|
419 Scam – "ROYAL GAMES LOTTERY / BOND TRUST LIMITED / Steve Henman / Martin Gardner"
"BOND TRUST LIMITED" is the fake identity used by a gang of advance fee fraud ("419") scammers operating in South Africa. It's a fraud. (see one example scam email here). This scam appears to be related to the "SOUTHTRUST INVESTMENT PTY. / GOLDEN REEF LOTTERY" as well as the "CASHFLO FINANCIAL SERVICES LTD / IMPERIAL LOTTERY UK" and "WORLD WIDE CASH CHANGE LTD / PRESTIGIUOS LOTTERY UK" scams.
The scammers have registered these domains, which - like the majority of domains registered for 419 fraud - are hosted by Microsoft's MSN service:
Email addresses used for the scam:
The scammers use UK phone numbers to give the victim the impression he/she is dealing with a bona-fide British company, but the +44 70... numbers are premium rate personal numbers that can forward calls to anywhere in the world and which are very costly to call. We assume that the calls will be answered in South Africa or maybe Nigeria.
Sample "winning notification":
To: r.games@mail.com Subject: WINNING NOTIFICATION!!!! From: RoyalGames <r.games@mail.com> X-Priority: 3 (Normal) Cc: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Mailer: RLSP Mailer Message-Id: <20050214000324.04BCE43CA7@dd5106.kasserver.com> Date: Mon, 14 Feb 2005 01:03:24 +0100 THE ROYAL GAMES LOTTERY UK HEAD OFFICE 10 Cabot Square London H146QR,UK. ENGLAND. Dear Sir/Madam, We are pleased to announce you as one of the 3 lucky winners in the ROYAL GAMES LOTTERY draw held on 10th of February. All 3 winning addresses were selected randomly from a batch of 5,000,000 international and local emails. Your email address emerged alongside 2 others as a 3rd category winner in this month's draw. you have therefore been approved for a total pay out of £2,000,000 Pounds ( Two million pounds) only. These details are attached to your lotto payment order: (i) Winning numbers: 09, 10, 25, 33, 42, 45 (ii) Email ticket number: 273-1-3221 (iii) Lotto batch number: RG-916 (iv) File Ref. number: BT-512-8 Please contact the underlisted claims officer as soon as possible for the immediate payout of your winnings: Mr.Steve Henman Claims Department Manager BOND TRUST LIMITED. Email: claimsoffice@bondtrustltd.net Tel:Fax +44 7005804427 Congratulations once again on behalf of all our staff, Sincerely, Martin Gardner Promotions Manager Tel: +44 7040118013 Fax: +44 7005805159 N.B: 1.All claims are nullified after 10 working days from today. 2.Your Ref number must be in all your mails with the claims officer. 3.Inform your claims officer of any change of names or addresses. 4.All winners under the age of 18 are automatically dis-qualified. 5.Please do not reply to this email. Contact your claims agent. ____________________________________________________________ The Royal Games Lottery Awards is proudly sponsored by financialCorp's,the royal group and a conglomeration of other international IT companies. ROYAL GAMES internet draw is held monthly, and is organized to encourage the use of the internet and computers worldwide. We are proud to say that over 200 Million Pounds are won annually in more than 150 countries worldwide. ___________________________________________________________________________ Geschickt über www.Retropoly.de Dem Portal für kultige Computer und Videospiele Sample reply from the "claims agent": Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Tue, 15 Feb 2005 07:53:02 -0800 Message-ID: <BAY21-F187965D7D3BF77F8A9F3B3BD6B0@phx.gbl> Received: from 155.239.67.95 by by21fd.bay21.hotmail.msn.com with HTTP; Tue, 15 Feb 2005 15:52:03 GMT X-Originating-IP: [155.239.67.95] X-Originating-Email: [claimsoffice@bondtrustltd.net] X-Sender: claimsoffice@bondtrustltd.net From: "Claims Department" The email above was sent from South Africa. WHOIS details for sending IP address 155.239.67.95: OrgName: Telkom OrgID: TELKOM Address: Soekor Building Address: 151 Frans Conradie Ave City: Parow StateProv: Western Cape PostalCode: 7500 Country: ZA NetRange: 155.239.0.0 - 155.239.255.255 CIDR: 155.239.0.0/16 NetName: TELKOM NetHandle: NET-155-239-0-0-1 Parent: NET-155-0-0-0-0 NetType: Direct Assignment NameServer: IGUBU.SAIX.NET NameServer: SANGOMA.SAIX.NET Comment: Please contact abuse@saix.net for abuse queries RegDate: 1992-03-25 Updated: 2003-08-27 AbuseHandle: TIA-ARIN AbuseName: Telkom IPNet Abuse AbusePhone: +27 12 6807561 AbuseEmail: abuse@saix.net NOCHandle: TIN2-ARIN NOCName: Telkom IPNet NNOC NOCPhone: +27 12 6800224 NOCEmail: nnoc@saix.net TechHandle: JDU24-ARIN TechName: Du Preez, Johan TechPhone: 012 6800067 TechEmail: johan@saix.net OrgAbuseHandle: TIA-ARIN OrgAbuseName: Telkom IPNet Abuse OrgAbusePhone: +27 12 6807561 OrgAbuseEmail: abuse@saix.net OrgTechHandle: TIN2-ARIN OrgTechName: Telkom IPNet NNOC OrgTechPhone: +27 12 6800224 OrgTechEmail: nnoc@saix.net The claims form is called LWCF.doc, just like in the "SOUTHTRUST LTD" scam. It was last saved by "PC2" and the author is set to "Your User Name". Another version of the scam email using a different domain but otherwise identical details (postal address, winning numbers, etc.): Date: Thu, 17 Feb 2005 10:37:03 +0200 From: royalgames_uk@tiscali.co.uk Reply-To: royalgames_uk@tiscali.co.uk Subject: WINNING NOTIFICATION! To: royalgames_uk@tiscali.co.uk THE ROYAL GAMES LOTTERY UK HEAD OFFICE 10 Cabot Square London H14 6QR,UK. ENGLAND. Dear Winner, We are pleased to announce you as one of the 3 lucky winners in the ROYAL GAMES LOTTERY draw held on 7th of February. All 3 winning addresses were randomly selected from a batch of 5,000,000 international emails. Your email address emerged alongside 2 others as a 3rd category winner in this month's draw. Consequently,you have therefore been approved for a total pay out of �2,000,000 Pounds ( Two million pounds) only. The following particulars are attached to your lotto payment order: (i) Winning numbers: 09, 10, 25, 33, 42, 45 (ii) Email ticket number: 273-1-3221 (iii) Lotto batch number: RG-916 (iv) File Ref. number: BT-512-11 Please contact the underlisted claims officer as soon as possible for the immediate release of your winnings: Mr.Steve Henman Claims Department Manager BOND TRUST LIMITED. Email: deptmanager@bondtrusltd.com Tel/Fax: +44 7005804427 Once again on behalf of all our staff,CONGRATULATIONS!!! Sincerely, Martin Gardner Promotions Manager Tel: +44 7040118013 Fax: +44 7005805159 N.B: 1.All claims are nullified after 10 working days from today. 2.Your Ref number must be in all your mails with the claims officer. 3.Do inform the claims officer of any change of names or addresses. 4.All winners under the age of 18 are automatically dis-qualified. 5.Please do not reply to this email. Contact your claims agent. ___________________________________________________________ The Royal Games Lottery Awards is proudly sponsored by financial Corp's,the royal group and a conglomerationof other international IT companies. ROYAL GAMES internet draw is held monthly, and is organized to encourage the use of the internet and computers worldwide. We are proud to say that over 200 Million Pounds are won annually in more than 150 countries worldwide. ___________________________________________________________ Book yourself something to look forward to in 2005. Cheap flights - http://www.tiscali.co.uk/travel/flights/ Bargain holidays - http://www.tiscali.co.uk/travel/holidays/
Date: Wed, 23 Feb 2005 07:09:02 +0800 From: Royalgames_Coordinator
"bondtrustltd.net" (complaints to: abuse@msn.com)
