|
419 Scam Example: "CASTLE INTERNATIONAL LOTTERY / BRIAN HUNT / LILIAN BANK"
"CASTLE INTERNATIONAL LOTTERY / BRIAN HUNT / LILIAN BANK" are labels used by a gang in Nigeria for a fake lottery fraud (advance fee fraud, "419"). It is related to the "alphaexworld.com" scam which used the same IP address.
Example of "CASTLE INTERNATIONAL LOTTERY / BRIAN HUNT / LILIAN BANK" scam email: INTERNATIONAL-LOTTERY.CO.UK Other contact addresses: MRS: LILIAN BANK Email: lilianbanks@castle-fiduciary-agent.com Mr Alley Mcdonald alleymcdonald@castleinternationals.com MRS. JIMMY ROY Email: jimmyroy@castleinternational.org Reponse from the claims agent:
Here are mail headers from a "Castle International" response: Return-Path:
WHOIS details of sending network (IP 192.116.119.135): inetnum: 192.116.119.0 - 192.116.119.255
netname: GILAT-SATCOM-BLOCK-3
descr: Gilat-Satcom
remarks: For abuse issues related to Gilat, email abuse-gilat@012.net.il
notify: abuse-gilat@012.net.il
country: GB
admin-c: GS3350-RIPE
tech-c: GS3350-RIPE
status: ASSIGNED PA
mnt-by: AS9116-MNT
mnt-lower: AS9116-MNT
changed: lir@linux.goldenlines.net.il 20050102
source: RIPE
route: 192.116.64.0/18
descr: Goldenlines
remarks: For addressing issues, email lir@linux.goldenlines.net.il
remarks: For abuse issues, email abuse@012.net.il
origin: AS9116
mnt-by: AS9116-MNT
changed: lir@linux.goldenlines.net.il 20041121
source: RIPE
role: Gilat Support
address: Gilat Satcom
address: 21D Yagia Kapaim st. Petach-Tikva, Israel
phone: +972 3 9255000
fax-no: +972 3 9217938
admin-c: DR5299-RIPE
admin-c: GE2074-RIPE
tech-c: DR5299-RIPE
tech-c: GE2074-RIPE
trouble: abuse-gilat@012.net.il
e-mail: customer@gilat.net
nic-hdl: GS3350-RIPE
mnt-by: AS9116-MNT
changed: hank@att.net.il 20040909
source: RIPE
Here is a money demand from the fake company:
Message headers: Received: from M2W031.mail2web.com ([168.144.251.135]) by relay3.mail2web.com with Microsoft SMTPSVC(5.0.2195.6713); Fri, 25 Feb 2005 02:47:27 -0500 X-Priority: 3 Reply-To: courier2@castle-international.co.uk X-Originating-IP: 80.179.242.244
WHOIS details for sending network (IP 80.179.242.244): inetnum: 80.179.242.224 - 80.179.242.255
netname: Gilat-ART2036
descr: Please Send Abuse/SPAM complaints To Abuse-gilat@012.net.il
country: GB
admin-c: DR5299-RIPE
tech-c: DR5299-RIPE
status: ASSIGNED PA
notify: lir@linux.goldenlines.net.il
changed: lir@linux.goldenlines.net.il 20040617
mnt-by: AS9116-MNT
mnt-lower: AS9116-MNT
source: RIPE
route: 80.179.128.0/17
descr: Golden Lines
origin: AS9116
mnt-by: AS9116-MNT
changed: lir@linux.goldenlines.net.il 20020711
source: RIPE
role: DNS REG
address: 25 Hsivim st. Petach-Tiikva, Israel
e-mail: dnsreg@012.net.il
trouble: abuse@012.net.il
admin-c: GE2074-RIPE
tech-c: IB737-RIPE
tech-c: AG914-RIPE
nic-hdl: DR5299-RIPE
notify: lir@linux.goldenlines.net.il
changed: lir@linux.goldenlines.net.il 20030715
mnt-by: AS9116-MNT
source: RIPE
WHOIS details for domain "castleinternationals.com": Request: castleinternationals.com connected to whois.melbourneit.com [203.27.227.114:43] ... Domain Name.......... castleinternationals.com Creation Date........ 2005-02-12 Registration Date.... 2005-02-12 Expiry Date.......... 2006-02-12 Organisation Name.... Castle International Lottery Organisation Address. 67 mable ct buffalo Organisation Address. Organisation Address. NY Organisation Address. 14203 Organisation Address. NY Organisation Address. UNITED STATES Admin Name........... Castle International Lottery Admin Address........ 67 mable ct buffalo Admin Address........ Admin Address........ NY Admin Address........ 14203 Admin Address........ NY Admin Address........ UNITED STATES Admin Email.......... info@castleinternationals.com Admin Phone.......... +1.7223457484 Admin Fax............ Tech Name............ MSN NOC Tech Address......... One Microsoft Way Tech Address......... Tech Address......... Redmond Tech Address......... 98052 Tech Address......... WA Tech Address......... UNITED STATES Tech Email........... MSN-PA-TECH@msn.com Tech Phone........... +1.4258828080 Tech Fax............. Name Server.......... pdomns1.msn.com Name Server.......... pdomns2.msn.com
UK NATIONAL LOTTERY (Jennifer Carlton(MRS)., Mr. Mike Saunders)
