"Equity Investment Limited" lottery scam still around after more than a decade

Scammers can be really stupid. Take these guys who are running a non-existent UK National Lottery / FIFA Brazil 2014 World Cup scam..

The scam is purportedly from a "Mrs Hilda Adams" references a fake company:

Equity Investment Limited
132 Blackburn Road
Bolton
BL7 9RP
England
UK
Tel: 00447924556231
Email: uklclaims@mail.com

Some key parts of the email are:
Reference: EKS255125600304
Ticket number: 034-1416-4612750

But search for "Equity Investment Limited" on just about any search engine and the first hit you will get is an article I wrote way back in 2003 about a lottery scam using a company of exactly the same name.

The email address is a throwaway free email account, the telephone number looks like it is British but in fact it a forwarding number provided by Cloud9  which could potentially forward calls to anywhere in the world. This type of "follow me anywhere" number is often abused by scammers. As for the address.. well, it's unlikely that whoever lives at that address is anything to do with this at all.

Luckily, most people who run lottery scams have the intelligence of a box of rocks. And it seems that quite a few of their victims have heard of a thing called a search engine..

"You are a Mercedes-Benz winner !!!" spam

This is a slightly novel twist on an advanced fee fraud scam:

From:     Mercedes-Benz [desk_notification@yahoo.com]
Reply-To:     bmlot20137@live.com
Date:     27 October 2013 13:44
Subject:     You are a Mercedes-Benz winner !!!

Dear Recipient,

You have received a loyalty reward from Mercedes-Benz, Answer the Below question correctly and stand a chance of winning our Promotional Award Grand prize of $4,000,000USD and a Brand New 2013 Mercedes-Benz GLK350 4Matic SUV Car. If you have never had a Mercedes-Benz Product, this is your chance to benefit from our company while if you have any of our products this is your opportunity of enjoying some of our benefits apart from the comfortability and efficiency of our products. Just answer the questions asked below and you could be a winner:

QUESTION:

(1). What year was Mercedes-Benz found?
(a). 1946
(b). 1926
(c). 1936

(2). Who was the founder of Benz?
(a). Terry Benz
(b). Tom Benz
(c). Karl Benz

(3). In which country is the Benz Headquarter Located?
(a). Germany
(b). United Kingdom
(c). United State of America

Note that you are to send your answers along with your Full Name, Sex, Age, Phone Number, Country and Occupation.to our Fiduciary agent:

Mr.Richard Ashton
Email: bmlot20137@live.com
TEL: +44 703 590 2283
Fax: +44 871-247-6031

Our aims to support the abilities of the neediest groups to fulfill human dignity and social justice in cooperation with development partners in the world.

Kind Regards,
Mrs.Katherine Dooley
Mercedes-Benz,Online coordinator

The email was sent to a spamtrap address from 41.138.182.219 which is in Lagos, Nigeria via a mail server in the US at 65.40.236.192 (Embarq).

You might wonder what the scam is because it looks like a competition.. once you have answered the three trivially easy questions (we all know that Mercedes Benz was founded by Terry Benz in 1946 and is headquartered in the UK, after all) then you will find that you'll need to pay a stiff fee to get your prize.. which will never materialise.

Scam sites to block on 209.25.137.196

Here's a site of very professional looking scam sites, incuding fake investment firms and escrow companies. Most of these have been registered over the past few weeks with anonymous details.

atlasconsultancyltd.com
bfsauthority.org
bltradinggrp.com
chicagobgllc.com
crawfordcapitalpartners.com
fidelitycorporategroup.com
grenfellassociates.com
johnsonsterlingconsultancy.com
knowltonadvisors.com
mediatransfersltd.com
millerconsultancyservices.com
morganpremiergrp.com
notanordinarysite.com
peregrineintlgroup.com
scmrcom.org
sftcommission.org
tatecarverconsultancy.com
toddwhitefinancial.com
warrenfisherassociates.com
wellsconsultancy.com
winchesterconsultancygrp.com

also hosted on the same server:
mentemptation.com
webhostingbreaker.com

Some of the trading names used by these scammers (some may be similar to legitimate companies):

