YUGO THIS WAY, I'LL GO THAT WAY

This particular scam is under investigation by the National Criminal Intelligence Service (UK). Vlajko Stojiljkovic is a real person, but as always the Lads are happy to use other peoples' names. This is somewhat edited - any errors in the sequence are ScamORama's. Thanks to a Kindly Contributor in the UK.


Return-Path: 
Received: from web21210.mail.yahoo.com (web21210.mail.yahoo.com
[216.136.175.253])
 by linux1792.easyspace.com (8.11.4/8.11.4) with SMTP id fBVLWOa16266
 for Kindly Contributor; Mon, 31 Dec 2001 21:32:24 GMT
Message-ID: <20011231213230.28583.qmail@web21210.mail.yahoo.com>
Received: from [195.166.231.3] by web21210.mail.yahoo.com via HTTP; Mon, 31
Dec 2001 13:32:30 PST
Date: Mon, 31 Dec 2001 13:32:30 -0800 (PST)
From: glorja S 
Subject: Thank your reply
To: Kindly Contributor

From: Glorja Stojiljkovic  
To: Kindly Contributor
Sent: 31 December 2001 15:57
Subject: Please Help

 Hello,

  I need your help.

  I am the wife of VLAJKO STOJILJKOVIC, one of the
  people indicted at the Hague War Crimes
  Tribunal in Hague. The indictment is politically
  motivated. It was for the package the
  western worlkd has provided Yogoslavia.

  Slobodan and my husband had kept some funds ,
  european
  currencies, in cash to enable them take care
  of rebel problems. However, now the country they
  protected has turned against them. We need
  to transfer the money out to safety.

  The funds are in excess of 200 million (in Euros ,
  Swiss Francs and US dollars). They can be shipped
  under diplomatic immunity. They will then have to
  be paid into off
 shore accounts. They are not in
  Yugoslav.

  Can you help? Are you capable of handling funds? Are
  you trustworthy? I have been asked to
  offer you 30%. Will that be ok?

  Please reply to me. I am grateful.

  Glorja.

***

To follow up on the previous (the Kindly Contributor) replied, vaguely, and got this reply:


> Thank you your mail.
>
> You see, since March, all money (not only dollar but
>  CHF)
> kept diplomatic security Global diplomatic parcel
> service at Helsinki, Finland
> (no problem that country).
>
> I want you give me address where company deliver
> boxes
> to you.
>
> I give you website: www.gdps-online.com.
>
>
> If you give me address where They send the
> boxes then I file with
> company and then they bring to you then you put for
> bank all money and then
> I tell Mirjana that all safe now. I speak with
> Dragoslav other issues but
> he not know money in boxes. Only yuou know now and I
> ask you not tell anybody.
>
> So now please give me address for you to collect
> boxes
> and also please make
> arrangement pay the required fees to company. You
> know
> that we not have
> bank account again as they close the bank for us
> here
> and soldiers come
> take all money from house. Also we not able to
> travel
> out (Embargo for travel,
> only Mirjana travel to see Slobo). Once you give
> information, then I give
> you tracking code for company and then we know when
> boxes come to you. Then
> everything OK.
>
> I put all my trust in you.
>
> Glorja.
end paste:

[sez KC: Note the little bit in the middle about payment to company!!!!]

***

Dear Kindly Contributor,
Ref:GDPC/37/SP/EUP2990-voll0029/39
Sender: Glorja S., Belgarde, Yugoslavia.

We wish you a very happy new year.

GDPS AG is writing in respect of your consignment referred
above. We have received instructions from Sender to ship
the consignment to the following address:

Kindly Contributor

***

Dear Kindly Contributor,
Ref:GDPC/37/SP/EUP2990-voll0029/39
Sender: Glorja S., Belgarde, Yugoslavia.

We wish you a very happy new year.

Please send a copy of your passport or driver's license
via fax to:+874-762-580-942. Please call Customer Support
for further information on +874-762-580-941 or
+874-762-580-944.

We shall send your tracking code upon receiving a valid
identification of the receiver.
(signed by someone as customer rep)

***

I assume this to be the Freight Company.
I looked up the website, Not much info on who or where they are, very odd.
Tried to contact them, message back that they only recognised "Secure
Addresses"
Then said my address was 62 255 32 5 - it's not??
I have learnt a bit about html lately and checked the coding of the site.
As far as my very amature eye can see there is no coding in there to
retrieve my address.
The 62 255 32 5 gets sent to anyone (I Think) Perhaps our "experts" could
check it out?

I have just sent a message asking how much I have to pay, who to and how.
Wait and see.