Message headers: Received: from 80.179.242.249 by by15fd.bay15.hotmail.msn.com with HTTP; Thu, 24 Mar 2005 02:55:03 GMT X-Originating-IP: [80.179.242.249] X-Originating-Email: [notification@merseyukgames.com] X-Sender: notification@merseyukgames.com From: "Jennifer Carlton" <notification@merseyukgames.com> Subject: Winning Notification Mail Reponse from the claims agent:
Message headers: Received: from 192.116.153.132 by by1fd.bay1.hotmail.msn.com with HTTP; Thu, 24 Mar 2005 22:49:13 GMT X-Originating-IP: [192.116.153.132] X-Originating-Email: [notification@merseyworldgames.com] X-Sender: notification@merseyworldgames.com In-Reply-To: messageid From: "Jennifer Carlton" <notification@merseyworldgames.com> To: emailaddress Subject: Form Of Verification The following was sent after the victim provided personal details: A N C Parcels Unit D/apollo Business Centre, 158 Trundleys Road,London,SE8 5JE United Kingdom. You are welcome to ANC Parcels Dispatch LTD an affiliate of the UK National Lottery .We are pleased to be at your service. Dear Firstname Lastname We are Sending you all necessary document backing your winings but you will have to satisfy all our requirements. Your winning certficate and all other documents to sign will be sent to you as soon as you complete all necessary requirements. This means that you have been officially cleared for payment by the Verifications Department at the headquarters of the UK National Lottery. The original copy of your winning certificate, together with a covering document (Money Laundering protection and Letter of Affidavit for Claims) from the British government stating that the money was obtained legally through their National Lotto will be sent to you as soon as you meet with any of the option selected. You can now begin the final step of the claims process, which is the transferring of your cash prize to you. With regards to this, there are three options open to you, you are required to select the most convenient of the three. Option 1.: You can come over to the uk national lottery office in liverpool to claim your winnings if thats okay by you.You will be informed on how to reach us and all the necessary details you need.Or choose from any of our transfer options which is stated below . The uk lottery office address is : UK NATIONAL LOTTERY OFFICE(payment office) 27 CYPRESS CLOSE NE4 8UJ Liverpool, L70 1NL ENGLAND,UNITED KINGDOM OPTION 2.: (You are to make your prefered and affordable choice in OPTION 2) The options, together with their associated conditions are presented below: Courier of your winning draft original winning certificate and your documents to sign to you.you are to sign these documents immediately and return them back to us via any of this channel listed below: FEDEX Mailing £225.00 Insurance £75.00 Vat (5%) £20.75 TOTAL £320 .75 UPS Mailing &n bsp; £289.00 Insurance £30.00 Vat (5%) £18.95 TOTAL £337.95 POST OFFICE MAIL Mailing ; £240.00 Insurance £80.00 Vat (5%) £39.00 TOTAL £329.00 The insurance company declined reverse payment for the courier, stating that it is against their professional policy towards ensuring the safe delivery of the draft to you. That if a reverse payment is made, an d something goes wrong, that we/you cannot sue the courier company or insurance company to recover the full value of t he fund as stipulated in the draft since payment for insurance cover was not made at point of mailing. With the above reason, reverse payment is ruled out. Forward the cost of mailing your draft with any of the courier channel cost you choose above to us. Option 3.: £67,728 (Sixty seven thousand, seven hundred and tweenty eight pounds sterling) will be wired to your bank account via swift bank transfer. Condition: The cost of COT (commission of transfer) being charged by our transferring bank, which is 1.5% (i.e 1015.92) of the cash being transferred will be paid by you. Note that your prize is protected by a hardcover insurance policy, which makes it impossible to deduct any amount from the money before it has been remitted to you. This means that the above charges cannot be deducted from the prize and hence must be provided by you before your prize is transferred to you. Please respond to this email by making a selection from the two options above. Also attach a scanned copy of either your driver's