• About the 419 (Advance Fee) scam
• Phone numbers used by 419 scammers
  
• How to report 419 spam to us
• Frequently asked Questions (419 FAQ)
• Opinions about the scammers and their victims
  
• Domains registered by 419 scammers
  
• Company names mentioned in 419 spam
  
• Names of people mentioned in 419 spam
  
• What can you do when you receive 419 spam
  

The same criminals who pose as email lotteries, corrupt bank employees, lawyers or family members of dead dictators in the "419" advance fee fraud seem to be taking advantage of the death of hundreds of thousands and the suffering of millions of people in the Indian Ocean tsunami desaster.

Here are several examples of emails, most of which are from Africa, that bear marks of the "419" advance fee fraud but are solicitations for money supposedly destined for tsunami victims in Asia.

• "Mr Teh Ho, Indonesia" (South Africa / Malta)
  
• "Musliman Musliman, Jakarta" (Australia / Indonesia)
  
• "Mr Teh Ho, Indonesia" (Korea)
  
• "ECOWAS, Mali" (Mali)
  
• "WILLIAM BECKS / THE DYSPRAXIA FOUNDATION / Susan Khan" (UK)
  
• "sanko dami, Somalia" (Nigeria)
  

This one is not a fraud, but was sent as spam anyway:

• UNICEF donation spam
  

Other websites documenting tsunami-related frauds:

• ourcommunity.com.au - Asian Tsunami Disaster - Scam Watch
  

Are you sick of spam too? Do you want it stopped now? Try jwSpamSpy, the spamfilter we use to track the spammers! Free 30-day trial version available now!

Example #1:

Return-Path: <tsunami.aidsappeal@eramail.co.za>
Received: from mail02.infosat.net (mailout06.infosat.net [66.18.69.6])
 by ############## (Postfix) with ESMTP id 6CA1CD83FF
 for <##############>; Mon,  3 Jan 2005 00:57:00 +0000 (GMT)
Received: from [196.38.110.44] (HELO mail01.infosat.net)
  by mail02.infosat.net (CommuniGate Pro SMTP 4.1.8)
  with ESMTP id 175626736; Mon, 03 Jan 2005 02:59:10 +0200
Received: from [213.255.201.11] (account tsunami.aidsappeal@eramail.co.za)
  by mail01.infosat.net (CommuniGate Pro WebUser 4.1.8)
  with HTTP id 578456025; Mon, 03 Jan 2005 02:59:10 +0200
From: "Tsunami Victims Aids Appeal" <tsunami.aidsappeal@eramail.co.za>
Subject: TSUNAMI VICTIMS AIDS APPEAL
X-Mailer: CommuniGate Pro WebUser Interface v.4.1.8
Date: Mon, 03 Jan 2005 02:59:10 +0200
Message-ID: <web-578456025@mail01.infosat.net>
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
To: undisclosed-recipients:;

TSUNAMI VICTIMS AIDS APPEAL
Dear Sir/Madam,

We are from a small village in the Aceh Region in
Indonesia affected by the recent Tsunami Quakes/floods
disaster that swept through South Eastern Asia.
We have been rendered homeless and have lost all we
have in life. Many foreign tourists also were affected
by the quakes/floods.

Since we have no other way to survive as of now and
have lost most of our relations and children, we have
decided to write this letter of APPEAL FOR DONATIONS.

We will be very grateful if you can assist us with any
amount of money to enable us start a new lease of
life. Our little business have been swept off by the
floods and we cannot go and steal. All we need is
money to rehabilitate and start business again to make
a living. No amount is too small to assist in this
relief efforts.

We are sending this mail to many people all over the
world for assistance as we cant help ourselves. The
United Nations and other world bodies/organisations
are helping but it is not enough. So we need your
assistance.

 Sir/Madam we pray that God/Allah will reward you
abundantly for listening to the voice of the less
priviledged and people whose lives have been
devastated by a natural disaster.

Any Donation can be sent to us through our nominated
bank account below:

FIRST INTERNATIONAL MERCHANT BANK PLC
THE PLAZA COMMERCIAL CENTRE
BISAZZA STREET
SLIEMA, SLM 15-MALTA
SWIFT CODE: FIMB MTM3
FAVOR: EASTLINE INTERNATIONAL SERVICES LTD
A/C No: MT65FIMB3301900001361CALLUSD 012



Please do not hesitate to reach us with a copy of the
transfer slip for any money sent to our designated
account above for our records and also for
reconciliations with the
bank.Email(tsunamivictims_aidappeal@yahoo.com)

Your assistance will be appreciated.

Thanks for your anticipated cooperation.

Mr Teh Ho
For: Aceh Victims of Tsunami
Indonesia

It seems highly unusual that someone from Aceh, Indonesia would be using a webmailer in South Africa and a bank account in Malta for such an appeal. Furthermore, the IP address this was sent from (which belongs to a worldwide satellite broadband provider) has a history. We received a total of 8 "419"-scam emails originating from this very same IP address between Dec 02 and Dec 30, 2004. We therefore assume the IP to be statically assigned to an Internet service provider or Internet cafe in Nigeria or somewhere else in Africa.

We contacted SkyVision Global Networks, the service provider and asked them to confirm if the IP was assigned to a customer in Indonesia or a different country. They responded by saying they were unable to provide any information about their customers without a court order. However they were investigating the incident I reported in accordance with their Acceptable Use Policies, concluding their response with these words:

"I would suggest you make your donations to this cause via well-known charities."

