Email Spam Filter:
jwSpamSpy
Try it for free!


About spam / "419" / Blog
jwSpamSpy
Recent spam domains
Spam domain blacklist

Software
Links
joewein.de
joewein.net
Contact
Google

 

Beware of Fraud: Mailer order shipping to Nigeria

Beware when you receive sales inquiries such as the following, which don't mention any specific products and involve shipping to risky countries. Below are several examples of typical fraud emails from Nigeria.

jwSpamSpy
Are you sick of spam too? Do you want it stopped now?
Try jwSpamSpy, the spamfilter we use to track the spammers!
Free 30-day trial version available now!

Exhibit #1:

From: "tony smith" <tonystore@atlas.cz>
To: <someotheraddress>
Sent: Friday, 22 October, 2004 10:16
Subject: mail order,,,,,,,,,,,,,,


ATTENTION:SALES
Sir/madam,
It is my easrnest interest to write you,my clients saw your address on
the internet ,they have also visited your website and found your
products good to them.My company is a consultant in America here.my clients are interested in your products and they are situated in Nigeria.they are interested in buying your products I will be very glad if you will respond to my request as soon as possible to enable us start a good business relationship and also the payment option of my company is through credit card (not paypal) and my shipping method is via United Parcel Service (UPS) or fedex express. Looking forward to recieving from you soon.
Thanks.

Exhibit #2:
From: "jose smith" <jose_store@yahoo.com>
To: <recipientaddress>
Sent: Friday, 22 October, 2004 9:57
Subject: mail order....



ATTENTION:SALES
Sir/madam,
It is my easrnest interest to write you,my clients saw your address on
the internet ,they have also visited your website and found your
products good to them.My company is a consultant in America here.my clients are interested in your products and they are situated in Nigeria.they are interested in buying your products I will be very glad if you will respond to my request as soon as possible to enable us start a good business relationship and also the payment option of my company is through credit card (not paypal) and my shipping method is via United Parcel Service (UPS) or fedex express. Looking forward to recieving from you
soon.
Thanks.



---------------------------------
Do you Yahoo!?
Y! Messenger - Communicate in real time. Download now.

Exhibit #3:
From: "TERRY SMITH" <terrystore@atlas.cz>
To: <recipientaddress>
Sent: Wednesday, 27 October, 2004 9:24
Subject: MAIL ORDER.....
HELLO SALES, THIS GREETING IS FROM TERRY OWNER. WE BASED ON SELLING GOODS AND I WILL LIKE TO ORDER FOR SOME GOODS IN YOUR STORE I WILL LIKE YOU TO SHIP THEM TO ME IN LAGOS NIGERIA VIA FEDEX OR UPS EXPRESS AND I WILL LIKE TO MAKE MY PAYMENT BY MY CREDIT CARD DETAILS ISSUE IN MY COUNTRY,WHICH IS UNITED STATE AND PLS I WILL BE EXPECTING YOUR URGENT REPLY TO GIVE ME AN AUTHORITY TO GO AN CHOOSE AN PRODUCT NEEDED. THANKS AND REGARDS
Exhibit #4:
From: tony smith <tony_store@hotmail.com>
To: <recipientaddress>
Sent: Friday, October 29, 2004 4:13 AM
Subject: MAIL ORDER.....

I want to purchase from your store to lagos nigeria, i will like to know if you ship to Nigeria and accept credit card as means of payment, kinldy get back to me as soon as possible for me to forward to you the items needed from you.
Regards,
Tony Smith.

_________________________________________________________________
Don't just search. Find. Check out the new MSN Search!
http://search.msn.com/

Exhibit #5:

From: Benedict James <walindainternational@gendistributor.com>
To: walindainternational@gendistributor.com
Sent: Thursday, 18 November, 2004 2:00
Subject: Urgent Order....

