Scammer in the U.S?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Not quite a Newb Joined: 28 Sep 2008 Posts: 25

I received a scam e-mail today about a British Online Lottery. I haven't been at this long, but I haven't received any of them from the US. The person that sent this has a Univ. of Houston e-mail address. Is that common? Sure this person would be harder to bait than someone in Africa / Asia where the language is more of a barrier?

Posted: Wed Oct 01, 2008 5:59 am

Please post the e-mail with full headers.

Not quite a Newb Joined: 28 Sep 2008 Posts: 25

Header
____________________________________________________
Delivered-To: [email protected]
Received: by 10.181.24.15 with SMTP id b15cs127345bkj;
Tue, 30 Sep 2008 03:56:50 -0700 (PDT)
Received: by 10.90.91.9 with SMTP id o9mr7094855agb.95.1222772205704;
Tue, 30 Sep 2008 03:56:45 -0700 (PDT)
Return-Path: <[email protected]>
Received: from sabine.mail.uh.edu (Sabine.Mail.UH.EDU [129.7.234.64])
by mx.google.com with ESMTP id 39si1424183agb.23.2008.09.30.03.56.34;
Tue, 30 Sep 2008 03:56:45 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of [email protected] designates 129.7.234.64 as permitted sender) client-ip=129.7.234.64;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of [email protected] designates 129.7.234.64 as permitted sender) [email protected]
Received: from mail.uh.edu ([129.7.234.64])
by mail.uh.edu (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006))
with ESMTP id <[email protected]>; Tue,
30 Sep 2008 05:56:30 -0500 (CDT)
Received: from [129.7.234.64] by neches.mail.uh.edu (mshttpd); Tue,
30 Sep 2008 11:56:28 +0100
Date: Tue, 30 Sep 2008 11:56:28 +0100
From: [email protected]
Subject: RESULT NOTIFICATION
Bcc:
Reply-to: [email protected]
Message-id: <[email protected]>
MIME-version: 1.0
X-Mailer: Sun Java(tm) System Messenger Express 6.2-6.01 (built Apr 3 2006)
Content-type: multipart/alternative;
boundary="Boundary_(ID_AsBA4INV1n3v2I4B12Rdzw)"
Content-language: en
X-Accept-Language: en
Priority: normal
____________________________________________________

BRITISH ONLINE
British Online Lottery
P. O. Box 4279
Liverpool, L70 1NL UNITED KINGDOM
(Customer Services)
Ref: BOL/101OXI/02
Batch: 16/211/0374

WINNING NOTIFICATION

We happily announce to you the draw (#954) of the British online Sweepstakes International program held on 21st Septembet, 2008 which was co-hosted by major domain providers like YAHOO ,HOTMAIL, and other well known domain providers, thereby giving every email user the legibility and opportunity to be randomly selected for the prize.

This means your email address registered you for the game.

Your e-mail address attached to ticket number: 56475600545 188 with Serial number 5368/02 drew the lucky numbers: ((13)-(43)-(06)-(15)-(02)-(40)bonus # (09),which subsequently won you the lottery in the 2nd category i.e match 5 plus bonus.

You have therefore been approved to claim a total sum of £250,000.00 (Two hundred and fifty thousand pounds sterling) in cash credited to file
BOL/9023118308/03

All participants for the online version were selected randomly from World Wide Web sites through computer draw system and extracted from over 100,000 unions, associations, and corporate bodies that are listed online.

Please note that your lucky winning number falls within our European booklet representative office in Europe as indicated in your play coupon. In view of this, your £250,000.00 (Two hundred and fifty thousand pounds sterling) would be released to you by any of our affiliated securities/couriers companies.

Our European agent will immediately commence the process to facilitate the release of your funds as soon as you contact him.

For security reasons, you are advised to keep your winning information confidential till your claim is processed and your money remitted to you in whatever manner you deem fit to claim your prize.

This is part of our precautionary measure to avoid double claiming and unwarranted abuse of this program. Please be warned.

To begin the claiming process of your prize you are to
contact our accredited dispatch officer with the information
you shall find below:

=============================================
Mr Perry Lawson
22 Garden Close, Stamford ,
Lincs , PE9 2YP , London
United Kingdom
E-mail: [email protected]
Tel: +447045722634

=============================================

Provide him with these following details with which he will begin the processing of your winnings.

1.Name in full.
2.Address.
3.Nationality.
4.Age.
5.Occupation.
6.Phone/Fax.
7.Present Country.
8.Fax [optional].
9.Email address.
10.Sex.
11.Winning Amount.

BELOW ARE PHOTOS OF SOME OF OUR LAST YEAR's WINNERS

Good luck from me and members of staff of the BRITISH ONLINE INTERNATIONAL LOTTERY.

OUR Executives:
Mrs Steffan Lloyd (ORGANIZER), Mr. Gerald Goodman (Manager Foreign Operations), Mr. Franklyn Van Der Weijden (Manager Domestic Banking Operations), Dr. Collin Powell (Director Online InternationalPromotions Unit), Mr Perry Lawson (Fiduciary Agent),Mr Robert Benjamin, Mrs. Lyudmyla Marchukova(Regional Manager), Mr. Stephen Boer (Chairman), Thomas Hills(Accounts Officer)

*Winners under the age of 16 is automatically disqualified.

Yours faithfully,

Mrs Steffan .K. Lloyds.
Online coordinator for British ONLINE
INTERNATIONAL LOTTERY.
Sweepstakes International Program.