Here is the originating network:

     inetnum:      213.255.192.0 - 213.255.255.255
     org:          ORG-SGN1-RIPE
     netname:      UK-SKYVISION-20030324
     descr:        PROVIDER
     descr:        SkyVision Global Networks
     country:      GB
     admin-c:      SVAC-RIPE
     tech-c:       SVNC-RIPE
     status:       ALLOCATED PA
     mnt-by:       RIPE-NCC-HM-MNT
     mnt-lower:    SV-MNT
     mnt-routes:   SV-MNT
     notify:       noc@sky-vision.net
     changed:      hostmaster@ripe.net 20030324
     source:       RIPE
     
     route:        213.255.192.0/18
     descr:        SkyVision Network Services
     origin:       AS25228
     mnt-by:       SV-MNT
     changed:      noc@sky-vision.net 20030324
     source:       RIPE
     
     organisation: ORG-SGN1-RIPE
     org-name:     SkyVision Global Networks
     org-type:     LIR
     address:      SkyVision Global Networks
                   Kinetic Business Centre
                   Theobald Street
                   Borehamwood
                   Hertfordshire WD6 4PJ
                   United Kingdom
     phone:        +44 20 8387 1750
     fax-no:       +44 20 8387 4004
     e-mail:       lir@sky-vision.net
     admin-c:      SVAC-RIPE
     admin-c:      SVNC-RIPE
     admin-c:      YURI
     admin-c:      TATA-RIPE
     admin-c:      SB106-RIPE
     mnt-ref:      SV-MNT
     mnt-ref:      RIPE-NCC-HM-MNT
     mnt-by:       RIPE-NCC-HM-MNT
     changed:      hostmaster@ripe.net 20040415
     changed:      bitbucket@ripe.net 20040428
     changed:      bitbucket@ripe.net 20041229
     source:       RIPE
     
     role:         SkyVision Network Coordination Center
     org:	      ORG-SGN1-RIPE
     address:      SkyVision Global Networks
     address:      Kinetic Business Centre
     address:      Theobald Street
     address:      Borehamwood
     address:      Hertfordshire WD6 4PJ
     address:      United Kingdom
     phone:        +44 20 8387 1750
     fax-no:       +44 20 8387 4004
     e-mail:       noc@sky-vision.net
     admin-c:      SVAC-RIPE
     tech-c:       SVTC-RIPE
     nic-hdl:      SVNC-RIPE
     mnt-by:       SV-MNT
     notify:       noc@sky-vision.net
     changed:      noc@sky-vision.net 20011220
     source:       RIPE
     
     person:       SkyVision Administrative Contact
     address:      SkyVision Global Networks
     address:      Kinetic Business Centre
     address:      Theobald Street
     address:      Borehamwood
     address:      Hertfordshire WD6 4PJ
     address:      United Kingdom
     org:	      ORG-SGN1-RIPE
     phone:        +44 20 8387 1750
     fax-no:       +44 20 8387 4004
     e-mail:       ripeadm@sky-vision.net
     nic-hdl:      SVAC-RIPE
     mnt-by:       SV-MNT
     notify:       noc@sky-vision.net
     changed:      noc@sky-vision.net 20011220
     source:       RIPE

Example #2:
If example #1 was not suspicious enough, compare it with the following, remarkably similar email:

From: "stones" <tsunamirehab@hotmail.com>
Sent: Monday, 10 January, 2005 7:25
Subject: TSUNAMI RELIEF AIDS APPEAL

Dear Sir/Madam,

We are from a small village in the Aceh Region in Indonesia affected by the recent Tsunami Quakes/floods Disaster that swept through South Eastern Asia.

We have been rendered homeless and have lost all we have in life. Many foreign tourists also were affected by the quakes/floods.

Since we have no other way to survive as of now and have lost most of our relations and children, we have decided to write this letter of APPEAL FOR DONATIONS.

We will be very grateful if you can assist us with any amount of money to enable us start a new lease of life. Our little business have been swept off by the floods and we cannot go and steal. All we need is money to rehabilitate and start business again to make a living. No amount is too small to assist in this relief efforts.

We are sending this mail to many people all over the world for assistance as we can't help ourselves. The United Nations and other world bodies/organisations are helping but the funds are not well circulated. So we need your assistance.

Sir/Madam we pray that God/Allah will reward you abundantly for listening to the voice of the less privileged and people whose lives have been devastated by a natural disaster.

Any donation can be sent either by Western Union Money Transfer Services or Money Gram Transfer to:

Mr. Musliman Musliman
Kp Kurus RT 009-RT0089
Utara, Jakarta,
Indonesia,
14130.

As soon as you effect the Payment, email me the relevant Money Transfer details vis: Money transfer control number, senders name and address as it appears in the transfer receipt, amount sent, test question and answer (if any).

My email for further contact is: tsunamirehab@netscape.net

Your assistance will be appreciated. Thanks for your anticipated cooperation.

Mr. Musliman Musliman
For: Aceh Victims of Tsunami
Indonesia
email: tsoonamirehab@netscape.net

___________________________________________________________________________
Mail sent from Penny's Research service at
- http://iresearch-solutions.com

This spam avoids several of the red flags of the first example, but nevertheless is very suspicious:

• The sending host is no webmailer in Africa but a website in Australia, at least a neighbour country to Indonesia. However the spam was not sent via regular webmail. The abused website was more or less dormant until the spam hit people's mailboxes (only 315 hits in total from June-December 2004). This spam was sent through an insecure PHP-Nuke installation, a spammer trick currently exclusively used by 419 scammers. As in those 419 spams that go through a PHP-Nuke host the sender address is that of a regular webmail account at a common free webmail provider, in this case a Hotmail account. The sender name "stones" is an unusual choice.
• The subject line is written in ALL CAPITAL LETTERS, a peculiarity of Nigerian scams.
• The money is to be sent to someone in Jakarta, which admittedly is less suspicious than a bank in Malta (Example #1), but nevertheless Jakarta is located some 1600 km from Banda Aceh, anything but an easy trip for a homeless villager.
• We did a Google search for "Musliman Musliman", to see if the name used by the sender of this spam could be Indonesian. We did not find a single hit for Indonesia. Instead, almost all hits came from Bosnian websites (Serbo-Croat language), with Turkish websites a distant second.

