| 
 | 
 Ghana Gold Scam / Alluvial Gold Dust scam
 We have received some unsolicited emails from senders in Accra, Ghana offering gold for sale. The sellers claim to be in possession of large quantities of gold dust, which they are willing to sell at below market prices. The catch is that you, the buyer, will have to send money upfront and the seller can walk away at any point with virtually no risk of being caught by the police as all contacts are via anonymous free webmail accounts accessed from Internet cafes and via prepaid mobile phones. The would-be buyer is made to send money for travel of the seller, for insurance, for shipping and for refinery assays before they would receive anything of any value. If they receive anything at all, the yellowish metal powder will turn out to be powdered brass. In any case they will lose thousands to tens of thousands of dollars. Any email from a stranger in West Africa offering gold dust or diamonds for sale is an Advance Fee Fraud! Here is a typical example, that immediately raised several red flags, see below: From: "rockmining_co" <rockmining_co@libero.it> Other examples: 
 
 Here's what immediately caught my eye: 
 
Here is an example of an actual email exchange with a Ghana Gold scammer: From: "harrison hayford" <goldcoast@atlas.cz>Where's the catch? To get that "gold" shipped to you, you first have to wire money to Ghana for shipping and insurance. What if you never receive it or it turns out to be powdered brass? We contacted these guys and asked about shipping modalities. They replied from a different address at a different webmailer, using a satellite broadband ISP that services West Africa and shows up in many Nigeria scams: 
 From: "deputy manager" <goldcoastminerscompany@yahoo.com>Sending network:      inetnum:      192.116.85.0 - 192.116.85.255
     netname:      GILAT-SATCOM-BLOCK-16
     descr:        SKY2Net ltd
     remarks:      For abuse issues related to Gilat, email abuse-gilat@012.net.il
     notify:       abuse-gilat@012.net.il
     country:      GB
     admin-c:      GS3350-RIPE
     tech-c:       GS3350-RIPE
     status:       ASSIGNED PA
     mnt-by:       AS9116-MNT
     mnt-lower:    AS9116-MNT
     changed:      hank@att.net.il 20040912
     source:       RIPE
     
     route:        192.116.64.0/18
     descr:        Goldenlines
     remarks:      For addressing issues, email lir@linux.goldenlines.net.il
     remarks:      For abuse issues, email abuse@012.net.il
     origin:       AS9116
     mnt-by:       AS9116-MNT
     changed:      lir@linux.goldenlines.net.il 20041121
     source:       RIPE
     
     role:         Gilat Support
     address:      Gilat Satcom
     address:      21D Yagia Kapaim st. Petach-Tikva, Israel
     phone:        +972 3 9255000
     fax-no:       +972 3 9217938
     admin-c:      DR5299-RIPE
     admin-c:      GE2074-RIPE
     tech-c:       DR5299-RIPE
     tech-c:       GE2074-RIPE
     trouble:      abuse-gilat@012.net.il
     e-mail:       customer@gilat.net
     nic-hdl:      GS3350-RIPE
     mnt-by:       AS9116-MNT
     changed:      hank@att.net.il 20040909
     source:       RIPE
From: "Yaha Amed" <local_sellers2@yahoo.co.uk> The spam email was not sent through Yahoo.co.uk but directly from an ISP in Africa. There it was not from Guinea, Conakry either but from Mali:      inetnum:      196.200.80.0 - 196.200.95.255
     netname:      ML-IKATEL-20040609
     descr:        IKATEL SA
     descr:        PROVIDER Local Registry
     country:      ML
     org:          ORG-IS28-RIPE
     admin-c:      SD2024-RIPE
     tech-c:       MA1231-RIPE
     status:       ALLOCATED PA
     mnt-by:       RIPE-NCC-HM-MNT
     mnt-lower:    MNT-IKATEL
     mnt-routes:   MNT-IKATEL
     notify:       noc@ikatel.net
     changed:      hostmaster@ripe.net 20040609
     source:       RIPE
     
     route:        196.200.80.0/20
     descr:        IKANET
     origin:       AS30985
     mnt-by:       MNT-IKATEL
     changed:      noc@ikatelnet.net 20040923
     source:       RIPE
     
     organisation: ORG-IS28-RIPE
     org-name:     IKATEL SA
     org-type:     LIR
     address:      IKATEL SA
                   Immeuble SONAVIE
                   ACI 2000
                   BP : E 3991
                   BAMAKO, Mali
     phone:        +223 4999900
     fax-no:       +223 223 08 35
     fax-no:       +223 499 90 01
     e-mail:       noc@ikatel.net
     admin-c:      DH1500-RIPE
     admin-c:      SD2024-RIPE
     mnt-ref:      MNT-IKATEL
     mnt-ref:      RIPE-NCC-HM-MNT
     mnt-by:       RIPE-NCC-HM-MNT
     changed:      hostmaster@ripe.net 20040415
     changed:      bitbucket@ripe.net 20040604
     changed:      hostmaster@ripe.net 20040609
     source:       RIPE
     
