419 Fraud: "Dgcourier Worldwide Express"
"Dgcourier Worldwide Express" is a fake courier company used in lottery scams delivering a prize from the "California Lottery".
See the following links for examples and related scams:
Here is the first response from the "claims officer" the victim was told to contact in the initial "winning notification" spam email (see also: Thomas Walter (Speedfast) for another version of this scam).
ATTENTION:REF: NHL/19-AO19742005 I am Mr Edward Pinto the fiduciary agent assigned to your case. I wish to Congratulate you on your victory,you are a lucky person to have won this lottery. Your email address is amongst those chosen this quarter from our new java-based software that randomly selects email addresses from the web from which winners are selected. You are required to forward the following details to help facilitate the processing of your claims and certificate which will facilitate the release of your winnings. 1. Full names. 2. Residential address. 3. Phone number. 4. Fax number. 5. Occupation. 6. Sex. 7. Age. 8. Nationality. You are adviced to forward these informations as soon as possible to enable us attend to your file.Please note that your funds have been deposited safely in a security firm in Europe,and your information will be forwarded to them before they can release your winnings. After you have sent down these information, a certificate will be prepared for you. This is to be your proof of winning from this office to the payment center before they release your funds.You are adviced to keep your winning numbers secret to avoid unscripulous elements from taking advantage of the situation.Once again, congratulations. Regards, Mr Edward Pinto
Return-Path: <firstname.lastname@example.org> Received: from 18.104.22.168 (EHLO monster.coolgoose.com) (22.214.171.124) by mta160.mail.dcn.yahoo.com with SMTP; Sun, 16 Jan 2005 13:01:23 -0800 Received: from as03.coolgoose.com (as03.coolgoose.com [126.96.36.199]) by monster.coolgoose.com (8.12.10/8.12.7) with SMTP id j0GL1MOt027703 for emailaddress; Sun, 16 Jan 2005 16:01:22 -0500 Received: from [188.8.131.52] by as03.coolgoose.com via HTTP; Sun, 16 Jan 2005 22:01:20 +0100 From: "Edward Pinto" <email@example.com> To: emailaddress Subject: CLAIMING PROCEDURE FROM EDWARD PINTO CLAIMOFFICER Date: Sun, 16 Jan 2005 22:01:20 +0100 X-Originating-IP: [184.108.40.206]
inetnum: 220.127.116.11 - 18.104.22.168 org: ORG-BL4-RIPE netname: NG-BROADBANDTECH-20000327 descr: BT Limited descr: PROVIDER Local Registry country: NG admin-c: IO243-RIPE tech-c: IO243-RIPE status: ALLOCATED PA notify: firstname.lastname@example.org mnt-by: RIPE-NCC-HM-MNT mnt-routes: BT-LIMITED-MNT mnt-lower: BT-LIMITED-MNT changed: email@example.com 20000327 changed: firstname.lastname@example.org 20001003 changed: email@example.com 20010507 changed: firstname.lastname@example.org 20010704 changed: email@example.com 20011214 changed: firstname.lastname@example.org 20020419 changed: email@example.com 20020423 changed: firstname.lastname@example.org 20020613 changed: email@example.com 20030211 changed: firstname.lastname@example.org 20040406 source: RIPE organisation: ORG-BL4-RIPE org-name: BT Limited org-type: LIR address: BT Limited address: 8B Ademola Street, address: Off Awolowo Road, address: S. W. Ikoyi, address: Lagos, Nigeria. phone: +234 1 2693192 fax-no: +234 1 2693192 e-mail: email@example.com admin-c: IO243-RIPE admin-c: IO243-RIPE mnt-ref: BT-LIMITED-MNT mnt-ref: RIPE-NCC-HM-MNT mnt-by: RIPE-NCC-HM-MNT changed: firstname.lastname@example.org 20040415 source: RIPE person: Israel Oyeleke address: BT Limited address: 8B Ademola Street address: Ikoyi S.W. address: Lagos, Nigeria phone: +234 1 2673532 fax-no: +234 1 2673203 e-mail: email@example.com nic-hdl: IO243-RIPE notify: firstname.lastname@example.org changed: email@example.com 20010605 changed: firstname.lastname@example.org 20030917 source: RIPE
The next step is an email directing a victim to contact the fake courier company to deliver the prize check. The postal address is the same as for "Speedfast Worldwide" in another version of the scam.