Return-Path: <nobody@server2.pe-servers.com>
Received: from 64.71.151.83  (EHLO server2.pe-servers.com) (64.71.151.83)
  by mta107.mail.scd.yahoo.com with SMTP; Sun, 09 Jan 2005 14:32:55 -0800
Received: from nobody by server2.pe-servers.com with local (Exim 4.43)
	id 1CnlV8-0003yN-1x; Sun, 09 Jan 2005 14:25:34 -0800
To: 
Subject: TSUNAMI RELIEF AIDS APPEAL
From: stones <tsunamirehab@hotmail.com>
X-Priority: 3 (Normal)
CC: 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Mailer: RLSP Mailer
Date: Sun, 09 Jan 2005 14:25:34 -0800

Example #3:
An almost identical version of the letter from Example #2 but using a different sender address (tsunamivictims_aa@tiscali.co.uk) was reported on 2004-01-03 (see here), reproduced below. The domain tiscali.co.uk is the third most frequently used webmailer in 419 scams (netscape.net, used in example #1, happens to be the most frequent one). The bank account used there was located in Korea, using the name "MOJEKWU VICTOR". According to our research via Google, "Mojekwu" appears to be a Nigerian surname. This spam used the same name as in Example #1, "Teh Ho". In other words, Example #1, Example #2 and Example #3 are all variations of the same scam.

TSUNAMI VICTIMS AIDS APPEAL
DearSir/Madam.

We are from a small village in the Banda/Aceh Region in Indonesia affected by the recent Tsunami Quakes/floods disaster that swept through South Eastern Asia.
We have been rendered homeless and have lost all we have in life. Many foreign tourists also were affected by the quakes.

Since we have no other way to survive as of now and have lost most of our relations and children, we have decided to write this letter of APPEAL FOR DONATIONS.

We will be very grateful if you can assist us with any amount of money to enable us start a new lease of life. Our little business have been swept off by the floods and we cannot go and steal. All we need is money to rehabilitate and start business again to make a living.

We are sending this mail to many people all over the world for assistance as we cant help ourselves. The United Nations and other world bodies/organisations are helping but it is mostly in Clothes, water and medicaments. So we need your assistance Sir/Madam and we pray that God will reward you abundantly for listening to the voice of the less priviledged and people whose life have been devastated by a natural disaster.

Any Donation can be sent to us through our nominated bank account below:

BANK: KOREA EXCHANGE BANK, ITAEWON BRANCH,
SEOUL. SOUTH KOREA
SWIFT CODE: KOEXKRSE,
A/C #: 089-JSD-101464-3,
A/C NAME: MOJEKWU VICTOR,
BENEFICIARY: TSUNAMI AIDS APPEAL

Please do not hesitate to reach us with a copy of the transfer slip for any money sent to our designated account for our records and also for reconciliations with the bank.

Your assistance will be appreciated.

Thanks for your anticipated cooperation.

Mr Teh Ho
For: Banda/Aceh Victims of Tsunami
Indonesia

Example #4
(196.200.81.140 / Mon, 03 Jan 2005 06:35:05 -0500):

From: "Economics Community Of West African States (ECOWAS)" <ecowasheads@post.com>
To: <ecowasheads@post.com>
Sent: Monday, 03 January, 2005 20:35
Subject: Tsunami Disaster Aid Raises.

Branch Headquarters: (Rue 27 VoxDar Porte 111 Bamako Mali
Contacts : 00223 6711675 Fax : 00223 228 5553

E-mail : ecowasheads@post.com

Website : www.ecowasbranch70.tripod.com



Ref: 0073220 Date:- 03, Jan 2005



U.N.: Tsunami aid rises to $2 billion



Attention Sir,

The ECONOMIC COMMUNITY OF WEST AFRICAN STATES (ECOWAS) wants to draw your attention to the terrible disaster that claims about 140 thousands lives and properties in Thialand, Siri lanka and Indonesia,

Pledges of international financial support for countries devastated by this disastser needs emergency financial support, according to the U.N.'s emergency relief coordinator. The estimated death toll in the disaster now is more than 140,000,

Ecowas needs your financial aid to sustain the victims affected by this disaster.

Also Ecowas has raised an open donation to any body who feels concern to make a generous nonation to aid the victims. Ecowas expects to raised about $1.5 Billion USD.

So far, Ecowas has organized to pump 850 40 Ft containers of food items to the countries affected. Some of those supplies began reaching victims in remote areas of Indonesia on Saturday, while relief workers were expected to arrive in Colombo in Sri Lanka, later in the day.

No amount of donation like funds, food,medicines,clothes is small, please make your donation today for the survival of the victims and God pay back to those who donate.The money will allow relief workers to feed, clothe, and provide emergency medical services to the affected victims.

Payment instruction to the Ecowas Relief Management Coordinator BEN IDOWU

ECO BANK BAMAKO BRANCH MALI WEST AFRICA

BP E 1272 BAMAKO MALI.
Account No:- 440030102018
Swift Code:- ECOCMLBA
Beneficiary:- BEN IDOWU

Correspondent in USA
Citibank New York
Finance Institutions Africa
111 Wall Street
19th Floor / Zone 1
New York 10043
Account:- 36219282
Swift:- CITIUS 33

GOD Bless you as you donate.

Thanks.

Dr. Musa Owo

(Ecowas Procurement Manager)

What's wrong with the picture?

• This was sent as spam.
• Mali as a landlocked country in Western Africa is not in the best position to send shipping containers to Indonesia.
• Instead of using a Tripod.com webpage, the real ECOWAS has it's own domain (www.ecowas.int/).
• A google search for the street address given for the "ECOWAS regional headquarters" finds exactly one match: The scam warning page you are now reading! Even the website the scammers give lists a different street address.
• Page http://www.ecowasbranch70.tripod.com/id6.html on that website offers gold and gemstones for sale. We have come across a variation of the "Ghana Gold scam" from an ISP in Mali before (IP 196.200.92.18, see here). There may well be a connection.

