419 Scam Example: "FREEDOM LOTTO SOUTH AFRICA / PERAGO FINANCIAL HOLDINGS LTD. / THEMBA NDLOVU / Susan Cotze"

• About "419" scams
  
• Email addresses used by 419 scammers
• Phone numbers used by 419 scammers
  
• How to report 419 spam to us
• Domains registered by 419 scammers
  
• What can you do when you receive 419 spam
  

"FREEDOM LOTTO SOUTH AFRICA / PERAGO FINANCIAL HOLDINGS LTD. / THEMBA NDLOVU / Susan Cotze" are labels used in a fake lottery scam run by a gang in South Africa. This is a "419" fraud.

Are you sick of spam too? Do you want it stopped now? Try jwSpamSpy, the spamfilter we use to track the spammers! Free 30-day trial version available now!

Example of initial "winning notification":

X-Originating-IP: [196.39.9.102]
Return-Path: <freedomlotto_s@pochta.ru>
Received: from 196.39.9.102  (EHLO mydomain.com) (196.39.9.102)
  by mta247.mail.scd.yahoo.com with SMTP; Wed, 02 Mar 2005 09:26:37 -0800
(several fake "Received: from" headers)
Date: Wed, 02 Mar 2005 19:26:40 +0200
From: freedomlotto_s@pochta.ru
To: freedomlotto_s@pochta.ru
Subject: ++WINNING NOTIFICATION++


FROM: THE DESK OF THE PROMOTIONS MANAGER,
     INTERNATIONAL PROMOTIONS/PRIZE AWARD DEPARTMENT,
     REF: ZAR/23457677/2004
     BATCH: 11/576809/KC/MFP

RE/AWARD NOTIFICATION; FINAL NOTICE

We wish to inform you of the lottery draws held on
1st March,2005, to declare the winners of the FREEDOM LOTTO SOUTH
AFRICA/INTERNATIONAL PROMOTIONS.

Your company, attached to ticket number
356-00098-3211-222, with serialnumber 818-09 drew the lucky numbers
14-41-25-19-49-37, and consequently won the lottery. You have therefore 
been
approved for a lump sum pay out of $500,000 in cash credited to file 
ref
number: ZAR/23457677/2004 and
batch number: 11/576809/KC/MFP.

You are among the six international winners in this category. All
participants were selected through a
computer ballot system drawn from 17,000 names from Australia, New 
Zealand,
America, Europe and Middle
East and Asia as part of our International Promotions Program, which is
carried out quarterly.


Due to the mix up of some numbers and names, we ask that you keep this 
award
strictly from public notice until your 
claim has been processed and your prize money remitted to your account.

This is part of our security protocol to avoid double claiming or
unscrupulous acts by participants of this
promotion. We hope with a part of your prize, you will participate in 
our
end of year high stakes.

We have deposited your prize money of $USD500,000(Five hundred thousand
united states dollars)
with the paying finance/security company and is now available for 
claim. 

To begin your claim,please contact: 

MR.THEMBA NDLOVU
(FOREIGN SERVICE MANAGER)
PERAGO FINANCIAL HOLDINGS LTD.,
PHONE:+27-838 662 054
EMAIL:peragoltd@zwallet.com

You are expected to provide the following details below to your claims
agent:

1) BATCH AND REFFERENCE NUMBERS
2) FULL NAMES
3) AGE
4) MAILING ADDRESS
5) PHONE AND FAX NUMBERS


Note: All prize money must be claimed not later than 12th March,2005.
After this date,all funds will be returned as unclaimed.

Congratulations once again,from all our staff and thank you for being 
part
of our promotions program.


Sincerely,
Susan Cotze.
Promotions Manager

Here is a reply from "Themba Ndlovu":

Dear Firstname Lastname,

To claim your prize you need to come down
here personally to south Africa before the deadline
for claims, to make the claim and collect your 
prize cheque as you will need to perform signing of
documents at the gammings board before you can be
issued a certificate for your winnings.

In the event of your inability to claim personally
you could authorize us to claim on your behalf and
send your prize cheque to you. But in this case 
you must remmit to us the fees for processing and
sending you your cheque by Insured Diplomatic express
courier and this fee is broken down as follows:

If you chose us to claim please let us know so we can
give you details on how to remmit this fee so we can
process and send you your cheque.

Mr. Themba Ndlovu


______________________________________________________
Get Paid... With Your Free Email at
http://www.zwallet.com/index.html?user=peragoltd

Money demand:

From: perago ltd 
X-Originating-IP: [198.54.202.210]
To: emailaddress
Subject: TO PROCESS & DESPATCH YOUR CHECK THROUGH EXPRESS COURIER.
Date: Thu, 10 Mar 2005 13:15:12 +0000

Dear Firstname Lastname,

To process your claims on your behalf, these fees has
to be taken care off by you.

This is the breakdown of the fees you are to pay. And
it should be paid today to 
enable us have your check sent to you.

1) Gaming Board fees on prize win             $100.00
2) Perago Financial Holdings ltd.Admin fee    $100.00
3) Full insurance on package                  $270.00
4) Courier Charges                            $190.00
5) Stamp duties                               $160.00

Total $820

As soon as we confirm payment of
the fees through money gram, we shall process your
claims and despatch
your check immediately. 
This is the cashier's information you will use in
remitting the fee through money gram:

MR. PAUL OKENYE
42 BLAIR ST.,
DURBAN 4000, 
SOUTH AFRICA.

