419 scam: Tim White <phantom421366@yahoo.com> CIA generated SPOOFING and PHISHING.."Contact Bank of America For Your Approved

joewein.de LLC
fighting spam and scams on the Internet

Try our spam filter!
Free trial for 30 days

Home

About Us

Spam

419/Nigeria

Fraud

Contact

"419" Scam – Advance Fee / Fake Lottery Scam

The so-called "419" scam is a type of fraud dominated by criminals from Nigeria and other countries in Africa. Victims of the scam are promised a large amount of money, such as a lottery prize, inheritance, money sitting in some bank account, etc.

Victims never receive this non-existent fortune but are tricked into sending their money to the criminals, who remain anonymous. They hide their real identity and location by using fake names and fake postal addresses as well as communicating via anonymous free email accounts and mobile phones.

Keep in mind that scammers DO NOT use their real names when defrauding people.
The criminals either abuse names of real people or companies or invent names or addresses.
Any real people or companies mentioned below have NO CONNECTION to the scammers!

Read more about such scams here or in our 419 FAQ. Use the Scam-O-Matic to verify suspect emails.

Click here to report a problem with this page.

Some comments by the Scam-O-Matic about the following email:

An email address listed inside this email has been used in a known fraud before.
The following phrases in this message should put you on alert:
- "money laundering" ("anti-terrorist", "anti-money laundering" or "drug-free" certificates are a common way for criminals in fake lottery scams and other Advance Fee scams to get you to send money to them. There are no such certificates in the real banking world. )
- "insurance fee " (this will cost you money - be careful with upfront payments to anyone you only know through email, especially if they promise you a lot of money. NEVER send money by Western Union or MoneyGram to people you do not know personally - NO EXCEPTIONS! Instant wire transfer services are not meant to be used with strangers because they offer no protection against fraud. That is precisely why the criminals want you send money that way. )
- "western union" (this will cost you money - be careful with upfront payments to anyone you only know through email, especially if they promise you a lot of money. NEVER send money by Western Union or MoneyGram to people you do not know personally - NO EXCEPTIONS! Instant wire transfer services are not meant to be used with strangers because they offer no protection against fraud. That is precisely why the criminals want you send money that way. )
- "money gram" (this will cost you money - be careful with upfront payments to anyone you only know through email, especially if they promise you a lot of money. NEVER send money by Western Union or MoneyGram to people you do not know personally - NO EXCEPTIONS! Instant wire transfer services are not meant to be used with strangers because they offer no protection against fraud. That is precisely why the criminals want you send money that way. )
- "you are required to pay " (this will cost you money - be careful with upfront payments to anyone you only know through email, especially if they promise you a lot of money. NEVER send money by Western Union or MoneyGram to people you do not know personally - NO EXCEPTIONS! Instant wire transfer services are not meant to be used with strangers because they offer no protection against fraud. That is precisely why the criminals want you send money that way. )
- "robert mueller" (This name is often mentioned in money recovery scams (re-scam): the real FBI will not tell you to contact some email address. If you are in any doubt, contact an FBI field office via www.fbi.gov. )
- "lagos" (a location commonly mentioned in 419 scams)
- "cashier's check" (Beware of any scheme that involves cashing checks or money orders and then wiring a portion of the funds somewhere - you'll be liable for the entire amount if the checks or money orders turn out to be fake, even after you have received and forwarded cash. If it's a lottery prize, remember that real lotteries do not pay large prizes by check. They wire the money directly to your bank account and you do not pay for that. Many scammers promise a large check only in order to then demand payment of courier fees for a fake courier service. )
This email message is a fake lottery scam. Consider the following facts about real lotteries:
1. They don't notify winners by email.
2. You can't win without first buying a lottery ticket.
3. They don't randomly select email addresses to award prizes to.
4. They don't use free email accounts (Yahoo, Hotmail, etc) to communicate with you.
5. They don't tell you to call a mobile phone number.
6. They don't tell you to keep your winnings secret.
7. They will never ask a winner to pay any fees to receive a prize!
Western Union money transfer is completely untraceable and therefore is *not* safe to use with anyone you do not know personally. It is the preferred method of online criminals to collect money from their victims.
This email lists free webmail addresses. Use of such addresses is typical for scams. Lotteries, banks and any but the smallest of companies do not normally use such addresses. Criminals use them to anonymously send and receive email at Internet cafes.
- phantom421366@yahoo.com (email address has been used in a known fraud before)

Fraud email example:

From: Tim White <phantom421366@yahoo.com>
Date: Tue, 27 Jul 2010 12:58:47 -0700 (PDT)
Subject: CIA generated SPOOFING and PHISHING.."Contact Bank of America For Your Approved Check"(BoA is a CIA money laundering bank)