WHOIS record for 419-scam domain "bondtrustltd.net" Request: bondtrustltd.net from whois.crsnic.net:43 [cached Wed Feb 16 01:41:25 2005 UTC] from whois.melbourneit.com:43 [cached Wed Feb 16 01:41:26 2005 UTC] Domain Name.......... bondtrustltd.net Creation Date........ 2005-02-03 Registration Date.... 2005-02-03 Expiry Date.......... 2006-02-03 Organisation Name.... Benjamin Berkowitz Organisation Address. 1400 Laurel Avenue Organisation Address. Organisation Address. Minneapolis Organisation Address. 55403 Organisation Address. MN Organisation Address. UNITED STATES Admin Name........... Benjamin Berkowitz Admin Address........ 1400 Laurel Avenue Admin Address........ Admin Address........ Minneapolis Admin Address........ 55403 Admin Address........ MN Admin Address........ UNITED STATES Admin Email.......... claimsmanager@bondtrustltd.net Admin Phone.......... +1.6123331210 Admin Fax............ Tech Name............ MSN NOC Tech Address......... One Microsoft Way Tech Address......... Tech Address......... Redmond Tech Address......... 98052 Tech Address......... WA Tech Address......... UNITED STATES Tech Email........... MSN-PA-TECH@msn.com Tech Phone........... +1.4258828080 Tech Fax............. Name Server.......... pdomns1.msn.com Name Server.......... pdomns2.msn.com
"bondtrustlimited.com" (complaints to: abuse@msn.com)
WHOIS record for 419-scam domain "bondtrustlimited.com" Request: bondtrustlimited.com connected to whois.crsnic.net [198.41.3.54:43] ... connected to whois.enom.com [66.151.151.170:43] ... Registration Service Provided By: Microsoft Contact: pdenomcs@microsoft.com Visit: http://support.msn.com/contactus.aspx?pk=PersonalAddress Domain name: bondtrustlimited.com Registrant Contact: Benjamin Berkowitz Benjamin Berkowitz (deptmanager@bondtrustlimited.com) +1.8186234544 Fax: none 116 vassar avenue canoga park, CA 91304 US Administrative Contact: Benjamin Berkowitz Benjamin Berkowitz (deptmanager@bondtrustlimited.com) +1.8186234544 Fax: none 116 vassar avenue canoga park, CA 91304 US Technical Contact: NOC MSN NOC MSN (MSN-PA-TECH@msn.com) +1.4258828080 Fax: none One Microsoft Way Redmond, WA 98052 US Billing Contact: NOC MSN NOC MSN (MSN-PA-BILL@MSN.COM) +1.4258828080 Fax: none One Microsoft Way Redmond, WA 98052 US Status: Locked Name Servers: pdomns1.msn.com pdomns2.msn.com Creation date: 02 Feb 2005 16:13:30 Expiration date: 02 Feb 2006 16:13:30
WHOIS record for 419-scam domain "bondtrusltd.com" Request: bondtrusltd.com connected to whois.melbourneit.com [203.27.227.114:43] ... Domain Name.......... bondtrusltd.com Creation Date........ 2005-02-08 Registration Date.... 2005-02-08 Expiry Date.......... 2006-02-08 Organisation Name.... George Duncan Organisation Address. 122, griven avenue, Organisation Address. Organisation Address. excel Organisation Address. 36439 Organisation Address. AL Organisation Address. UNITED STATES Admin Name........... George Duncan Admin Address........ 122, griven avenue, Admin Address........ Admin Address........ excel Admin Address........ 36439 Admin Address........ AL Admin Address........ UNITED STATES Admin Email.......... Stevehenman@bondtrusltd.com Admin Phone.......... +1.2023417989 Admin Fax............ Tech Name............ MSN NOC Tech Address......... One Microsoft Way Tech Address......... Tech Address......... Redmond Tech Address......... 98052 Tech Address......... WA Tech Address......... UNITED STATES Tech Email........... MSN-PA-TECH@msn.com Tech Phone........... +1.4258828080 Tech Fax............. Name Server.......... pdomns1.msn.com Name Server.......... pdomns2.msn.com
