Has someone offered you a huge sum of money or a valuable consignment? It's a 419 or advance fee fraud - find out how they work, and what to do to be safe.
#215410 by Gidje012 Wed Aug 20, 2014 9:39 am
Hello everyone,

I've recently had the experience of being scammed by someone. I was foolish enough to pay via Moneygram. I have looked all over the internet about information and I though I had it all figured out. I failed to do one simple thing and that was calling the company itself I was thinking of doing business with. I did call it's neighbors and asking them if the company did exist and asking a few things about it's owner. This costs me nearly 700 Euro's. The day after that I send the Money I did phone the company in question I was told that It was probably a Scam. Their company name was used in the past (2012) by a scammer from Alibaba.com.

First some information:
Company name: WAISANG (EUROPE) RECYCLE LTD.
Contact: Chun Tao Leung (Director Exports & Trading)
Regarding: Electronic scrap like CPU's, motherboard, telecom boards, RAM etc
Used numbers in the mails: Cell: (+44) 7452276314, (+44) 7024071704
Used Skype account: Chuntoa.leung

Email header of the first email:
Received: from spam2.luxcloud.net (80.92.93.146) by exsmtp.luxcloud.net
(10.20.20.11) with Microsoft SMTP Server (TLS) id 14.1.218.12; Wed, 25 Jun
2014 14:26:08 +0200
Received: from mail-oa0-f67.google.com ([209.85.219.67]) by spam2.luxcloud.net
with esmtps (TLSv1:RC4-SHA:128) (Exim 4.82) (envelope-from
<[email protected]>) id 1WzmIz-0000Cv-3E for [email protected]; Wed, 25
Jun 2014 14:28:07 +0200
Received: by mail-oa0-f67.google.com with SMTP id n16so523364oag.10 for
<[email protected]>; Wed, 25 Jun 2014 05:28:05 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20120113;
h=mime-version:date:message-id:subject:from:to:content-type;
bh=W8ofIuc5yg1n6RQzPPp/FJR37XFSM/v6POXrHMu7afE=;
b=UX3br8HY5bJGF/DdpN3fn2UBhd/jvkQ0XA+vogYJDOaszn13UlTpF867lP7s7Z4gHJ
KTkugXfisFHkXYY1yKNesM7MN4y+4++I+ULjudC2/mTYhqIG9+VhPjRYoP5/QM2tvFbi
eWTXRH8c8HKprjT0z9pihR/t8Xs3nV6Dw1IBrR5ON+Z2emMKpsvpP05hw/AdrGa+60xo
wfoab/6xJCy4x6uyXHYRrgunILsaWRh+2hqVHDJ/TVBFeQemJ73M0l8kPX5rEUqTa4dZ
kuAGh7SruJZ37SWxPR4iQWGclGJF7Guh2XvyoL7BlcQNFKnrd3raJi5fr4PexnH6sk4x
6CMw==
X-Received: by 10.182.116.161 with SMTP id jx1mr7649320obb.50.1403699285124;
Wed, 25 Jun 2014 05:28:05 -0700 (PDT)
Received: by 10.76.11.72 with HTTP; Wed, 25 Jun 2014 05:28:05 -0700 (PDT)
Date: Wed, 25 Jun 2014 13:28:05 +0100
Message-ID: <[email protected]om>
Subject: cpu processors scrap
From: chuntoa leung <[email protected]>
To: <[email protected]>
Content-Type: multipart/alternative; boundary="089e0158ab9a42f6c304fca83597"
Received-SPF: SoftFail (LCEXHUB03.cmsad.local: domain of transitioning
[email protected] discourages use of 80.92.93.146 as permitted sender)
Received-SPF: pass (spam2.luxcloud.net: domain of gmail.com designates 209.85.219.67 as permitted sender) client-ip=209.85.219.67; [email protected]; helo=mail-oa0-f67.google.com;
X-SPF-Result: spam2.luxcloud.net: domain of gmail.com designates 209.85.219.67 as permitted sender
