|
Ghana Gold Scam / Alluvial Gold Dust scam
We have received some unsolicited emails from senders in Accra, Ghana offering gold for sale. The sellers claim to be in possession of large quantities of gold dust, which they are willing to sell at below market prices. The catch is that you, the buyer, will have to send money upfront and the seller can walk away at any point with virtually no risk of being caught by the police as all contacts are via anonymous free webmail accounts accessed from Internet cafes and via prepaid mobile phones. The would-be buyer is made to send money for travel of the seller, for insurance, for shipping and for refinery assays before they would receive anything of any value. If they receive anything at all, the yellowish metal powder will turn out to be powdered brass. In any case they will lose thousands to tens of thousands of dollars. Any email from a stranger in West Africa offering gold dust or diamonds for sale is an Advance Fee Fraud! Here is a typical example, that immediately raised several red flags, see below: From: "rockmining_co" <rockmining_co@libero.it> Other examples:
Here's what immediately caught my eye:
Here is an example of an actual email exchange with a Ghana Gold scammer: From: "harrison hayford" <goldcoast@atlas.cz>Where's the catch? To get that "gold" shipped to you, you first have to wire money to Ghana for shipping and insurance. What if you never receive it or it turns out to be powdered brass? We contacted these guys and asked about shipping modalities. They replied from a different address at a different webmailer, using a satellite broadband ISP that services West Africa and shows up in many Nigeria scams:
From: "deputy manager" <goldcoastminerscompany@yahoo.com>Sending network: inetnum: 192.116.85.0 - 192.116.85.255
netname: GILAT-SATCOM-BLOCK-16
descr: SKY2Net ltd
remarks: For abuse issues related to Gilat, email abuse-gilat@012.net.il
notify: abuse-gilat@012.net.il
country: GB
admin-c: GS3350-RIPE
tech-c: GS3350-RIPE
status: ASSIGNED PA
mnt-by: AS9116-MNT
mnt-lower: AS9116-MNT
changed: hank@att.net.il 20040912
source: RIPE
route: 192.116.64.0/18
descr: Goldenlines
remarks: For addressing issues, email lir@linux.goldenlines.net.il
remarks: For abuse issues, email abuse@012.net.il
origin: AS9116
mnt-by: AS9116-MNT
changed: lir@linux.goldenlines.net.il 20041121
source: RIPE
role: Gilat Support
address: Gilat Satcom
address: 21D Yagia Kapaim st. Petach-Tikva, Israel
phone: +972 3 9255000
fax-no: +972 3 9217938
admin-c: DR5299-RIPE
admin-c: GE2074-RIPE
tech-c: DR5299-RIPE
tech-c: GE2074-RIPE
trouble: abuse-gilat@012.net.il
e-mail: customer@gilat.net
nic-hdl: GS3350-RIPE
mnt-by: AS9116-MNT
changed: hank@att.net.il 20040909
source: RIPE
From: "Yaha Amed" <local_sellers2@yahoo.co.uk> The spam email was not sent through Yahoo.co.uk but directly from an ISP in Africa. There it was not from Guinea, Conakry either but from Mali: inetnum: 196.200.80.0 - 196.200.95.255
netname: ML-IKATEL-20040609
descr: IKATEL SA
descr: PROVIDER Local Registry
country: ML
org: ORG-IS28-RIPE
admin-c: SD2024-RIPE
tech-c: MA1231-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: MNT-IKATEL
