Fake check scam starting in my country

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Wed Apr 11, 2007 3:08 pm

Humm, finally... It makes me feel ashamed and angered;
A scammer from my country:

X-Apparently-To: [email protected] via 66.196.101.27; Tue, 10 Apr 2007 21:39:58 -0700
X-Originating-IP: [193.223.101.198]
Return-Path: <[email protected]>
Authentication-Results: mta130.mail.re2.yahoo.com from=radikalartandcrafts.biz; domainkeys=neutral (no sig)
Received: from 193.223.101.198 (EHLO s10.hostway.ro) (193.223.101.198) by mta130.mail.re2.yahoo.com with SMTP; Tue, 10 Apr 2007 21:39:54 -0700
Received: from aongtr by s10.hostway.ro with local (Exim 4.52) id 1HbUbp-0004GX-3B; Wed, 11 Apr 2007 07:39:05 +0300
Received: from 193.93.96.187 ([193.93.96.187]) (SquirrelMail authenticated user [email protected]) by www.aongtr.ro with HTTP; Wed, 11 Apr 2007 07:39:05 +0300 (EEST)
Message-ID: <[email protected]>
Date: Wed, 11 Apr 2007 07:39:05 +0300 (EEST)
Subject: Free Instant Job Offer (Hurry Now!!!)
From: "Public Notice" <[email protected]> Add to Address BookAdd to Address Book Add Mobile Alert
Reply-to: [email protected]
User-Agent: SquirrelMail/1.4.8
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - s10.hostway.ro
X-AntiAbuse: Original Domain - yahoo.com
X-AntiAbuse: Originator/Caller UID/GID - [32490 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - radikalartandcrafts.biz
X-Source: /usr/local/cpanel/3rdparty/bin/php
X-Source-Args: /usr/local/cpanel/3rdparty/bin/php /usr/local/cpanel/base/3rdparty/squirrelmail/src/compose.php
X-Source-Dir: :/base/3rdparty/squirrelmail/src
Content-Length: 3506

Radikal Art & Craft Center
201 Cromer Road
Erpingham,Norwich NR11 7QE
Tel/Fax: +44-870 478 7122
E-mail: [email protected]
Website: www.radikalartandcrafts.biz

Dear Sir/Madam,

Radikal Art & Craft Center. is an European Art & Craft Company, which
has
a Standardized branches here in UK. Radikal Art & Craft Center is a
full
range of Art & Craft works such as, raku fired,crystal glazed ceramics,
porcelain agateware, fussed,blown glass ware,turned wooden bowls,hand
crafted boxes,colourful scarves, bags,textiles,hedgerow baskets,silver
and
beaded jewellery worldwide. We have reached big sales volume of
Constructing Materials in Europe and now are trying to penetrate the
USA/Canada market. Quite soon we will open representative offices or
authorized sales centers in the USA/Canada and therefore we are
currently
looking for people who will assist us in establishing a new
distribution
network there. The fact is that despite the USA/Canada market is new to
us
we already have regular clients infact our products speak for itself.

WHAT YOU NEED TO DO FOR US:

But we have a problem that's setting us back. We have some problem
collecting our payments from our USA/Canada clients. The international
money transfer tax for legal entities (companies) in USA is 25%,
whereas
for the individual it is only 7%.There is no sense for us to work this
way, while tax for international money transfer made by a private
individual is 7% .That's why we need you. We need agents to receive
payment for our products (in Money Orders or Checks ) from our clients
in
the USA/Canada and to send the money to us via Western Union Money
Transfer, or any related Money Transfer Agent. This way, we will save
money because of tax decreasing.

JOB DESCRIPTION:
1. Receive payment from Clients
2. Cash Payments at your Bank or Exchange Rate Offices
3. Deduct 10% which will be your percentage/pay on Payment processed.
4. Forward balance after deduction of percentage/pay to any of the
offices
you will be contacted to send payment.

HOW MUCH WILL YOU EARN ?
*10% from each operation. For instance: you receive $8000 via Checks or
money orders on our behalf. You will cash the money and keep $800 (10%
from $8000) for yourself; at the beginning your commission will equal
10%,though later it will increase up to 12% as you can earn up to
$80,000-$150,000 anually from us.

ADVANTAGES:
You don't have to go out as you will work as an independent contractor
right from your home office. Your job is absolutely legal. You can earn
up
to $10,000-$20,000 monthly depending on time you will spend for this
job.
You do not need any capital to start. You can do the work easily
without
leaving or affecting your present Job. The employees who make efforts
and
work hard have a strong possibility to become managers.

Anyway our employees never leave us.

MAIN REQUIREMENTS
* 18 years and above
* Legally capable
* Responsible
* Interested Persons/Applicant are required to Forward The Following
Informations Below.

Name:
Address Line 1:
Address Line 2:
City:
State:
Zip:
Phone:
Occupation:
Age:
Marital Status:

You will be contacted by a staff of the company in 48hrs on your
response
of interest for the Job Position and you will be Informed on when you
will
receive the first set of Payments.

