|
|
Chaos Project #2 |
Mawete Maseka |
|
On December 8 2002 we received a message from an individual who had been spammed by an Advance Fee Fraud criminal claiming to be Mrs. Louise Estrada. This person supplied email and website addresses associated with this particular scam, and asked if we might be interested in taking a closer look. What we found when we accessed the mail account used by this fraudster alarmed us - he appeared to have a victim on the hook in a typical "wash wash" scheme, and had already convinced him to travel from his home in Grenoble, France to Madrid, Spain. At the point in which we entered the discussion, the victim appeared to be emailing the original scammer from Spain, discussing the meetings he had been having with (people who he did not know to be) other members of the criminal gang. After carefully analysing the available data to assure ourselves that the victim was genuine, and not another reverse scammer, we sent him an urgent warning message. What we did not know was that this would be the start of a campaign, still ongoing after 14 days, in which every single person whom we attempted to contact in order to ask for help in saving M. Maseka from his own foolishness completely ignored our approach. What follows is a transcript which first shows as much as we have been able to recover of the conversation between "Louise" and M. Maseka. From December 8, when we came in, it includes our attempts to raise a response from anyone who might be in a position to make direct contact with M. Maseka. The complete lack of response from his employers, the French police, a local newspaper, and Interpol is nothing short of shameful. We have published M. Maseka's real identity in the hope that someone reading this will find a way to contact him, or get some appropriate authority to contact him, and ensure that he is out of danger. We did tell M. Maseka that we would be publishing this page, and specifically offered to conceal his true identity if he so wished. We know that he read that offer, but he did not reply. Incidentally, this particular 'Louise Estrada' is the same as the one featured in the Louise Estrada thread of "The Lads do an Erap", which can be found at Scam-O-Rama. |
 M. Mawete Maseka - A Kenyan-born, French-resident victim of an Advance Fee Fraud scam.
|
||||||
|
|
See bottom of transcript for summary of post-publication updates. As messages may be deleted from the scammer's account in future, all headers have been reproduced here for later research. However, only messages relating to M. Maseka have been recorded - other messages to and from "Louise" have been omitted; indeed, she didn't seem to be handling any other promising victims in this account, although the same scammer or group have managed to swindle money out of at least one other victim in another account. The scammer usually did not keep copies of the messages he sent to M. Maseka (although he did on a few early occasions). On December 10, we activated the option in the scammer's account to keep copies of sent messages by default, so more outbound messages are available from that date forward. |
| This is the earliest message to which we have access. It would appear to be a typical 'first response' message, sent by the scammer to M. Maseka after he had replied to a spam 'format' (inital approach).
From M. Maseka's email address, we could see that he worked at IMAG, a grouping of research institutes in Grenoble, France. Specifically, he worked in the CMP team, although he now seems to have lost his job there (see entries for December 13). The google-cached version of the team's web page includes M. Maseka, and photos of all staff. The only other context in which M. Maseka turns up in a google search is a past-pupil listing of Lycée Denis Diderot, a French-language school in Nairobi, Kenya, where he apparently sat for his 'BAC' qualification in 1997. |
From: "louise estrada"
Dear Mawete Maseka, I thank you for your response and willingness to help me, your mail came to me at the greatest time of need in my life. i understand your plight and you need to be reassured that am very much real thus i will open up to you for the fact that you have shown good faith and trust. for us to proceed with this transactions, i will need you to contact my attorney in canada who's contact details i will be forwarding to you later so that you will contact and discuss the modus operandi of this transaction, but before you do that i will like you to forward to me your most private phone number so that i will give you a phone call to discuss this transaction with you after which you will choose which way to go, am not in the position to make a phone call, because of the high secuirty measures mounted in my house here in Manila philippine, but i will try as this money is my life and hope. please i will need you to reassure me that you will not sell me out to the philippine Government, because they are not aware of my contact to you neither do they know about this fund which is the last for my family (Myself and Kids) besides they have frozen all my husband account, who is now facing trails. on the other hand i will assure you that i will be very honest with you. I await to hear from you so that we can proceed. Louise Mrs. |
| This message from M. Maseka (the first that we can see) originated from an address that can be verified as oise.imag.fr, strong confirmation that it was sent from within IMAG. It seems safe to assume that this message really did come from Mawete Maseka, who really does work for IMAG. |
From: mawete.maseka@imag.fr Dear Mrs Louise Estrada, Your message and it contents were received. With all my due respects,I am attracted in this kind of deals but I want to be sure That's why, before I start any thing you, I want you to send a kind of I will be waitting your reply. Best Regards, Mrs Louise Estrada wrote: Dear, Listen and read carefully, i have found seriousness in you must take instructions from me at all time and for I,am Mrs LOUISA EJERCITOR ESTRADA , the wife of Mr During my husband's regime as president of Now i have used an NGO to move the money to a bank Mrs Louise Estrade (Wife to former philippine president) Upon your acceptance to deal with me i will forward to you the contact informations of my Attorney in canada for you to contact and discuss the terms. |
|
From: mawete.maseka@imag.fr Dear Mrs Louise, I acknowledge good receipt of your message. I perfectly understand your delicate situation and It will be I can see a restless mother for her children and familly future. Finally I'd like to set your mind at rest : My most private phone number is +33 6 99 19 44 25 but before calling me So long. Yours with regards, |
|
|
From: "louise estrada"