     person:       Sekou DRAME
     address:      IKATEL SA
     address:      Immeuble SONAVIE BP: E 3391
     address:      Bamako ACI 2000
     phone:        +223 6299908
     e-mail:       sekou.drame@ikatel.net
     nic-hdl:      SD2024-RIPE
     changed:      sekou.drame@ikatel.net 20040331
     source:       RIPE
     
     person:       Mohamed Aboubacrine
     address:      IKATEL SA
     address:      Immeuble DT BP 3991 Bamako Mali
     phone:        +223 499 9932
     phone:        +223 629 9932
     nic-hdl:      MA1231-RIPE
     changed:      mohamed.aboubacrine@ikatel.net 20040607
     source:       RIPE
Anyone willing to bet that the various certificates promised are any more genuine than the sender address or the origin of the email? I certainly am not :-) 
"Mary Saxon - South African gold from Chad (Nigeria) 
 Email headers:Received: by mail.interchange.ca (Postfix, from userid 555) id 77AC6861339; Wed, 9 Feb 2005 09:51:15 -0500 (EST) Received: from 213.181.81.242 by fastmail.ca with HTTP; Wed, 9 Feb 2005 14:51:15 +0000 (UTC) Date: Wed, 9 Feb 2005 14:51:15 +0000 (UTC) Subject: [ADV] hello From: "Mary Saxon" <marisaxon@fastmail.ca> X-Fastmail-IP: [213.181.81.242] MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Priority: urgent Message-Id: <20050209145115.77AC6861339@mail.interchange.ca> To: undisclosed-recipients: ; 
Originating network (IP 213.181.81.242)      inetnum:      213.181.64.0 - 213.181.95.255
     org:          ORG-BL4-RIPE
     netname:      NG-BROADBANDTECH-20000327
     descr:        BT Limited
     descr:        PROVIDER Local Registry
     country:      NG
     admin-c:      IO243-RIPE
     tech-c:       IO243-RIPE
     status:       ALLOCATED PA
     notify:       bt@micro.com.ng
     mnt-by:       RIPE-NCC-HM-MNT
     mnt-routes:   BT-LIMITED-MNT
     mnt-lower:    BT-LIMITED-MNT
     changed:      hostmaster@ripe.net 20000327
     changed:      hostmaster@ripe.net 20001003
     changed:      hostmaster@ripe.net 20010507
     changed:      hostmaster@ripe.net 20010704
     changed:      lir-help@ripe.net 20011214
     changed:      hostmaster@ripe.net 20020419
     changed:      hostmaster@ripe.net 20020423
     changed:      hostmaster@ripe.net 20020613
     changed:      hostmaster@ripe.net 20030211
     changed:      hostmaster@ripe.net 20040406
     source:       RIPE
     
     organisation: ORG-BL4-RIPE
     org-name:     BT Limited
     org-type:     LIR
     address:      BT Limited
     address:      8B Ademola Street,
     address:      Off Awolowo Road,
     address:      S. W. Ikoyi,
     address:      Lagos, Nigeria.
     phone:        +234 1 2693192
     fax-no:       +234 1 2693192
     e-mail:       bt@micro.com.ng
     admin-c:      IO243-RIPE
     admin-c:      IO243-RIPE
     mnt-ref:      BT-LIMITED-MNT
     mnt-ref:      RIPE-NCC-HM-MNT
     mnt-by:       RIPE-NCC-HM-MNT
     changed:      hostmaster@ripe.net 20040415
     source:       RIPE
     
     person:       Israel Oyeleke
     address:      BT Limited
     address:      8B Ademola Street
     address:      Ikoyi S.W.
     address:      Lagos, Nigeria
     phone:        +234 1 2673532
     fax-no:       +234 1 2673203
     e-mail:       i.oyeleke@moneynett.com
     nic-hdl:      IO243-RIPE
     notify:       i.oyeleke@moneynett.com
     changed:      ifiok@btlimited.com 20010605
     changed:      ifiok_moses@yahoo.com 20030917
     source:       RIPE
 From: "thankgod nelson " <thankgod_nelson@mixmail.com> 
 From: "JEFF NANA OFORI" <jeffofori6@yahoo.com> 
 From: <drbellosadiq@tiscali.co.uk> Message headers: Received: from [192.116.69.33] by mk-cpfrontend.uk.tiscali.com with HTTP; Wed, 13 Jul 2005 04:38:44 +0100 Date: Wed, 13 Jul 2005 04:38:44 +0100 Message-ID: <428DEEE80012AC9E@mk-cpfrontend-3.mail.uk.tiscali.com> From: drbellosadiq@tiscali.co.uk Subject: Gold Offer 
WHOIS details for sending network (IP 192.116.69.33): 
     inetnum:      192.116.65.0 - 192.116.69.255
     netname:      GILAT-SATCOM-BLOCK-31-32-40-46-53
     descr:        Gilat-Satcom
     remarks:      For abuse issues related to Gilat, email abuse-gilat@012.net.il
     country:      GB
     admin-c:      GS3350-RIPE
     tech-c:       GS3350-RIPE
     status:       ASSIGNED PA
     mnt-by:       AS9116-MNT
     mnt-lower:    AS9116-MNT
     source:       RIPE # Filtered
     
