Search phrases used by West Africans to harvest email addresses for scams
We keep a careful eye on logs on our server in real time with our real time statistics map. West Africans who use the following search terms on search engines may get arrested on the spot. . .
2012 all people email in usa
was the search term in Google for a surfer from Abidjan
This search turned up a client's file and resulted in the following overpayment scam email being sent to an owner of an apartment for rent:
From: phillips mike mikephill22@yahoo.co.uk (Scammers love Yahoo mail facilities)
Subject: NEED A HOUSE
To: floridavillas
dear sir/madam,
I came across your addreses on the realtor site, am in need of a house
for sale IN florida,a 4 bedroom apartment for my family and i, and that
is why i am trying to use this meduim to let you know that we are interested
if there is any property that fits that discription for sale. ,just get bact
to me and if i feel the price is reasonable then will have a deal and start
transactions immediately thanks for your anticipated cooperation............
mike phillips
Yahoo! Messenger - want a free & easy way to contact your friends online?
People throughout the net are fed up of this nonsense . . . so we keep an
eye upon scammers' search terms to ring bells with ISPs and search engines so that
we can maintain blocks of IP block lists to supply to our SpamInsights clients for
their firewalls.
On 10th May a Nigerian walked into an Internet Cafe in Lagos and searched for:
newly listed apartment for rent in the world by owners
and sent either one of the following two emails:
Return-path: markwilly_2002@yahoo.com
X-ClientAddr: 209.73.178.146
Received: from web60418.mail.yahoo.com (web60418.mail.yahoo.com [209.73.178.146])
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
b=01ER5N/RiiZc1yE1YpTyOmagLav6EzHbcEvyh5PQVyuKEt/3gKCQqvdjzYeU0GqmEqCD6K7glkD6A0BB4ytM7ge7Y427eRXBm/E5SD+xo5SHgXRhhq4cXorrUy1Lgy37y93pOAh9QgLWNtdu3QGF+TVjNzqx0rxicnYMpUpq5i4= ;
Message-ID: 20110510165306.36582.qmail@web60418.mail.yahoo.com>
Received: from [65.172.4.250] by web60418.mail.yahoo.com via HTTP; Tue, 10 May 2011 09:53:06 PDT
Date: Tue, 10 May 2012 09:53:06 -0700 (PDT)
From: mark williams markwilly_2002@yahoo.com>
Subject: interested renter...
hello
thanks for the advert well Mark williams by name and i will like to
confirm if the apartment is still available for rent and the total cost
per week and the aslo the full details of the apartment for the month
june/july 2012
thanks
williams...
Do you Yahoo!?
Make Yahoo! your home page
* * * * * * * * * * * * * * *
X-ClientAddr: 217.146.176.97
Received: from web26908.mail.ukl.yahoo.com (web26908.mail.ukl.yahoo.com [217.146.176.97])
Received: (qmail 10556 invoked by uid 60001); 10 May 2011 16:57:02 -0000
Message-ID: 20110510165702.10554.qmail@web26908.mail.ukl.yahoo.com>
Received: from [80.179.191.179] by web26908.mail.ukl.yahoo.com via HTTP; Tue, 10 May 2011 17:57:02 BST
Date: Tue, 10 May 2011 17:57:02 +0100 (BST)
From: vera alfred vr_alfred@yahoo.co.uk>
Subject: YOUR APARTMENT ENQUIRY FROM MRS VERA ALFRED
DEAR CARL ,
SIR,
I AM WRITING TO EXPLORE THE POSSIBILITY OF HAVING YOUR FULL COMPRHENSIVE ENQUIRE
OF YOUR APARTMENT FOR RENT.
MRS VERA ALFRED A CITIZEN OF NIGERIA AND WILL LIKE TO HAVE YOUR FULL RENTAL LIST
TO ENABLE ME SECURE AN APARTMENT IN YOUR AREA.
PLEASE YOU CAN ALSO CALL ME THROUGH MY TELEPHONE NUMBER+2348023808315 SO THAT I
CAN KNOW ON HOW TO SEND THE MONEY TO YOU AS SOON AS POSSIBLE.
OUR CONVENTION IS COMING UP BY THE END OF THIS MONTH AND I WILL DETAIL YOU FOR
MY RAVAL DETAILS.
I WAIT TO HEAR FROM YOUR URGENTLY,
BEST REGARDS,
MRS VERA ALFRED
Send instant messages to your online friends http://uk.messenger.yahoo.com
- - - - - - - - - - - - - - - - - - - - - - - - - -
The next time that that Nigerian walks into the Internet Cafe, he will be arrested
if a policeman can be found who is not part of the endemic corruption there.