X-Filter-ID: XtLePq6GTMn8G68F0EmQvZ6FhEgQIvUTFBGgSCrgeiloufnv6AwgIfp1HqTloMMg1A/6t51a7Dur
+uha/0iQGyOWKKfVwbEnBqkWSdyJ+aG44ltXdqztCKjnlD+k1CWLAd5Qt9/C8FG9SdVb8JZGm2vw
mBdcNbVjQeV97U6x7is/+dSmCAE2JLwX+F1wICHd6hFhKo51s0qu6AEVHV4OgRTc+yvJd/JyHseq
567qhP5BP8TsXqXbdxXsyM3jyrR5ctgzcDoFd+96Xw4QUNtTnTWckktOOh+ELGOOoMx7UzginLPg
N8EDaWjggSFLzcgxGOxQbMspgcOjQEyiulpdaLOVDQMcm33X2U5qRqWvANvDqcigOvSxdRnthmhn
8Zn6adK7ghjniUjKM1Lbn8mrlhNrCpAWQIEz/MFx4bzWD6zKalDwPuIfUAzxcRu/EzgLmWMw9PUV
Sx++KF8opRG9x6qNN9p3wbgUuCQa+2fJVkUIWH5zieHvMvd7aZID7tm9QCiO3RJRpBlyiIJ46suN
9miH1Wgh6RAenBR+licROGYjDi94L26Xw8xQtxfNtS9Qa8O+PrBnPw0fd1lOifhynQ==
X-Report-Abuse-To: [email protected]
X-Filter-Fingerprint: cPaH8lomer6UwsJ3BnJDymYx1CJ6KMTQUv8HZyW6zsC0VFDyP20las9Mq1v6nXmfrqKtWpHLpkE8
c09GKJn2t2OZomTHDk91cPirch0MyQuBkvtoLByS8TB6/8s7kBFU3viGky7q70+kb3qUfYhKoRHw
gN5sJVRUBXXQsgvAzRWCLQVv/6ZfKG/GRXPl/rLOBAwcah76bF9AlpNf/vHDT4jdh76ck8EP9/8N
8DjsCyeiQd2LfM1DsvceGTxfmfXSV/23aynHHLpYOYwnpjmJio/RK5MW7/igB3MczWw6pg8/+UC2
VPiHSdPVIYMOn+Xp2KU8HSV0tnc/vSXkXWQSAOFtRwfqa+sNVnmaLSdsPm3WWtPitpfuOswmnitR
jAohuPJPBz+hOpK9U52UEBqCtKTCz/uAcmDkc3nyqX/5LXSmoEsy669/aQy/5x7X264XMS+4ayUp
OtEhdxekWDmK9g==
Authentication-Results: luxcloud.net; spf=pass [email protected]
Authentication-Results: luxcloud.net; dkim=pass header.i=gmail.com
X-SpamExperts-Class: ham
X-SpamExperts-Evidence: Combined (0.15)
X-Recommended-Action: accept
Return-Path: [email protected]
X-MS-Exchange-Organization-AuthSource: LCEXHUB03.cmsad.local
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-PRD: gmail.com
X-MS-Exchange-Organization-SenderIdResult: SoftFail
X-MS-Exchange-Organization-Antispam-Report: SCLNotProvided
MIME-Version: 1.0

What I have done before I transferred the money:
- Checked the company name on the internet for problems with the law
- Checked the company based on its registration number (04966801)
- Checked the AQSIQ number of the comany (A826090107)
- Checked other sites that holds information about companies in the UK. basically any information that I could find about the company.
- Their own website was offline at the time so I was unable to check that. (this should have been a red flag)

What I have done after I transferred the money:
- Called the company the next day as I didn't trust it completely
- Also called Moneygram and filed a complaint
- Printed all the communication that I have from Skype and all the mail that where send (still have all the data)
- Looked up the IP address of the skype account 41.190.10.122 and 41.58.204.66. Both are in Nigeria
- Contacted the local police, but they can't do anything about it. They say that the person that this guy was impersonating should file a complained of identity theft before they can do anything :(
- Looking for sites that might have more information about it. So I found this site.
- I'm still in contact with the scammer and demand to get my money back because it has been 3 weeks for him to deliver the goods from the UK to the Netherlands. and of-course still nothing.