This spam was sent from Mali, West Africa:

     % This is the RIPE Whois query server #1.
     % The objects are in RPSL format.
     %
     % Rights restricted by copyright.
     % See http://www.ripe.net/db/copyright.html
     
     inetnum:      196.200.80.0 - 196.200.83.139
     netname:      IKATEL-BACKBONE
     descr:        bacbone IP IKATEL
     country:      ML
     admin-c:      SD2024-RIPE
     tech-c:       MA1231-RIPE
     status:       ASSIGNED PA
     remarks:      http://www.ikatelnet.net
     remarks:      ***************************************************
     remarks:      For spam use :   abuse@ikatelnet.net
     remarks:      ***************************************************
     notify:       noc@ikatelnet.net
     mnt-by:       MNT-IKATEL
     mnt-lower:    MNT-IKATEL
     notify:       noc@ikatel.net
     changed:      sekou.drame@ikatel.net 20040713
     source:       RIPE
     
     route:        196.200.80.0/20
     descr:        IKANET
     origin:       AS30985
     mnt-by:       MNT-IKATEL
     changed:      noc@ikatelnet.net 20040923
     source:       RIPE
     
     person:       Sekou DRAME
     address:      IKATEL SA
     address:      Immeuble SONAVIE BP: E 3391
     address:      Bamako ACI 2000
     phone:        +223 6299908
     e-mail:       sekou.drame@ikatel.net
     nic-hdl:      SD2024-RIPE
     changed:      sekou.drame@ikatel.net 20040331
     source:       RIPE
     
     person:       Mohamed Aboubacrine
     address:      IKATEL SA
     address:      Immeuble DT BP 3991 Bamako Mali
     phone:        +223 499 9932
     phone:        +223 629 9932
     nic-hdl:      MA1231-RIPE
     changed:      mohamed.aboubacrine@ikatel.net 20040607
     source:       RIPE

Example #5:

From: "dyspraxia" <dyspraxiafoundation@yahoo.com>
Sent: Tuesday, 04 January, 2005 19:49
Subject: I NEED YOUR ASSISTANCE


THE DYPRAXIA FOUNDATION
8 WEST ALLEY
HITCHIN
HERTFORDSHIRE SGS 1EG
UNITED KINGDOM

The dyspraxia foundation is a charitable foundation headquartered in uk [london] which serves to promote music, theater, art, literature, projects in the social and political arena with a focus on health, as well as science, research, and higher education. Most recently the foundation set up as a foundation that caters for the needs of the poor and the lees privelage in the society

The TSUNAMI DISASTER as it is now known the world over took everybody by surprise. It rought with it horror, death and destruction of a very high magnitude that has not been withnessed for a long time.
We are co-orditaing activities towards providing relief materials, shelter and food to the displaced survivors of the disaster. As you are aware over one hundred and fifty thousand innocent people including six thousand tourist perished in the disaster. We are using this medium to solicite and appeal to well meaning organization and individuals to come to their rescue by contributing their own quota towards helping the survivors. To this end we request that you make a generous donation of at least 100 pound(215 dollars) towards this cause. For further information on how you can be of help please respond to;

MR WILLIAM BECKS
THE DYSPRAXIA FOUNDATION, LONDON ;UK
EMAIL ADDRESS: williamsbecks@london.com
TELEPHONE NUMBER :44 - 704 - 010 - 4605

You will be greatly rewarded as you give to the less fortunate in our society. Certificate of appreciation and citation would be issued to those who support this noble cause.

Yours faithfully,

Susan Khan.

___________________________________________________________________________
Mail sent from WebMail service at PHP-Nuke Powered Site
- http://www.thaitestdrive.com

The real Dyspraxia Foundation owns its own domain, dyspraxiafoundation.org.uk and associated email address: admin@dyspraxiafoundation.org.uk

It doesn't have to use free webmailer accounts such as london.com (a service operated by Outblaze.com) to send email. We reported the scammer to Outblaze who promptly took action.

Example #6: "Sanko Dami"

This email was forwarded to us, so it didn't come with any message headers (that's why we prefer submissions via "Forward as attachment"). We contacted the email address and received a reply from a source in Nigeria.

The plot seems rather far fetched. How likely is it that the son of one of several dozen fishermen's families in Somalia makes it all the way to an internet cafe in Nigeria and finds your email address somewhere on the WWWW? Give me a break! Somalia has little trade with Nigeria, which is a long trip by sea around the Cape of Good Hope. By contrast, it has much closer ties with Kenya and with the Arab peninsula.

From: "sanko dami" <sanko4dami@tsamail.co.za>
Sent: Sunday, January 16, 2005 8:00 AM
Subject: Tsunami victim

Hello sir,

My name is sanko dami a good citizen of somalia. I am from a family of
six including my parents. On the 26 december 2004 by 10 am in the morning
I lost my parents and my two kid brothers to Tsunami disaster and left me
and my kid sister sahar. My parents are fishing in the sea near more remote
village before this deadly disaster came.

One week after this disaster one of my relation who sales cattle in nigeria
came back home to pick me and kids sister to nigeria where he offer me to
be in the cattle business which I am not interested in and also to feed
3 times a day is a war. Before this deadly disaster claim my parents, I
am about to entry one of the colleges in somalia but now things have changed
to the wrong side.

Please I am pleading to the good citizen of the world to help me and my
kids sister to get a better life and education. Here in nigeria, there education
is better than ours and I really like to finish my education.i intended
to study economic which my parent promised me that they will spornsor me.
My kid sister is 3 year and she will like to be in nursery schools. Please
which ever way you will help me and sister who is the whole thing I have
in this world, please do. Anything you offer to me with have a positive
affect on life and that of my sister. If you can give me a text book on
economic, I will apperiate it. It will help me to know more about the course
I choose to study.

Here I nigeria I have met some friends who are of great help to me in terms
of food and clothing for me and my sister. Remember that anything you offer
with have a great change in the life of me and my sister.