SCAMMERS LOVE CERTAIN ISPs PROVIDING FREE EMAIL BOXES
11:48:55 AM from 66-178-82-211.reverse.newskies.net Nigeria Lagos
a scammer was searching:
"for boxes used to send emails"
- - - - - - - - - - - - - - - - - - - - - - - - - - -
http://www.joewein.de/sw/419-by-ip.htm is a good site about African scams
- - - - - - - - - - - - - - - - - - - - - - - - - - -
SCAMMERS' SEARCH PHRASES - all the following groups of people and email addresses are at risk of being
scammed:
2011 all people email in usa
2011 email contacts royal families
2011 directory of female realtors in europe and america site:.com
(ISP knows the identity of this one)
(Are Nigerians and net users in Benin, Ivory Coast and Ghana more effective than
Bin Laden in disrupting business and people's lives? These people are waging an
electronic war on the rest of the world. They operate using stolen cheque books and
then offer "jobs" laundering money)
yahoo email directories golf club associates northern america march 2011
2011 email and fax contact of fruit farmers in usa
2011 email contact of people in american villa
Click here for current private guestbook directory 2011 2011 email contacts of new clients with
email contact of directors in panama 2011/2011 "mail"
all email of staff in france 2011
email addresses in france 2011
email contact of estate valuers in europe 2011
email addresses in @malta 2011
newly listed apartment for rent in the world by owners (This Nigerian Internet Cafe
user is very near to being arrested)
email Supermarket 2011
company director email address in European Marketing Group
company@antespam.co.uk
email addresses of contractors in italy "2011"
2011 email directory of shops owners in nice france
2011 april end email addresses of town in usa
email rennes
gold stores in japan "2011 @aol.com
current email contact on business directories in japan "@aol"
South Korea of email address in guestbook 2011
2011 men association of company owners in canada
2011 email guestbook of all the contractors in peru
ben email directory in usa
45 bank email contacts
2011 email address of all board of directors in switzerland
2011 email of costa
2011 email addresses of wood dealer in italy
emails address of hotels owners in spain 2011
email addresses of Pozzo
2011 email addresses of church owners in Aruba
California 2011 email address
usa 2011 email address
2011 email contact address of plaza factory shop in canada
2011 email contact of south asia managers and directors,co
@european owners emails 2011
2011 email staff and directors business works in portugal
2011 email contacts of companies factories in america
companies@antespam.co.uk
2011 birmingham and england email addresses directors
john castle emails addresses in europe 2011
investors in italy emails addresses
2011 email guestbook of contractor in uk
guestbook email address business men in germany 2011
2011 email addresses of filling station owners in france
+009 hotmail OR .co.uk "email addresses"
+009 hotmail OR .co.uk "e
2011 email contact of Public building and related furniture in mexico
pedro- email 2011
@+canary island+34+emails addresses 2011
2011 email addresses of photography company owners in usa
2011 email contact of England furnitures companies
Mallorca Hotels emails
32 COMPANY CEO EMAIL LISTING @hotmail.com @aol.com 2011
- - - - - - - - - - - - - - - - - - - - - - -
Tue May 10 at 09:26:26 PM
Server IP - 192.116.127.197 - GILAT-SATCOM-BLOCK-15 - goldenlines.net.il
We have blocked access from Goldenlines to our server so the visitor used Google Cache:
May 10 at 09:26:26 PM 64.233.183.104cache:4ThPh5xmxU0J:info-spain.co.uk/costa.blanca/calpe.apartment.rental.php+2011+email+and+fax+contact+of+fruit+farmers+in+usa&hl=en
2011 email and fax contact of fruit farmers in usa
This resulted in a series of the following email:
Delivery-date: Tue, 10 May 2012 20:48:20 +0100
X-ClientAddr: 205.158.62.67
Received: from webmail-outgoing.us4.outblaze.com (webmail-outgoing.us4.outblaze.com [205.158.62.67])
X-OB-Received: from unknown (205.158.62.133)
by wfilter.us4.outblaze.com; 10 May 2011 19:47:41 -0000
Received: from [81.23.193.88] by ws5-3.us4.outblaze.com with http for helenfresh2011@outgun.com; Wed, 11 May 2011 03:47:41 +0800
From: "helen foster" helenfresh2011@outgun.com
Date: Wed, 11 May 2012 03:47:41 +0800
Subject: Intrested.......LOCHES 15TH CENTURY TOWN HOUSE RENTAL
X-Originating-Ip: 81.23.193.88
X-Originating-Server: ws5-3.us4.outblaze.com
Message-Id: 20110510194741.2C74823D02@ws5-3.us4.outblaze.com
I am a business woman. I am coming over to france for a business trip but I have a problem with where I would reside so I would like to book an appointment in your apartment suite to stay for my trip which i believe will be up to 2 month so pls kindly let me know how much it will cost me
to stay in your room for my stay which is 2 month.