Dear Mawete Maseka, Thank you for your mail.and perfect understanding of my predicament. unfortunately i can not assure you of the time and when i will be calling you for the fact that i dont control the phone here as i would call at any giving time, that implies that my calling will be when i have noticed security lapeses/ but all the same i still believe we can still forge ahead. or should the call be a stobling block to our business? or better still i will advise you provide me with your cell phone number that way it will be easy for you to speak with me anytime am chance to call. Further more i need you to understand that at the moment am handicapped for the fact that i really can not do anything regarding getting my funds for some reasons thus with out wasting much time i will like to enquire from you how safe and secure your account is for such transfer of money.. dear am trying to protect myself and the kids. because the money in question USD120.5m is the very last for my family, thus i will not want anything to go wrong not for any reason, so we need to be extra careful about the bank account you will use for the transfer.as i dont know much about the banking system in paris. Please do reassure me that nothing will go wrong with my money as soon as it has been transfered to you. upon this assurance i will forward to you the details informations regarding the bank you will contact in view of securing the release of the funds to you as the beneficiary. Louise Mrs. It is very important you give me your cell phone number as i can call anytime. |
|
|
To: louise estrada
Dear Mrs Louise, Thank you for your mail. My bank is called Crédit Lyonnais.One of oldest, of most serious, Some situations have approached my banker and me. In such manner that In short, I have an account deposit in a serious bank of which the banker is Thus, it is a question of trusting me, knowing that my banker can facilitate the things to us. That's for my bank and my account. Personally I am optimistic for a sure and effective trasanction , if it exists. I rather hope to have been clear in my explanations. In all the cases, I think that we need to be connected 24h/24h so that this transaction should be I will wait for your answer. Regards, |
|
|
To: louise estrada
Dear Mrs Louise Estrada, It was nice to talk to you yesterday and on monday. I am ready to proceed. You talked about some one whose name was "Granman" (I don't know if the spelling is correct), So, I'd like you to tell me what do you realy want me to do ? As soon as you tell me what to do I will do it. I'm waiting for your instructions ! Reagrds, |
|
|
From: "louise estrada"
Dear Mawete Maseka, Am very happy that you are now very prepared to proceed with me in this transaction, let reassure you that i will remain honest and open with you till the end of this transaction. for us to have a smooth and sucessful transaction you will have to contact and open an online account with Crubank of bahamas. please do contact and open the account today so that the funds will be transfered into your account. BANK NAME: CRUBANK CORPORATION OF BAHAMAS Bless You. |
|
| Here we see M. Maseka change to a free-mail account (saintly.com is a domain handled by mail.com), but he has still posted this from the same IMAG IP as his earlier messages. |
From: mawete@saintly.com Dear Mrs Louise, Thank you for your picture. You are so smart. For security purposes I changed my mail address. The account with crubank is opened. I was given a reference number. But what is the second step ? What I am supposed to tell Mr. MICHEAL I don't understand the need of this online account. Can you explain I am waiting your instructions. Have a nice time. I await to hear from you too. Regards, |
|
From: mawete@saintly.com Dear Mrs. Louise, I tried, several times, to reach Mr. Glenn, by phone,today but he I would like also to have your news ! Good luck in whatever you do. I wait to hear from you. Yours, |
|
| This message (15 Nov) was found in the Trash, not the Inbox.
This message doesn't originate from M. Maseka's work address, but instead from 193.251.69.3 (AGrenoble-101-2-1-3.abo.wanadoo.fr). This is presumably a dynamically-allocated IP from his local ISP. This was sent at 8:34 PM, France time. |
From: mawete@saintly.com Dear Mrs Louise, One of Crunbank staff lady told me that Mr. Glenn Then I called again the lady back and asked her if she was able to She asked me who told me about they bank ? First, I am sorry be cause I told you that the account was opened. Now I don't know what to do. I will be waiting for instructions from you. I'd only like you to Know that I am not tired and I am ready to Bless you and all your familly |
|
From: "louise estrada"
Dear Mawete Maseka, I understand you better now, i now know that you are honest going by My advise now is for you to contact Mr.M. Glenn using his private I await to get a positive response from you asap. Bless You. Louise Mrs. |
|
|
From: mawete@saintly.com Dear Mrs. Louise, How are you? Did you receive my messages ? Please, update me on your news ! I just hope that you are doing well. Bless you; |
|
|
From: mawete@saintly.com Dear Mrs. Louise, I am very happy to have your news. About US$8500 I am going to do my best but The problem is that we have only two busness days I will report the progress to you asap. God bless you and try to have good time ! Yours, |
|
|
From: mawete@saintly.com Dear M. Glenn, Thank you for your quick response to my E-mail! I would like to pleadingly request an extension of two more days for Please confirm me whether you are OK or not. I will prefer Western Union for that deposit because it faster. Is the information given enough for a safe sending? I thank you in advance for your cooperation. Best Regards, |
|
|
From: mawete@saintly.com Dear Mrs. Louise, I decided to send a copy of all my correspondence with Crubank to you. I am looking for the opening balance, and I am positive. But I have two questions: How do you plan to manage once the funds are sent in my account ? What about your advocate in Canada you were talking about at the I am asking these questions not because I don't trust you, I just hope that you do understand me. I hope to hear from you soon. Please take care. Bless you and all your people. Yours, |
|
| M. Maseka uses his work account again, the first time for some time. |
To: "louise338@mail.com"
Dear Mrs. Louise, You don't have to worry because I obtained the extension of two I also found a source for the openning balance and I plan to sent the money But I need your call. So please, call me whenever you can. I thank you in advance. Yours, |
| IMAG account again. |
To: louise estrada
Dear Mrs. Louise, I have been facing troubles and problems because of As I told you, I am not rich. And as a matter of fact I had The guy was perfectly OK but he changed his mind at the last I tried to explain to him the profit that he could gain, fast That's why I was desappointed. I didn't want to tell those kind bad news for I knew your desapointement I went on searching and at this moment I just have a date with some one Dear Louise Mrs, I do undertand what you can feel at this moment by I just have my self. I am ready to go with our deal but you have to give me more time ! So I will continue searching the money for the opening balance ! Just tell me what you think about me and my situation. If I don't have any news from you I will conclude that you are tired But in all other cases please let me know your decision . With all my Best Regards, |
| Back to the free-mail account again, but sent from his work IP address. |
To: "zack smith"
Dear Mr. zack smith, My post office met some problems that delayed my transfer by westren I plan to acheive this transfer during this week. As soon that the transfer is done I will update you. I thank you in advance for your understanding. Best Regards, ----- Original Message ----- Date: Thu, 21 Nov 2002 12:32:41 GMT Subject: Send the money to our north American Representative > Dear Sir, |
| IMAG account again. |