CIA generated SPOOFING and PHISHING.."Contact Bank of America For Your Approved Check"(BoA is a major CIA money laundering bank)========================================

Contact Bank of America For Your Approved
Check
Tuesday, July
27, 2010 12:52 PM
From
Robert Mueller. Tue Jul 27 18:52:13 2010

X-Apparently-To:

phantom421366@yahoo.com via
68.180.197.96; Tue, 27 Jul 2010 11:55:57 -0700

Return-Path:

<tmslch@nus.edu.sg>

X-YahooFilteredBulk:

137.132.21.156

Received-SPF:

pass (mta1124.mail.mud.yahoo.com:
domain of tmslch@nus.edu.sg designates 137.132.21.156 as permitted
sender)

X-YMailISG:

UK1S3bMcZAo5Ea6Pi5dMMOC4586jO9jeYawRzdlNrQvNa5CY
ZCkqghOhVt4AJXSPTQQAv8dRGz6FN5l231AiN1rkXga.KIR0PCtuH9iX9m4D
Gc3AuZXAWpb9iDSuHd9R4lXGaqG4fgqaWcU38cSOEjqss8PkO9fIWz6JxHIc
bGfxyHeS.vgRrbr4WyjvFGJyErop_pSh2LusmXPaht.2qMgSxvOmyQn3EIE2
pkgABilPqk37iIt.112tZhnoTVCh5akVANpB60OmR03qJEAXxpulKdbZUeB5
wwV.6dV6KPsy7sZ_5XqE20Hx8UlEgG..ZZpRcQ_UXHjWYoI6R1zXQxmVCedZ
F0xY4GpvWe.9_F3_U3c7uToTk26Z1HUBLToCxoK1MPp2Bh5BJRhsmT3ogM0U
Tcf17lBoXTJi2ytSZsd0hOH.1IIRRPRhqf5SQIEb_6bdphvZtAU84SHl0TcX
Hxt6cIgsNHEFNhoIKPV3cTA67i.4XMC.ghitVqj_GjPt2rfV0GATyPkqdiH4
1DeTqv41f1tMQmahfjy9ZX8qz6_nzEooPBW3ySR1f2PS2cYct2twOJEQNDXU
PW.wJgdrF1qjCFQLNNi2gUbWwIHM8JVxeUn1S5McMkebAwyzt7ApSzfi45LF
j6hDVpzkO6fOihnPcvnnjLSI4fyY.LqvvHESwyQas3Lo.eyZAeq_aBIzPFlZ
CsKq8Z4VVF0t1DbG4pxYhRGcgBKCkkdb6nszc2mCrFYSs9Y92DS6upJQ8Wyl
xr2LJxptn_A4o5d8OXGKUjsu7PykRKyo9Q3ATzARo8eEOh1KssAnwBxNKlcu
dILzWOer3.kdCzR4P8KgRPT3fhv2ITc9HurnEpMm1efQY1hTxkAXbckprLp2
rF2FRfDvfoqiOYWNqNz7RvWBcWLYyijY.QWQ6mbibS.6xTTPvjw8GxXd9kOH
VPNvvcpTxPzOARS9D_qhUkGCQQRg.kJ3HZT0v2npouHaHHZxvELdFkMbgHzP
0tP40MdvsPSGgSRICC4LVEi7QJaS7m8Xv2yxDw935j7UjQRCjuTYd4CL3T_H
8a2_5dUQTuST4jBN5WMBqVFZdEW7Z7usQ3D6KGKBXRtlKV1yuYn2jB9NqDeG
BsYTiHhX3AB3BqgjOKg.151YRYR2QL4JQgGFpEbUm8gQZOBiNP6RQuFEzYYN
pg--

X-Originating-IP:

[137.132.21.156]

Authentication-Results:

mta1124.mail.mud.yahoo.com
from=nus.edu.sg; domainkeys=neutral (no sig); from=nus.edu.sg;
dkim=neutral (no sig)

Received:

from 127.0.0.1 (EHLO
smtp.nus.edu.sg) (137.132.21.156)
by mta1124.mail.mud.yahoo.com with SMTP; Tue, 27 Jul 2010 11:55:54
-0700

Received:LAGOS Nigeria===>>

from User ([82.128.84.195]) by
smtp.nus.edu.sg with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 28 Jul 2010 02:52:24 +0800

Reply-To:

<peterspencer1@live.com>

From:

"Robert
Mueller."<tmslch@nus.edu.sg>
Add sender to Contacts

Subject:

Contact Bank of America For Your
Approved Check

Date:

Tue, 27 Jul 2010 11:52:13 -0700

MIME-Version:

1.0

Content-Type:

text/plain;
charset="Windows-1251"

Content-Transfer-Encoding:

7bit

X-Priority:

3

X-MSMail-Priority:

Normal

X-Mailer:

Microsoft Outlook Express
6.00.2600.0000

X-MimeOLE:

Produced By Microsoft MimeOLE
V6.00.2600.0000

Bcc:

Return-Path:

tmslch@nus.edu.sg

Message-ID:

<MAILGW010ZnxV9j1TWC000019bd@smtp.nus.edu.sg>

X-OriginalArrivalTime:

27 Jul 2010 18:52:24.0949 (UTC)
FILETIME=[DA48B250:01CB2DBC]

Content-Length:

4581
Compact
HeadersAnti-Terrorist and Monetary Crimes
Division
FBI Headquarters in Washington, D.C.
Federal Bureau of
Investigation

J. Edgar Hoover Building
Washington, D.C.
20535-0001

Telephone Number: (206) 973-2572

Attn:
Beneficiary.

This is to Officially inform you that it has come to
our notice and we have thoroughly completed an Investigation with the
help of our Intelligence Monitoring Network System that you legally won
the sum of $850,000.00 USD from the Bank of America Online Balloting
System, which was held at the Bank of America Corporate Center in
Charlotte, NC. During our investigation we discovered that your e-mail
was one of the 8 Lucky Addresses in this New Year Balloting Program that
won the money. Your Winnings have been deposited at the Bank of America
(Bank Address: 1375 N Citrus Ave, Covina, CA 91722) and the Bank have
been authorized to pay you via a Certified Cashier's Check drawn from
the Bank of America.I wish to congratulate you on your winnings; your
email address was among those chosen during the Bank of America Online
balloting from the new Java-based software that randomly selects email
addresses from the web from which winners are selected.

Normally,
it will take up to 4 business days for a Bank of America Check to be
cleared, cashed and remitted into your account by another local bank. We
have successfully notified the banks on your behalf that funds are to
be drawn from our registered bank (Bank of America) so as to enable you
cash the check instantly without any delay, henceforth the stated amount
of $850,000.00 USD has been deposited with our bank, Bank Of America in
COVINA, CALIFORNIA.

We have completed this investigation and you
are hereby approved to receive the certified cashier's check into your
personal account as we have verified the entire transaction to be Safe
and 100% risk free, due to the fact that the funds is with Bank Of
America you will be required to settle the following bills directly to
the Bank of America Agent in-charge of this transaction whom is located
in Covina, California, United States of America. According to the
directives, you are required to pay for the following -

(1)
Deposit Fee's (Fee's paid to setup a new account for the beneficiary by
the Bank of America)
(2) Courier Delivery Fee (Fee paid to deliver
the check through UPS delivery to your designated address)
(3)
Insurance Fee (This is the fee paid by bank to insure the check before
been deposited at the bank to avoid any deduction)

The total
amount for everything is $750.00 (Seven Hundred and Fifty-US Dollars).
We have tried our possible best to indicate that this $750.00 should be
deducted from your winning prize but we found out that the funds have
already been insured and deposited at Bank Of America, Centralia,
Washington and cannot be accessed by anyone apart from you the
beneficiary, therefore you will be required to pay the required fee's to
the Agent in-charge of this transaction via Western Union Money
Transfer Or Money Gram.

In order to proceed with this
transaction, you will be required to contact the agent in-charge
(MR.PETER SPENCER) via e-mail.

Kindly look below to find
appropriate contact information:

Contact Agent Name: MR.PETER
SPENCER (Senior Personal Banker)
E-mail Address: peterspencer1@live.com
Telephone
Number: (415) 871-0744
Bank of America: 1375 N Citrus Ave, Covina,
CA 91722.

You will also be required to e-mail him with the
following information:

FULL NAME:
ADDRESS:
CITY:
STATE:
ZIP
CODE:
DIRECT CONTACT NUMBER:
OCCUPATION:
ANY FORM OF IDENTITY:

You
will also be required to request Western Union details on how to send
the required $750.00 in order to immediately deliver your Funds of
$850,000.00 USD via Certified Cashier's Check drawn from Bank Of
America, also include the following transaction code in order for him to
immediately identify this transaction : EA2948-910.

This letter
will serve as proof that the Federal Bureau Of Investigation is
authorizing you to pay the required $750.00 ONLY to Mr. Peter Spencer
via information in which he shall send to you, if you do not receive
your winning prize of $850,000.00 we shall be held responsible for the
loss and this shall invite a penalty of $8,000 which will be made
PAYABLE ONLY to you (The Winner).

Due to the confidentiality of
this matter, I decided to contact you privately to avoid imposters.

Please
find below an authorized signature which has been signed by the FBI
Director- Robert Mueller, also below is the FBI NSB (National Security).

ONCE
AGAIN CONGRATULATIONS.

FBI Director
Robert Mueller.

======================================

WHOIS - 137.132.21.156
Location: Unknown

ARIN says that this IP belongs to APNIC; I'm looking it up there.