Dear Sir/Madam
My name is Benedit James a citizen of NYC but i have a store in nigeria which i would like the items to be shippied toand i came across your product which i am
interested in purchasing your product . I will like you to please get back to me
if it is still available in stock or not?. If it is,please be sure to
provide us
with the following
informations.
Seller's full name
Seller's full contact address and phone number.
We will be very happy if you can provide us with the above
requested informations.We will also like to state here that payment for the items would be made via credit card
Regards
benedict james


Several things are odd about these messages:

  • In #1 and #5, mail was not addressed to the recipient. Actually, it has been sent to many recipients via Bcc (blind carbon copy), which normally produces a "Recipient list suppressed" message or shows "None" as the recipient, unless one specific recipient is listed.
  • Sender #1 and #3 use a free webmailer hosted in the Czech Republic used by many Nigerian 419 scammers. We have over 140 email addresses for the 419 fraud in our files for this provider. Sender #2 is also a free webmailer popular with Nigerian scammers.
  • Sender #5 used a very recently registered domain. It was hosted by Rediffmailpro.com, a web hoster in India which is often used by Nigerian scammers (see examples).
  • Emails #1 and #2 are almost identical, except for the sender address and the first name used. Mails #1, #2 and #3 use the same common surname. There are probably more of these going around.
  • Sender discloses no postal address or even location.
  • Sales involving shipping to an address other than the person who places the order.
  • All messages make a point of mentioning payment by credit card. These buyers are not interested in using any other form of payment. This is odd, considering that some of the buyers claim to be in the USA, where cheques (checks) are quite commonly used for payment.
  • Mail was sent to a personal email address, not to a business. Ricipient #3 is a spamtrap address not currently used for any valid email.
  • "Benedit James" (#5) is so unfamiliar with his own name that he manages to misspell it.

Even though the sender in #1, #2 and #5 claim to be US-based, the IP address in #2 (81.23.193.88) traces to an Irish satellite ISP that provides connectivity for Nigeria:

     inetnum:      81.23.193.80 - 81.23.193.95
     netname:      WEB-SAT-ISP-NETBLK1
     descr:        Web-Sat ISP services - dmz
     country:      IE
     admin-c:      MS4605-RIPE
     admin-c:      AG1614-RIPE
     tech-c:       WSO2-RIPE
     status:       ASSIGNED PA
     mnt-by:       WEB-SAT-MNT
     notify:       noc@web-sat.com
     changed:      mike@web-sat.com 20021031
     source:       RIPE
     
     route:        81.23.192.0/20
     descr:        Web-Sat ISP services
     origin:       AS12488
     mnt-by:       WEB-SAT-MNT
     changed:      mike@web-sat.com 20031001
     source:       RIPE
     
     role:         Web-Sat ISP Operations
     address:      Unit 3, Bluebell Industrial Estate
     address:      Dublin 12
     address:      Ireland
     phone:        +353 1 4501711
     admin-c:      MS4605-RIPE
     admin-c:      AG1614-RIPE
     tech-c:       MS4605-RIPE
     tech-c:       AG1614-RIPE
     e-mail:       noc@web-sat.com
     nic-hdl:      WSO2-RIPE
     notify:       noc@web-sat.com
     changed:      nick@iol.ie 20021011
     source:       RIPE
     
     person:       Mike Smith
     address:      Unit 3, Bluebell Industrial Estate
     address:      Dublin 12
     address:      Ireland
     phone:        +353 1 4501711
     e-mail:       mike@web-sat.com
     nic-hdl:      MS4605-RIPE
     notify:       mike@web-sat.com
     mnt-by:       WEB-SAT-MNT
     changed:      mike@web-sat.com 20040818
     source:       RIPE
It's similar for #5: Despite the sender claiming to be in New York City, the IP address logged by Rediffmailpro for webmail posting belongs to a business in Abuja, Nigeria connected via a satellite uplink:
     OrgName:    Microcity Computers 
     OrgID:      MICRO-50
     Address:    1579 Kayes st
     City:       Abuja
     StateProv:  Nigeria
     PostalCode: 
     Country:    NG
     
     NetRange:   66.178.80.176 - 66.178.80.183 
     CIDR:       66.178.80.176/29 
     NetName:    MICROCITY-COMPUTERS
In one of these cases an order was placed. The shipping address provided to the (fortunately scam-aware) business was:
ANTHONY SMITH
142 Isolo road ,
Mushin ,
Lagos 23401,
Nigeria.