To: "louise338@mail.com"
Dear Mrs. Louise, I managed to get $US 4000. Today I am supposed to get , thanks to an other date with an other friend, But I'am wondering why the money can't be sent from As also I noticed that you are familiar with Crubank and Mr. Glenn, In all the cases we have all this week for us to send the money to CruBank, In two hours from now I will know if the second guy is going lend me the needed But what if the doesn't ? This is the only guy remaining in whom I am confident. So please, reply to this message of mine so that I can update you about Bless You, PS: By the way I am still wondering how did you managed it to get my address ? |
|
To: "louise338@mail.com"
Dear Mrs. Louise, How are you doing ? I hope that there is nothing that could make me worry I am looking forward to hearing from you! Bless you |
|
|
To: "louise338@mail.com"
Message received OK!! |
|
| Free-mail account, sent from IMAG. |
From: mawete@saintly.com Dear Mrs. Louise, As I told you on the phone, I changed my mind about CruBank The link below is the Bahamas Central Bank web site full adress. So although the money is available. I am not going the send it for What do you think about this ? Bless You. |
|
From: mawete@saintly.com Dear Mrs. Louise, I am ready to proceed to any of this place. Because I like I hope that you do understand what I mean ! But I also think that this have to be well planned so that So, my decision is : let's go on. Bless you. |
|
|
From: mawete@saintly.com Dear Mrs. Louise, I will be waiting for news from you. I have started plans for proceeding to spain. Bless You, |
|
| From his local ISP IP address again, presumably because it's a Saturday, |
From: mawete@saintly.com Dear Mrs. Louise, Your mail was in good receipt.I thank you. I am going to call Mr. Fredinand. What am I going to tell him ? I will be back to you later today to update you Bless you. |
|
From: mawete@saintly.com Dear Mrs. Louise, I called Mr. Ferdinand GODJO. I reached him and he gave me his fax number. He talled me that once he receives the fax, then he will be able to I am just wondering if I will not need extra information I will wait for the acknowldge of this message before I So,I will wait for news from you before I do anything. Bless You, |
|
| Monday: back to work and mailing from IMAG. |
From: mawete@saintly.com Dear Mrs. Louise, I sent the fax to Mr. Ferdinand and I am still I was thinking that it is useless for me to move I will update you as soon as I have further information. Bless You, |
| Tuesday, 8:57 AM France time: ISP IP address. Off work? He says that he is planning to fly to Spain today. |
From: mawete@saintly.com Dear Mrs. Louise, I had confirmation of the consignemnt I just have to date him for the delivery, which I plan to be tomorrow I will take an airplane today as soon as possible. Dear Mrs. Louise, For now I will need your instructions and I will I trust you strongly now !!! I will update you with my arrival planning in Spain in few hours. Bless you, |
| Just after midday, and he has apparently organised his flight. |
From: mawete@saintly.com Dear Mrs. Louise, I thank you for your E-mail. I will be at Madrid today at 8:00 PM. I will then book a hotel for the night and proceeding Mr. Ferdinand is aware of my arrival. I will write to you as soon as I arrive. God Bless You, |
| M. Maseka reports that he has arrived in Madrid. Local time for this message is (we think) Wed 04 Dec, 01:35 AM.
The originating IP address is new: 213.39.30.202. Whois info as follows: inetnum: 213.39.30.0 - 213.39.30.255 Although at first glance this seems to indicate France, a google search on the raw IP turns up far more Spanish references, suggesting that the whois info may be misleading. On closer examination, it seems likely that PSI France have allocated a small address range to "Easy Internet Cafes Europe" (which appears to be a division of the UK company EasyEverything, which includes EasyJet), and the specific address in question is perhaps used by an Internet Cafe in Madrid. Later research confirmed that there is indeed an Easy Internet Café in Madrid. If anyone in Madrid is reading this, it would be very much appreciated if you could email the_chaos_project@yahoo.com -- this would tell us for certain the IP address used by that café. |
From: mawete@saintly.com Dear Mrs. Louise, Thank you for your E-mail. This is mainly to inform you about my arrival at Madrid. This is the main reason of the delay of my message. Mr. Ferdinand booked a hotel for me and that's where I will stay He is aware of my arrival and the delivery is planned between 11:00 The box code are received and Your instructions will be executed. I will update you as regularly as possible from tomorrow. I thank you for your blessings, I think need them. I will leave you now and be back tommorow as soon as I will. God Bless You, |
|
From: mawete@saintly.com Dear Mrs. Louise, The delivery was postponned to tomorrow morning. So, I spent all the morning and the afternoon searching that money. Mr. Ferdinand was very co-operative with me and he agreed to postpon Dear Mrs. Louise, Please don't to worry. Tomorrow I wiil update you with positive news. Please if possible do confirm me that you are not going to wory. I will be back to you tomorrow. Have nice time and |
|
|
From: mawete@saintly.com Dear Mrs. Louise, I was wondering... What attitude will I have to Ex: - The code is not the one you gave me ? This is just for prevision. Be cause We never now .. Even if I remain positive and pray God so that every thing If you can answer it will be Ok, but if not Meanwhile stay with GOD blessings. |
|
|
From: mawete@saintly.com Dear Mrs. Louise, I have an other question : Is Mr. Ferdinand aware of Bless You, |
|
| For the first time, M. Maseka reports actually meeting one of the fraudsters (the "Office Manager") |
From: mawete@saintly.com Dear Mrs. Louise, THIS IS THE REPORT OF THE DAY: 11:00 -> I call Mr. Ferdinand, from down town to confirm that I He tels me that as tomorrow is a national hollyday in Spain, plans 13:00-> Mr. Ferdinand calls me, and tells me that due to the As you ask me to do all that they ask me to, I have agreed. 16:20-> The Office manager arrives to the Hotel, we operate The O.M tells me that is going to the airport, to take the 18:00-> I call Mr. ferdinand to ask for update. Then He tells me That delays but is not a a problem because their firm has a A few moments later he says to me that the parcel has been set free He says to me that considering the hour, the delivery is likely not 20:30 -> I call Mr. Ferdinand. 1:15-> The parcel is to destination. Re-confirmation for the ... Dear,I need assistance more than ever. What must I make. Is it ... Bless You, |
|
From: mawete@saintly.com Dear Mrs. Louise, As at this time I still have no reply from you, I will be back to you as soon as possible, May God of mercy Bless all of us, mainly you. |
|
| The first mention of money needing to be washed - a standard "wash wash" fraud. |
From: mawete@saintly.com Dear Mrs. Louuise, Hello. You don't have to worry. The money is in safety and cannot be to used because secured. To be spent, It has to be washed with a special machine available Excellent method of safety for which I am proud of Mr. Glenn. I am sending immediately this messge to avoid you any heart attack. I will give you details in the minutes which follow to make you So be happy, relaxe your self please, and give thanks and praises to May he bless all of us , Ps: In few moments I will be back to you. |
|
From: mawete@saintly.com Very Dear Madam Louise, The transaction is in the course of success. I say in progress because we have reached only 99% of chance to end The 1% remainder returns to the will of God. After, it will be necessary that I open one non-resident account here Thus you can blow a good blow. But considering the way in which the things have been organized, by - God loves us very very much, Because in the absence of only one of the points quoted above, I Mr. Glenn would have declared the exact contents of the parcel. This would have avoid the Spanish government suspucion, which was at Moreover I have been asked necessary documents as legitime and legal But malgre all these legally insuperable obstacles in theorie, the Thus, there is no mystery other than the infinite size of the eternal Thus ALELUYA... God is great.. I would wish by now to go to rest a little, because this one is my I am looking very very forward to read you earliest tomorrow thus. May the lord God bless us all like our work. By... By...by now. |
|
| The first change in IP address in some time, but only a slight one, to 213.39.30.210 (still in the same range as the address being used recently, with the same whois information). |
From: mawete@saintly.com Dear Mrs. Louise, Hello. I am sorry for the delay of my answer. This mail is just for update purposes. Please don´t worry, I am collecting all the By today evening I will be back to you. Things have to continue in a positive way Yes I now trust you about the perfect organisation Meanwhile have a good time. Bless You, |
| Enter The Chaos Project
This is the point at which we gained access to the account louise338@mail.com. All previous messages were extracted from that account to build up the transcript thus far. |
|
| Our first attempt to warn M. Maseka. |
Date: Sun, 8 Dec 2002 21:27:24 -0800 (PST) Dear Mawete, YOUR LIFE IS IN DANGER This is not a joke. The people you are dealing with (Louise Estrada, Mr. Glenn, Ferdinand Godjo, Crubancorp, etc.) are ALL criminals who are carrying out an elaborate fraud. If you have really travelled to Madrid and met with them, you are in EXTREME DANGER from these people! You must cease all contact with them IMMEDIATELY and contact the police without delay. These people (who will all be using false names) are operating what is known as an "Advance Fee Fraud" scheme, also called Nigerian fraud, or 419 fraud. This is an extremely common form of international fraud, usually conducted by Nigerians. Normally, they simply try to get you to send them money in the form of "fees" that they claim are needed to release large sums of money, and promise to send you a share. However, when they are lucky enough to lure a victim to travel to another country, there is a SERIOUS RISK that they will kidnap and ransom, or even MURDER you. We realise that this information will come as a shock to you, and you will be tempted to disbelieve us. However, you do not need to believe what we say: CONTACT THE SPANISH POLICE IMMEDIATELY. They will confirm what we are saying, and provide you with advice and protection. You will not be in trouble yourself. Please understand, the criminals have lured you to Spain because they hope that you will feel uncertain in a foreign country, and unwilling to contact the authorities. There is also a lot of information available on the Internet that will explain the issue of 419 Fraud. Given the advanced stage of your involvement, we urge you to contact the authorities WITHOUT DELAY, for your own protection. It may also be a good idea to speak immediately to the manager of your hotel, to help avoid further contact with the criminals before you are able to meet with the police. However, if you wish to research the issue first, simply use google to search for terms such as "419 fraud" "advance fee fraud", "nigerian scam", etc. Or ask for assistance from anyone you trust, who is not involved with the people that you are dealing with. Many people know of this form of fraud. You can of course also contact us by replying to this email, but that is not necessary. We are not in Spain, and cannot help you directly: you must help yourself. In your particular instance, they appear to be running a scam that they call "wash wash", in which they show you money that has been marked, but can be cleaned with a special solvent. Search for "wash wash fraud" with google and you will find more information on this topic. The Chaos Project is involved in actively interfering with the activities of Nigerian fraudsters (there are literally thousands of them) by gaining access to the email accounts and websites that they use in their schemes, and using this access to warn their victims. Many other people are involved in similar activities, or in wasting the criminals' time by corresponding with them under false identities. See http:///www.scamorama.com for many humorous examples, including the case of another person who corresponded with the SAME group of criminals that are defrauding YOU. This site also has many links to further information, including international law enforcement advisories. We have contacted you because we found your correspondence with one of these criminals in an email account that was advised to us by another person whom they attempted to defraud. It is possible that you too are simply lying to the criminals. However, we cannot tell this from the correspondence that we have access to, and we are EXTREMELY CONCERNED that you do appear to have travelled to Spain to meet them. BEWARE! This places you in extreme danger. We cannot stress this strongly enough. Do not panic, but please proceed with the UTMOST CAUTION - it is clear that the criminals have invested a significant amount of time in you, and they will make strong efforts to retain you as their victim. Once again, YOU ARE IN IMMINENT DANGER, and you MUST contact the police for protection. Yours sincerely, |
| 18 hours later, the following message was sent to M. Maseka's work address, and Cc:ed to his saintly.com address. A bounce message was received from the mail server at his place of work (see example later), suggesting that yahoo.com was 'blacklisted' by their anti-spam software. Therefore we assume that this message never reached his work mailox. |
Date: Mon, 9 Dec 2002 15:32:02 -0800 (PST) Dear Mawete, We have not yet received a reply to the message (below) which we sent you this morning (your time) If we do not receive a response from you soon, we will next contact your employers at IMAG. We Yours sincerely, --- The Chaos Project
|
| This message was sent to the contact address listed on the IMAG website (icom@imag.fr) as a test, to see if it would be rejected like the earlier message. No bounce message was received, so possibly the restriction against yahoo.com addresses does not apply with this address.
There has never been any response to this message. |
Date: Mon, 9 Dec 2002 16:30:01 -0800 (PST) Bonjour, I am trying to contact an IMAG employee, Mr. Mawete Maseka. My attempts to email him have been Are you able to advise whether there is any way around this blacklisting? Yours sincerely, |
| This is the first message we saw after turning on "Keep copies of sent messages" in the scammer's account.