     role:           Gilat Support
     address:        Gilat Satcom
     address:        21D Yagia Kapaim st. Petach-Tikva, Israel
     phone:          +972 3 9255000
     fax-no:         +972 3 9217938
     admin-c:        DR5299-RIPE
     admin-c:        GE2074-RIPE
     tech-c:         DR5299-RIPE
     tech-c:         GE2074-RIPE
     remarks:        trouble:      abuse-gilat@012.net.il
     nic-hdl:        GS3350-RIPE
     mnt-by:         AS9116-MNT
     source:         RIPE # Filtered
     abuse-mailbox:  abuse-gilat@012.net.il
     
     % Information related to 'GS3350-RIPE'
     
     route:        192.116.64.0/18
     descr:        Goldenlines
     remarks:      For addressing issues, email lir@linux.goldenlines.net.il
     remarks:      For abuse issues, email abuse@012.net.il
     origin:       AS9116
     mnt-by:       AS9116-MNT
     source:       RIPE # Filtered
Other examples: Here's a report I received about a victim from Croatia who travelled to meet the scammers in West Africa: I DO know this guy from Split, Croatia. We even went together to university. He fell for 419 scam from Nigeria. The pressure was very high since the scammer already skinned him and his asocaiates for several thousand dollars and my friend was already in Frankfurt awaitnig for instructions how to meet the "son" of some "late" state official who knows where are millions of $$$ and he "needed to sign" the "release documents". Then he recieved phonecall from Croatia, from his associates, that they recieved an e-mail saying that this guy is afraid to cross the border of nigeria since that police is very near to find what he is trying to do and that is of outmost importance that he comes to Nigeria to sign this documents. He fell for that, went to Nigeria and it took about three weks until relatives and familly collected 20,000 $ ransom and even more for travel costs, so one of the familly went to Lagos, Nigeria and asked police to help him. Yes, they helped to deliver the ransom and kicked out of nigeria both of croatians, since, aparently, it is not a crime if nigerians take money from someone abroad. 
 Dear Sir, Message headers: Received: from mail-ww0-f66.google.com (mail-ww0-f66.google.com [74.125.82.66]) by indigo.pobox.com (Postfix) with ESMTP id CD3B420067A for <myemailaddress>; Mon, 22 Mar 2010 10:28:28 -0400 (EDT) Received: by wwb17 with SMTP id 17so124443wwb.5 for <myemailaddress>; Mon, 22 Mar 2010 07:26:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:message-id:subject :from:to:content-type; bh=EeySvWYFqcYBQW/jlESN2nIYFdltVdzNQ+CTNcOaLd8=; b=XDIIDZScJrTFIYrUtUeXANMp27CT2jY4JICOa+k86ZlV0bhnIyLH/QLWleZ0bzNAiG gIxGo4ozxPmQMp6ohT83NAdzhaDg5OPz/kXwFIGo3cnzA9ojO4OhNT5VWXMWLxRWtXFd wJxGg0ZcX/BHs54BVE335A7HMKsMJq7HEt7XM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=HlNw+P1/IEeGv4pRgeS3e4TeljZgjrT5Awh3Wv5dc9CyCCWWdh3stRF9xkxtPIdqyU mYtedPa3yedoVV0HWOY4QfhHq2c+MTJ+6ujinHh8q0xF/SiD6LOQBvIxSUUX2OZNRu8o 3li3sg2WbZ879JBgLNhbMJDQGbk8+BVJxRf5A= MIME-Version: 1.0 Received: by 10.216.85.194 with SMTP id u44mr3248635wee.65.1269267970144; Mon, 22 Mar 2010 07:26:10 -0700 (PDT) Date: Mon, 22 Mar 2010 14:26:09 +0000 Message-ID: <e291f3ec1003220726ie72a6fbne28c0320b4ba2527@mail.gmail.com> Subject: Gold Offer From: Simon Ewing <masterminers001@gmail.com> To: masterminers001@gmail.com 
 
 |