Thanks as I await you favorable responses

Sincerely yours,

Sanko dami


Note. Our major promble is food and clothing. Please help.

     inetnum:      193.219.234.0 - 193.219.234.255
     netname:      ORBITILS-NET-NG
     descr:        Orbit Infolink Systems Ltd
     country:      NG
     admin-c:      LNW1-RIPE
     tech-c:       LNW1-RIPE
     status:       ASSIGNED PA
     remarks:      --------------
     remarks:      T-IP-20040427
     remarks:      --------------
     mnt-by:       TAIDE-NOC
     notify:       lawrence@orbitinfolink.com
     notify:       admin@orbitinfolink.com
     changed:      registry@taide.net 20040427
     source:       RIPE
     
     route:        193.219.192.0/18
     descr:        TAIDE-NET
     origin:       AS5377
     mnt-by:       TAIDE-NOC
     changed:      registry@taide.net 20010402
     source:       RIPE
     
     person:       Lawrence Nwezza
     address:      No 3 First Avenue, Independence-Layout
     address:      Enugu, Nigeria.
     phone:        +234 42 458903
     phone:        +234 804 611211
     fax-no:       +234 42 458903
     e-mail:       lawrence@orbitinfolink.com
     e-mail:       admin@orbitinfolink.com
     nic-hdl:      LNW1-RIPE
     changed:      registry@taide.net 20040427
     source:       RIPE

In addition to the donation frauds, the tsunami disaster is also woven into many existing scam storylines. Here are some examples:

Example ("Roger Hankin"):

From: "Roger Hankin" <rogerjh@tsamail.co.za>
Sent: Thursday, 06 January, 2005 11:10
Subject: Urgent Help......

Good day,

Compliments of the Season to you and your Family.

My name is Roger Jame Hankinsa, a merchant from London,in England. I have been diagnosed with Esophageal cancer which was discovered very lately after the incident of the Tsunami disaster which I know you are aware of,I and my lost or as the case may be late family came to Aceh Province of Indonesia to spend the Christmas/New Year holiday but I didnt Know it was going to be the last time of seeing my wife and lovely children.Presently I'm in the hospital undergoing treament apart from the injuries incured in the Disaster I was told by the Doctors that This desease has defied all forms of medication and right now I have only about a few moments to live on earth, according to medical experts.

http://www.msnbc.msn.com/id/6754820
http://www.servicesmind.com/list.php?page=215

Now that God! has called me,I want God to be merciful to me and accept my soul and so, I have decided to give alms to charity organizations, as I want this to be one of the last good deeds I will do on earth but my health has deteriorated so badly, that I can not do this myself.
The last of my money which is the huge
cash deposit of "US$8.3M" that I lodge as precious materials with a Security company.
I need you, as God fearing and trustworthy person to help me give out this to charity as that is the only ideal thing to do because I have seen people cry because they are homeless and helpless even I too is heartbroken because I have lost all that I worked and Lived for.

I will be trusting to hear from you soon, remain blessed and God be with you and your family.

Kind regards,
Roger Jame Hankinsa
rogerjh59@yahoo.co.uk

Here are the message headers for this spam:

Received: from [196.38.110.54] (HELO mail01.infosat.net)
  by mail02.infosat.net (CommuniGate Pro SMTP 4.1.8)
  with ESMTP id 176995579; Thu, 06 Jan 2005 04:10:24 +0200
Received: from [212.199.137.66]
 (account rogerjh@tsamail.co.za)
  by mail01.infosat.net (CommuniGate Pro WebUser 4.1.8)
  with HTTP id 581616676; Thu, 06 Jan 2005 04:10:24 +0200
From: "Roger Hankin" <rogerjh@tsamail.co.za>
Subject: Urgent Help......
X-Mailer: CommuniGate Pro WebUser Interface v.4.1.8
Date: Thu, 06 Jan 2005 04:10:24 +0200
Message-ID: <web-581616676@mail01.infosat.net>
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-MailScanner-SpamCheck: spam, SpamAssassin (score=9.01,
	required 5, BAYES_60 0.37, MISSING_HEADERS 0.12,
	NIGERIAN_SUBJECT2 2.09, RCVD_IN_BL_SPAMCOP_NET 1.22,
	RCVD_IN_SORBS_SPAM 2.00, URIBL_OB_SURBL 3.21)
X-MailScanner-From: rogerjh@tsamail.co.za

Here is the source network for IP 212.199.137.66, Golden Lines, a satellite broadband provider in Israel that is used by many ISPs in Nigeria and other African countries:

     inetnum:      212.199.0.0 - 212.199.255.255
     org:          ORG-GLIC1-RIPE
     netname:      IL-GOLDENLINES-20000726
     descr:        Golden Lines International Communication Services Ltd.
     descr:        PROVIDER Local Registry
     country:      IL
     admin-c:      DR5299-RIPE
     tech-c:       DR5299-RIPE
     status:       ALLOCATED PA
     notify:       lir@linux.goldenlines.net.il
     mnt-by:       RIPE-NCC-HM-MNT
     mnt-lower:    AS9116-MNT
     mnt-routes:   AS9116-MNT
     changed:      hostmaster@ripe.net 20000726
     changed:      hostmaster@ripe.net 20001206
     changed:      hostmaster@ripe.net 20010710
     changed:      lir-help@ripe.net 20011217
     changed:      hostmaster@ripe.net 20040525
     source:       RIPE
     
     route:        212.199.0.0/16
     descr:        Golden Lines
     origin:       AS9116
     mnt-by:       AS9116-MNT
     changed:      lir@linux.goldenlines.net.il 20010807
     source:       RIPE
     