Thanks and God bless
Helen.........
--
_______________________________________________
Outgun.com free e-mail @ www.outgun.com
Check out our Premium services - POP3 downloading, e-mail forwarding, and 25MB mailboxes!
Powered by Outblaze
- - - - - - - - - - - - -
LOG OF FURTHER ACCESSES - OFTEN ABUSING GOOGLE AND OTHER SEARCH ENGINE CACHE FACILITIES:
May 11 at 09:39:23 AM 64.233.161.104cache:D4o85JE-EOwJ:travelfactfile.com/travel/p/General++peru+directory+"@hotmail.com"+-Co+-ltd.&hl=en
peru directory "@hotmail.com" -Co -ltd.
Wed May 11 at 09:39:23 AM 195.166.237.40 pbr.linkserve.net Nigeria
May 11 at 12:46:18 PM 64.233.183.104cache:E6Kgn41NlrIJ:travelfactfile.com/travel/p++hotmail.com++apartment+rental+europe&hl=en&start=48
hotmail.com apartment rental europe
Possible compromise of US military servers:
May 11 at 09:38:30 AM travelfactfile.com/travel/Italy
realestate sicily italy
search.msn.com
Wed May 11 at 09:38:30 AM 138.178.8.2 toro.rota.navy.mil
United States Fpo
May 11 at 05:45:16 AM http://www.info-world.com/world.class.property
MANSIONS FOR SALE
Wed May 11 at 05:45:16 AM 144.59.12.174 Yongsan-Cache2.korea.army.mil
United States Apo
Wed May 11
at 11:06:32 PM 80.179.254.58
80.179.254.58.ispeednet.net
Used Google cache: 64.233.183.104cache:eHe_JTOUY7oJ:antespam.co.uk/west-africans/+guestbook+all+the+email+addresses+of+all+yahoo+members+in+europe&hl=en
Search phrase: guestbook all the email addresses of all yahoo members in europe
Wed May 11
at 10:58:23 PM 80.179.249.201
80.179.249.201.ispeednet.net
Search phrase: 2011 email addresses guestbook of resident doctors
Wed May 11
at 11:30:00 PM 80.87.80.242 no associated domain name Ghana
Search phrase: email address list of company in europe and asia current guest book of 2011
Thu May 12
at 01:48:05 AM 213.209.161.164
ip164net161.skylogicnet.it
HOUSE FOR RENT BY PROVATE OWNERS IN FRANCE
Thu May 12
at 02:05:27 AM 81.199.154.130 Cote D'Ivoire Abidjan
Used Google Cache 64.233.183.104cache:eHe_JTOUY7oJ:antespam.co.uk/west-africans/+email+contacts+of+vera&hl=de&ie=UTF-8
email contacts of vera
May 12 at 01:20:06 AM
Used Google Cache 64.233.183.104cache:eHe_JTOUY7oJ:antespam.co.uk/west-africans/+may+2011+world+email+directory+of+workers+and+directors&hl=en
may 2011 world email directory of workers and directors
Many of the following searches had to use Google Cache to access this file:
it appears that Google takes no notice of the No-Cache Meta Tag:
META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE"
email addresses of resort homes in the mediterranean
email addresses EUROPEAN FORESTRY 2011
usa towels emails agents
2011 contacting email addresses of don in usa
2011/2011 email addresse guestbook in australia
current email address and guestbook 2011 of traders and farmers
80.179.104.38.ispeednet.net (80.179.104.38)
2011 guestbook email address of realtors in america
- - - - - - - - - - - - - - - - - - - - - -
ISPs serving West Africa need to clean up their acts and push their
scammers off their networks:
Wed May 11
at 11:15:20 PM 213.185.106.3 no associated domain name Nigeria
Used Google Cache 64.233.179.104cache:eHe_JTOUY7oJ:antespam.co.uk/west-africans/+current++email+Directory+of+Fishing+Members++contact+address+in+the+world&hl=en
Search phrase: current email Directory of Fishing Members contact address in the world
Network operated by INTELSAT-CUST-Timasy-NG
descr: Reassignment to Timasy customer, Nigeria
For more information about Scam Friendly ISPs email directors@antespam.co.uk