Now strangely enough I got another email about e-scrap from some other "supplier" called "HARMON INTERNATIONALS LIMITED" and contact person "Timothy Berryman (director)" after the this one felt a little silent. This supplier claims to get my information from Alibaba.com, but I have not been able to find the company on alibaba. Also checking his skype account to see what IP address is behind it I noticed that this one is from Nigeria also 154.120.80.132. So I know for an fact that this is also a scammer. He claims to operate in the UK, but in fact he's located in Nigeria. At least according to the Skype account. I got a proforma from him claiming that I need to pay 600 Euro's. But that is not what I agreed upon. Also from one moment to the next the guy is suddenly very friendly and using statements like 'my friend' and such.

Here is the email header from this one:
Received: from spam1.luxcloud.net (80.92.93.145) by exsmtp.luxcloud.net
(10.20.20.11) with Microsoft SMTP Server (TLS) id 14.1.218.12; Mon, 18 Aug
2014 16:16:30 +0200
Received: from mail-qg0-f42.google.com ([209.85.192.42]) by spam1.luxcloud.net
with esmtps (TLSv1:RC4-SHA:128) (Exim 4.82) (envelope-from
<[email protected]>) id 1XJNlH-0001S2-CS for [email protected];
Mon, 18 Aug 2014 16:18:24 +0200
Received: by mail-qg0-f42.google.com with SMTP id j5so4706679qga.1 for
<[email protected]>; Mon, 18 Aug 2014 07:18:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20120113;
h=mime-version:date:message-id:subject:from:to:content-type;
bh=iVhaYN7AkRyLUtVYthDKAhXjFb7JsJ+GOcBt4Dp3/Po=;
b=XdzLUkZmLNNvREg/5oPFId2fXFnlweR40EclgQTBo+P+NjYHgFf3zOrvbp3A19gLoE
P7b3F+1iEdZeDXh7+Bw2gfwB0Jw9XIveMUa7mco/OKedNtltY435VxjRdcslNp304TRe
K8PwsdWr4w3pGIlHbNeEqsLcEFawHdq4rB18WAMBxKDzS9zcbIdZXrMNMaBsbJoScQpt
rYBUEtacUuk7rbbAjfRtNnCsjVge4MG/lDtE6FxG5X8onzB0lJ/XJjjJlcKB5xxqn1kV
Rv/Np425+Eydc84BHbUluCmwaHbmk5I/S5jfxTnTgNZFeVw0VgAks3GddYvtD/cDVvdC
uOsg==
X-Received: by 10.224.44.14 with SMTP id y14mr54907044qae.34.1408371493632;
Mon, 18 Aug 2014 07:18:13 -0700 (PDT)
Received: by 10.224.142.81 with HTTP; Mon, 18 Aug 2014 07:18:13 -0700 (PDT)
Date: Mon, 18 Aug 2014 15:18:13 +0100
Message-ID: <[email protected]om>
Subject: PROFORMA INVOICE FROM TIMOTHY BERRYMAN,CEO HARMON INT. LTD
From: Timothy Berryman <[email protected]>
To: <[email protected]>
Content-Type: multipart/mixed; boundary="047d7bdc8d5e976d860500e80a0f"
BCC: <[email protected]>
Received-SPF: SoftFail (LCEXHUB04.cmsad.local: domain of transitioning
[email protected] discourages use of 80.92.93.145 as permitted
sender)
Received-SPF: pass (spam1.luxcloud.net: domain of gmail.com designates 209.85.192.42 as permitted sender) client-ip=209.85.192.42; [email protected]; helo=mail-qg0-f42.google.com;
X-SPF-Result: spam1.luxcloud.net: domain of gmail.com designates 209.85.192.42 as permitted sender
