You are being scammed. Call the UK Security Agency

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Thu Nov 27, 2008 2:56 pm

Who appear to originate from an IP Address in Lagos, strangely enough.

Quote:

101 Endsleigh Street, London WCIH oDD,
United Kingdom.
Tel; +44(0)7024099770
Fax; +44(0)7025099707
Email; [email protected] OR
[email protected]

UK Security Agency is stopping on-line business due to the high level of Scam and Fraud business in some countries and setting up another easy way to make and secure your money.

The UK Security Agency has ten (10) branches all over the world to guard and protect people on their on-line business,involving a lot of effort and dedication. The main objective of these initiatives is the fight against corruption.
Many people have been duped due to insufficient information and lack of security, now our main aim is to STOP scam business.

At times we receive emails like "YOU HAVE WON A LOTTERY", SEEKING YOUR HELP", NEXT OF KING", OIL IN THE LAND". and so many others please when you receive these kind of mail DO NOT reply and if you MOST reply first contact UK Security Agency for assistant and investigation.

Lastly if you are once a victim of Scam business or have on-going business please DO NOT hesitate to contact us on the above address.

We would like to hear from you!

HENRY VAN WALSUM
Director,
UK Security Agency.

Well I have quite a few suspicious email here that I would like them to check out. Never been asked to be a next of King though. Wonder if there will be a fee for their services?

This is a new modality on me and given the times I've been asked "is this a scam" I can see some people falling for this.

Feel free to rip them a new a**ehole. - Headers below

----------------
Headers

Delivered-To: [email protected]
Received: by 10.64.149.9 with SMTP id w9cs103191qbd;
Wed, 26 Nov 2008 20:00:59 -0800 (PST)
Received: by 10.214.149.3 with SMTP id w3mr6321873qad.111.1227758458779;
Wed, 26 Nov 2008 20:00:58 -0800 (PST)
Return-Path: <[email protected]>
Received: from blu0-omc2-s34.blu0.hotmail.com (blu0-omc2-s34.blu0.hotmail.com [65.55.111.109])
by mx.google.com with ESMTP id 4si2606130yxj.7.2008.11.26.20.00.58;
Wed, 26 Nov 2008 20:00:58 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 65.55.111.109 as permitted sender) client-ip=65.55.111.109;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 65.55.111.109 as permitted sender) [email protected]
Received: from BLU120-W30 ([65.55.111.73]) by blu0-omc2-s34.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Wed, 26 Nov 2008 20:00:57 -0800
Message-ID: <[email protected]>
Return-Path: [email protected]
Content-Type: multipart/alternative;
boundary="_83672eb6-2d49-4f1a-853c-06592cab2583_"
X-Originating-IP: [77.70.128.190]
Reply-To: <[email protected]>
From: your inbox <[email protected]>
Subject: UK Security Agency
Date: Thu, 27 Nov 2008 04:00:58 +0000
Importance: Normal
MIME-Version: 1.0
Bcc:
X-OriginalArrivalTime: 27 Nov 2008 04:00:57.0669 (UTC) FILETIME=[C0A33750:01C95044]

--_83672eb6-2d49-4f1a-853c-06592cab2583_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Baiting Guru Joined: 17 Sep 2006 Posts: 5905

Quote:

At times we receive emails like... NEXT OF KING

Another slick professional con pitch brought to you courtesy of "The Lads From Lagos." Rolling Eyes

And they pay money for these scripts Laughing

Posted: Thu Nov 27, 2008 3:18 pm

Da de Cool lost some orphans to scammers can they help

Mr H3nry,

I belief mine orphanage was one of your victims of scam it was the 'Next of Kin' one
how can you help as we at orphange need more orphans

Da de C00l
Dir3ktor

Posted: Thu Nov 27, 2008 4:10 pm

Quote:

This is a new modality on me

Recovery scam, but they usually tell you they can get your money back in the first email.

Posted: Fri Nov 28, 2008 12:49 am

Has anybody warned the queen or Prince Charlie that there is a 'next of king' scam doing the rounds?

