|
|
Chaos Project #2 |
Mawete Maseka |
|
On December 8 2002 we received a message from an individual who had been spammed by an Advance Fee Fraud criminal claiming to be Mrs. Louise Estrada. This person supplied email and website addresses associated with this particular scam, and asked if we might be interested in taking a closer look. What we found when we accessed the mail account used by this fraudster alarmed us - he appeared to have a victim on the hook in a typical "wash wash" scheme, and had already convinced him to travel from his home in Grenoble, France to Madrid, Spain. At the point in which we entered the discussion, the victim appeared to be emailing the original scammer from Spain, discussing the meetings he had been having with (people who he did not know to be) other members of the criminal gang. After carefully analysing the available data to assure ourselves that the victim was genuine, and not another reverse scammer, we sent him an urgent warning message. What we did not know was that this would be the start of a campaign, still ongoing after 14 days, in which every single person whom we attempted to contact in order to ask for help in saving M. Maseka from his own foolishness completely ignored our approach. What follows is a transcript which first shows as much as we have been able to recover of the conversation between "Louise" and M. Maseka. From December 8, when we came in, it includes our attempts to raise a response from anyone who might be in a position to make direct contact with M. Maseka. The complete lack of response from his employers, the French police, a local newspaper, and Interpol is nothing short of shameful. We have published M. Maseka's real identity in the hope that someone reading this will find a way to contact him, or get some appropriate authority to contact him, and ensure that he is out of danger. We did tell M. Maseka that we would be publishing this page, and specifically offered to conceal his true identity if he so wished. We know that he read that offer, but he did not reply. Incidentally, this particular 'Louise Estrada' is the same as the one featured in the Louise Estrada thread of "The Lads do an Erap", which can be found at Scam-O-Rama. |
 M. Mawete Maseka - A Kenyan-born, French-resident victim of an Advance Fee Fraud scam.
|
||||||
|
|
See bottom of transcript for summary of post-publication updates. As messages may be deleted from the scammer's account in future, all headers have been reproduced here for later research. However, only messages relating to M. Maseka have been recorded - other messages to and from "Louise" have been omitted; indeed, she didn't seem to be handling any other promising victims in this account, although the same scammer or group have managed to swindle money out of at least one other victim in another account. The scammer usually did not keep copies of the messages he sent to M. Maseka (although he did on a few early occasions). On December 10, we activated the option in the scammer's account to keep copies of sent messages by default, so more outbound messages are available from that date forward. |
| This is the earliest message to which we have access. It would appear to be a typical 'first response' message, sent by the scammer to M. Maseka after he had replied to a spam 'format' (inital approach).
From M. Maseka's email address, we could see that he worked at IMAG, a grouping of research institutes in Grenoble, France. Specifically, he worked in the CMP team, although he now seems to have lost his job there (see entries for December 13). The google-cached version of the team's web page includes M. Maseka, and photos of all staff. The only other context in which M. Maseka turns up in a google search is a past-pupil listing of Lycée Denis Diderot, a French-language school in Nairobi, Kenya, where he apparently sat for his 'BAC' qualification in 1997. |
From: "louise estrada"
Dear Mawete Maseka, I thank you for your response and willingness to help me, your mail came to me at the greatest time of need in my life. i understand your plight and you need to be reassured that am very much real thus i will open up to you for the fact that you have shown good faith and trust. for us to proceed with this transactions, i will need you to contact my attorney in canada who's contact details i will be forwarding to you later so that you will contact and discuss the modus operandi of this transaction, but before you do that i will like you to forward to me your most private phone number so that i will give you a phone call to discuss this transaction with you after which you will choose which way to go, am not in the position to make a phone call, because of the high secuirty measures mounted in my house here in Manila philippine, but i will try as this money is my life and hope. please i will need you to reassure me that you will not sell me out to the philippine Government, because they are not aware of my contact to you neither do they know about this fund which is the last for my family (Myself and Kids) besides they have frozen all my husband account, who is now facing trails. on the other hand i will assure you that i will be very honest with you. I await to hear from you so that we can proceed. Louise Mrs. |
