419 Scam Example: "ELECTRONIC LOTTERY / Macurly Clary / Macurly Pablo"
"ELECTRONIC LOTTERY / Macurly Clary / Macurly Pablo" is a label used by a gang in the Netherlands for a fake lottery fraud (advance fee fraud, "419").
All phone numbers used in the scam are Dutch mobile phones. The scam appears to be connected to another Dutch lottery scam, "ADS LOTTERY / Paul Zimmerman" as the claims agents of boths scams send responses from the same IP address.
The same Dutch cell phone number has been attributed to "Macurly Clary" and "Macurly Pablo" who are likely just different aliases used by the same person(s). "Macurly Pablo" is supposedly the claims agent for "ADS LOTTERY PROMOTIONS", as is "Paul Zimmerman". Emails from all three aliases are sent from the same Dutch IP address.
Example of "Macurly Clary" scam email:
From: "macurly clary" <firstname.lastname@example.org>
Received: from [184.108.40.206] by web42107.mail.yahoo.com via HTTP; Sat, 05 Feb 2005 10:04:11 EST Date: Sat, 5 Feb 2005 10:04:11 +1100 (EST) From: macurly clary
The attached JPG file "electronij form.JPG" is marked "PROPERTY OF GULF ATLANTIC SA".
Emails by "Macurly Clary" are sent from the same IP address at the same Dutch provider as emails in the "ADS LOTTERY / Paul Zimmerman" scam (IP 220.127.116.11):
inetnum: 18.104.22.168 - 22.214.171.124 org: ORG-CB6-RIPE netname: NL-CHELLO-20000509 descr: Provider Local Registry country: NL admin-c: GM3659-RIPE tech-c: HTK1-RIPE status: ALLOCATED PA mnt-by: RIPE-NCC-HM-MNT mnt-lower: CHELLO-MNT mnt-routes: CHELLO-MNT changed: email@example.com 20000509 changed: firstname.lastname@example.org 20010516 changed: email@example.com 20011211 source: RIPE route: 126.96.36.199/16 descr: UPC.nl Network Services descr: Chello Customers descr: The Netherlands origin: AS8209 notify: firstname.lastname@example.org notify: email@example.com mnt-by: CHELLO-MNT changed: firstname.lastname@example.org 20010622 source: RIPE organisation: ORG-CB6-RIPE org-name: Chello Broadband org-type: LIR address: Chello Broadband N.V. boeing avenue 101 1119pe schiphol rijk The Netherlands phone: +31 20 7788200 fax-no: +31 20 7788203 e-mail: email@example.com admin-c: GM3659-RIPE admin-c: RM2527-RIPE admin-c: AK991-RIPE admin-c: SB9000-RIPE admin-c: MH392-RIPE admin-c: MG872-RIPE admin-c: HTK1-RIPE admin-c: MS2509-RIPE mnt-ref: CHELLO-MNT mnt-ref: RIPE-NCC-HM-MNT mnt-by: RIPE-NCC-HM-MNT changed: firstname.lastname@example.org 20040415 changed: email@example.com 20040617 changed: firstname.lastname@example.org 20041112 changed: email@example.com 20050201 source: RIPE role: Hostmaster Telekabel Wien address: UPC Telekabel Wien GmbH address: Erlachgasse 116 address: A-1100 Vienna address: Austria phone: +43 1 96068 5000 fax-no: +43 1 96068 5666 e-mail: firstname.lastname@example.org trouble: email@example.com admin-c: AK991-RIPE tech-c: SB666-RIPE tech-c: AK991-RIPE tech-c: MS2509-RIPE nic-hdl: HTK1-RIPE notify: firstname.lastname@example.org mnt-by: CHELLO-MNT changed: email@example.com 20040609 source: RIPE person: Gary Mendel address: Koningin Wilhelminaplein 2-4 address: 1062 HK Amsterdam address: The Netherlands phone: +31 20 355-2777 fax-no: +31 20 355-2755 e-mail: firstname.lastname@example.org nic-hdl: GM3659-RIPE notify: email@example.com mnt-by: CHELLO-MNT changed: firstname.lastname@example.org 20010212 source: RIPE