mnt-routes: MNT-IKATEL
notify: noc@ikatel.net
changed: hostmaster@ripe.net 20040609
source: RIPE
route: 196.200.80.0/20
descr: IKANET
origin: AS30985
mnt-by: MNT-IKATEL
changed: noc@ikatelnet.net 20040923
source: RIPE
organisation: ORG-IS28-RIPE
org-name: IKATEL SA
org-type: LIR
address: IKATEL SA
Immeuble SONAVIE
ACI 2000
BP : E 3991
BAMAKO, Mali
phone: +223 4999900
fax-no: +223 223 08 35
fax-no: +223 499 90 01
e-mail: noc@ikatel.net
admin-c: DH1500-RIPE
admin-c: SD2024-RIPE
mnt-ref: MNT-IKATEL
mnt-ref: RIPE-NCC-HM-MNT
mnt-by: RIPE-NCC-HM-MNT
changed: hostmaster@ripe.net 20040415
changed: bitbucket@ripe.net 20040604
changed: hostmaster@ripe.net 20040609
source: RIPE
person: Sekou DRAME
address: IKATEL SA
address: Immeuble SONAVIE BP: E 3391
address: Bamako ACI 2000
phone: +223 6299908
e-mail: sekou.drame@ikatel.net
nic-hdl: SD2024-RIPE
changed: sekou.drame@ikatel.net 20040331
source: RIPE
person: Mohamed Aboubacrine
address: IKATEL SA
address: Immeuble DT BP 3991 Bamako Mali
phone: +223 499 9932
phone: +223 629 9932
nic-hdl: MA1231-RIPE
changed: mohamed.aboubacrine@ikatel.net 20040607
source: RIPE
Anyone willing to bet that the various certificates promised are any more genuine than the sender address or the origin of the email? I certainly am not :-)
"Mary Saxon - South African gold from Chad (Nigeria)
Email headers:
Received: by mail.interchange.ca (Postfix, from userid 555) id 77AC6861339; Wed, 9 Feb 2005 09:51:15 -0500 (EST) Received: from 213.181.81.242 by fastmail.ca with HTTP; Wed, 9 Feb 2005 14:51:15 +0000 (UTC) Date: Wed, 9 Feb 2005 14:51:15 +0000 (UTC) Subject: [ADV] hello From: "Mary Saxon" <marisaxon@fastmail.ca> X-Fastmail-IP: [213.181.81.242] MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Priority: urgent Message-Id: <20050209145115.77AC6861339@mail.interchange.ca> To: undisclosed-recipients: ;
Originating network (IP 213.181.81.242) inetnum: 213.181.64.0 - 213.181.95.255
org: ORG-BL4-RIPE
netname: NG-BROADBANDTECH-20000327
descr: BT Limited
descr: PROVIDER Local Registry
country: NG
admin-c: IO243-RIPE
tech-c: IO243-RIPE
status: ALLOCATED PA
notify: bt@micro.com.ng
mnt-by: RIPE-NCC-HM-MNT
mnt-routes: BT-LIMITED-MNT
mnt-lower: BT-LIMITED-MNT
changed: hostmaster@ripe.net 20000327
changed: hostmaster@ripe.net 20001003
changed: hostmaster@ripe.net 20010507
changed: hostmaster@ripe.net 20010704
changed: lir-help@ripe.net 20011214
changed: hostmaster@ripe.net 20020419
changed: hostmaster@ripe.net 20020423
changed: hostmaster@ripe.net 20020613
changed: hostmaster@ripe.net 20030211
changed: hostmaster@ripe.net 20040406
source: RIPE
organisation: ORG-BL4-RIPE
org-name: BT Limited
org-type: LIR
address: BT Limited
address: 8B Ademola Street,
address: Off Awolowo Road,
address: S. W. Ikoyi,
address: Lagos, Nigeria.
phone: +234 1 2693192
fax-no: +234 1 2693192
e-mail: bt@micro.com.ng
admin-c: IO243-RIPE
admin-c: IO243-RIPE
mnt-ref: BT-LIMITED-MNT
mnt-ref: RIPE-NCC-HM-MNT
mnt-by: RIPE-NCC-HM-MNT
changed: hostmaster@ripe.net 20040415
source: RIPE
person: Israel Oyeleke
address: BT Limited
address: 8B Ademola Street
address: Ikoyi S.W.