| This message from M. Maseka (the first that we can see) originated from an address that can be verified as oise.imag.fr, strong confirmation that it was sent from within IMAG. It seems safe to assume that this message really did come from Mawete Maseka, who really does work for IMAG. |
From: mawete.maseka@imag.fr Dear Mrs Louise Estrada, Your message and it contents were received. With all my due respects,I am attracted in this kind of deals but I want to be sure That's why, before I start any thing you, I want you to send a kind of I will be waitting your reply. Best Regards, Mrs Louise Estrada wrote: Dear, Listen and read carefully, i have found seriousness in you must take instructions from me at all time and for I,am Mrs LOUISA EJERCITOR ESTRADA , the wife of Mr During my husband's regime as president of Now i have used an NGO to move the money to a bank Mrs Louise Estrade (Wife to former philippine president) Upon your acceptance to deal with me i will forward to you the contact informations of my Attorney in canada for you to contact and discuss the terms. |
|
From: mawete.maseka@imag.fr Dear Mrs Louise, I acknowledge good receipt of your message. I perfectly understand your delicate situation and It will be I can see a restless mother for her children and familly future. Finally I'd like to set your mind at rest : My most private phone number is +33 6 99 19 44 25 but before calling me So long. Yours with regards, |
|
|
From: "louise estrada"
Dear Mawete Maseka, Thank you for your mail.and perfect understanding of my predicament. unfortunately i can not assure you of the time and when i will be calling you for the fact that i dont control the phone here as i would call at any giving time, that implies that my calling will be when i have noticed security lapeses/ but all the same i still believe we can still forge ahead. or should the call be a stobling block to our business? or better still i will advise you provide me with your cell phone number that way it will be easy for you to speak with me anytime am chance to call. Further more i need you to understand that at the moment am handicapped for the fact that i really can not do anything regarding getting my funds for some reasons thus with out wasting much time i will like to enquire from you how safe and secure your account is for such transfer of money.. dear am trying to protect myself and the kids. because the money in question USD120.5m is the very last for my family, thus i will not want anything to go wrong not for any reason, so we need to be extra careful about the bank account you will use for the transfer.as i dont know much about the banking system in paris. Please do reassure me that nothing will go wrong with my money as soon as it has been transfered to you. upon this assurance i will forward to you the details informations regarding the bank you will contact in view of securing the release of the funds to you as the beneficiary. Louise Mrs. It is very important you give me your cell phone number as i can call anytime. |
|
|
To: louise estrada
Dear Mrs Louise, Thank you for your mail. My bank is called Crédit Lyonnais.One of oldest, of most serious, Some situations have approached my banker and me. In such manner that In short, I have an account deposit in a serious bank of which the banker is Thus, it is a question of trusting me, knowing that my banker can facilitate the things to us. That's for my bank and my account. Personally I am optimistic for a sure and effective trasanction , if it exists. I rather hope to have been clear in my explanations. In all the cases, I think that we need to be connected 24h/24h so that this transaction should be I will wait for your answer. Regards, |
|
|
To: louise estrada
Dear Mrs Louise Estrada, It was nice to talk to you yesterday and on monday. I am ready to proceed. You talked about some one whose name was "Granman" (I don't know if the spelling is correct), So, I'd like you to tell me what do you realy want me to do ? As soon as you tell me what to do I will do it. I'm waiting for your instructions ! Reagrds, |
|
|
From: "louise estrada"
Dear Mawete Maseka, Am very happy that you are now very prepared to proceed with me in this transaction, let reassure you that i will remain honest and open with you till the end of this transaction. for us to have a smooth and sucessful transaction you will have to contact and open an online account with Crubank of bahamas. please do contact and open the account today so that the funds will be transfered into your account. BANK NAME: CRUBANK CORPORATION OF BAHAMAS Bless You. |
|
| Here we see M. Maseka change to a free-mail account (saintly.com is a domain handled by mail.com), but he has still posted this from the same IMAG IP as his earlier messages. |
From: mawete@saintly.com Dear Mrs Louise, Thank you for your picture. You are so smart. For security purposes I changed my mail address. The account with crubank is opened. I was given a reference number. But what is the second step ? What I am supposed to tell Mr. MICHEAL I don't understand the need of this online account. Can you explain I am waiting your instructions. Have a nice time. I await to hear from you too. Regards, |
|
From: mawete@saintly.com Dear Mrs. Louise, I tried, several times, to reach Mr. Glenn, by phone,today but he I would like also to have your news ! Good luck in whatever you do. I wait to hear from you. Yours, |
|
| This message (15 Nov) was found in the Trash, not the Inbox.