Not quite a Newb Joined: 30 Aug 2008 Posts: 54

I just now got something very similar, but more professional looking and with a link to a fraudulent registration site. It looks like it's coming from the US,
but I can't be sure:

----------------------------
*** FRAUD WARNING *** vpd <[email protected]

From vpd Thu Nov 27 15:33:25 2008
Return-Path: <[email protected]>
Authentication-Results: mta133.mail.ac4.yahoo.com from=gmail.com; domainkeys=pass (ok)
Received: from 209.85.128.190 (EHLO fk-out-0910.google.com) (209.85.128.190)
by mta133.mail.ac4.yahoo.com with SMTP; Thu,
27 Nov 2008 15:33:26 -0800
Received: by 10.180.222.14 with SMTP id u14mr2522616bkg.141.1227828805315;
Thu, 27 Nov 2008 15:33:25 -0800 (PST)
Received: by 10.181.138.17 with HTTP; Thu, 27 Nov 2008 15:33:25 -0800 (PST)
Message-ID: <[email protected]>
Date: Thu, 27 Nov 2008 15:33:25 -0800
From: vpd <[email protected]>
To: (A BUNCH OF EMAIL ADDYS)

Subject: *** FRAUD WARNING ***
Content-Type: multipart/alternative;
boundary="----=_Part_53718_1182860.1227828805302"

My name is Det Mark Fenton and I am with the Vancouver Police Department. I investigate online fraud.

You have either been sent a cheque or, will receive one shortly:

*** IT IS COUNTERFEIT ***

If you attempt to cash the cheque YOU will be held responsible for any funds lost.

This particular scam will involve you cashing the counterfeit cheque and sending money to another country.

Cashing these counterfeit cheques could make you
liable for the entire amount once the bank identifies it as counterfeit.
If you have cashed it and sent money via Western Union
or MoneyGram, attempt to stop the transaction immediately.
If you are successful, take the money back to the bank and explain the situation.

File a police report immediately.

If you reside in Canada, make an online report to Phonebusters or (Phishing site). or, make your report to your local police.

US citizens should make their reports to both their local police and the US Postal Inspectors in their area.

*** CEASE ALL COMMUNICATION WITH THE SCAMMERS. IF THEY CALL, HANG UP. IF THEY EMAIL DO NOT RESPOND***

Never tell the criminal anything--especially that you have been warned. By warning the sender you could face criminal charges OF OBSTRUCTION OF JUSTICE.

--
Detective Mark Fenton
Vancouver Police Department
Tech Crime Unit--Internet Investigations
Office: 604-717-2565 Fax: 604-665-2331
--------------------------------------------------------------

Posted: Fri Nov 28, 2008 1:26 am

that one sounds like a fun one to do, Angelfish. Mind if I steal him?

Not quite a Newb Joined: 30 Aug 2008 Posts: 54

Please be my guest. I just found out that the dectective named is a real person with that police dept. and in the division of internet crime.

Do you want me to pm you the link used?

Posted: Fri Nov 28, 2008 1:51 am

sounds good Smile

Posted: Fri Nov 28, 2008 5:12 pm

Why would you want to bait a policeman or am I missing something here?

JumpinJayJay wrote:

that one sounds like a fun one to do, Angelfish. Mind if I steal him?

Posted: Fri Nov 28, 2008 5:26 pm

^^^
The fact that it shows the name and address of a real policeman, doesn't mean that it's from him.
As it was sent from a gmail address to multiple people, it's a scam. The only uncertainty is what type of scam it is.

Edit
Not that you can always trust police emails of course.
www.theregister.co.uk/2008/11/28/urban_myth_email/

Posted: Fri Nov 28, 2008 7:36 pm

It's not a scam, it's a warning email, for godsake do some research before pointing the finger!

http://www.fims.uwo.ca/NewMedia2007/page55821745.aspx

http://www.linkedin.com/pub/9/1bb/764

EDIT:

I've spoken to him and as suspected, he uses a gmail account for 2
very good reasons, firstly, by the very nature of the emails, he is prone to
being very heavily spammed back so has to keep changing email addresses

Secondly, if he used an official email address, again by the nature of emails
being received, they would almost certainly be stripped by the filters.

Mark is one of the good guys, his full name and contact details are clearly
posted!