     organisation: ORG-GLIC1-RIPE
     org-name:     Golden Lines International Communication Services Ltd.
     org-type:     LIR
     address:      25 Hasivim St.
                   K. Matalon
     address:      41970
     address:      Petach Tikva
     address:      Israel
     phone:        +97239291122
     fax-no:       +97239274608
     e-mail:       dnsreg@012.net.il
     admin-c:      DR5299-RIPE
     admin-c:      AG914-RIPE
     admin-c:      GE2074-RIPE
     admin-c:      MH21010-RIPE
     admin-c:      IB737-RIPE
     mnt-ref:      AS9116-MNT
     mnt-ref:      RIPE-NCC-HM-MNT
     mnt-by:       RIPE-NCC-HM-MNT
     changed:      hostmaster@ripe.net 20040415
     changed:      bitbucket@ripe.net 20041105
     source:       RIPE
     
     role:         DNS REG
     address:      25 Hsivim st. Petach-Tiikva, Israel
     e-mail:       dnsreg@012.net.il
     trouble:      abuse@012.net.il
     admin-c:      GE2074-RIPE
     tech-c:       IB737-RIPE
     tech-c:       AG914-RIPE
     nic-hdl:      DR5299-RIPE
     notify:       lir@linux.goldenlines.net.il
     changed:      lir@linux.goldenlines.net.il 20030715
     mnt-by:       AS9116-MNT
     source:       RIPE

Example ("Madhi Albalawi"):

From: "madhi" <madhi178@netscape.net>
Sent: Friday, 07 January, 2005 22:12
Subject: Response Needed

From Mr. Madhi Albalawi
Email: madhi178@netscape.net
Good Day.
It is my sincere prayers and wishes that the year has been fulfilling and rewarding for you and your family. Sorry to surprise you and take some of your time in going through this unexpected letter of plea for your understanding and assistance.

This message may come as a surprise as we have not met, but we are desperately in need of help. I got this contact out of desperation and frustration, via a comprehensive search on the Internet.
I am a victim of the last Sunday the 26th of December 2004 Tsunami Strike where I lost my whole family and virtually everything I have labored for, My name is Madhi Albalawi a Saudi national and a merchant in Indonesia, Now I have been diagnosed with prostate, esophageal Cancer and High Blood Pressure that was discovered after the strike and shock from the heavy under water wave that claimed many lives. I have only about a few months to according to medical experts.

I have not particularly lived my life so well, as I never really cared for anyone not even myself but my business. Though I am very rich, I was never generous, I was always hostile to people and only focus on my business as that was the only thing I cared for. But now I regret all this, as I now know that there is more to life than just wanting to have or make all the money in the world.
Presently, I'm in my house here in London where I have been undergoing treatment for esophageal cancer. I have now lost my ability to talk and my doctor have told me that I have only a few months to live. It is my last wish to see that my money distributed to Victims of the Tsunami using the allocated Agencies like the UNICEF, UN. SAVE THE CHILDREN etc.

The last of my money, which is the huge cash deposit that I have with Financial Firm in London .I will want you to help me collect this deposit and dispatched it to charity organizations in charge of the tsunamis victims and let them know that it is I, Madhi Albalawi that is making this generous donation.
I am writing this from my laptop computer in my hospital bed where I wait for my time to come. I pray that God uses you to support and assist me with good heart

I am not afraid of death hence I have seen plenty of them in recent times. I don't need any telephone communication in this regard because of my soundless voice and inability to talk. As soon as I receive your reply I shall give you the contact details of the holding firm in London where the funds are presently been held in safe custody.
I await your response and please send me further mails to Email: madhi178@netscape.net

Trustfully Yours
Madhi Albalawi.




___________________________________________________________________________
http://kija.snurkle.net

Example ("James Brooks"):

Return-Path: <endtime05@teenmail.co.za>
Received: from [66.18.69.6] (helo=mail02.infosat.net)
	by mx.mailix.net with esmtp (Exim 4.24-ND)
	id 1CtH63-0001FE-Ua
	for #######; Mon, 24 Jan 2005 19:10:28 -0800
Received: from [196.38.110.52] (HELO mail01.infosat.net)
  by mail02.infosat.net (CommuniGate Pro SMTP 4.1.8)
  with ESMTP id 188641637; Tue, 25 Jan 2005 04:28:33 +0200
Received: from [80.88.128.12] (account endtime05@teenmail.co.za)
  by mail01.infosat.net (CommuniGate Pro WebUser 4.1.8)
  with HTTP id 604231634; Tue, 25 Jan 2005 04:28:33 +0200
From: "james brooks" <endtime05@teenmail.co.za>
X-Mailer: CommuniGate Pro WebUser Interface v.4.1.8
Date: Tue, 25 Jan 2005 04:28:33 +0200
MIME-Version: 1.0
X-SA-Exim-Connect-IP: 66.18.69.6
X-SA-Exim-Mail-From: endtime05@teenmail.co.za
Subject: CAN WE HELP THE TSUNAMIS VICTIMS? 
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on 
	southcarolina.backend
X-Spam-Status: No, score=9.2 required=10.0 tests=FROM_ENDS_IN_NUMS,
	J_CHICKENPOX_101,J_CHICKENPOX_23,J_CHICKENPOX_33,J_CHICKENPOX_41,
	J_CHICKENPOX_51,J_CHICKENPOX_54,J_CHICKENPOX_63,J_CHICKENPOX_71,
	J_CHICKENPOX_83,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SBL,SUBJ_ALL_CAPS 
	autolearn=no version=3.0.0
X-Spam-Level: *********


All correspondence should be forwarded to 
email: endtime_ministry2005@yahoo.co.in
phone number:+44 2070 600 459 
Calvary Greetings. 
I am a preacher with the End Time Ministry,and I will like
to get advice from you.I believe the advice I need is
secular to some extent,but do have the patience to
understand my intention.