This message doesn't originate from M. Maseka's work address, but instead from 193.251.69.3 (AGrenoble-101-2-1-3.abo.wanadoo.fr). This is presumably a dynamically-allocated IP from his local ISP. This was sent at 8:34 PM, France time. |
From: mawete@saintly.com Dear Mrs Louise, One of Crunbank staff lady told me that Mr. Glenn Then I called again the lady back and asked her if she was able to She asked me who told me about they bank ? First, I am sorry be cause I told you that the account was opened. Now I don't know what to do. I will be waiting for instructions from you. I'd only like you to Know that I am not tired and I am ready to Bless you and all your familly |
|
From: "louise estrada"
Dear Mawete Maseka, I understand you better now, i now know that you are honest going by My advise now is for you to contact Mr.M. Glenn using his private I await to get a positive response from you asap. Bless You. Louise Mrs. |
|
|
From: mawete@saintly.com Dear Mrs. Louise, How are you? Did you receive my messages ? Please, update me on your news ! I just hope that you are doing well. Bless you; |
|
|
From: mawete@saintly.com Dear Mrs. Louise, I am very happy to have your news. About US$8500 I am going to do my best but The problem is that we have only two busness days I will report the progress to you asap. God bless you and try to have good time ! Yours, |
|
|
From: mawete@saintly.com Dear M. Glenn, Thank you for your quick response to my E-mail! I would like to pleadingly request an extension of two more days for Please confirm me whether you are OK or not. I will prefer Western Union for that deposit because it faster. Is the information given enough for a safe sending? I thank you in advance for your cooperation. Best Regards, |
|
|
From: mawete@saintly.com Dear Mrs. Louise, I decided to send a copy of all my correspondence with Crubank to you. I am looking for the opening balance, and I am positive. But I have two questions: How do you plan to manage once the funds are sent in my account ? What about your advocate in Canada you were talking about at the I am asking these questions not because I don't trust you, I just hope that you do understand me. I hope to hear from you soon. Please take care. Bless you and all your people. Yours, |
|
| M. Maseka uses his work account again, the first time for some time. |
To: "louise338@mail.com"
Dear Mrs. Louise, You don't have to worry because I obtained the extension of two I also found a source for the openning balance and I plan to sent the money But I need your call. So please, call me whenever you can. I thank you in advance. Yours, |
| IMAG account again. |
To: louise estrada
Dear Mrs. Louise, I have been facing troubles and problems because of As I told you, I am not rich. And as a matter of fact I had The guy was perfectly OK but he changed his mind at the last I tried to explain to him the profit that he could gain, fast That's why I was desappointed. I didn't want to tell those kind bad news for I knew your desapointement I went on searching and at this moment I just have a date with some one Dear Louise Mrs, I do undertand what you can feel at this moment by I just have my self. I am ready to go with our deal but you have to give me more time ! So I will continue searching the money for the opening balance ! Just tell me what you think about me and my situation. If I don't have any news from you I will conclude that you are tired But in all other cases please let me know your decision . With all my Best Regards, |
| Back to the free-mail account again, but sent from his work IP address. |
To: "zack smith"