For more information, visit our public Website
www.radikalartandcraft.biz.
OR contact Public Notice Manager, Mr. Brian Graham on
[email protected].

Radikal Art & Craft Center.
Public Notice Section.

I think I'll try to pinpoint their location and then report them to the Police. There are precedents of scammers/falsifiers apprehended and sentenced.

Posted: Wed Apr 11, 2007 3:16 pm

If it's any consolation, we've got scammers on my side of the pond too, who are involved in the 419 games and the fake check scams.

Wherever you find humans, you'll find scam artists.

Baiting Guru Joined: 17 Sep 2006 Posts: 5905

After checking the IPs it is hard to confirm where this scammer is as it seems to have come from two possible IPs. In his mail he says he is in the UK a "who is" search on 193.93.96.187 suggests the ISP is in Israel and IP android resolves his location to West Africa (most probably Nigeria or a boardering country). However as Barr Kelly says there are scammers all over the world.

The other IP 193.223.101.198 resolves to Romania.

Posted: Wed Apr 11, 2007 3:29 pm

Nah, this ones are in my fxxxxxx country.
Check these IP's:

193.223.101.198
193.93.96.187

They are on my turf now, and oh boy, are they gonna PAY!!!

Posted: Wed Apr 11, 2007 3:36 pm

It looks like the website & email domain are already dead

Posted: Wed Apr 11, 2007 3:40 pm

I found the town this e-mail was sent from, but I'll have to be a lot more specific to seek the police on them.
I'll try to find the IP provider.

Posted: Wed Apr 11, 2007 10:49 pm

Quote:

Received: from 193.93.96.187 ([193.93.96.187]) (SquirrelMail authenticated user [email protected]) by www.aongtr.ro with HTTP; Wed, 11 Apr 2007 07:39:05 +0300 (EEST)

This line was added by the originator mail server (Squirrel using the HTTP interface). It says that the computer from where the mail is being sent is at 193.93.96.187. The IP belongs to Ariave Satcom LTD in Israel but the terminal could be anywhere, or wherever Ariave is selling services. They don't own satellites (as far as I know), they're buying services from PanamSAT and New Skies (AFAIK).
A lot of the scam messages come through GilatSAT, another satellite company from Israel, and they're known to be originated in Nigeria. I've seen a lot of Gilat bills and support contacts messages related to Nigerian customers (don't ask).
Ariave was present at the 2003 GVF (Global VSAT Forum) conference held in Abuja, Nigeria. Their coverage includes Africa, Europe, Asia and Oceania. So, it's reasonable to assume that they have customers in Nigeria, the country with the highest number of VSATs installed in Africa.

Quote:

Received: from aongtr by s10.hostway.ro with local (Exim 4.52) id 1HbUbp-0004GX-3B; Wed, 11 Apr 2007 07:39:05 +0300

This line was (most likely) added by the mail server, reporting that it has received this message from the HTTP interface.

Quote:

Received: from 193.223.101.198 (EHLO s10.hostway.ro) (193.223.101.198) by mta130.mail.re2.yahoo.com with SMTP; Tue, 10 Apr 2007 21:39:54 -0700

This line was added by Yahoo, reporting that it has received this message from a mail server that identified itself as s10.hostway.ro. The IP is in Romania which is reasonable because the server is romanian, but it has nothing to do with the location of the scammer.
If you look closely, you'll notice that the user who sent the message identified itself as [email protected] (aongtr.ro a domain hosted at hostway.ro). The "From" field and the "Return-Path" can be changed to anything the user wants (unless the server prevents him from doing it).

Posted: Wed Apr 11, 2007 11:09 pm

I sense your anger fillosaurus, but the fact is that there are 1'000's of 419 scammers in the UK and some appear on recordings here taken from webcams. Some of the webcams must be getting a reputation as a Lad meeting place. But there are also thousands in Europe and the USA and Canada too. I even recently made some calls for a baiter to a Lad in Jakarta.

It is a rare opportunity you get to put one in police custody, and it would be a significant event, though there are baiters here who have managed it. You'll achieve more by baiting and learning as much as you can here than trying for the most difficult feat of all, without learning the basics. You are likely to become frustrated and bored otherwise.

It is every baiters amition, but don't aim too high to begin with. There are tactics you can use to make an arrest more likely for a Lad, but verifying it is another issue.

Posted: Wed Apr 11, 2007 11:23 pm

Of course. I would not send an innocent's man's IP to the police.
But then again...
I'll hunt those IP's.
I am familiar with the laws, and we do not take kindly with scammers.
One of me friends is a high ranking official fighting against organised crime.
Let me say I got to touch his Glock (No pun) without the magasine inserted.
He's in a special squad; the squad against terrorism, financial crimes (the really heavy ones), and mafia.

Baiting Guru Joined: 31 Jan 2007 Posts: 12237

Yup... the email is dead. (This one: [email protected])

Edit: This one is still alive. [email protected]

Asem sent.