Not quite a Newb Joined: 30 Aug 2008 Posts: 54

Mark Fenton is definitely one of the good guys, but that email sent out is not from him. I would think he's busy enough that he would hardly send out multiple emails to people he doesn't know and saying this (which he would have no way of knowing)

Quote:

You have either been sent a cheque or, will receive one shortly

He also wouldn't include a link to a fake website that is NOT secure and does NOT have the right address, and that asks for personal information.

Mark Fenton's name is on quite a few website, and scammers would have no problem finding it and using it for just this purpose.

Here's what I get when I go to the linked site:

Quote:

There is a problem with this website's security certificate.

The security certificate presented by this website was issued for a different website's address.

Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server.
We recommend that you close this webpage and do not continue to this website.
Click here to close this webpage.
Continue to this website (not recommended).
More information

If you arrived at this page by clicking a link, check the website address in the address bar to be sure that it is the address you were expecting.

If you choose to ignore this error and continue, do not enter private information into the website.

Posted: Fri Nov 28, 2008 9:45 pm

Dr I B
Baiters are more suspicious than many, and I'd much rather take a genuine email as a scam than be fooled by a scam. And as the website has tripped angelfish's browser's anti-phishing warning, I don't see how the email can be genuine.
I haven't been able to confirm that the phone number on the email belongs to the police, so how do you know you spoke to the real detective?

Angelfish, can you quote the website address, or PM it to me?

Edit. Is there any reason for you to have been sent a genuine warning? Such as running a bait that would result in you being sent a fake check.

Posted: Fri Nov 28, 2008 10:12 pm

Because he's working with someone I know, who by the way, has had two scammers in the states arrested this week!

Not quite a Newb Joined: 30 Aug 2008 Posts: 54

OK, I"m not the best at all when it comes to tracing emails, but why does the original email appear to originate in California when Det. Fenton is in Vancouver, Canada? Am I wrong about that?

Mr Tamourine Man, here's the site that tripped my anti-phishing warning:

https://recol.ca/intro.aspx?lang=en

This is a real site that you can get into with no problem if you type it in on your own, but following the link in the email gives the warning.

I don't understand it, but perhaps someone else more savvy than I may.

Quote:

Is there any reason for you to have been sent a genuine warning? Such as running a bait that would result in you being sent a fake check.

Absolutely not. I've never even had a dialogue with any scammers on that email address.

Posted: Fri Nov 28, 2008 11:14 pm

Angelfish wrote:

OK, I"m not the best at all when it comes to tracing emails, but why does the original email appear to originate in California when Det. Fenton is in Vancouver, Canada? Am I wrong about that?

Because you can't tell where a gmail email comes from, that's why most baiters use gmail!

Quote:

Mr Tamourine Man, here's the site that tripped my anti-phishing warning:

https://recol.ca/intro.aspx?lang=en

This is not a phishing site, there is an error with the coding, if you go to www.recol.ca and click on the English
tab, it takes you to that same page with no problems.

Will you give this guy a break?

Not quite a Newb Joined: 30 Aug 2008 Posts: 54

Okay, thanks for the tip about gmail. I wasn't aware of that since I was able to trace other scam emails I've gotten on my Gmail acct to Nigeria and Dakar, exactly where the scammers said they were.

I earlier emailed back to Det. Fenton, and said this:

Quote:

On Fri, Nov 28, 2008 at 12:47 PM, [email protected]> wrote:

Hello Det. Fenton,

Thanks for the warning, but the link you included goes to a fake website with the wrong adress and is not secure.

What should I do if I want to report a cyber crime there?

Thanks

I signed my real name. Here's the complete reply I got with a link to the real site. No mention of my asking about a unsecure, fake site.

Quote:

the site in Cda is www.recol.ca

Dr. Ivor Bollockov, I"m certainly not being argumentative (I know everyone here is no doubt more savvy than I am) but in your next discussion with Det. Fenton, could you ask him why he's sending out unsolicited emails to people whose names he doesn't know, who have never used the email address to bait scammers, have never expected cheques, and why he includes a link to a site flagged as a deceptive one?

I"m very confused.