Few months ago I was in Sri-Lanka were I had established a
little congregation where I preached regularly in
collaboration with some other preachers from Sri-Lanka.On
one fateful day, one christian Missionary/ Philantropist
from Thailand came to the church and gave 
the Ministry a donation of US$8M towards the development of
the church.After a few days,I travelled back to London to
continue my ministry.Although,he deposited the US$8M in a
Security Deposit/Bank in Madrid-Spain. 
But, When the TSUNAMI flood incident arose,I was intimated
by a fellow preacher that the Philantropist (MR.BOSCO
WHENG) and his entire family were killed. 
I am interested in using a small fraction of this
money,much less than one percent for a reorganisation of
the work of God,but I do not need the rest and do not want
to have any direct dealing with it.but I need 
someone who will be able to use the fund better maybe for
charity and to support the Tsunami victims,I have thought
of doing it myself, but my ministry is the apocalypse and I
believe and preach the soon coming of the Lord which make
me not to indulge in reliance on money or wealth in 
any form.I will be glad if you have any interest in the
direction of maybe managing or transmitting the fund as you
prefer inyour capacity and understanding. 
Please if you are interested,I would want you to send me
the following 
informations: 
1.Your legitimate name. 
2.Your contact address. 
3.Your phone number. 
4.Your fax number. 
With all these informations,I will take it that you are
interested and I will immediately forward your details to
the Security Deposit/Bank to enable them effect payment to
you.You must promise me that you will use the fund for 
the purpose which it is meant for. 
I will be glad to get a response from you to show your
interest. 
I am presently In the U.k{LONDON} where I am conducting a
deliverance service for cancer patients. 
To further throw more lights on the procedures and
requirements involve In receiving this funds you can call
me on this 
number:+44 2070 600 459 
email: endtime_ministry2005@yahoo.co.in
Regards, 
Pastor James Brooks.

Date: Mon, 21 Feb 2005 21:53:11 +0600
Message-Id: <200502211553.j1LFrBNF012687@w3ext.druknet.bt>
To:
Subject: APPOINTMENT AS A TRUSTEE
From: asiapacificfoundation <asiapacificfoundation@web-mail.com.ar>

ASIA PACIFIC FOUNDATION,UK
# 15 MORGAN MANSION,
MORGAN ROAD LONDON N7. 8NA.
EMAIL: asiapacificfoundation@web-mail.com.ar
TEL/FAX: 44- 870-135-5036
DATE: 21 February, 2005.


ATTN: PRESIDENT/CEO.

RELIEF FUND FOR DISTRIBUTION IN ACEH REGION INDONESIA.

Sir,

The ASIA PACIFIC FOUNDATION, in the United Kingdom has for the past fifteen (15) years been a leading contributor in the development of a peaceful,prosperous and open South East Asia region.

With a network of 17 offices throughout the United Kingdom and Overseas, the ASIA PACIFIC FOUNDATION, supports programmes in the SOUTH EAST ASIA that contribute to poverty alleviation, and other humanitarian purposes.

The ASIA PACIFIC FOUNDATION is funded by contributions from corporations, foundations, individuals, governmental organizations in the U.S. and Asia Countries, and annual appropriation from the U.K. Parliament.

The Foundation has today raised the sum of US55 million Dollars. The fund of US55 million Dollars will be used for charitable and humanitarian work in ACEH REGION INDONESIA FOR THE TSUNIMI FLOOD DISASTER especially in the areas of Hospitals, Ambulances, schools and Foods for refugees rehabilitation etc.

WE SEEK for you to act as the TRUSTEE of this fund (US55 million Dollas ). We believe you are a person of integrity, vision and organizational skill and ability.

As a TRUSTEE of the funds, you will be given the entire funds to manage, disburse and distribute to charitable purposes in ACEH REGION OF INDONESIA.

The TRUSTEE will receive a compensation / commission for his duties. This will be 15% of the total Trust Fund of US55 million Dollars.

Your acceptance of this offer / letter of interest should be directed to the above office fax or e-mail address.

Regards,

DR. RAHMAN ALI.(PHD) (DIRECTOR).

FOR: ASIA PACIFIC FOUNDATION ( UNITED KINGDOM

___________________________________________________________________________
http://www.telecom.net.bt

UNICEF donation spam

On January 18 we received a spam email made to look like it came from UNICEF, but directing people to a website using the domain "cbnserjlwe.com". Most of the message body was a graphics image that acted as a hypertext link to a website. At first we thought this was a decptive-looking scam. However, more investigation showed that it actually a case of a legitimate organisation hiring a spammer to drive traffic to their website. The oddly named domain redirects to "unicefusa.org", a domain registered in 1995.

Click here to view the graphics image of the UNICEF solicitation (make sure to blow up to full size if viewing in Internet Explorer):

• UNICEF donation solicitation
  

Here is the full message with headers:

Return-Path: 
Received: from 4.z-deals.com ([63.214.155.101] helo=consumerselects.biz)
	by ############### with esmtp (Exim 4.43)
	id 1CqzlX-0003nl-Ij
	for ##################; Tue, 18 Jan 2005 21:15:51 +0100
Received: from cbnserjlwe.com (10.0.1.102)
  by pogobuzz.com with QMQP; 18 Jan 2005 12:15:22 -0800
Message-Id: <3ji1eg$s9psvh@pogobuzz.com>
To: ##################
Date: Tue, 18 Jan 2005 10:56:21 -0800
From: "U.S. Fund for UNICEF" <U.S.FundforUNICEF@cbnserjlwe.com>
MIME-Version: 1.0
X-Mailer: 2044962036
Content-type: text/html; charset=us-ascii
X-MailScanner-SpamCheck: spam, SpamAssassin (score=14.559,
	required 5, autolearn=spam, BAYES_95 2.06, DOMAIN_RATIO 3.18,
	HTML_90_100 0.02, HTML_MESSAGE 0.00, HTML_MIME_NO_HTML_TAG 0.14,
	MIME_HTML_ONLY 0.18, RCVD_IN_BL_SPAMCOP_NET 1.22,
	RCVD_IN_NJABL_RELAY 1.40, RCVD_IN_SBL 0.11, RCVD_IN_SORBS_SPAM 2.00,
	URIBL_SBL 4.26)
X-MailScanner-From: u.s.fundforunicef@cbnserjlwe.com
Content-Transfer-Encoding: quoted-printable
X-MIME-Autoconverted: from 8bit to quoted-printable by ################
 id j0IKFsJf001750