Posted: Wed Apr 11, 2007 11:40 pm

Nevermind;
I know their IP's, I know their location, and I'll keep on hunting them.

BTW, I'm NOT an english native speaker, so forgive me grammar.
And oh, I'm not a lad, even if one of me pets asked if I do not want to be his oba.

Posted: Wed Apr 11, 2007 11:50 pm

Their nationality does not matter.
Their colour does not matter.
They are scammers.

This is one of me dreams: A scammer doing some time; in a secure prison;

Baiting Guru Joined: 31 Jan 2007 Posts: 12237

Pardon me if this is out of line, but you seem a bit emotionally attached to this. Be careful, actions taken out of emotion and haste can yield dangerous results.

Posted: Thu Apr 12, 2007 12:03 am

@ Pastor Frank
Maybe you are right

Why hello Pastor Frank; nice boobs;
I'll send them some veeeery niiice Romanian curses.
They cannot be properely translated into english.

Very Happy

and yes I do like the boobs; too bad they are not yours Embarassed

It seems you are a big fan of Monty too

Baiting Guru Joined: 31 Jan 2007 Posts: 12237

^^
Yes: they are nice boobs
No: they are not mine (I have a willie)
Yes: I am a MP fan (Wolf nipple chips!)

Wink

Posted: Thu May 10, 2007 9:00 am

This to a young lady who has received one of Radikal's Checks, but will not part with the balance until her Bank Manager clears it with her for real

Delivered-To: [email protected]
Received: by 10.65.141.15 with SMTP id t15cs271317qbn;
Tue, 8 May 2007 02:18:37 -0700 (PDT)
Received: by 10.67.20.3 with SMTP id x3mr338467ugi.1178615917421;
Tue, 08 May 2007 02:18:37 -0700 (PDT)
Return-Path: <[email protected]>
Received: from web23406.mail.ird.yahoo.com (web23406.mail.ird.yahoo.com [217.146.189.91])
by mx.google.com with SMTP id c1si327186ugf.2007.05.08.02.18.35;
Tue, 08 May 2007 02:18:37 -0700 (PDT)
Received-SPF: neutral (google.com: 217.146.189.91 is neither permitted nor denied by domain of [email protected])
DomainKey-Status: good (test mode)
Received: (qmail 32667 invoked by uid 60001); 8 May 2007 09:18:35 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.co.uk;
h=X-YMail-OSG:Received:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID;
b=ZPxp769WvxdiGWZqRJt0u4fxdBaex9bGF3mZJqiA16+RVkzzSejGciUj2jrlfRsk3h+jnKSCmHtT0y9907rqvtjXvS/WMzsNc5t360RitLXgaVbIgiYn7AOazR8sCnad0OkoUxWaRCXYJkKHgoey7yh2c0IT6z1zXM473fwzm+I=;
X-YMail-OSG: ZJUwL0cVM1mGNOxwHv_ocIEwK02kgxVKgPq_VftPh54VP44dHfw.YqeiyczeuMp5lw--
Received: from [196.220.3.196] by web23406.mail.ird.yahoo.com via HTTP; Tue, 08 May 2007 10:18:35 BST
Date: Tue, 8 May 2007 10:18:35 +0100 (BST)
From: Radikal Art & Crafts Center <[email protected]>
Subject: HELLO
To: Delma Notis <[email protected]>
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1722071934-1178615915=:31456"
Content-Transfer-Encoding: 8bit
Message-ID: <[email protected]>
--0-1722071934-1178615915=:31456
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit

from Radikal Art & Crafts Center <[email protected]> hide details May 8 (2 days ago)
to Delma Notis <[email protected]>
date May 8, 2007 7:18 PM
subject HELLO
signed-by yahoo.co.uk

Dear Delma,
I am in receipt of your letter below with an update on funds,Delma,i have come a long way in this bussiness,all my customers have proven honest and they will not at this time we are sharing good bussiness relationship and fail me,i give you my word,incase the funds did not finally go through,my company will bear the lost and not you my employee,that anyway i do not foresee,please go ahead and transfer the funds today at the earliest convinience,please remember my bussiness is yours also,you will highly be favoured if you transfer the funds urgently as we are running short of materials and presently we have a cotract with wallmart and time is of essence to their demand,we banked our hope on the funds in your care in other to secure the materials from our wood suppliers in Africa,we recently floated a charity home and lacked funds,my wife is even ready to go hungry and see that the less previledge are allright,she has a bigheart and this invariable is affecting our company funds,but i enjoy the peace we have from above for helping the less previledge.Treat urgently and do not hesitate to ring me directly if you have any further concern.
Thank you
Mr.Graham
Tel: + 44-701 114 1072

Now there are a few morals to this story.
One, it shows the complete honesty of the sender, Mr Graham from Radikal
Two, The IP resolves to Nigeria
Three, The young lady in question never received any cheque whatsoever, although perhaps the details she supplied to Radikal were not accurate, as no real names or locations are used.
The young lady, Delma is not as silly as she sounds.

Fake check scam starting in my country	View next topic View previous topic