Our best guess is that the scammer is simply trying to hurry the victim up. |
From: "louise estrada"
Dear Mawete, It seems you want me dead.. right? let me hear from you. Bless You. Louise Mrs. |
| As we still have had no response from M. Maseka, we now use the icom@imag.fr address to try to contact his employers.
There has never been any response to this message. |
Date: Tue, 10 Dec 2002 03:05:46 -0800 (PST) EXTREMELY URGENT (Une Copie suit en français) We have been trying without success to contact your employee, Mr. Mawete Maseka. We recently discovered email correspondence between Mr. Maseke and a group of people who are criminals operating a Nigerian-style Advance Fee Fraud (also known as 419 fraud). We are hoping that Mr. Maseka is safely at work in Grenoble, and that he has been misleading these criminals with false information. However, if he is not currently at work, then it is almost certain that (as the correspondence suggests) he is in Madrid, and is now in direct contact with these potentially dangerous criminals. If Mawete Maseka is not in Grenoble, this case must now be treated very seriously. In some instances, this type of fraud can lead to kidnapping and even murder, so his life may be in danger. Please contact your local police immediately, and show them this message. Unfortunately we have not been able to discover any information about the exact location of Mr. Maseka. He mentions being in a hotel in Madrid, but does not give the name. If he has a cellphone, you (or the police) should try to contact him immediately to warn him of the danger he is in. The correspondence we discovered can be accessed as follows: Website: www.mail.com This account is used by one of the criminals who is deceiving your employee. Please understand that the criminal is not aware that other people are accessing his mailbox - take care to avoid alerting him and his associates. Most of the messages which can be viewed in this account are messages from Mr. Maseka to this criminal. Yesterday we activated the option to record copies of outgoing messages, so from now on (10 Dec), copies of messages from the criminal will also appear (in the "Sent Mail" folder). Please act on this information IMMEDIATELY. This is not a joke. Unless we are mistaken, your employee is in the clutches of a group of criminals who may be very dangerous. Unless you can establish with absolute certainty that he is not in danger, the police must be contacted immediately. Yours sincerely, The Chaos Project ===== EXTREMEMENT URGENT Nous avons essayé sans le succès pour contacter votre employé, M. Mawete Maseka. Nous avons découvert récemment la correspondance d'e-mail entre M. Maseke et un groupe de gens qui sont des criminel qui opèrent une Fraude d'Honoraire d'Avance de nigérian Style (aussi su comme 419 fraude). Nous espérons que M. Maseka soit sans accident au travail dans Grenoble, et qu'il a été trompeur ces criminel avec l'information fausse. Cependant, s'il n'est pas actuellement au travail, alors c'est presque certain cela (comme la correspondance suggère) il est dans Madrid, et est maintenant dans le contact direct avec ces criminel potentiellement dangereux. Si Mawete Maseka n'est pas dans Grenoble, ce cas doit être maintenant traité très sérieusement. Dans quelques exemples, ce type de fraude peut mener à l'enlèvement et même le meurtre, donc sa vie peut être en danger. S'il vous plaît contacter votre police locale immédiatement, et les montrer ce message. Malheureusement nous n'avons pas pu découvrir de l'information de l'emplacement exact de M. Maseka. Il mentionne est dans un hôtel dans Madrid, mais ne donne pas le nom. S'il a un radiotéléphone, vous (ou la police) doit essayer de le contacter immédiatement l'avertir du danger qu'il est dans. La correspondance que nous avons découvertes peut être accessed comme suit: Website: www.mail.com Ce compte est utilisé par un des criminel qui trompe votre employé. S'il vous plaît comprendre que le criminel est gens pas conscient qu'autre que les accessing sa boîte à lettres - prendre le soin pour éviter alerter lui et le sien associe. La plupart des messages qui peut être regardé dans ce compte sont des messages de M. Maseka à ce criminel. Hier nous avons activé l'option pour enregistrer des copies de messages sortants, donc à partir de (10 Décembre), les copies de messages du criminel apparaîtront aussi (dans le "le Courrier Envoyé" le dossier). S'il vous plaît l'acte sur cette information IMMEDIATEMENT. Ceci n'est pas une plaisanterie. A moins que nous sommes mépris, votre employé est dans les embrayages d'un groupe de criminel qui peut être très dangereux. A moins que vous pouvez établir avec la certitude absolue qu'il n'est pas en danger, la police doit être immédiatement contactée. |
| We also send a copy to M. Maseka's departmental director, in case the main icom@imag.fr mailbox is not cleared frequently. Unfortunately, this address is subject to the same over-enthusiastic anti-spam restrictions, and a rejection message is received for this copy. |
Date: Tue, 10 Dec 2002 03:29:01 -0800 (PST) EXTREMELY URGENT (Also sent to/aussi envoye a: icom@imag.fr) (Une Copie suit en français) We have been trying without success to contact your employee, Mr. Mawete Maseka. |
| No response to the earlier warnings. As they have had all afternoon (France time) to respond, we give up that approach and next track down the only method we could find of contacting the French police (via email), and submit a form at their main web site.
There has never been any response to this message. |
Date: Tue, 10 Dec 2002 18:15:01 +0000 (GMT) Sent copy of icom@imag.fr warning msg to the French Ministry of the Interior |
| The victim sent this message to the scammer about half an hour before finally acknowledging our warning. Presumably he was working through his email account responding to messages, and replied to the scammer before reading our warning.
The raw originating IP address hasn't been seen before (80.11.136.219), but it reverses to something very similar to his previous local ISP IP address: AGrenoble-101-1-5-219.abo.wanadoo.fr |
From: mawete@saintly.com Dear Mrs. Madam Louise, I am realy sorry for the delay. I was looking for the cash amount of 30.000 Euro that was required But according to my financial situation and as you know how much I it Took me $US 1.500 000 for the help I was given from spain so that How long will it take me to get the 30.000 Euro ? I don't Know. I am trying my best And I will update you as soon as I will be abble Dear Mrs. Louise, I am very very very very afraid according to the I don't undesrtand why the secured money can't help us wash that AS I was telling you in the beggining, I am a poor man with many I would like to avoid any kind of problem, so please I ask for your I will wait anxiously yor reply. Bless You, ----- Original Message ----- Date: Wed, 11 Dec 2002 03:12:41 -0500 Subject: update. > Dear Mawete, |
| Finally the victim replies to our warning. Curiously, his prime concern seems to be whether we had told his boss (as we hinted we would). |
X-Apparently-To: the_chaos_project@yahoo.com via 216.136.131.40; 11 Dec 2002 04:51:11 -0800 (PST) Hello, Your message were received only today by me. I am sorry. I could not Know or imagine that things were like this. So please help me instead of warning my boss. I will wait a reply ASAP. I thank you in advance. Yours Mawete, |
| Again he asks whether we have told his boss ... |
X-Apparently-To: the_chaos_project@yahoo.com via 216.136.131.41; 11 Dec 2002 05:02:54 -0800 (PST) Hello, Please tell me if my boss have been told about all these So that I can Know How to proceed, I thank you in advance. Yours Mawete. |
| ... and again.