Using 0 day old cached answer (or, you can get fresh results).
Displaying E-mail address (use sparingly -- this will make it more likely that you will trigger our rate limiting system).

% [whois.apnic.net node-2]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

inetnum: 137.132.0.0 - 137.132.255.255
netname: NUSNET
descr: imported inetnum object for NUS-1
country: SG
admin-c: CCNU1-AP
tech-c: CCNU1-AP
status: ALLOCATED PORTABLE
remarks: -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
remarks: This object can only be updated by APNIC hostmasters.
remarks: To update this object, please contact APNIC
remarks: hostmasters and include your organisation's account
remarks: name
in the subject line.
remarks: -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
remarks: Fault, Abuse & Spam Reporting:
remarks: Spam and Abuse: abuse@nus.edu.sg
remarks: Network Issues: noc@nus.edu.sg
remarks: NOC Telephone: +65-6516-1786
remarks: -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
notify: ccenet@nus.edu.sg
mnt-by: APNIC-HM
mnt-lower: MAINT-NUS-AP
changed: hostmaster@arin.net 20020215
changed: hm-changed@apnic.net 20041214
changed: hm-changed@apnic.net 20070227
source: APNIC

person: Computer Centre National Universityof Singapore
address: 2 Engineering Drive 4,
National University of Singapore117584
country: SG
phone: +65 8742484
e-mail: ccenet@nus.edu.sg
nic-hdl: CCNU1-AP
remarks: ----------
remarks: imported from ARIN
object:
remarks:
remarks: poc-handle: DA18-ORG-ARIN
remarks: is-role: Y
remarks: last-name: Computer Centre, National Universityof Singapore
remarks: street: 2 Engineering Drive 4,
National University of Singapore117584
remarks: country: SG
remarks: mailbox: ccenet@nus.edu.sg
remarks: bus-phone: +65 8742484
remarks: reg-date: 1999-03-09
remarks: changed: hostmaster@arin.poc 20020215
remarks: source: ARIN
remarks:
remarks: ----------
notify: ccenet@nus.edu.sg
mnt-by: MNT-NUS-SG
changed: hostmaster@arin.poc 20020215
changed: hm-changed@apnic.net 20040123
source: APNIC

WHOIS - 82.128.84.195

status = "Getting WHOIS results...";Location: Nigeria (high) [City: Lagos, Lagos]

Using 0 day old cached answer (or, you can get fresh results).
Displaying E-mail address (use sparingly -- this will make it more likely that you will trigger our rate limiting system).

% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Information related to '82.128.0.0 - 82.128.127.255'

inetnum: 82.128.0.0 - 82.128.127.255
org: ORG-AFNC1-RIPE
netname: AFRINIC-NET-TRANSFERRED-20050223
descr: This network has been transferred to AFRINIC
remarks: These IP addresses are assigned in the AFRINIC region.
remarks: Authoritative registration information for this network
remarks: is available for query and modification in
remarks: the AFRINIC whois database: whois.afrinic.net or
remarks: web site: http://www.afrinic.net
remarks: The routing registry information (route(6) objects)
remarks: may be published in any Routing Registry, including
remarks: RIPE Whois Database
country: EU # country is really somewhere in African Region
admin-c: AFRI-RIPE
tech-c: AFRI-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-routes: RIPE-NCC-RPSL-MNT
changed: hostmaster@ripe.net 20050223
source: RIPE

organisation: ORG-AFNC1-RIPE
org-name: African Internet Numbers Registry
org-type: RIR
address: see http://www.afrinic.net
e-mail: bitbucket@ripe.net
admin-c: AFRI-RIPE
tech-c: AFRI-RIPE
remarks: For more information on AFRINIC assigned blocks, use
remarks: AFRINIC's whois database, whois.afrinic.net.
mnt-ref: RIPE-NCC-HM-MNT
mnt-by: RIPE-NCC-HM-MNT
changed: bitbucket@ripe.net 20050223
source: RIPE

role: The African Internet Numbers Registry
org: ORG-AFNC1-RIPE
address: AFRINIC, see http://www.afrinic.net
admin-c: AFRI-RIPE
tech-c: AFRI-RIPE
nic-hdl: AFRI-RIPE
e-mail: bitbucket@ripe.net
remarks: For more information on AFRINIC assigned blocks, connect
remarks: to AFRINIC's whois database, whois.afrinic.net.
mnt-by: RIPE-NCC-HM-MNT
changed: hostmaster@ripe.net 20050223
source: RIPE

[The following lines added by www.dnsstuff.com per requirement by RIPE]
This service is subject to the terms and conditions stated in the RIPE NCC Database Copyright Notice.
Contact dnsstuff.com's 'info2@' address to report problems regarding the functionality of the service.

Anti-fraud resources:

What can you do when you receive 419 spam