Nigerian Prince Email Scam Network Analysis

The Cyber Crime Cell of Mumbai Police has received 150 complaints over 6 months from victims who fell prey to email scams promising large inheritances. The scam emails originate from multiple IP addresses but show patterns in timing, language, and money trail. Students will analyze network graphs, victim distribution, and financial patterns.

# Aplly.xyz Case Study Submission

## Title
Nigerian Prince Email Scam Network Analysis

## Type
Cybercrime & Digital Forensics

## Difficulty
Intermediate

## Estimated Time
60 minutes

## Overview
The Cyber Crime Cell of Mumbai Police has received 150 complaints over 6 months from victims who fell prey to email scams promising large inheritances. The scam emails originate from multiple IP addresses but show patterns in timing, language, and money trail. Students will analyze network graphs, victim distribution, and financial patterns.

## Case Details

Function Focus: Cybercrime & Digital Forensics — manual reasoning, decomposition, and critical judgment (no spreadsheet or AI tool permitted in Phase 1)

Scenario:
You are the analyst at a fictional consultancy ("Praxis Advisors") tasked with answering: Nigerian Prince Email Scam Network Analysis. You have a clean, synthetic dataset described below. You must produce a defensible answer using structured reasoning — no tool-assisted shortcut on the first pass.

Dataset Structure:
- email_id
- sender_ip
- sender_country
- recipient_domain
- amount_requested_usd
- urgency_level
- grammar_errors
- reply_rate
- bank_mentioned
- attachment_count
- link_count
- scam_type
- blocked

Tasks:
1. Sort/segment the records to isolate suspicious entities (IPs, accounts, devices). Do this by hand first.
2. Map the connections between entities into a network; identify hubs, bridges, or high-risk clusters.
3. Correlate timestamp/event columns to reconstruct an attack or fraud timeline and locate the first-mover root source.
4. Score or rank candidate entities by risk using the dataset columns, justifying weights explicitly.
5. After your manual pass, re-run the risk ranking in a tool and reconcile any differences.

Expected Output:
A one-page incident analysis memo: suspect/entity shortlist with risk scores, network/timeline map, root-source identification.

Evaluation Criteria:
Soundness of the network/timeline reconstruction, correct risk-scoring methodology, evidence integrity reasoning.

## Data Sources

| email_id | sender_ip | sender_country | recipient_domain | amount_requested_usd | urgency_level | grammar_errors | reply_rate | bank_mentioned | attachment_count | link_count | scam_type | blocked |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| E001 | 41.203.72.15 | Nigeria | gmail.com | 5000000 | High | 12 | 0.02 | First Bank Nigeria | 2 | 3 | Advance fee | True |
| E002 | 41.203.85.42 | Nigeria | yahoo.com | 2500000 | Medium | 8 | 0.05 | Zenith Bank | 1 | 2 | Advance fee | False |
| E003 | 102.89.32.17 | Ghana | outlook.com | 8500000 | High | 15 | 0.01 | Bank of Ghana | 3 | 4 | Inheritance | True |
| E004 | 197.210.76.5 | Nigeria | protonmail.com | 12000000 | Very High | 10 | 0.03 | Central Bank | 1 | 5 | Lottery | True |
| E005 | 154.120.45.8 | Nigeria | gmail.com | 3500000 | Low | 6 | 0.08 | GTBank | 0 | 1 | Business proposal | True |
| E006 | 41.215.33.91 | Benin | hotmail.com | 7200000 | High | 14 | 0.02 | EcoBank | 2 | 3 | Advance fee | True |
| E007 | 102.65.12.55 | Ivory Coast | gmail.com | 10000000 | Medium | 9 | 0.04 | BICICI | 1 | 2 | Contract | True |
| E008 | 197.242.60.3 | Nigeria | outlook.com | 4500000 | Very High | 11 | 0.01 | Access Bank | 4 | 6 | Emergency | True |
| E009 | 41.190.28.44 | Nigeria | yandex.com | 6200000 | High | 13 | 0.02 | FCMB | 2 | 4 | Donation | True |
| E010 | 154.68.92.7 | Cameroon | gmail.com | 9000000 | Medium | 7 | 0.06 | Afriland First Bank | 1 | 2 | Investment | True |


Full dataset: https://github.com/arora200/aplly_case_db/datasets/060-cybercrime-email-scam-network (synthetic, 15 records)

## Solution Frameworks
Network/graph analysis, log correlation, kill-chain mapping, anomaly detection, chain of custody & evidence integrity

## Solver Guidance & Tutorials
_Solver guidance added by the pipeline (tutorial links) — see `solver_guidance` field._

## What You'll Learn
- Map relationships into actionable networks
- Reconstruct attack timelines from logs
- Score risk from raw attributes

## Tags
Cybercrime, Email Scam, Network Analysis, Financial Fraud

## Registration Links
Register as Solver / Register as Evaluator