Please as soon as you do that today, call me to give
me the 8 digit figures in the money gram receipt and
the sender's name so that I can process everything
first thing tomorrow morning.

Congratulations,

Mr. Themba Ndlovu

______________________________________________________
Get Paid... With Your Free Email at
http://www.zwallet.com/index.html?user=peragoltd

Here's another version of the scam:

FROM: THE DESK OF THE PROMOTIONS MANAGER,
     INTERNATIONAL PROMOTIONS/PRIZE AWARD DEPARTMENT,
     REF: ZAR/23457677/2004
     BATCH: 11/576809/KC/MFP

RE/AWARD NOTIFICATION; FINAL NOTICE

We wish to inform you of the lottery draws held on
24th March,2005, to declare the winners of the FREEDOM LOTTO SOUTH
AFRICA/INTERNATIONAL PROMOTIONS.

Your company, attached to ticket number
356-00098-3211-222, with serialnumber 818-09 drew the lucky numbers
14-41-25-19-49-37, and consequently won the lottery. You have therefore 
been
approved for a lump sum pay out of $500,000 in cash credited to file 
ref
number: ZAR/23457677/2004 and
batch number: 11/576809/KC/MFP.

You are among the six international winners in this category. All
participants were selected through a
computer ballot system drawn from 17,000 names from Australia, New 
Zealand,
America, Europe and Middle
East and Asia as part of our International Promotions Program, which is
carried out quarterly.


Due to the mix up of some numbers and names, we ask that you keep this 
award
strictly from public notice until your 
claim has been processed and your prize money remitted to your account.

This is part of our security protocol to avoid double claiming or
unscrupulous acts by participants of this
promotion. We hope with a part of your prize, you will participate in 
our
end of year high stakes.

We have deposited your prize money of $USD500,000(Five hundred thousand
united states dollars)
with the paying finance/security company and is now available for 
claim. 

To begin your claim,please contact: 

MR.THEMBA NDLOVU
(FOREIGN SERVICE MANAGER)
MIDWAY FINANCIAL HOLDINGS LTD.,
PHONE:+27-736-670-362 
EMAIL:midwayholdings@zwallet.com

You are expected to provide the following details below to your claims
agent:

1) BATCH AND REFFERENCE NUMBERS
2) FULL NAMES
3) AGE
4) MAILING ADDRESS
5) PHONE AND FAX NUMBERS


Note: All prize money must be claimed not later than 4th April,2005.
After this date,all funds will be returned as unclaimed.

Congratulations once again,from all our staff and thank you for being 
part
of our promotions program.


Sincerely,
Susan Cotze.
Promotions Manager

Reply from the claims agent:

Dear Firstname Lastname,


To process your claims on your behalf, these fees has
to be taken care off by you.

This is the breakdown of the fees you are to pay. And
it should be paid today to 
enable us have your check sent to you.

1) Gaming Board fees on prize win           $100.00
2) Perago Financial Holdings ltd.Admin fee  $100.00
3) Full insurance on package                $100.00
4) Courier Charges                          $163.00
5) Stamp duties                             $100.00

Total $563

As soon as we confirm payment of
the fees through money gram, we shall process your
claims and despatch
your check immediately. 
This is the cashier's information you will use in
remitting the fee through money gram:

MR. PAUL OKENYE
42 BLAIR ST.,
DURBAN 4000, 
SOUTH AFRICA.

Please as soon as you do that today, call me to give
me the 8 digit figures in the money gram receipt and
the sender's name so that I can process everything
first thing tomorrow morning.

Congratulations,

Mr. Themba Ndlovu

______________________________________________________
Get Paid... With Your Free Email at
http://www.zwallet.com/index.html?user=midwayholdings

Message headers:

Date: Thu, 31 Mar 2005 10:05:41 -0500
From: midway holdings <midwayholdings@zwallet.com>
Subject: TO PROCESS & DESPATCH YOUR CHECK THROUGH EXPRESS COURIER.
X-Originating-IP: [198.54.202.210]

WHOIS details for sending network (IP 198.54.202.210):

     inetnum:      198.54.202.0 - 198.54.202.255
     netname:      SAIX-CACHE
     descr:        Telkom SA Ltd.
     descr:        Soekor Building
     descr:        151 Frans Conradie Ave
     descr:        Parow
     descr:        Western Cape
     descr:        7500
     country:      ZA
     admin-c:      PB455-AFRINIC
     tech-c:       PB455-AFRINIC
     status:       ASSIGNED PA
     mnt-by:       TF-198-54-MNT
     mnt-lower:    TF-198-54-MNT
     changed:      hostmaster@arin.net 20020329
     changed:      hostmaster@arin.net 20020329
     changed:      hostmaster@afrinic.net 20050221
     source:       AFRINIC
     
     person:       Pieter Bezuidenhout
     address:      Telkom SA Ltd SAIX
     address:      151 Frans Conradie Ave
     address:      Parow
     address:      Western Cape
     address:      7500
     address:      ZA
     phone:        +1 111 1111111
     fax-no:       +2721 9302789
     e-mail:       bezuidp@telkom.co.za
     e-mail:       pieter@saix.net
     nic-hdl:      PB455-AFRINIC
     remarks:      Abuse complaints can be directed to abuse@saix.net
     changed:      hostmaster@arin.net 20000622
     changed:      hostmaster@arin.net 20021024
     changed:      hostmaster@afrinic.net 20050221
     source:       AFRINIC

Are you sick of spam too? Do you want it stopped now? Try jwSpamSpy, the spamfilter we use to track the spammers! Free 30-day trial version available now!