• Atlas Consultancy
• Brussels Financial Supervisory Authority
• BL Trading Group
• Chicago Business Group LLC
• Crawford Capital Partners
• Fidelity Corporate Group
• Grenfell and Blackrock Associates
• Johnson Sterling Consultancy
• Knowlton Group
• Media Transfers Limited
• Miller Counsulting Group
• Morgan Premier Group
• Peregrine International Group
• Swiss Commodity Market Regulatory Commission
• Swiss Financial Trading Commission
• Tate and Carver Consultancy Group
• Todd and White Financial Marketing Services
• Warren Fisher and Associates
• Wells Capital Management
• Winchester Consultancy Group

Do not be fooled by how good the sites look.. they are very, very convincing. Here is are some examples:

The sites are all hosted on 209.25.137.196 which looks like a rented server from LiquidNet, Florida. Also hosted on the same server is webhostingbreaker.com (possibly based in the Philippines) which might be the black hat reseller involved.

Part of this network was fingered a few weeks ago here, and it still appears to be active. Avoid at all costs.

"Paul Badji: Treat As Urgent" email

Paul Badji is a real diplomat at the UN, this email is NOT from Paul Badji. The UN's name has been used this way before, notably with Ban Ki-moon's name attached. This email is probably the usual Advance Fee Fraud approach, using a couple of links to reputable websites to try to make it look more authentic. Avoid.

Unusually for what appears to be an African scam, the originating IP is 89.39.24.2 in Romania.

From: PAUL BADJI <africacomittee@yahoo.gr>
Reply-To: paulbadji_africaunionworld2@yahoo.com.hk
Date: 24 July 2010 04:18
Subject: Treat As Urgent
   

Greeting to you, I am Mr. Paul Badji Chairman on human right Exercise  Committee (CHREC ) on the Inalienable Rights of the People a member of Africa Union Committee and Special Adviser to Mr. President. Sir, your file appears in my office four days ago Through FMS  Headquarter. that you are the beneficiary  to receive payment of fifteen million British pound on behalf of Late Mrs.Veronica Daniela from Ukraine, Europe, Former Managing Director of Mobile oil and Gas Company Nigeria Ltd. who died in plan crash on Sunday, Oct  22nd, 2005 .

when a Bellview Airline Boeing 737 crashed in the countryside shortly after takeoff from the commercial capital Lagos, 117 people died  .therefore the  Bellview Airline's  management and Mobile oil and Gas Company Nigeria Ltd, has deposited   fifteen million British pound at First Bank Nigeria Plc on behalf of Late Mrs.Veronica Daniela, Signed  approved by secretary of state on Friday 16 2nd July 2010, please confirm the accident  picture to find the true of these site click here: http://www.1001crash.com/index-page-description-accident-Bellview_B737-lg-2-crash-6.html

there for you are to receive this fund in your name as the next of kin which appear in the file, This is to notify you that  the Two companies  have agreed to pay fifteen million British pound to  you  in your name on behalf of Late Mrs.Veronica and to change the decease name to your name. This is regarding the draws organized lately to help individuals whom have lost their earnings in this act.  on Sunday, Oct  22nd, 2005 . . And to build true organizations so as to help the less privileged in the society. you are therefore advised to contact Correspondent paying Bank, First Bank Foreign Remittance Department Chief Director Operations & Services. Requirement is requested by your full Name including your home address, country. And your private telephone number to confirm the file here and to release the fund to you. For more information you are to contact  via Email below.

Thank you and God bless
Mr. Paul Badji
Special Adviser to Mr. President
Chairman, Committee on the Exercise
of the Inalienable Rights of the People.
Africa Union Committee (AU)
N:B website
Contact Email: badjipaul@rocketmail.com
http://www.africa-union.org/root/au/index/index.htm

Terminally confused 419er

This is just a straight advanced fee fraud scam, but the scammer seems to want to through in the names of Yahoo, Nokia AND Microsoft into the same fraudulent pitch. Just to add overkill, it's from a "Reverend" too, which a bunch of email addresses which are frankly all over the shop. Oh yes, the originating IP is Argentina of all places.