licence, international passport (photo page) or any other legally identifying document. Also be reminded that the deadline for the claiming of winnings is exactly One week after the receipt of this email. After this period, your cash prize will be deemed to have been forfeited by you and will be reused in the drawings of the next edition of the lottery. Good luck and Congratulations once again. Please send your response to this same email address or that of the fiduciary agent ( notification@merseyworldgames.com) Mr. Mike Saunders The UK National Lottery Copyright © 1994-2005 ANC Parcels C/o The UK National Lottery Inc. All rights reserved. Terms of Service - Guidelines
Received: from 192.116.153.132 by by15fd.bay15.hotmail.msn.com with HTTP; Fri, 25 Mar 2005 17:18:05 GMT X-Originating-IP: [192.116.153.132] X-Originating-Email: [courier@ancparcels.com] X-Sender: courier@ancparcels.com From: "Mike Saunders" <courier@ancparcels.com> To: emailaddress Subject: Final Process for Transfer of Winnings
WHOIS details for sending network (IP 192.116.153.132):
inetnum: 192.116.153.0 - 192.116.157.255
netname: GILAT-SATCOM-BLOCK-47-48-49-50-51
descr: Gilat-Satcom
remarks: For abuse issues related to Gilat, email abuse-gilat@012.net.il
notify: abuse-gilat@012.net.il
country: GB
admin-c: GS3350-RIPE
tech-c: GS3350-RIPE
status: ASSIGNED PA
mnt-by: AS9116-MNT
mnt-lower: AS9116-MNT
changed: lir@linux.goldenlines.net.il 20050102
source: RIPE
route: 192.116.128.0/18
descr: Goldenlines
remarks: For addressing issues, email lir@linux.goldenlines.net.il
remarks: For abuse issues, email abuse@012.net.il
origin: AS9116
mnt-by: AS9116-MNT
changed: lir@linux.goldenlines.net.il 20041121
source: RIPE
role: Gilat Support
address: Gilat Satcom
address: 21D Yagia Kapaim st. Petach-Tikva, Israel
phone: +972 3 9255000
fax-no: +972 3 9217938
admin-c: DR5299-RIPE
admin-c: GE2074-RIPE
tech-c: DR5299-RIPE
tech-c: GE2074-RIPE
trouble: abuse-gilat@012.net.il
e-mail: customer@gilat.net
nic-hdl: GS3350-RIPE
mnt-by: AS9116-MNT
changed: hank@att.net.il 20040909
source: RIPE
WHOIS details for domain "merseyworldgames.com": Request: merseyworldgames.com connected to whois.crsnic.net [198.41.3.54:43] ... connected to whois.melbourneit.com [203.27.227.114:43] ... Domain Name.......... merseyworldgames.com Creation Date........ 2005-03-16 Registration Date.... 2005-03-16 Expiry Date.......... 2006-03-16 Organisation Name.... Jennifer Carlton Organisation Address. 250 hickory lane Organisation Address. Organisation Address. grants Organisation Address. 87020 Organisation Address. NM Organisation Address. UNITED STATES Admin Name........... Jennifer Carlton Admin Address........ 250 hickory lane Admin Address........ Admin Address........ grants Admin Address........ 87020 Admin Address........ NM Admin Address........ UNITED STATES Admin Email.......... notification@merseyworldgames.com Admin Phone.......... +1.6064278192418 Admin Fax............ Tech Name............ MSN NOC Tech Address......... One Microsoft Way Tech Address......... Tech Address......... Redmond Tech Address......... 98052 Tech Address......... WA Tech Address......... UNITED STATES Tech Email........... MSN-PA-TECH@msn.com Tech Phone........... +1.4258828080 Tech Fax............. Name Server.......... pdomns1.msn.com Name Server.......... pdomns2.msn.com
WHOIS details for domain "ancparcels.com": Request: ancparcels.com connected to whois.enom.com [66.151.151.170:43] ... Registration Service Provided By: Microsoft Contact: personal_address@css.one.microsoft.com Visit: http://support.msn.com/contactus.aspx?pk=PersonalAddress Domain name: ancparcels.com Registrant Contact: Mike Saunders Mike Saunders (courier@ancparcels.com) +1.6064278192418 Fax: none 2210,canago avn. grants, NM 87020 US Administrative Contact: Mike Saunders Mike Saunders (courier@ancparcels.com) +1.6064278192418 Fax: none 2210,canago avn. grants, NM 87020 US Technical Contact: NOC MSN NOC MSN (MSN-PA-TECH@msn.com) +1.4258828080 Fax: none One Microsoft Way Redmond, WA 98052 US Billing Contact: NOC MSN NOC MSN (MSN-PA-BILL@MSN.COM) +1.4258828080 Fax: none One Microsoft Way Redmond, WA 98052 US Status: Locked Name Servers: pdomns1.msn.com pdomns2.msn.com Creation date: 15 Mar 2005 21:16:59 Expiration date: 15 Mar 2006 21:16:59
|