So far, these are the only messages that we have had from M. Maseka, and all three are mainly concerned with asking us whether his boss has been informed. Around this time, he appears to have lost his job (see later). This might simply be due to his having run off to Spain without telling his employers, or staying away too long, but it is interesting to speculate that he may actually have stolen money from his workplace or colleagues to pay the scammers - this is something that turns up quite often in news reports of 419 victims |
X-Apparently-To: the_chaos_project@yahoo.com via 216.136.131.44; 11 Dec 2002 05:06:43 -0800 (PST) Hello, Please tell me if my boss have been told about all these So that I can Know How to proceed, I thank you in advance. Yours Mawete. |
| So we tell him what we have done.
We are keen to hear back from him, as there is a slight chance that he will not heed our warning. In order to encourage ongoing contact with us, we withhold full copies of our messages to his employer and the police until he responds. There has never been any response to this message. |
Date: Wed, 11 Dec 2002 12:55:46 -0800 (PST) Dear Mawete, Thank you for your reply. We are VERY relieved to see that you are safely back in Grenoble. We have been extremely concerned about your safety. We tried to contact you in a number of ways, including emails to your place of work (IMAG). We are sorry if this causes you any trouble, but after very careful research, we determined that it was very likely that you were in Spain (as your emails suggested), and were in EXTREME danger from the criminals who were defrauding you. We located your IMAG contact details on a web page (http://cmp.imag.fr/CMPStaff.html). Our attempts to contact your director Bernard Courtois failed because your company's anti-spam software rejected mail from our yahoo.com address. This means that he will not have received our message. We also sent a warning message to the email address icom@imag.fr, which was not rejected, but we have received no reply to that message. Perhaps messages to that address are read only infrequently, or it may have been rejected 'silently', without notification to us. Another person, acting independently, tried to email your colleague Sebastien Colin. This message was probably also rejected because of its yahoo.com originating address, but we have not had confirmation of this. Because we were extremely concerned for your safety, we also sent a message through a web-based contact form at the national French Police web site. We have received no response to that message. Mawete, it appears almost certain that you have been the victim of an Advance Fee Fraud criminal operation, also known as 419 fraud. Could we please ask you to reply ASAP to confirm that you now understand what has been happening? When we receive your reply, we will forward to you copies of the messages we sent to icom@imag.fr, and to the French police. It is vital to your safety that you research the issue of Advance Fee Fraud, and understand what these criminals were doing to you. If you still believe the story that they have told you, then you may still be in danger from them (although this is now unlikely, as long as you do not meet them again in person). However they will certainly continue to try to get money from you until you either tell them that you know what they are doing, or (safer) simply stop communicating with them altogether. The fastest way to find information on the particular scheme they were using with you is to do a google search on the phrase "wash wash fraud". You can also find a good selection of informative links at the bottom of the excellent Scam-O-Rama page (http://www.scamorama.com), and you may like to visit our own site at http://connect.to/chaosproject We are very interested to receive more information about what really happened to you. Although we considered the possibility that you were deceiving the criminals (as many people now do), all the evidence suggested that you had actually gone to Spain and met with them. Is that correct? What happened to you there - did you lose money? If you have lost money to these criminals, we strongly recommend that you contact your local Police. Police attitudes vary in different countries (e.g. in the USA the police will not be interested unless you have lost a great deal of money), but it would be worth checking with your local authorities. Once again, please accept our apologies if we have caused you any difficulty, with your employer or otherwise. Our efforts to contact them, and the police, were made because we genuinely believed, after careful research, that there was a significant risk that you were in mortal danger from dangerous criminals. Yours sincerely, --- Mawete Maseka
|
| After still not hearing any more from M. Maseka, we took another look in the scammer's account, and found the following.
Local Grenoble Wanadoo IP address again. |
From: mawete@saintly.com Dear Mrs. Louise, Thank you for your message. I am planning to ask for a personnal credit from one richisim But before I proceed I would like to be asssured about the future How come that the spanish central bank can't take some pourcentages In all the cases I will do my best, to collect some money but I am May The GOD of Goodness Bless You, |
|
From: "louise estrada"
Dear Mawete, Listen dear you need not worry yourself over the 6,000.00 euros you Note that, it will be impossible for the spanish central bank to My, dear please go ahead and request for the loan from your friend Xmas is around the corner and am quite sure you want to get the best I will wait for your detailed informations that you have gotten the Bless You. Louise Mrs. |
|
|
There has never been any response to this message. |
Date: Fri, 13 Dec 2002 04:10:58 -0800 (PST) Dear Mawete, A couple of days ago we asked you to write to us to tell us what had happened to you in Spain. As you haven't replied, we looked again at the email account louise338@mail.com We were amazed to find that you are still corresponding with the criminal that operates this account! Do you not understand what is happening here? That person is not Louise Estrada - it is a male Nigerian criminal, who is part of a group that are stealing your money. We are also very alarmed to see that they want you to go back to Spain. Mawete, you MUST NOT DO THIS! There is a small but SERIOUS risk that you will be kidnapped or murdered by this criminal gang. We are guessing that perhaps you do understand that they are criminals, but you are hoping to get back the 6.000 Euros you have given them. You must accept that this will not happen - that money is lost, and you will only endanger yourself by trying to recover it. Have you researched the issue of Advance Fee Fraud, as we advised you? Just search for "wash wash fraud" at Google (http://www.google.com), and you will find plenty of information about the scam they are pulling on you. We understand that you are a French speaker (having gone to the Lycee Denis Diderot in Kenya, and now working in Grenoble at IMAG); perhaps you had difficulty understanding our warnings. Show our letters to an English speaker that you trust - they will translate them for you. Mawete, PLEASE heed our warnings. Do not continue to place yourself in DANGER. Please reply to this message as soon as possible to reassure us that you accept that you have been defrauded, and will not continue to meet with these criminals or send them money. Yours sincerely, The Chaos Project |
| This is the last message we have seen in the louise338@mail.com mailbox. We speculate that M. Maseka may have told his scammer about our ability to access this mailbox, prompting him to switch to a new address.