<!--      NFORME DE FEDERICO: Informe del dia 16 de enero del 2005 pacien=
te amanece ,en buen estado de animo no presenta otras ccomplicaciones,sol=
o presenta herida en los gluteos lado del ano,asta el momento todavia no =
se recupera bien, se esta teniendo encuenta cada rato que se contamine co=
n las heces mixion ,se esta ventilando cada vez mas,se esta teniendo en p=
revio curacion , le hecho su ba=F1o general,curaciones ,dar su alimentaci=
on por via oral como siempre,toque su guitarra,se le hace sus ejercicios,=
masjes,curaciones,administracion de medicamentos,por via oral,poner de cu=
bito ventral ,dorsal,colocar de posicion lateral derecho y lateral izquie=
rdo,lavar su babero,hacxer sepillado de dientes tocar su guitarra,cantar,=
etc.,solo me ausentado de la 1 de la tarde hasta las 6 de la tarde ,por h=
aber tenido mis horas libres nada mas,solo he ocupado mis horas de descan=
so casi durante doto los dias,porque mi descanso es dos horas en cada dia=
,entonces en un mes solo tengo 4 horas de vacaciones concideradas en los =
domingos,y otros domingos trabajando todo los dias durante las 24 horas,s=
in salida,hoy dia Azucena y Susana se an engargado de cuidar a Se=F1or Di=
onicio de las 1 de la tarde hasta las 6 de la tarde,me parece que mi tiem=
po de salida debe ampliarse mas,teniendo en cuenta en buenas moralidades.=
 se=F1ora Yuri no se si usted tendria la bondad de darme permiso por un m=
es entero,porque tengo la necesidada de sacar su Libreta Militar de Azuce=
na,por estuve verificando su voleta de inscripcion ,su canje ha vensido e=
l dia 31 del 2004,me parece que voya pagar una multa de 300 nuevo soles,p=
or omistia.    INFORME DE FEDERICO: INFORME DEL DIA 15 -01-05 Paciente Di=
onisio Duran paciente que amanece tranquilo ,con buenas energias de comer=
 hablar,preguntar,las 7 de la ma=F1ana converzan,con el se=F1or Lucio Roq=
ue,don Dionsio le reconocio su nombre y le pregumto subre sus hijas, plat=
icaron por una hara luego llega la se=F1ora Sara cuidador futura de Dioni=
sio Duran las 9 de la ma=F1anay se converzando con Susana y luego con Dio=
nicio,misma hora hago su limpieza genital donde la se=F1ora Sara se queda=
 observando mi trabajo y le ense=F1o tambien de como ba=F1arlo y sobre su=
 estado que se encuentra el paciente,se retira la se=F1ora Sara las 11 de=
 la ma=F1ama Durante todo el dia hago mis cosas como siempre , cumpliendo=
 con mis labores diarios ,concreniente al paciente,por ejemplo le hago co=
mer,contar tocar su guitarra,converzar,hacer sus ejercicios,masajes,paral=
o de pie,colocar de posiscion de cubito ventral,dorsal,lateral derecho y =
izquierdo,hacer su ba=F1o genital,hacer su higiene bucal, lavar su babero=
,lavar sus pltos y tasas despues de las comidas como siempre,realizo tamb=
ien exploracion fisica del paciente, curacion de heridas producida por le=
sion en el ba=F1o a ducha combiar su ropa del paciente ,cortar sus u=F1as=
 del pie y del mano. Visitas por Lucio Roque,Pepe Duran,dondellega las 5 =
de la tardey luego se regresa despues de saludar su Pap=E1y compro=B4 una=
 caja de guantes a s/ 11 ,etecetra.  INFORME DE FEDERICO:. Informe del di=
a 14 -01 -05 paciente Dionisio ,paciente q amanece con ganas de converzar=
,comer su herida ya esta recuperado,duerme bien ,come bien sus alimentos,=
se peina solo se limpia la boca solo,solo quiere rascarse pero se le cort=
a las u=F1as y se le coloca los guantes se le hace sus higiene personal,c=
omo siempre ,tambien para curar las heridas,las heridas se le cura todo l=
os dias y para eso se le hace higiene y lavado de herida con jabon para c=
urar,hago mis labores completas como siempre ,ejercicios,masajes,administ=
racion de medicamentos,,hacer comer sus alimentos,,cantar tocar su guitar=
ra,lo coloco al paciente de cubito ventral,para evitar prision gluteal co=
ntrol de funciones vitales PA=3D10/ 50 paciente q conversa todo los dias =
conla Se=F1ora Yuri Duran 2 a tres veces por dia,mediante internet VISITA=
S Cuando son las 10 y 10 de la noche ,llegan Lurdes y su Papa ,su Papa se=
 queda a dormir en al casa ,lurdes se va asu casa las 10 y 20 de la noche=
.  -->  <a href=3D"http://www.cbnserjlwe.com/bb.pl?j=3D9395ZphjJjKQ204496=
2036woZDkydI14432">  <img src=3D"http://cbnserjlwe.com/images/c/c169a.gif=
?i=3D2044962036_9395" border=3D"0"></a>  <br>  <a href=3D"http://www.cbns=
erjlwe.com/bb.pl?u=3D9395ZphjJjKQ2044962036woZDkydI14433">  <img src=3D"h=
ttp://cbnserjlwe.com/images/c/c169b.gif?i=3D2044962036_9395" border=3D"0"=
></a>

Are you sick of spam too? Do you want it stopped now? Try jwSpamSpy, the spamfilter we use to track the spammers! Free 30-day trial version available now!