WHOIS record for 419-scam domain "bond-trust.com" Request: bond-trust.com connected to whois.enom.com [66.151.151.170:43] ... Registration Service Provided By: Microsoft Contact: personal_address@css.one.microsoft.com Visit: http://support.msn.com/contactus.aspx?pk=PersonalAddress Domain name: bond-trust.com Registrant Contact: williams Jones williams Jones (manager@bond-trust.com) +1.7186123124 Fax: none 6567 baisely blvd jamaica, NY 11434 US Administrative Contact: williams Jones williams Jones (manager@bond-trust.com) +1.7186123124 Fax: none 6567 baisely blvd jamaica, NY 11434 US Technical Contact: NOC MSN NOC MSN (MSN-PA-TECH@msn.com) +1.4258828080 Fax: none One Microsoft Way Redmond, WA 98052 US Billing Contact: NOC MSN NOC MSN (MSN-PA-BILL@MSN.COM) +1.4258828080 Fax: none One Microsoft Way Redmond, WA 98052 US Status: Locked Name Servers: pdomns1.msn.com pdomns2.msn.com Creation date: 21 Feb 2005 14:42:22 Expiration date: 21 Feb 2006 14:42:22 ATTN: Firstname Lastname Dear Winner, Acting on the instructions in your claims file with the below Lotto payment order: Winning numbers: 02, 12, 19, 23, 40, 49 Email ticket number: 273-1-3221 Lotto batch number: RG-916 File Ref. number: BT-512-09 I wish to inform you that payment of your Lottery Claims amounting to �2,000,000.00 being prize money from Royal Games lottery 3rd Category draws has been certified by all authorities involved. You are required to fill a "Lottery Winnings Claim Form" with all necessary details. Follow the link below to download the form as .doc or .PDF documents. http://www.bondonline-site.com/lottery_page_2.htm After download, print, fill, and send to us either by fax or as an email attachment. You will also be required to pay a fee of �4,550.00 (Four thousand five hundred and fifty Great Britain Pounds), or its equivalent in your local currency. This payment is to cover transfer charges, administrative cost, opening of account charges, Insurance of vital documents like prize claim certificate and other transfer documents, that will be sent to you via Courier service immediately transfer of your winnings is effected. Note that your total prize claim of �2,000,000.00 has been insured to it's real value and it's against the Gaming control rules here in Britain to deduct the above fees from the prize money for any reason whatsoever. You are required to respond and act without delay to all instructions provided above to ensure a glitch free claims process that will facilitate the transfer of your prize money. Note that your winnings will be transferred to your stipulated Bank account within 24hours after receipt of all requirements. I shall send you remittance instruction for the required fee, once I recieve your filled lottery winning claims form. Congratulations once more, and thanks for your cooperation. Truly yours, Mr.Steve Henman Claims Department Manager BOND TRUST LIMITED. Email: lotteryclaims@bond-trust.net Tel: +44 7040118829 Fax: +44 7005804427 NB: We also encourage you to visit ROYAL GAMES LOTTERY website at www.rgs-page.org and take your chance to play and become part of thier monthly winners. Millions are won on a monthly basis on one of the world's most famous free lotto service.
Firstname Lastname <emailaddress>Received: from 64.213.70.208 by by15fd.bay15.hotmail.msn.com with HTTP; Fri, 01 Apr 2005 13:22:48 GMT X-Originating-IP: [64.213.70.208] X-Originating-Email: [lotteryclaims@bond-trust.net] X-Sender: lotteryclaims@bond-trust.net
WHOIS details for sending network (IP 64.213.70.208): OrgName: Global Crossing OrgID: GBLX Address: 14605 South 50th Street City: Phoenix StateProv: AZ PostalCode: 85044-6471 Country: US ReferralServer: rwhois://rwhois.gblx.net:4321 NetRange: 64.212.0.0 - 64.215.255.255 CIDR: 64.212.0.0/14 NetName: GBLX-11D NetHandle: NET-64-212-0-0-1 Parent: NET-64-0-0-0-0 NetType: Direct Allocation NameServer: NAME.ROC.GBLX.NET NameServer: NAME.PHX.GBLX.NET NameServer: NAME.SNV.GBLX.NET NameServer: NAME.JFK1.GBLX.NET Comment: rwhois.gblx.net:4321 - THESE ADDRESSES ARE Comment: NON-PORTABLE RegDate: Updated: 2003-10-31 TechHandle: IA12-ORG-ARIN TechName: GBLX-IPADMIN TechPhone: 800-404-7714 TechEmail: ipadmin@gblx.net OrgAbuseHandle: GBLXA-ARIN OrgAbuseName: GBLX-Abuse OrgAbusePhone: 800-404-7714 OrgAbuseEmail: abuse@gblx.net OrgNOCHandle: GBLXN-ARIN OrgNOCName: GBLX-NOC OrgNOCPhone: 800-404-7714 OrgNOCEmail: gc-noc@gblx.net OrgTechHandle: IA12-ORG-ARIN OrgTechName: GBLX-IPADMIN OrgTechPhone: 800-404-7714 OrgTechEmail: ipadmin@gblx.net