Dear Mr. zack smith, My post office met some problems that delayed my transfer by westren I plan to acheive this transfer during this week. As soon that the transfer is done I will update you. I thank you in advance for your understanding. Best Regards, ----- Original Message ----- Date: Thu, 21 Nov 2002 12:32:41 GMT Subject: Send the money to our north American Representative > Dear Sir, |
| IMAG account again. |
To: "louise338@mail.com"
Dear Mrs. Louise, I managed to get $US 4000. Today I am supposed to get , thanks to an other date with an other friend, But I'am wondering why the money can't be sent from As also I noticed that you are familiar with Crubank and Mr. Glenn, In all the cases we have all this week for us to send the money to CruBank, In two hours from now I will know if the second guy is going lend me the needed But what if the doesn't ? This is the only guy remaining in whom I am confident. So please, reply to this message of mine so that I can update you about Bless You, PS: By the way I am still wondering how did you managed it to get my address ? |
|
To: "louise338@mail.com"
Dear Mrs. Louise, How are you doing ? I hope that there is nothing that could make me worry I am looking forward to hearing from you! Bless you |
|
|
To: "louise338@mail.com"
Message received OK!! |
|
| Free-mail account, sent from IMAG. |
From: mawete@saintly.com Dear Mrs. Louise, As I told you on the phone, I changed my mind about CruBank The link below is the Bahamas Central Bank web site full adress. So although the money is available. I am not going the send it for What do you think about this ? Bless You. |
|
From: mawete@saintly.com Dear Mrs. Louise, I am ready to proceed to any of this place. Because I like I hope that you do understand what I mean ! But I also think that this have to be well planned so that So, my decision is : let's go on. Bless you. |
|
|
From: mawete@saintly.com Dear Mrs. Louise, I will be waiting for news from you. I have started plans for proceeding to spain. Bless You, |
|
| From his local ISP IP address again, presumably because it's a Saturday, |
From: mawete@saintly.com Dear Mrs. Louise, Your mail was in good receipt.I thank you. I am going to call Mr. Fredinand. What am I going to tell him ? I will be back to you later today to update you Bless you. |
|
From: mawete@saintly.com Dear Mrs. Louise, I called Mr. Ferdinand GODJO. I reached him and he gave me his fax number. He talled me that once he receives the fax, then he will be able to I am just wondering if I will not need extra information I will wait for the acknowldge of this message before I So,I will wait for news from you before I do anything. Bless You, |
|
| Monday: back to work and mailing from IMAG. |
From: mawete@saintly.com Dear Mrs. Louise, I sent the fax to Mr. Ferdinand and I am still I was thinking that it is useless for me to move I will update you as soon as I have further information. Bless You, |
| Tuesday, 8:57 AM France time: ISP IP address. Off work? He says that he is planning to fly to Spain today. |
From: mawete@saintly.com Dear Mrs. Louise, I had confirmation of the consignemnt I just have to date him for the delivery, which I plan to be tomorrow I will take an airplane today as soon as possible. Dear Mrs. Louise, For now I will need your instructions and I will I trust you strongly now !!! I will update you with my arrival planning in Spain in few hours. Bless you, |
| Just after midday, and he has apparently organised his flight. |
From: mawete@saintly.com Dear Mrs. Louise, I thank you for your E-mail. I will be at Madrid today at 8:00 PM. I will then book a hotel for the night and proceeding Mr. Ferdinand is aware of my arrival. I will write to you as soon as I arrive. God Bless You, |
| M. Maseka reports that he has arrived in Madrid. Local time for this message is (we think) Wed 04 Dec, 01:35 AM.