Posted: Fri Nov 28, 2008 11:47 pm

Please read my last post, it is not, I repeat not an "unsecure, fake site. "
This in official RMCP website, sadly with a scriping error.

I am not being argumentative, I'm just suggesting that you are way off the mark.

This is an open forum and we don't want to educatate the lads, if you've got
any more questions, I suggest you do it by p.m.

Also, did you want your email address in the public domain? If not, I suggest
you xxxx it out.

Hello I'm New here! Joined: 28 Nov 2008 Posts: 1

OK guys, I did send out that email and recol.ca is a legit site. If you take the time to google the Vancouver police switchboard and then ask for me by name you will be put through to me ( Tue - Fri 7am-4pm). Also, I can't help that the mounties can't put together a proper site.

I use gmail because I can receive a lot of mail AND my work email will overload and or filter a lot of outside email.

As I come upon potential victims I try to warn them in advance. How this could of been misconstrued as a scam is beyond me. At what time did I ever ask for anything??

If you have any other questions please feel free to email me at, yes, vpdcisu - at - gmail.com

Thanks,

Mark

Posted: Sat Nov 29, 2008 12:38 am

These are pretty amateurish Recovery Scam scripts but I've seen some which look very convincing indeed which is why they successfully re-hook so many victims Crying or Very sad

Posted: Sat Nov 29, 2008 12:47 am

some good "bait safe" practice here

Posted: Sat Nov 29, 2008 1:00 am

~ CdnCopper,

Hello Mark, and welcome!

The problem was that we are a somewhat cynical and curmudgeonly bunch here and when the false positive on phishing showed up, it's not difficult to see why the worst was assumed.

We all appreciate your work in preventing cheque scamming, and wish you well.

Baiting Guru Joined: 04 Jan 2006 Posts: 3193

It is easy for a baiter to become so used to seeing scams that they see them everywhere. For pedagogical purposes, here is an analysis of the email:

The email itself reads like a bona-fide warning. The only oddity is that the writer identifies himself. Most warners are anonymous.

Firefox does indeed pop up a scary warning about a fraudulent certificate. If you click through that you can view the certificate and that shows that the only problem with the it is that it is for www.recol.ca, whereas the site is recol.ca, without the www.

recol.ca and www.recol.ca have to be the same organisation. That's how the Internet works. Once you own the domain, you can add anything you like to the left of it. Phishers like to add stuff to the right, for example ebay.id-register.com, which is in the domain of id-register.com, not ebay.com. But that isn't what happened here.

whois recol.ca wrote:

Approval date: 2001/11/30
Renewal date: 2009/11/30

Registrant:
Name: Royal Canadian Mounted Police

Administrative contact:
Name: Scott Thornton
Job Title: Programmer/Analyst
Postal address: Royal Canadian Mounted Police
1200 Vanier Parkway
Ottawa ON K1A 0R9 Canada
Phone: 613-993-5726
Fax: 613-993-6600
Email: [email protected]

Note that it is registered for many years and that it has valid contact details.

On the RCMP site, click on Scams/Fraud (on the button bar at the top), then under the first FAQ is a link to recol.ca

Conclusion: the site is valid and so is the email.

The correct response to a valid warning is to thank the warner and tell them that you are baiting. There is nothing worse for a warner than a victim who does not respond but carries on with the scam. You would be taking up resources that should be being used to help a real victim. No bait is worth the risk of that happening.

If you are unsure about any warning you receive then post it here or on scamwarners, or PM a moderator.

Not quite a Newb Joined: 30 Aug 2008 Posts: 54

Getting unsolicited scam emails from people and organizations who really exist (army sargents, banks, lawyer firms, police, PayPal, EBay, BHP Billiton Plc etc etc) plus getting similar warning letters from scammers themselves does indeed make one skeptical of all emails, no matter how genuine they appear to be.

Many of of the above listed senders' emails contain links that show identical anti-phishing warnings as the one in Det.Fenton's email so I (quite naturally I think) assumed someone was using his name for phishing purposes.

I'm glad that this one at least is genuine....so far it's the only one of many hundreds that has been.

You are being scammed. Call the UK Security Agency	View next topic View previous topic