Not quite a Newb Joined: 28 Sep 2008 Posts: 25

The funny thing is that Mr. Perry Larson's e-mail address had someone else's name in the address. Rolling Eyes

Posted: Wed Oct 01, 2008 6:20 am

It does appear to originate to the University of Houston, but notice that the reply to address is a standard hotmail address. It's a slightly strange one, so I'm making an educated guess.
I think that some student may be mass mailing this format out on behalf of someone else... possibly for a small payment.
There is the possibility that the address is being spoofed, but I don't know much about that side of things so it's speculation I'm afraid.

If it was me, I'd reply to the hotmail address and get hold of his script, then check the headers. See what that tells you. I get the feeling that it's not US based at all, although some lads do operate in the states. Bang off a reply and see what happens.

Don't be led to believe that a UK / USA etc based lad will be any easier / harder to bait because of better language skills. Most African based lads have perfectly good English skills anyway, it's one of the primary languages in many African nations.

EDIT: Have you tried googling the University email address? The results can be quite telling.

Posted: Wed Oct 01, 2008 6:50 am

Houston is mugu central. Lots of lads there. Used to see a lot of fake cheques from that area. If your Nigerian lad has a 'diplomat' in the US, he's quite likely to reside in Houston.

Posted: Wed Oct 01, 2008 6:54 am

Psychadelia: Do you think this is a low level lad, pushing out the initial formats? I'm just put off by the university address. Confused

Posted: Wed Oct 01, 2008 6:56 am

I've seen this before often, it's quite common. Catchers, yes. Either studying at the Uni, or using the Uni's network somehow. I'd guess the Uni has wireless access, and if it's there, the local mugun will exploit it. How hard can it be to get the WPA password?

Master of Master Baiters Joined: 26 Sep 2008 Posts: 689

Wow! London has expanded an awful lot since I last checked. About 150 miles northwards into Lincolnshire ..... Rolling Eyes

A quick search on one of the names at the bottom of the letter produced this (1st link on Google) http://www.crawley.org.uk/datalink.htm

Not quite a Newb Joined: 28 Sep 2008 Posts: 25

I googled it and got this from fraudwatchers.org. This is the exact same one that I got.

http://www.fraudwatchers.org/forums/showthread.php?p=65132

Posted: Wed Oct 01, 2008 7:18 am

I don't know if there's any mileage in sending the mail, with headers, to the University's network admininstrator. I seem to recall it was tried before, and met with indifference.

Not quite a Newb Joined: 28 Sep 2008 Posts: 25

Being that I'm so new with all of this, would anyone like a crack at trying to bait this person?

Posted: Wed Oct 01, 2008 7:48 am

It's just a standard Lotto format Gifford, why not have a go yourself? You'll learn from it. It's not like you can really mess it up... the worst that can happen is that he drops you.

For your first bait, just try and learn how this scam works. Reply to him like a normal victim would... Wow, I won? How much? Ask him a few questions, just one per email. See if you can bait him for over a week for starters. Enjoy! Smile

Posted: Wed Oct 01, 2008 8:11 am

It's more likely that the mail.uh.edu email address has been hacked or phished. Forwarding the original email to the University IT people would be the way to go. The intial scam email is often sent from an account that the lad is prepared to lose as opposed to the reply-to email address.

Baiting the hell out of the hotmail account would also be the way to go!

Not quite a Newb Joined: 28 Sep 2008 Posts: 25

Alright...I'll give it a go. I'll post any positive results that I get.

Posted: Wed Oct 01, 2008 10:17 am

Just found a reference to the Houston 419 connection here:

http://www.city-data.com/forum/houston/53374-nigerian-419-advance-fee-fraud-scammers.html

Trophy Videos · Posted: Wed Oct 01, 2008 6:48 pm

Gifford Pinchot wrote:

Alright...I'll give it a go. I'll post any positive results that I get.

Way to go, Gifford! Very Happy

Otterfan just completed a 43 week straight-bait of a lotto lad. There are tons of great tips for keeping your own guy going for a long time here, so check it out.
Welcome to eater, and good luck with your lad! Very Happy

http://forum.419eater.com/forum/viewtopic.php?t=126285

Hello I'm New here! Joined: 23 Sep 2008 Posts: 15

Some insight into this: Freshman are easy as hell to phish.

It just happened here at my school. It seems that a few weeks before the start of school each year, some emails will come out that are asking everyone to update their information, confirm it, whatever; pretty detailed and targeted phishing directed at students.

Out of the tens of thousands sent, a handful (usually freshman) will respond with their info. They then have access to the students email account. Schools usually have good standing with other ISP's and their scams flow out. It happened this year so bad that gmail, hotmail, yahoo, verizon, and others all blacklisted our servers. Two weeks later were still trying to get everyone able to send email everywhere.

Posted: Wed Oct 01, 2008 8:05 pm

I'll have a go if you don't want to. Just PM me the address.

Posted: Wed Oct 01, 2008 9:32 pm

^^ Ok jjb, where you sending him? Wink

Interesting prospect, come to think of it. Getting a Houston lad on safari.

They don't need to phish addies from unclued students. Addies to spoof when sending out hundreds of formats are easy to come by. All they need is a username and password for the Uni network, a car to park within wireless range, and a laptop. I could be wrong, but this is the most likely scenario IMHO. It's hard to imagine a crooked student thinking he or she would be safe sending out 419 formats from the dorm.

Posted: Thu Oct 02, 2008 12:22 pm

Not sure. Somewhere close. I did get an Atlanta lad to travel a few hundred miles, along with member bigox.

Baiting Guru Joined: 07 Jan 2007 Posts: 2922

^^^

Hash conditions-Galveston Island or the Bolivar Peninsula (won't get u a hat though) or send him downtown New Orleans.