From: CONGRATULATION FROM YAHOO COMPANY THAILAND <lotto_officethai2@btinternet.com>
Reply-to: revralphdelahay@w.cn
Date: 14 June 2010 13:28
Subject: CONGRATULATION FROM YAHOO COMPANY THAILAND
   
Microsoft Award Team.
 ADDRESS: NOKIA THAILAND OFFICE
 105/33 BANGKOK THAI TWR.,
 108 SIAM ROAD.,
 BANGKOK, 10400,
 KINGDOM OF THAILAND.
 Batch: 12/25/0340


 Dear Winner


 This is to inform you that you have won a prize money of $2,000,000,00 (Two Million United state dollars) for the Edition 2010 Lottery promotion which is organized by YAHOO  LOTTERY INC & WINDOWS LIVE.YAHOO & MICROSOFT WINDOWS, collects all the email addresses of people that are active online, among the millions that subscribed to Yahoo and Hotmail we only select ten people every Month as our winners through electronic balloting System without the winner applying, we Congratulate you for being one of the people selected.

 PAYMENT OF PRIZE AND CLAIM


 You are to contact your Claims Agent with immediate effect to facilitate the protocol of your winning prize before the expiry date of Claim; Winners shall be paid in accordance with his/her Settlement Centre. Prize must be claimed not later than 15 days from date of Draw Notification after the Draw date in which Prize has won. Any prize not claimed within this period will be forfeited. These are your identification numbers:

 Batch number....................12/25/0340
 Ref number.......................Ref: MSN-L/200-26937
 Winning number...................YM09788


 You are therefore advised to send the following information to  to this office so that we facilitate the claims of your prize to you.


 1. Full name.............
 2. Country..............
 3. Contact Address........
 4. Telephone Number.....
 5. Marital Status........
 6. Occupation.............
 7. Company...............
 8. Age.....................


 Please Note:
 Your Lottery Prize must be claimed not later than 15 days from date of Draw Notification after the Draw date in which Prize has won. Any prize not claimed within this period will be forfeited.

 Congratulations!! Once again.

 Yours in service,
 REV.RALPH DELAHAY
 (Operation Manager)
 Yahoo International Promotion Center

 Email: thailand.lotto@yahoo.com
 Bangkok 10400
 Kingdom of Thailand

"Re: Intercepted Over Due Fund Transfer!!!" scam

This isn't the first time that we've seen a scam email pretending to be from the UN, but they are often slightly amusing in their pitch. The idea here is that the scammers are targeting people who have already been ripped off with the promise of compensation. Presumably the success rate with this approach makes it worth doing.

Unsurprisingly, the telephone number listed is in Nigeria. Avoid.

From: United Nations <info@un.org>
Reply-to: cenbankng@ml1.net
Date: 19 May 2010 02:40
Subject: Re: Intercepted Over Due Fund Transfer!!!

United Nations

Palais des Nations,

1211 Geneva 10,

Switzerland

Subject: Re: Intercepted Over Due Fund Transfer

Attention: Beneficiary,

In the last meeting between the United Nations OCHA and UNDP hold Copenhagen, 19 Febraury 2010-After a marathon all night session, talks aimed at injecting new and more wide-ranging momentum into the international effort to combat climate change, global recession and scam  ended with a positive outcome.

The United Nations and U.S department for Homeland security has meet with delegate from Africa, Asia, Australia, Antarctica, North America, South America  and Europe has agreed to Pay scam victims around the world the sum $10.8Million USD as compensation so the money could be use to combat unemployment and help people like you make the world a better place. The United States Department of Homeland Security (DHS), with the help of the FBI and Interpol Has screened through various Monitoring Networks and has been confirmed and notified that the transaction is Legal and you have the Lawful Right to claim your due fund.

To effect and carry out the directives given, you are advised to contact Dr David Wills

Dr David Wills.