Found at http://www.geek.com/news/geeknews/2001oct/bch20011025008521.htm:

Product enquiry (8:23am EST Mon Oct 04 2004)


Hello Sales,

I am Mandy,the CEO of mandywoodconsularstore ltd,I brows through your website and i found it interesting and i saw some items need to supply some of my clients. Please try and get back to me with the price list of your product including the shipping cost to the following address below

SHIPPING TO
Name : Mandy wood
Address : 12 KOGBEREGBE STREET
City : ISOLO
State : LAGOS STATE
Zip code : 23401
Country : NIGERIA.

As soon as possble, so that i can proceed with selecting and payment via credit card (VISA CARD OR MASTERCARD) AND IF YOU WISH, I ACN ALSO AFFORD YOU INTERNATIONAL CHEQUE OR MONEY ORDER,wish to hear from you soon.

Regards.
Mrs Mandy. mandywoodconsularstore@yahoo.com - by madny wood

Red flags: Starts with "Hello Sales" or "Dear Sales", from Webmailer address, no phone number, typo in sender's name, no specific products mentioned, posting in inappropriate forum.


From: "alexandria davis" <alexdavis@jmail.co.za>
To: <alexdavis@jmail.co.za>
Sent: Sunday, 27 February, 2005 23:39
Subject: ORDERING ENQUIRIES!!!!!!!!!


DEAR SELLER,
  WITH CLASSIFIED AD MADE ON INTERNET ,I
WISH TO MAKE AN ORDER FOR BLOCK TIES.,KINDLY GIVE
ME THE PRICE QUOTATION IF YOU  YOU HAVE.I WISH TO MAKE AN
ORDER  AS SOON AS POSSIBLE.HOPE TO READ FROM
YOU SOONEST.

FROM,
ALEX DAVIS,
BRAILE WORKSHOP STORE

Despite the South African webmail service that email came from Nigeria:

Received: from [66.178.81.106] (account alexdavis@jmail.co.za)
  by mail01.infosat.net (CommuniGate Pro WebUser 4.1.8)
  with HTTP id 652945809; Sun, 27 Feb 2005 16:39:01 +0200
WHOIS details for sending network (IP 66.178.81.106):
     OrgName:    INTERFINISH COMMUNICATIONS GROUP 
     OrgID:      ICG-43
     Address:    66, BODE THOMAS ST
     City:       Lagos
     StateProv:  Lagos
     PostalCode: 
     Country:    NG
     
     NetRange:   66.178.81.104 - 66.178.81.111 
     CIDR:       66.178.81.104/29 
     NetName:    INTERFINISH
     NetHandle:  NET-66-178-81-104-1
     Parent:     NET-66-178-0-0-1
     NetType:    Reassigned
     Comment:    
     RegDate:    2004-07-22
     Updated:    2004-07-22
     
     OrgTechHandle: YOS-ARIN
     OrgTechName:   OSHIKOYA, YOMI 
     OrgTechPhone:  234-803-330 8688
     OrgTechEmail:  yomi@interfinishwireless.com


Nigeria is but one of several high risk countries for accepting mail order business from. Other countries in that category (with varying degrees of risk) are: Indonesia, Romania, Ukraine, Yugoslavia, Lithuania, Egypt, Bulgaria, Turkey and Russia.

Many mail order businesses refuse to ship to these countries or take precautions to verify the identity of the buyer vs. the credit card. Ask for the 3 or 4-digit security code at the back of the card. You have to make absolutely sure that the shipping address for the order matches the billing address for the credit card or you could lose your merchandise and be stuck with a fee by the credit card company, even if the amount of the transaction is confirmed by the card company. If anything looks odd, don't take the risk.

Please read the recommendations at the following websites:

jwSpamSpy
Are you sick of spam too? Do you want it stopped now?
Try jwSpamSpy, the spamfilter we use to track the spammers!
Free 30-day trial version available now!