joewein.de LLC fighting spam and scams on the Internet

Try our spam filter! Free trial for 30 days

"419" Scam – Advance Fee / Fake Lottery Scam

• About the 419 (Advance Fee) scam
• "Is that email a scam?" - Check it online here!
  
• Frequently asked Questions (419 FAQ)
• Phone numbers used by 419 scammers
  (+225 +229 +234 +27 +31 +32 +34 +44 other)
• Company names mentioned in 419 spam:
  1 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
• Support our efforts to stop scams!
  
• How to report 419 spam to us
• What can you do when you receive 419 spam
  
  
• Spam archive, Daily index
  

Victims never receive this non-existent fortune but are tricked into sending their money to the criminals, who remain anonymous. They hide their real identity and location by using fake names and fake postal addresses as well as communicating via anonymous free email accounts and mobile phones.

Read more about such scams here or in our 419 FAQ. Use the Scam-O-Matic to verify suspect emails.

Click here to report a problem with this page.

Some comments by the Scam-O-Matic about the following email:

• This email message is a 419 scam. Please see our 419 FAQ for more details on such scams.
  

Fraud email example:

From: "SHELL GROUP AWARDS"<notification@shell.com>
Reply-To: <varification_department@live.com>
Date: Sun, 7 Sep 2008 19:04:47 -0700
Subject: ****SPAM(34.9)**** SHELL GROUP AWARDS 2008 (Please Verify)


Spam detection software, running on the system "server1.oasis-computers.co.uk", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.

Content preview: SHELL DEVELOPMENT COMPANY PLC SHELL GROUP INTERNATIONAL UK.
Shell Centre London [...]

Content analysis details: (34.9 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?41.220.75.3>]
0.9 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
[41.220.75.3 listed in zen.spamhaus.org]
1.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
4.0 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server
[41.220.75.3 listed in dnsbl.sorbs.net]
3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
0.0 MISSING_MID Missing Message-Id: header
1.0 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date
1.3 MISSING_HEADERS Missing To: header
3.2 DEAR_WINNER BODY: DEAR_WINNER
0.0 HTML_MESSAGE BODY: HTML included in message
1.5 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.2 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
1.6 KAM_LOTTO2 Highly Likely to be a e-Lotto Scam Email
0.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.8 SHORT_HELO_AND_INLINE_IMAGE Short HELO string, with inline image
0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS
2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email
2.0 LOTTERY_PH_004470 LOTTERY_PH_004470
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
3.0 DOS_OE_TO_MX_IMAGE Direct to MX with OE headers and an image
3.1 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
-0.2 AWL AWL: From: address is in the auto white-list

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.

Anti-fraud resources:

• What can you do when you receive 419 spam