Hello Firstname Lastname,
Next the "courier company" contacts the victim and asks him/her to wire cash by Western Union to London to be picked up by a member of the gang using a ficticious name:
Return-Path: <email@example.com> Received: from 22.214.171.124 (HELO web26403.mail.ukl.yahoo.com) (126.96.36.199) by mta217.mail.dcn.yahoo.com with SMTP; Mon, 24 Jan 2005 16:09:48 -0800 Received: (qmail 24556 invoked by uid 60001); 25 Jan 2005 00:09:47 -0000 Received: from [188.8.131.52] by web26403.mail.ukl.yahoo.com via HTTP; Tue, 25 Jan 2005 00:09:47 GMT Date: Tue, 25 Jan 2005 00:09:47 +0000 (GMT) From: martins reid <firstname.lastname@example.org> Subject: Courier Order Number 465657 To: Firstname Lastname <emailaddress In-Reply-To: <#################################> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Content-Length: 1181 Dear Firstname Lastname, We are a well established company offering courier and transport services 24 hour a day for priority delivery of letters, parcels and consignments to any destination by road, air or sea. We have a substantial team of couriers available for motorcycle despatch plus van driver couriers in all size vehicles from small vans up to 7.5 tonne and international couriers for despatch by road, sea or air. Having been established for 23 years we have the experience and expertise to provide services second to none. We have received the sent informations and confirmed it to be true. Description Of Parcel to be couriered. An original certificate of weight....................0.35kg Bank Cheque ..............................0.17kg Total weight of parcel ................................0.52kg Colour of parcel ......................................Brown Lenght of Days ........................................Nextday Destination of delivery: NAME :Firstname Lastname, ADDRESS : Streetaddress State, City, Country Please find below our charges: Courier charges .............................US$ 120.00 Administrative ............................. US$ 85.00 Taxes ..................................... US$ 80.00 Insurance .................................. US$ 65.00 TOTAL ......................................US$350.00 You are to make this payment to our account officer through your local western union center with details below as it is the fastest means of receiving your funds. Mr SIMAO DE JONGE 20 RAMSFORT HOUSE MANOR ESTATE LONDON SE16 3NZ After payment you are to fax the receipt of your payment to our office fax number so that we can collect your funds on your behalf and effect the courier of your documents accordingly. Please note that on confirmation of the paid charges,the date and time of departure and expected date of delivery will be sent to you. We are glad to be of service to you. Carl Johnson Customer Services DgcourierServices Rovex House, Hay Hall Rd., Tyseley, Birmingham. B11 2AG. England fax number:+44-8701388294 Tel: +447040113135 __________________________________ Do you Yahoo!? Read only the mail you want - Yahoo! Mail SpamGuard. http://promotions.yahoo.com/new_mail
WHOIS lookup of originating IP address (184.108.40.206):
inetnum: 220.127.116.11 - 18.104.22.168 netname: KI descr: Kalaallit Nunaanni Kommuneqarfiit Kattuffiat Informatik descr: KANUKOKA Informatik descr: Nuuk country: GL admin-c: JMP1-RIPE tech-c: JMP1-RIPE rev-srv: ki.ki.gl rev-srv: pentiumnt.ki.gl status: ASSIGNED PA notify: email@example.com mnt-by: RIPE-NCC-LOCKED-MNT remarks: Maintainer RIPE-NCC-NONE-MNT removed and object remarks: LOCKED by the RIPE NCC due to remarks: deprecation of the NONE authentication scheme. remarks: Please visit the following URL to unlock this object remarks: http://www.ripe.net/db/none-deprecation-042004.html changed: firstname.lastname@example.org 19951219 changed: email@example.com 19970805 changed: firstname.lastname@example.org 19970806 changed: email@example.com 20040429 source: RIPE route: 22.214.171.124/19 descr: TELENET-GL origin: AS8818 mnt-by: AS8818-MNT changed: firstname.lastname@example.org 20000220 source: RIPE person: Jan Munch Pedersen address: Kimik IT a/s address: Aalisartup Aqqutaa 47 address: P.O. 740 address: DK-3900 Nuuk address: Greenland phone: +299 342000 fax-no: +299 329830 e-mail: email@example.com nic-hdl: JMP1-RIPE changed: firstname.lastname@example.org 19951205 changed: email@example.com 20010619 source: RIPE
"mandatory administrative charges" (UKL 405)