address: Lagos, Nigeria
phone: +234 1 2673532
fax-no: +234 1 2673203
e-mail: i.oyeleke@moneynett.com
nic-hdl: IO243-RIPE
notify: i.oyeleke@moneynett.com
changed: ifiok@btlimited.com 20010605
changed: ifiok_moses@yahoo.com 20030917
source: RIPE
From: "thankgod nelson " <thankgod_nelson@mixmail.com>
From: "JEFF NANA OFORI" <jeffofori6@yahoo.com>
From: <drbellosadiq@tiscali.co.uk> Message headers: Received: from [192.116.69.33] by mk-cpfrontend.uk.tiscali.com with HTTP; Wed, 13 Jul 2005 04:38:44 +0100 Date: Wed, 13 Jul 2005 04:38:44 +0100 Message-ID: <428DEEE80012AC9E@mk-cpfrontend-3.mail.uk.tiscali.com> From: drbellosadiq@tiscali.co.uk Subject: Gold Offer
WHOIS details for sending network (IP 192.116.69.33):
inetnum: 192.116.65.0 - 192.116.69.255
netname: GILAT-SATCOM-BLOCK-31-32-40-46-53
descr: Gilat-Satcom
remarks: For abuse issues related to Gilat, email abuse-gilat@012.net.il
country: GB
admin-c: GS3350-RIPE
tech-c: GS3350-RIPE
status: ASSIGNED PA
mnt-by: AS9116-MNT
mnt-lower: AS9116-MNT
source: RIPE # Filtered
role: Gilat Support
address: Gilat Satcom
address: 21D Yagia Kapaim st. Petach-Tikva, Israel
phone: +972 3 9255000
fax-no: +972 3 9217938
admin-c: DR5299-RIPE
admin-c: GE2074-RIPE
tech-c: DR5299-RIPE
tech-c: GE2074-RIPE
remarks: trouble: abuse-gilat@012.net.il
nic-hdl: GS3350-RIPE
mnt-by: AS9116-MNT
source: RIPE # Filtered
abuse-mailbox: abuse-gilat@012.net.il
% Information related to 'GS3350-RIPE'
route: 192.116.64.0/18
descr: Goldenlines
remarks: For addressing issues, email lir@linux.goldenlines.net.il
remarks: For abuse issues, email abuse@012.net.il
origin: AS9116
mnt-by: AS9116-MNT
source: RIPE # Filtered
Other examples: Here's a report I received about a victim from Croatia who travelled to meet the scammers in West Africa: I DO know this guy from Split, Croatia. We even went together to university. He fell for 419 scam from Nigeria. The pressure was very high since the scammer already skinned him and his asocaiates for several thousand dollars and my friend was already in Frankfurt awaitnig for instructions how to meet the "son" of some "late" state official who knows where are millions of $$$ and he "needed to sign" the "release documents". Then he recieved phonecall from Croatia, from his associates, that they recieved an e-mail saying that this guy is afraid to cross the border of nigeria since that police is very near to find what he is trying to do and that is of outmost importance that he comes to Nigeria to sign this documents. He fell for that, went to Nigeria and it took about three weks until relatives and familly collected 20,000 $ ransom and even more for travel costs, so one of the familly went to Lagos, Nigeria and asked police to help him. Yes, they helped to deliver the ransom and kicked out of nigeria both of croatians, since, aparently, it is not a crime if nigerians take money from someone abroad.
Dear Sir, Message headers: Received: from mail-ww0-f66.google.com (mail-ww0-f66.google.com [74.125.82.66]) by indigo.pobox.com (Postfix) with ESMTP id CD3B420067A for <myemailaddress>; Mon, 22 Mar 2010 10:28:28 -0400 (EDT) Received: by wwb17 with SMTP id 17so124443wwb.5 for <myemailaddress>; Mon, 22 Mar 2010 07:26:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:message-id:subject :from:to:content-type; bh=EeySvWYFqcYBQW/jlESN2nIYFdltVdzNQ+CTNcOaLd8=; b=XDIIDZScJrTFIYrUtUeXANMp27CT2jY4JICOa+k86ZlV0bhnIyLH/QLWleZ0bzNAiG gIxGo4ozxPmQMp6ohT83NAdzhaDg5OPz/kXwFIGo3cnzA9ojO4OhNT5VWXMWLxRWtXFd wJxGg0ZcX/BHs54BVE335A7HMKsMJq7HEt7XM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=HlNw+P1/IEeGv4pRgeS3e4TeljZgjrT5Awh3Wv5dc9CyCCWWdh3stRF9xkxtPIdqyU mYtedPa3yedoVV0HWOY4QfhHq2c+MTJ+6ujinHh8q0xF/SiD6LOQBvIxSUUX2OZNRu8o 3li3sg2WbZ879JBgLNhbMJDQGbk8+BVJxRf5A= MIME-Version: 1.0 Received: by 10.216.85.194 with SMTP id u44mr3248635wee.65.1269267970144; Mon, 22 Mar 2010 07:26:10 -0700 (PDT) Date: Mon, 22 Mar 2010 14:26:09 +0000 Message-ID: <e291f3ec1003220726ie72a6fbne28c0320b4ba2527@mail.gmail.com> Subject: Gold Offer From: Simon Ewing <masterminers001@gmail.com> To: masterminers001@gmail.com
|