The originating IP address is new: 213.39.30.202. Whois info as follows: inetnum: 213.39.30.0 - 213.39.30.255 Although at first glance this seems to indicate France, a google search on the raw IP turns up far more Spanish references, suggesting that the whois info may be misleading. On closer examination, it seems likely that PSI France have allocated a small address range to "Easy Internet Cafes Europe" (which appears to be a division of the UK company EasyEverything, which includes EasyJet), and the specific address in question is perhaps used by an Internet Cafe in Madrid. Later research confirmed that there is indeed an Easy Internet Café in Madrid. If anyone in Madrid is reading this, it would be very much appreciated if you could email the_chaos_project@yahoo.com -- this would tell us for certain the IP address used by that café. |
From: mawete@saintly.com Dear Mrs. Louise, Thank you for your E-mail. This is mainly to inform you about my arrival at Madrid. This is the main reason of the delay of my message. Mr. Ferdinand booked a hotel for me and that's where I will stay He is aware of my arrival and the delivery is planned between 11:00 The box code are received and Your instructions will be executed. I will update you as regularly as possible from tomorrow. I thank you for your blessings, I think need them. I will leave you now and be back tommorow as soon as I will. God Bless You, |
|
From: mawete@saintly.com Dear Mrs. Louise, The delivery was postponned to tomorrow morning. So, I spent all the morning and the afternoon searching that money. Mr. Ferdinand was very co-operative with me and he agreed to postpon Dear Mrs. Louise, Please don't to worry. Tomorrow I wiil update you with positive news. Please if possible do confirm me that you are not going to wory. I will be back to you tomorrow. Have nice time and |
|
|
From: mawete@saintly.com Dear Mrs. Louise, I was wondering... What attitude will I have to Ex: - The code is not the one you gave me ? This is just for prevision. Be cause We never now .. Even if I remain positive and pray God so that every thing If you can answer it will be Ok, but if not Meanwhile stay with GOD blessings. |
|
|
From: mawete@saintly.com Dear Mrs. Louise, I have an other question : Is Mr. Ferdinand aware of Bless You, |
|
| For the first time, M. Maseka reports actually meeting one of the fraudsters (the "Office Manager") |
From: mawete@saintly.com Dear Mrs. Louise, THIS IS THE REPORT OF THE DAY: 11:00 -> I call Mr. Ferdinand, from down town to confirm that I He tels me that as tomorrow is a national hollyday in Spain, plans 13:00-> Mr. Ferdinand calls me, and tells me that due to the As you ask me to do all that they ask me to, I have agreed. 16:20-> The Office manager arrives to the Hotel, we operate The O.M tells me that is going to the airport, to take the 18:00-> I call Mr. ferdinand to ask for update. Then He tells me That delays but is not a a problem because their firm has a A few moments later he says to me that the parcel has been set free He says to me that considering the hour, the delivery is likely not 20:30 -> I call Mr. Ferdinand. 1:15-> The parcel is to destination. Re-confirmation for the ... Dear,I need assistance more than ever. What must I make. Is it ... Bless You, |
|
From: mawete@saintly.com Dear Mrs. Louise, As at this time I still have no reply from you, I will be back to you as soon as possible, May God of mercy Bless all of us, mainly you. |
|
| The first mention of money needing to be washed - a standard "wash wash" fraud. |
From: mawete@saintly.com Dear Mrs. Louuise, Hello. You don't have to worry. The money is in safety and cannot be to used because secured. To be spent, It has to be washed with a special machine available Excellent method of safety for which I am proud of Mr. Glenn. I am sending immediately this messge to avoid you any heart attack. I will give you details in the minutes which follow to make you So be happy, relaxe your self please, and give thanks and praises to May he bless all of us , Ps: In few moments I will be back to you. |
|
From: mawete@saintly.com Very Dear Madam Louise, The transaction is in the course of success. I say in progress because we have reached only 99% of chance to end The 1% remainder returns to the will of God. After, it will be necessary that I open one non-resident account here Thus you can blow a good blow. But considering the way in which the things have been organized, by - God loves us very very much, Because in the absence of only one of the points quoted above, I Mr. Glenn would have declared the exact contents of the parcel. This would have avoid the Spanish government suspucion, which was at Moreover I have been asked necessary documents as legitime and legal But malgre all these legally insuperable obstacles in theorie, the Thus, there is no mystery other than the infinite size of the eternal Thus ALELUYA... God is great.. I would wish by now to go to rest a little, because this one is my I am looking very very forward to read you earliest tomorrow thus. May the lord God bless us all like our work. By... By...by now. |
|
| The first change in IP address in some time, but only a slight one, to 213.39.30.210 (still in the same range as the address being used recently, with the same whois information). |
From: mawete@saintly.com Dear Mrs. Louise, Hello. I am sorry for the delay of my answer. This mail is just for update purposes. Please don´t worry, I am collecting all the By today evening I will be back to you. Things have to continue in a positive way Yes I now trust you about the perfect organisation Meanwhile have a good time. Bless You, |