CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer

ecmes scam

 
Post new topic   Reply to topic       All -> FavForums -> Phishing, Fraud and Dastardly Deeds [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
turion

Guest
IP: 212.123.*.*






PostPosted: Mon May 12, 2008 8:42 pm    Post subject: ecmes scam
Reply with quote

I've been receiving letters from a so called Ralph Winter who claims to be an accountant from the European Consult Madrid Espana (ECMES). This guy tells me that one of his client recently passed away and left $7,500,000.00 in her account and he couldn't contact any of her relatives. Since i have the same surname he wants to split the money with me.

Really how the hell did this guy get my home address? The letter looks fake with all these stamps plus he mentioned i didn't reply the last time. In the first letter (which he send to me a year ago) he told me i won the lottery. This is just hilarious.

They actually created their own site http://ecsmes.com/index.asp
just to let you believe the company does exist. Check the URL again, yes it's not ecmes.com but ecsmes looks suspicious.
IP range is 67.228.215.147 leads to a hosting provider based in Dallas without any registration info. So i continue to investigate

Domain Name.......... ecsmes.com
Creation Date........ 2007-09-20
Registration Date.... 2007-09-20
Expiry Date.......... 2008-09-20
Organisation Name.... European Consult
Organisation Address. Madrid
Organisation Address.
Organisation Address. Madrid
Organisation Address. 2008
Organisation Address. Madrid
Organisation Address. SPAIN

Admin Name........... European Consult European Consult
Admin Address........ Madrid
Admin Address........
Admin Address........ Madrid
Admin Address........ 2008
Admin Address........ Madrid
Admin Address........ SPAIN
Admin Email.......... mrs.rose_sm@yahoo.com
Admin Phone.......... 33.54645465
Admin Fax............

Tech Name............ European Consult European Consult
Tech Address......... Madrid
Tech Address.........
Tech Address......... Madrid
Tech Address......... 2008
Tech Address......... Madrid
Tech Address......... SPAIN
Tech Email........... mrs.rose_sm@yahoo.com
Tech Phone........... 33.54645465
Tech Fax.............
Name Server.......... ns1.vhostdns2.com
Name Server.......... ns2.vhostdns2.com

As you can see the yahoo email is fake and which legal company would use an yahoo email account to register.

Back to top
s0tet

PIRT Handler


Joined: May 21, 2005
Posts: 2960

Phishing Squad

PostPosted: Tue May 13, 2008 1:54 am    Post subject:
Reply with quote

Quote:
Really how the hell did this guy get my home address?

This is an escrow fraud account, and of course, they are trying to find out bank account information so they can fleece their victims who respond to "lottery" winner emails.

If your email is something common like johnsmith@ some ISP email account, they can just create a list of guessable email addresses, or comb them from search engine queries. You should see if your email address is in Google, just to see if you have posted it somewhere publicly online.

Forward your spam with the full headers to the host in question, so they may take action in disabling it. abuse [at] softlayer.com

Back to top
View users profile Send private message Send email
turion

Cadet
Cadet


Joined: May 12, 2008
Posts: 1
Location: Australia

PostPosted: Wed May 14, 2008 6:39 pm    Post subject:
Reply with quote

I didn't receive any email/spam from these guys but real letter. Somehow the must have picked out some addresses from the yellow pages. Anyway i was surprised there were no references in google. That guy did left an email ralphwinter@accountant.com in the letter. Searching for that domain did return references. This guy should be spammed to death Smile

Back to top
View users profile Send private message
pwillener

SRT Trainee
SRT Trainee
Premium Member

Joined: Apr 17, 2006
Posts: 1830
Location: Japan
Premium

PostPosted: Thu May 15, 2008 3:09 am    Post subject:
Reply with quote

I have received these kind of letters in the 70's, then in the 80's they switched to fax, and from the 90's of course they used spam as the cheapest delivery method.

Nowadays spam filters are getting too good, so they seem to have switched back to snail mail - which in a way seems more real.


P.S. the Yahoo address is not "fake", as you can see here http://profiles.yahoo.com/us/mrs.rose_sm - looks like "Mrs. Rose" has been using this account for scamming since 2004. You can notify Yahoo at http://help.yahoo.com/l/us/yahoo/abuse/abuse.html

Back to top
View users profile Send private message Visit posters website
mae_m

Trooper
Trooper


Joined: Apr 05, 2007
Posts: 21


PostPosted: Thu May 15, 2008 11:20 pm    Post subject:
Reply with quote

Taking the site over to aa419.org to get it shut down.

This is a classic advance fee fraud letter. If you bite and say that you are interested in a share of your "inheritance" you will get strung along with an ever increasing number of fees, taxes, duties and on and on in order to get your payday. The website is just a part of the subterfuge of what I am sure is a multilayered scam.

Hard to believe people still fall for this but thousands do every year.

ralphwinter@accountant.com is just a throwaway mail.com address.

Back to top
View users profile Send private message Visit posters website
BigFelix
Warnings : 2

Captain
Captain
Premium Member

Joined: Mar 19, 2008
Posts: 506
Location: San Diego
Premium

PostPosted: Fri May 16, 2008 1:12 pm    Post subject:
Reply with quote

This is the Nigerian Fraud, no? They send you a bank or certified check as pre-payment. They ask for money back under some pretense. Your bank credits your account, you send the sum requested, and weeks later you find that their check was counterfeit. And you lost thousands.

Try this: guy calls you and says he wants nothing. But he does expect your business if he gives you four/five correct stock market tips. Buy this, sell that, etc. And a month or so later you're convinced that this guy is a genius, you open an account, and you give or wire money. And you've been had! How? The con man starts out by calling 1,000 people. To 500 he says that a particular stock will go up; to 500 he says that it will go down. Of the 500 correct results, he then tells 250 this and 250 the other. And then 125 and then 60, 30. Hope I've explained it properly. To half, he's correct. And after halving and halving he has a number of believers. And never, ever send money by Western Union! Asking for money by wire should make one hear warning sirens, bells, etc.

And never agree to make a charitable contribution except by U.S. Mail. No giving it to a guy who will come to you house to pick it up. That way no mail fraud, a federal crime. And no postal inspectors.

A well-attired, well-groomed man with an attache case on Park Avenue screams, "Oh, my God, I've been pickpocketed. My wallet is gone!" Of course he has to take a train from Grand Central and the fare alone will be $12. He'll give you his business card and if you could lend him just $20, he promises to return the money by mail, wire, whatever. Beats the hell out of spare-changing. Or standing at an intersection with a plea for money scribbled on a piece of carton.

Ah! The joys of a Brooklyn upbringing!


_________________
The whole problem with the world is that fools and fanatics are always so certain of themselves, but wiser people so full of doubts.
    Bertrand Russell
Back to top
View users profile Send private message Send email
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Phishing, Fraud and Dastardly Deeds All times are GMT
Page 1 of 1

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer