Anyang and Phishing Scams
[Home] [Back to Heresy & Propaganda Page] [The latest round of Anyang and Phishing scams 2006]
This webpage is an old repost (from 2004). Below are some of the phishing scams that (courtesy of Anyang and Chinese Hammers) arrived in 2004. Always a spam from Anyang comes first, and then the spams and scams from his phishing buddies arrive within a few weeks. More scams come with each round of Anyang spams. I repost this page to display just a few examples of some of the earlier scams sent to me courtesy of Anyang and his friends. To see the latest round of Anyang spams and phishing scams for 2006, follow the link in the navigation bar above.
The categories:
WINNING NOTIFICATION. Whoopee! I won the lottery. Wait a minute, I didn't buy a ticket.
Camelback Drills. This guy wants me to send drills to him in Nigeria. He doesn't care about cost- just tell him the amount and he'll write a check. He cut and pasted the title of my webpage into his email. You gotta be kidding me! Plus a description of how this scam works.
Fake Pay Pal verification. Update now. They demand it!
Hello Sales Department- What is your website address?
Read These Emails Below
Subject: WINNING NOTIFICATION.
Date: Mon, 2 Aug 2004 16:27:20 +0200
From: MANIX LOTTOBV <manixlottobv@ofir.dk>
To: manixlottobv@ofir.dk
MANIX LOTTO BV.
INTERNATIONAL PROMOTION/PRIZE AWARD DEPT.
REF: REF/567-MA0781/03
BATCH: MAN/19/055/WFNL
RE: WINNING FINAL NOTIFICATION
Sir/Madam
We are pleased to inform you of the result of the Lottery Winners
International programs held on the 26st of July 2004. Your e-mail address
attached to ticket number 467-0556673 drew lucky numbers 2-23-74-32-76-55,
which consequently won in the 3rd Category, you have therefore been approved
for a Lump sum pay out of US$ 500,000.00 (Five Hundred Thousand United States
Dollars).
CONGRATULATIONS!!!
Due to mix up of some numbers and names, we ask that you keep your winning
information very confidential till your claims has been processed and your
prize/money Remitted to you. This is part of our security protocol to avoid
double claiming and unwarranted abuse of this program by some participants.
All participants were selected through a computer ballot system drawn from
over 200,000,000 company and 300,000,000 individual email addresses and names
from all over the world. This promotional program takes place annually. We
hope with part of your winning you will take part in our next year USD100
million international lottery.
To file for your claim, please contact our/your fiducial agent,
MR.MARK GORE of the,
EUROPOINT OFFSHORE SECURITY AND FINANCE
TEL: +31-621-498-052
FAX: +31-616-242-997.
Email:epsfin777@winning.com
Note that all winning must be claimed not later than 9th of August 2004.After
this date all unclaimed, funds will be included in the next stake. Please note
in order to avoid unnecessary delays and complications please remember to
quote your reference number and batch numbers in all correspondence.
Furthermore, should there be any change of address do inform our agent as soon
as possible. Congratulations once more from our members of staff and thank you
for being part of our promotional program.
Note: Anybody under the age of 18 is automatically disqualified.
Sincerely yours,
MR. PAUL VERK.
Lottery Coordinator.
REPLY EMAIL TO:epsfin777@winning.com
_________________________________________________________________________
OFiR Spil - Vind 1.000 vis af kroner! Besøg http://spil.ofir.dk
OFiR Kontakt - Find din nye ven el. partner på http://kontakt.ofir.dkThe link to kontakt.ofir.dk creates an adware threat. Take precautions against spyware, adware cookies and viruses when dealing with these clowns.
Comment- form-letter format. The "Camelback Drill" name appears to have been cut and pasted into the email directly from the title of one of my webpages. The cut and paste preserved the text style and size within the email similar to the way it is shown below. This is a form-letter and the scammer simply adds (cuts and pastes text in this case) the name of the decoy item in an attempt to get the recipient to write back. The camelback Drills were not offered for sale. This is a phishing expedition to see if the recipient of his email is stupid enough to reply. The funny part is that this moron had to spend time searching through my website to choose a name to cut and paste into this email. Note the Yahoo address, typical of spammers. Yahoo is a well known spam site and everyone suspects emails with this address. This idiot never had a clue.
Fact: Nobody is going to order an antique tool (a tool of questionable or unknown quality with no parts availability and no support) sight unseen and weighing approximately 5 to 10 times more than a modern machine, and then have it shipped overseas with high shipping charges due to weight, to be sold to people that don't have a lot of money. Think about it. A new drill press is already boxed up in a crate, easily shipped without damage, weighs a small fraction of the camelback, has parts available and manuals to help set it up, and is cheaper both in price and shipping. It doesn't take a genius to see this one coming.
How a scam works. Note the part about forwarding his check for 'clearance'. For those not familiar with this scam, here are three scenarios; 1.) The scammer sends a check for an amount far in excess of the price. The scammer/buyer then asks that the seller to send the remainder by wire to his bank in another country. Several weeks after the seller deposits the check in his local bank, the check bounces and the bank holds the seller liable for the wire transfer amount and also for any other cash withdrawn from the check amount. 2.) The scammer sends a check for the amount but he is in a hurry. He even offers to pay a premium for rush ordering and shipping. So don't wait for the check to clear, just send the goods. By the time the seller finds out the check bounced, the stuff is long gone and sitting on a boat or on a dock waiting to be loaded on the boat. The scammer gets a load of goods and the seller gets to pay large shipping fees and bounced check fees. Oh, and the seller is out the goods too. 3.) Both scenarios #1 and #2 above combined into one big scam. The seller receives a check far in excess of the purchase price, he wires this large remainder to the scammer's bank. Seller deposits the check in a local bank and takes out cash to ship the goods. A few weeks later the goods are loaded on a ship, the scammer's check bounces, the seller is held liable for the amount of both the wire transfer to the scammer's bank account, and for all cash drawn from the bounced check. Think massive shipping charges for rush delivery! And the seller still loses the goods.
Subject: Camelback Drills
Date: Sun, 4 Jul 2004 18:51:44 -0700 (PDT)
From: Ade Charles <faithinade@yahoo.com>
DEAR SIR,
I'M SO INTERESTING PURCHASING THESE GOODS(Camelback Drills) PLEASE SIR
MAY I KONW THE AMOUNT IN QUOTE SO I CAN FORWARD MY CHECK FOR CLEARANCE , I WANT MY ORDER TO BE SHIPPED TONIGERIA ...SO I WANT YOU TO ADD THE SHIPPING AMOUNT ON IT ,SO I CAN KNOW MY SUBTOTAL AMOUNT TO BE PAID.$$
YOURS FAITHFULLY .
ADE
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
More of Anyang's scammer friends from 2005
Comment: Much more sophisticated this time but anyone with half a brain would still recognize this as a phishing scam. This example relies on java or some other type of script to hide its true identity and actual source. In the original email, the user would simply hover their mouse cursor over the URL and the real PayPal URL would appear in the window at the bottom of Microsoft IE. The sender of this email was using a script to link to a fake website http://www.paypal-cgi-update.com/ while displaying the real PayPal URL. To prove this, one needed only to inspect the source by selecting the email, and clicking on the File drop-down menu, and clicking on properties. Then navigating to the Details to look at all the hidden relays the sender used to mask his real identity and to see the actual email address and website. In this case despite the real-looking PayPal URL showing up at the bottom of the Internet Explorer window, the actual website was at http://www.atom-pr.com and the return path was to webmaster@atom-pr.com and not to the real PayPal company. What was that famous saying? A sucker is born every minute. Lots of people still fall for this one.
Warning! This is a fraud. Note that the links do not take the user to the real PayPal website, but instead go to a fake website. The touchy feely pictures are used to make this scam look legitimate. This is a fraudulent email.
| |
|
 |
|
Recent Anyang scam from February 2006
Comment: This arrived around 4 days after a spam from Anyang in February of 2006. Again a poorly planned phishing scam. Does he really expect me to believe he "will like to place an order for "products in your store" but then he doesn't know the website address? How is it he doesn't know the website address after he sent me an email? So where exactly did he get this email address? Brilliant.
HELLO SALES DEPT,
I WILL LIKE TO PLACE AN ORDER FOR PRODUCTS IN YOUR STORE AND I WILL LIKE YOU TO
LET ME KNOW IF YOU ACCEPT ALL MAJOR CREDIT CARDS AS METHOD OF PAYMENT AND IF YOU
SHIP OUT TOLAGOS,NIGERIA GET BACK TO ME WITH YOUR WEBSITE ADDRESS SO AS TO ORDER
I HOPE TO READ FROM YOU SOONEST.
REGARDS.
WALTER MICHEAL
walter_michealstore@yahoo.com
What are the most popular cars? Find out at
Yahoo! Autos