***


From "glorja":
 First thing l need your address to give company so
they deliver to you company take 2 days to deliver .l
pay company for storage and diplomatic fees $30000
transport to you cost $19000 to $20000 once this done
all ok l show you picture of box before l give company
boxes company not know what inside boxes total box is
4 no problem with customs so company say since company
have diplomatic cover so no fear .Only fear is that
you keep money safe.

***

From Kindly Contributor:

You still have not made it clear.
Do you pay the 30000 and the 20000 transport cost or do you want me to pay.
If you want me to pay I need to know the details of how and who to pay.

Don't worry about the safety of your money. I can pay it into a UK bank and
then transfer it to a Swiss bank or anywhere else you want it. Its your
money. I will be happy with 30%

***

[ Very interesting.  Long way from Yugoslavia?
I seem to recall the Authorities being interested in these Nigerian Scams,
Can anyone remind me of who to contact to report this crap.

Kindly Contributor ]

***

From: Kindly Contributor's friend
To: Kindly Contributor
Sent: Monday, December 31, 2001 10:15 PM

> Yes I can ... the Yahoo account appears to be anonymous, but Yahoo has
> recorded the IP of the computer that sent the email to Yahoo. It is
> [195.166.231.3]
> This IP traces to an ISP in Africa in a town called Niamey
>
> The 195.166.231.0 - 195.166.231.255  IP block belongs to
> LINKSERVE-PHC-DIALUP an ISP in Nigeria
> Their contact person is tunde@linkserve.com.ng
> Tunde Ogedengbe
> Linkserve
> 22 Akin Adesola
> FATB Plaza
> Victoria Island
> Lagos
> Nigeria
> phone:        +234 1 2623900
> fax-no:       +234 1 262 3906
>
> I hope this helps
> The author certaibnly appears to be from Nigeria, so I guess this is just
a
> rerun of the old Nigerean oil scams



> In article , Kindly Contributor writes
> >Then said my address was 62 255 32 5 - it's not??
>
> 62.255.32.5 is inktomi2-bir.server.ntl.com. I would assume that it's
> either your address or that of a web proxy at NTL.
>
> They got my address right (Demon give out fixed IP addresses). This
> shouldn't be rocket science; a web server needs an IP address so it
> knows where to send the data back. They are using ASP (Active Server
> Pages), which is an MS scripting product; I presume that ASP gives
> access to the client's IP address.


***

From: glorja S 
To: Kindly Contributor
Sent: Tuesday, January 01, 2002 3:08 AM
Subject: Sorry for my english

> You good man now l put all trust in you and l make it
> clear now you pay to company 20000 but me not know how
> so you give me shipping address l send to company then
> company tell you how to pay money .l send pictuer to
> you again remember company not know what in boxes so
> we keep it so.
>
> glorja

***

From Kindly Contributor (who is Kindly but not Stupid):
I tell you before.  I will not pay money first.
Either you pay Company first   or   I pay AFTER boxes are delivered and
checked.

Otherwise NO DEAL


***

From: "glorja S" 
To: Kindly Contributor
Sent: Tuesday, January 01, 2002 8:18 PM
Subject: Re: Address

> You make my heart bleed me in bad state and desperate
> this biggest businness you do for life so please
> serious all company ask for now is shipping address
> you give that so l give company this no joke at all
> you never regret this l very seious.
>
> glorja

***

Friend of Kindly Contributor writes

There's two possibilities: either this site [the supposed packet delivery service] is part of the scam, or it's an innocent 3rd party site that's being used to give the impression of legitimacy.

There's nothing obviously non-kosher about the web site itself, unlike
the fake AOL details update page that was mentioned on this list a long
while ago. But the idea of a commercial diplomatic parcel service does
give rise to some skepticism; how does John Random 3rd World Kleptocrat
know it's not a CIA front?

However

1) AFAICT, the log-in uses HTTP, rather than HTTPS. This is not what one
expects from a secure site.
2) The mail host corresponding to the web site is in a spam black list,
as probable relay hijacking. Not what one expects of a secure site.
3) The web site traces to a $15 per month web hosting service.
4) The mail host corresponding to the web site is identical to that used
by that web hosting service.
5) The domain name registration and admin details are in the US, but the
admin email address is at a French site, which looks as if it's a French
equivalent of HotMail.
6) Google doesn't know about it. (Which means it's either new, is not
linked to from anywhere, or has disabled search engine scanning.)

REFERENCES
http://www.samspade.org/t/lookat?a=www.gdps-online.com
http://www.spews.org/html/S710.html
http://www.mavweb.net/default.asp
http://mail.voila.fr/

All in all the details look suspicious, but then one would expect this
of material offered in support of what looks like a variation of the
Nigerian scam. If you let me see the headers of the original email I may
be able to provide further details.

Of course, regardless whether it's genuine or fraudulent, it ought to be
reported to the relevant law enforcement agency.

Friend of Kindly Contributor


scamorama