International Claims Officer

Telephone: +234 8039393143

E-Mail: cenbankng@ml1.net

You have been instructed on what to do next you are strictly advice to follow his instruction so as to follow into the hands of fraudster,

Yours Faithfully,

Yvette Morris (UN)
Public Relation officer

419ers hit by the downturn?

A strangely worded 419 scam arrived today in a format I haven't seen before. Perhaps the economic downturn is having an effect on the supply of gullible people?

Subject: THAT IS ALL I CAN DO FOR YOU
From: "RICHARD GOZNEY" bhcommission1@mail2consultant.com
Date: Tue, May 12, 2009 6:56 pm

BRITISH HIGH COMMISSION
DANGOTE HOUSE,
AGUYI IRONSI STREET, MAITAMA DISTRICT,
ABUJA,NIGERIA..
TEL: +234-8039672472


Attention

After long silence from you we came to realize that you may have given up your compensation due to lack of money for the Certificates.

I have been able to settle for the Certificates which amounts to US$1800 so i expect you to pay me back once you receive your card.

You have to reconfirm your delivery address for the EMS courier company to mail your ATM card to you without delay. Note that you are entitled to settle for their safe keeping fee of $250.

Make haste to send down your address and i shall provide you with the information of their cashier for you to send the safe keeping fee of $250 to her.
I am looking forward to your immediate response.

Yours in Service,

Mr. Richard Gozney

Despite the Nigerian address the email originates from 200.7.198.3 in Ecuador, although the phone number is definitely Nigerian and has been used for this type of scam many times before.

Amusing 419 from "EFCC Investigation Office Nigeria"

A novel take on the 419 scam:

Subject: DID YOU AUTHORIZE MR. JOHN WHEELER FOR YOUR FUND CLAIMS
From: Mooreh Rose {mrsrosemooreh44@yahoo.com.hk}
Date: Tue, January 20, 2009 10:51 am

- Attention; Beneficiary, I am Mrs. Rose Moore (Assistance) Chairman from Efcc Investigation Office Nigeria, there is presently a counter claims on your funds by one MR.JOHN WHEELER, who is presently trying to make us believe that you are dead and even explained that you entered into an agreement with him, to help you in receiving your fund, So here comes the big question. Did you sign any Deed of Assignment in favor of (JOHN WHEELER). thereby making him the current beneficiary
with his following account details: MR JOHN WHEELER, AC/NUMBER: 6503809428. ROUTING/122006743, B/NAME:CITI BANK, ADDRESS:NEW YORK,USA, we shall proceed to issue all payments details to the said Mr. John Wheeler, if we do not hear from you within
the next two working days from today Thanks Mrs. Rose Moore (Assistance) Chairman Efcc Investigation Office Nigeria

Clearly if I was dead then I wouldn't be reading the email. Just to wind this particular scammer up, I replied with the one word "yes". That should confuse them.

Originating IP is 83.138.172.72 which seems to be a favourite with 419ers.

A 419 spam with a twist

419 scams often involve pandering to human greed. In this case, the email is clearly designed to make you think that you have lucked into $800,000 through mistaken identity. Of course, the internal logic doesn't bear close scrutiny.

What's interesting about this email is that it has a calendar invitation on the bottom - clicking on it confirms your email address and presumably is designed to give the message an authentic twist.

Of course, there isn't $800,000 sitting around for you and you can guarantee that "Eze Ike" will try and bilk you out of some money along the way.

---

Vous êtes invité ::		Dear Friend,
Par votre hôte:		Eze Ike
Message:		Dear Friend, I didnot forgot your past effort and attemps to assist me, now I'm happy to inform you that i have suceeded in getting those funds transferred under the cooperation of a new partner from Japan. Now Contact my secretary ask him for ($800.000.00)for your compensation his,name is Mr,Mike Bello, and his E-mail:(ifeany_eze01@yahoo.co.uk) 1,Your Full Name___ 2,Delivery address___ 3,phone number____ 4,email address___ Thanks and God Bless You. REGARDS Dr,Eze Ike.
Date:		vendredi, 28 mars 2008
Heure:		10 h 00 - 11 h 00 (GMT+00:00)
Viendrez-vous ?

Répondre à cette invitation