However, we do have reason to believe that the scammer is still monitoring the louise338@mail.com mailbox, at least as late as 19 December (we observed unrelated spam arrive in the Inbox, and then later get trashed). |
From: "louise estrada"
Dear Mawete, I need to hear from you, as am quite sure that by now you must have Please do update me soonest as am getting worried. Bless You. Louise Mrs. |
| Still no response, so we try to contact him at his work address. Although we get the expected bounce, somehow an automatic process is still triggered, and we also get a message suggesting that M. Maseka has been fired.
There has never been any response to this message. |
Date: Fri, 13 Dec 2002 12:56:21 -0800 (PST) Dear Mawete, Are you back at work yet? What is happening? We are very concerned about your safety - please reply ASAP. Yours sincerely, The Chaos Project |
| This is the bounce message that we receive for all messages sent to address @imag.fr, except for icom@imag.fr (no bounce). |
X-Apparently-To: the_chaos_project@yahoo.com via 216.136.131.44; 13 Dec 2002 12:56:32 -0800 (PST) Our UCE (spam) detectors have been triggered by a message you sent:- The server which is sending the message to our site is listed in a If you have any questions about this, or you believe you have received -- |
| We also note that M. Maseka has been expunged from the web page for his department, and all staff photos have been removed (leaving only names and contact details). |
X-Apparently-To: the_chaos_project@yahoo.com via 216.136.131.42; 13 Dec 2002 12:56:35 -0800 (PST) Hello Mawete Maseka is not anymore member of CMP, |
| Still no success in seeking help. Next we try a suggestion from a helpful correspondent, and email the 24-hour newsdesk of a newspaper in the Grenoble area.
There has never been any response to this message. |
Date: Fri, 13 Dec 2002 14:28:19 -0800 (PST) Bonjour, (Nous nous excusons d'écrire en Anglais; nous parlons Français un peu, mais pas très bien. Vous pouvez répondre en Français ou Anglais.) The Chaos Project is a modest project to frustrate the efforts of Nigerian Advance Fee Fraud criminals (419 fraud). We will assume that you are familiar with this type of fraud, or that you will research it. http://connect.to/thechaosproject/ We recently gained access to the email account of one of these criminals, and discovered a conversation with a Grenoble resident. The fraudsters are operating a scam on this person that the Nigerians call "wash wash fraud". We were very concerned to find that the victim had been lured to Madrid to meet the criminals. By doing this, he placed himself at serious risk - in some cases victims who travel to meet the criminals are kidnapped or even murdered. We made numerous efforts to contact the victim, his employers, and the French police, but without success. This is partly because The Chaos Project operates under one prime rule: anonymity at all costs. Because the perpetrators of these scams are sometimes dangerous criminals, we do not reveal our real identity, make traceable telephone calls, etc. All contact must be via email. Although he acknowledged our warning, the victim is still communicating with the criminals, and may still be deceived by their lies. His last email was from Grenoble, but they are trying to get him to go back to Spain with more money. Therefore he may still be in serious danger. The victim also seems to have lost his job, so he may be quite distraught and acting irrationally. In order to help him, we desperately need email contact with someone local to the victim (preferably the local police), in order to help make him understand what is going on. We are therefore asking if you could please make some enquiries and find someone who we can contact by email, who could then make contact with the victim and ensure that he is safe. Ideally we would like to communicate with someone from the local fraud authorities who has the time to help, and is willing to do so. In return for your help, we will provide updates on what happens with this fraud victim. It could potentially make quite a good newspaper story. Yours sincerely, The Chaos Project |
| 26 hours after that, once again with no response, we take our correspondent's second suggestion and email M. Erik Madsen, who is listed on Interpol's Intellectual Property Crimes Links page as follows:
Contact officer: Although 419 fraud is not related to intellectual property, is is a financial crime, and M. Madsen's address was suggested to us because Lyon is not far from Grenoble. We had assumed that he would either respond, or else pass the information to someone more appropriate. M. Madsen was given the address for a separate copy of M. Maseka's transcript, and that address has never been advised to anyone else. As far as we can tell, that page's built-in web-bug has never been triggered. Therefore we assume that M. Madsen, if he read our message at all, never looked at the transcript. There has never been any response to this message. |
Date: Sat, 14 Dec 2002 16:23:20 -0800 (PST) Bonjour, (Nous nous excusons d'écrire en Anglais; nous parlons Français un peu, mais pas très bien. Vous pouvez répondre en Français ou en Anglais.) The Chaos Project is a modest project to frustrate the efforts of Nigerian Advance Fee Fraud criminals (419 fraud). Obviously you will be familiar with this type of fraud. http://connect.to/thechaosproject/ We recently gained access to the email account of one of these criminals, and discovered a conversation with a Grenoble resident. The fraudsters are operating a scam on this person that the Nigerians call "wash wash fraud" (marked money that can only be cleaned with an expensive chemical). We were very concerned to find that the victim had been lured to Madrid to meet the criminals, and therefore was possibly at risk of violence from the scammers. We have a transcript of the conversation between the scammer and the victim, together with our own messages relating to this case. Because it is too large to email through Yahoo, we have posted the transcript on our website at the following address. Please note that this address has not been given to anyone else, so the transcript is not public. http://connect.to/thechaosproject/__________.html As you will see from the transcript, we have made numerous efforts to contact the victim, his employers, the French police, and the local media, but so far without success. Recently an ex-patriot Frenchman living in the U.K. responded to our appeal for contact information and helpfully suggested this Interpol address. Although the victim acknowledged our warning, he is still communicating with the criminals, and may still be deceived by their lies. His last email was from Grenoble, but they are trying to get him to go back to Spain with more money. Therefore he may still be in serious danger. The victim also seems to have now lost his job (at IMAG), so he may be quite distraught and acting irrationally. Please note that although we are a stricly amateur effort, we do have a reasonable understanding of what we are doing. We have only persisted with this case because an analysis of the victim's originating IP addresses in his diferent messages really do seem to confirm that he travelled from France to Spain to meet with the criminals, thus putting himself in serious danger. If he can raise more money, there is a risk that he will agree to their request to go back to Spain and meet them again. PLEASE respond immediately to indicate reception of this notification. We are very disappointed at the lack of response to all our previous efforts, and remain very concerned for the safety of M. Maseka. Although The Chaos Project has a cardinal rule of retaining its anonymity at all costs, we are eager to provide any help that we can offer, via email. Yours sincerely, The Chaos Project |
| This message, with its suggestion of publishing his name, was written specifically to provoke a response from M. Maseka. It was also bugged, so that we could find out if, and from where, he was receiving our messages. The bug revealed that the message was read approximately five hours later, from a Grenoble IP address (193.251.23.145; AGrenoble-101-1-1-145.abo.wanadoo.fr) on 17 Dec at 09:23 GMT.
