transfer after you must have made the transfer. The details are: money transfer control number, senders name and address as it appears in the transfer,amount sent, test question and answer if any. . Please note that on confirmation of the paid charges,the date and time of departure and expected date of delivery will be sent to you. We are glad to be of service to you. Paul Reid Speedfast Worldwide Services Rovex House, Hay Hall Rd., Tyseley, Birmingham. B11 2AG. England _______________________________________________________________ Get the FREE email that has everyone talking at http://www.mail2world.com 250MB & 2GB Email Accounts – POP3 – Calendar – SMS – Translator - Much More! -------------------------------------------------------------------------------- No virus found in this incoming message. Checked by AVG Anti-Virus. Version: 7.0.308 / Virus Database: 266.7.2 - Release Date: 3/11/2005
Message headers:
Received: from [213.181.83.2] by mail2Consultant.com with HTTP; 3/15/2005 12:03:51 AM PST thread-index: AcUpNYaAZ9y3DqxSSKif1nqUKEaoTA== Thread-Topic: COURIER CHARGES From: "speedfast courier" <speedfastworldwide@mail2Consultant.com> To: emailaddress Subject: COURIER CHARGES Date: Tue, 15 Mar 2005 00:03:51 -0800
The following reply comes from a different ISP in Nigeria:
Hello Surname, Thank you again.We hope that you got our instructions clearly and like i told you on phone earlier today you are to make the courier charges immediately and get back to us.You are to acknowledge this email also.Once again congratulations. Warmest Regards, Mr Paul Reid. _______________________________________________________________ Get the FREE email that has everyone talking at http://www.mail2world.com 250MB & 2GB Email Accounts – POP3 – Calendar – SMS – Translator - Much More! -------------------------------------------------------------------------------- No virus found in this incoming message. Checked by AVG Anti-Virus. Version: 7.0.308 / Virus Database: 266.7.3 - Release Date: 3/15/2005
Message headers:
Received: from [81.199.85.64] by mail2Consultant.com with HTTP; 3/15/2005 10:05:39 AM PST thread-index: AcUpiZicsAED2asERNG/6j0hicGSqw== Thread-Topic: THANK YOU From: "speedfast courier" <speedfastworldwide@mail2Consultant.com> To: <emailaddress> Subject: THANK YOU Date: Tue, 15 Mar 2005 10:05:39 -0800
WHOIS details for sending network (IP 81.199.85.64):
inetnum: 81.199.84.0 - 81.199.87.255
netname: CIDR-COMMUNICATION-01
descr: Internet service provider
country: NG
admin-c: TECH7-RIPE
tech-c: TECH7-RIPE
status: ASSIGNED PA
notify: lir@ipplanet.net
mnt-by: AS12491-MNT
changed: lir@ipplanet.net 20040902
source: RIPE
person: Tech Supernet300
address: 21 Mobolaji Bank
address: Anthony Way Ikeja
address: Lagos
address: Nigeria
phone: + 234 1 4976493
e-mail: admin@supernet300.com
nic-hdl: TECH7-RIPE
changed: lir@ipplanet.net 20040902
source: RIPE
Goodday Lastname, We had made an attempt to call you earlier today and are now writing you to inform you we are still awaiting to hear from you regarding the courier fee so we can send out your winning cheque to you. Once again congratulations . Mr Paul Reid. _______________________________________________________________ Get the FREE email that has everyone talking at http://www.mail2world.com 250MB & 2GB Email Accounts – POP3 – Calendar – SMS – Translator - Much More! -------------------------------------------------------------------------------- No virus found in this incoming message. Checked by AVG Anti-Virus. Version: 7.0.308 / Virus Database: 266.7.3 - Release Date: 3/15/2005
Message headers:
Received: from [213.181.83.2] by mail2Consultant.com with HTTP; 3/16/2005 10:10:27 AM PST
Message headers:
|