X-Filter-ID: s0sct1PQhAABKnZB5plbIdapNUlq9UPGHdptIq+cOrmhQvuKCjesWOVvY17KzeJB5Zui5i6ygtGH
Kpo7T8zctr/9enH9QL43WLiQWSve7tgxbv9Qztjt3gtfNqRSH5wkdIWSR9EOMmN4WaSYWp0RBSNX
L9wcuVP1d57uUtN3TKEqzRIY1eNv8tgNi0dnCyj3OLeDe6bDe0jYb8+n0lGfibRdRn7fzOw0Q/17
EnxwJcMr23hiWyyPcvWzcsXZYUIm3bAbKmj2qc6ViV3Fq/PYXgjwyk6OiPzVO33A6aHF7t/r07v8
9rHmsFdA/EEPbXELPd0rEuGjFyZoidhtHm+WoTmH0+CbDQeiJPYfYKGaf/5zy2jpnVs21Bjv/M75
Uyt0LsUMsKu4lvtzdmSs+JMWmO7F9Bd5ek236pZcMo4AjK/SYOgbgdJlLOiC0Ap7aQHPuzxD9FGq
mWdgu3HYtNVvVxlpPPT0P0q2rUk8OxuDjiSDwIE7VKe+bqpcdCns72R1dMmPFlGIrz3/FZCk2oHW
8STuHXPwq1jEdnWpZHp14zymXysXjneuUb/WfjNJdsmPA/L5uG0+lkS1e00oxS3C2DEvuGslKTrR
IXcXpFg5ivY=
X-Report-Abuse-To: [email protected]
X-Filter-Fingerprint: IFrWXGses7OKB5S5G8/dJQaha43/kwBtGLI/vVx+r7lA3cTUQ1R++keuE7RDJ8Kg79NdR28zbq2F
/faLXf3Ie4Lc0g55oBfTtOL4knBX8NKPjLCyL90dPM0QUqvSwy1OFs6JhvRopiVZHv22JIOIr629
jlkc0Ws7L3IrU1LVd6MloQr4O4CAAvJK/v30qUPT3+5p8O+J2mBUWknYG/420il5/riGtM9SPJyb
5DcwCEhwf6Ovp8G0B/IigY83qwr0ewZgD3YrxV8Dn9T6FZKYym30U7176s47qc1gViM56kAUb2Lt
P+X/kz85ZWL9Wh7Vqhq7fcuPQxuYMj81PtqPWJKWH9LmX/OVOS1yq4/S7s7nEuPZLlYJJR0YIRcs
Vtz7IiAPN1CmqF03u1HVoBE6Fx63iA7PeTxZF30dsCYvzXC/c6+DhViwNjdCSMS7FxK1
Authentication-Results: luxcloud.net; spf=pass [email protected]
Authentication-Results: luxcloud.net; dkim=pass header.i=gmail.com
X-SpamExperts-Class: ham
X-SpamExperts-Evidence: Combined (0.04)
X-Recommended-Action: accept
Return-Path: [email protected]
X-MS-Exchange-Organization-AuthSource: LCEXHUB04.cmsad.local
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-PRD: gmail.com
X-MS-Exchange-Organization-SenderIdResult: SoftFail
X-MS-Exchange-Organization-Antispam-Report: SCLNotProvided
MIME-Version: 1.0

Resolving skype accounts: http://www.speedresolve.com/resolve.php (will be discontinued on 5th of september)

Save to say that I will not continue with this scammer.

The question is how do I get rid of these people in such a way that they do not cancel the mail/sky accounts so that other people can look them up and know they are scammers.

Any other information that you like to know I'll make available on request
Advertisement

#215438 by vonpaso xlura Wed Aug 20, 2014 1:22 pm
Welcome to Scamwarners; sorry to hear that you were scammed. For future reference:
*Any number beginning +44-70 is a redirect and is probably not in England.
*Any other number beginning +44-7 is a pager or a mobile and is unlikely to be the main contact number for a company.
*Any IP address beginning 41 is in Africa.

Please post the body of the emails, especially the early ones, as they are probably script and other victims may be searching for them.

... ni los estafadores heredarán el reino de Dios. 1 Cor. 6:10

Who is online

Users browsing this forum: Google [Bot] and 17 guests