There has never been any response to this message. |
Date: Mon, 16 Dec 2002 20:04:23 -0800 (PST) Cher M. Maseka, Why have you not responded to our earlier messages? Where are you - are you safe? We will soon be publishing the transcript of your correspondence with the criminal who pretended to be Louise Estrada. If you would like, we can change your name in the text. Would you prefer this? Yours sincerely, |
| After a couple more hours with no response, we try again to coax a response out of him. This time we try harder to prove to him that we will publish his name.
This message was also bugged, and the bugs showed that he read the message on 17 December, at 5:15 PM GMT. The copy of the transcript for which we gave him the address (again, a separate copy specifically for him, this time with all mention of web bugs removed) is also bugged, and has not been viewed by the time of publication of this page. |
Date: Tue, 17 Dec 2002 03:31:05 -0800 (PST) Cher M. Maseka, We know that you are reading our messages, and we know that you are in Grenoble, so for the moment we are hoping that you are safe. However, you continue to ignore our requests for a response. We also know that all activity has now ceased in the account louise338@mail.com, an account that had previously been in active use for many months to defraud (or attempt to defraud) other victims as well as yourself. We can therefore surmise this possible scenario: - You continue to believe the lies that are being told to you about dirty money in Madrid. - You have told the criminals about our messages to you, and have perhaps even forwarded some of our messages to them. - Because of this, they have stopped using the address louise338@mail.com, and are communicating with you from another account. Is that what is actually happening, Mawete? Are we right? How close are we? We know that it will be hard to accept that you have lost your money to this fraudulent scheme. However, you MUST grasp this, or you will continue to lose money and endanger yourself. At our web site, we now have a page describing the type of fraud of which you are a victim. There are also links to other sites. READ this page. FOLLOW the links and READ what you find there. Website - http://connect.to/thechaosproject/ "About AFF" page - http://connect.to/thechaosproject/aboutAFF.html Follow this next link, and find a page that provides a transcript between the SAME SET OF CRIMINALS that are defrauding you, and somebody else who knows what they are doing. http://www.upvetmet79.org/~juramentado/ Despite the lack of response from you, we are determined to do all we can to thwart these criminals and save you from your own foolishness. If we do not hear from you soon, we will publish the full transcript of your conversations with Louise Estrada on our web site. In fact it is already there, we simply have not published the address of the page. You may view it immediately: http://connect.to/thechaosproject/__________.html If you are still in any doubt, contact the police. Show them our messages. Show them the messages from "Louise Estrada". The police will know who is lying, and will explain it to you. Remember, we are telling you to GO TO THE POLICE. Will the criminals give you the same advice? Yours sincerely, The Chaos Project |
| This message was sent simultaneously to the following addresses, as well as through the web form at http://www.interieur.gouv.fr
icom@imag.fr An immediate anti-spam rejection bounce was expected from the address of M. Maseka's ex-department director (Bernard Courtois), but did not arrive. There have never been any responses to this message. |
Date: Thu 19 Dec 12:10 GMT Over the past 12 days, The Chaos Project has been attempting to enlist help in warning a young Grenoble resident that he is being actively defrauded by a group of Nigerian criminals operating an Advance Fee Fraud, or '419' scheme. |
| PUBLICATION - Sunday December 22, 10:00 AM (GMT) - The transcript up to this point is published at The Chaos Project web site. A link is provided from the front page. The project is announced on Alex Kerensky's Reverse Scam Message Board. | |
| Apparently still unread as at 24 Dec 02:00 GMT, however the service we use for 'bugging' has been having some outages. |
Date: Sun, 22 Dec 2002 16:30:48 -0800 (PST) Cher M. Maseka, |
| This message was sent to nine addresses, two of which bounced immediately. It's a long shot, and we don't hold very high hopes of a response, but it's worth a try.
The French translation, a vast improvement on our original, was kindly provided by "Dr. Esher Koli", a fellow anti-scammer. |
Date: Sun, 22 Dec 2002 19:53:00 -0800 (PST) Bonjour, |
| A botched cut-and-paste job managed to drop the first few characters of this correction message. It should begin "Veuillez noter q'une erreur ..." The message itself is just to correct a typo in the CP2 link from the previous message, and went to the same list of recipients. |
Date: Mon, 23 Dec 2002 13:23:01 -0800 (PST) er q'une erreur s'est glissée dans l'hyperlien qui réfère à la correspondance entre les fraudeurs, |
UPDATES
The following is a summary of updates that have been made to this page since its initial publication on December 22, at 10:00 (GMT). The most recent updates appear at the top. All times are in GMT. Nigeria, France,and Spain are all GMT +0100.
23 December 2002 21:40 - Added the correction message.
23 December 2002 04:05 - Added the email sent to previous fellow students of M. Maseka.
23 December 2002 01:40 - Added further research to the 3 December entry, which reinforces the theory that M. Maseka was writing from an Internet Café in Madrid between the 3rd and 8th of December.
23 December 2002 00:30 - Emailed M. Maseka to advise him that we had published this page.