WHOIS details for 419 fraud domain "bondonline-site.com": Request: bondonline-site.com from whois.crsnic.net:43 [cached Sat Apr 2 14:24:54 2005 UTC] from whois.schlund.info:43 [cached Sat Apr 2 14:24:55 2005 UTC] % The data in the WHOIS database of Schlund+Partner AG is provided by % Schlund+Partner for information purposes, and to assist persons in % obtaining information about or related to a domain name registration % record. Schlund+Partner does not guarantee its accuracy. By submitting % a WHOIS query, you agree that you will use this data only for lawful % purposes and that, under no circumstances, you will use this data to % (1) allow, enable, or otherwise support the transmission of mass % unsolicited, commercial advertising or solicitations via E-mail % (spam); or % (2) enable high volume, automated, electronic processes that apply to % Schlund+Partner or its systems. % Schlund+Partner reserves the right to modify these terms at any time. % By submitting this query, you agree to abide by this policy. domain: bondonline-site.com created: 22-Feb-2005 last-changed: 22-Feb-2005 registration-expiration: 22-Feb-2006 nserver: ns29.1and1.com 217.160.224.2 nserver: ns30.1and1.com 217.160.228.2 status: CLIENT-TRANSFER-PROHIBITED registrant-firstname: Derby registrant-lastname: Hackney registrant-street1: 1188 baisley blvd registrant-pcode: 11434 registrant-state: NY registrant-city: Jamaica registrant-ccode: US registrant-phone: +1.7185167810 registrant-email: businessbond@yahoo.com admin-c-firstname: Derby admin-c-lastname: Hackney admin-c-street1: 1188 baisley blvd admin-c-pcode: 11434 admin-c-state: NY admin-c-city: Jamaica admin-c-ccode: US admin-c-phone: +1.7185167810 admin-c-email: businessbond@yahoo.com tech-c-firstname: Hostmaster tech-c-lastname: ONEANDONE tech-c-organization: 1&1 Internet Inc. tech-c-street1: 701 Lee Rd. tech-c-street2: Suite 300 tech-c-pcode: 19087 tech-c-state: PA tech-c-city: Chesterbrook tech-c-ccode: US tech-c-phone: +1.8774612631 tech-c-fax: +1.6105601501 tech-c-email: hostmaster@1and1.com bill-c-firstname: Hostmaster bill-c-lastname: ONEANDONE bill-c-organization: 1&1 Internet Inc. bill-c-street1: 701 Lee Rd. bill-c-street2: Suite 300 bill-c-pcode: 19087 bill-c-state: PA bill-c-city: Chesterbrook bill-c-ccode: US bill-c-phone: +1.8774612631 bill-c-fax: +1.6105601501 bill-c-email: hostmaster@1and1.com
WHOIS details for 419 fraud domain "bond-trust.net": Request: bond-trust.net from whois.crsnic.net:43 [cached Sat Apr 2 14:21:45 2005 UTC] from whois.melbourneit.com:43 [cached Sat Apr 2 14:21:46 2005 UTC] Domain Name.......... bond-trust.net Creation Date........ 2005-03-30 Registration Date.... 2005-03-30 Expiry Date.......... 2006-03-30 Organisation Name.... James Conolly Organisation Address. 20 Paradise lane Organisation Address. Organisation Address. Houston Organisation Address. 77535 Organisation Address. TX Organisation Address. UNITED STATES Admin Name........... James Conolly Admin Address........ 20 Paradise lane Admin Address........ Admin Address........ Houston Admin Address........ 77535 Admin Address........ TX Admin Address........ UNITED STATES Admin Email.......... lottoclaims@bond-trust.net Admin Phone.......... +1.3162210233 Admin Fax............ Tech Name............ MSN NOC Tech Address......... One Microsoft Way Tech Address......... Tech Address......... Redmond Tech Address......... 98052 Tech Address......... WA Tech Address......... UNITED STATES Tech Email........... MSN-PA-TECH@msn.com Tech Phone........... +1.4258828080 Tech Fax............. Name Server.......... pdomns1.msn.com Name Server.......... pdomns2.msn.com
|