missrosehayes@gmail.com

[Big Al]

Pacific Loan Mortgage Bank
Address: 100 Indiana Ave NW, Washington, DC 20004, United States
Tel/Fax: + 1 ( 202) 892-7470


Subject: INTERNATIONAL TAX SERVICE CHARGE OF $3,977.69 US Dollars required very urgent.

Approved: 052 -111RK2023

Payment Ref# LCME/FHM19/8923.

TRANSFER APPROVAL NUMBER:PLMB /114/FST/01-07- USA/2023

Attention:

This is to inform you that I received your message and I am very surprised that you are not able to use the account given to you to make this payment of $3,977.69.

Kindly have a new account below to make this payment today and send me the payment slip.


Bank name: Bank of America
Acct no: 29103675XXXX
Routing no: 026009593
Acct name: F. C.
Bank Address: 7131 S Stony Is Ave, Chicago, IL 60649
Beneficiary address: Chicago Hts Illinois 60411

Kindly go ahead to pay the tax today and send the payment receipt. I am giving you assurance that your fund valued $1,750,000.00 will be transferred directly into your account as soon as I receive the payment receipt of $3,977.69 today.

Go to your bank now to pay the tax and send me the payment receipt.

I am waiting for the payment receipt.

Best Regards,

Mr.Richard Claussen.
Transfer Manager
+ 1 ( 202) 892-7470

[firefly]

The fake site used in scam is a spoof of the International Monetary Fund.

The domain name shows no content and is used only for the email address.

Entry in the aa419 database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=166469

From the domain name registration:
Domain Name: IMF-INT.ORG
Updated Date: 2024-03-13
Creation Date: 2024-01-12
Registrar Registration Expiration Date: 2025-01-12
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: Dan Junior
Registrant Street: 5030 Greenville Ave
Registrant City: Dallas
Registrant Postal Code: 75206
Registrant Country: US
Registrant Phone: +1.2143566895
Registrant Email: percificcreditunion@outlook.com

The faker maker pretending to be named "Dan Junior" and using the email address percificcreditunion@outlook.com is creating fake sites impersonating banks since 2017.

[firefly]

The fake site used in scam is spoofing the Federal Bureau of Investigation.

The domain name shows no content and is used only for the email address.

Entry in the aa419 database of fraudlent websites: https://db.aa419.org/fakebanksview.php?key=166471

From the domain name registration:

Domain Name: FBI-GOV-USA.ORG
Updated Date: 2024-03-23
Creation Date: 2024-03-23
Registrar Registration Expiration Date: 2025-03-23
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: Goodie Franklin
Registrant Street: 2780 S Hitt Rd, Idaho Falls
Registrant City: Falls
Registrant Postal Code: 83404
Registrant Country: US
Registrant Phone: +1.2086523692
Registrant Email: firsttrustb@hotmail.com

The faker maker pretending to be "Goodie Franklin" while using the email address firsttrustb@hotmail.com is registering fake sites since 2017, mostly impersonating banks and other bogus entities used in lottery scams.

[Big Al]

From The Desk of Ms.Kristalina Georgieva,
IMF Managing Director ( International Monetary Fund)

IMF/EU/UN/ Approved: 052 -111RK2023

PAYMENT REFERENCE NUMBER: CO19/8901.

TRANSFER APPROVAL NUMBER:PLMB /114/FST/01-07- USA/2023

Subject: COMPENSATION FUND VALUED US$1,750,000.00 APPROVED BY IMF/EU/ UN.


Greetings to you.

How are you doing today?. What is going on with this transaction?. have you been able to receive your compensation fund valued us$1,750,0000 dollars ?. why are you keeping silent? , tell me the status of this transaction. Have you communicated with mr. Richard Clausen, the transfer manager of Pacific loan mortgage bank ? Please, I need your urgent reply. I am looking forward to hearing from you.

Thank you and have a nice day.


Kristalina Georgieva
MS. Kristalina Georgieva. (Managing Director)
International Monetary Fund
Email address:kristalina@imf-int.org

Header:

Delivered-To:
Received: by 2002:a59:8186:0:b0:472:8a69:c415 with SMTP id o6csp352510vqg;
Wed, 29 May 2024 03:09:08 -0700 (PDT)
X-Google-Smtp-Source: AGHT+IHIDf+i1q4782/nohXG0RwoHhw8F0cY/vVsS4ezon6uog5ceAjHQadiUUgC0GlJaKAS6WhJ
X-Received: by 2002:a05:6e02:2167:b0:374:593f:9157 with SMTP id e9e14a558f8ab-3747369afb1mr12697515ab.5.1716977348263;
Wed, 29 May 2024 03:09:08 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1716977348; cv=none;
d=google.com; s=arc-20160816;
b=BNqaWZ7kR0O69m5y4vKtWdZie2Z0ZDy+vRE14jDRkGXFjRd16pV3uJr0g8AlIfXI+Y
YMTLNkEzbRdUTZVv5z6K6siL6/DZ64B7y45dxOAqNDqSwJ+C3UZ/WQo0cazU0tpxFebG
FlEsyRsHztIgDXbpYAGOHuIANEUllzHmzGa9L8b9+W5A6iMur9bjYDzh9reTt04ZBCAn
1tqqPk3jUcVJuxvRVEKm9eqizqY0iFT3eTSYsGVCZuyFrXHotksyAl5ZZB+D2kh3Br8S
2/xXvQuzuPsDH6lUvNnE1e/N0f/rhit70rOpShuf+72KcH0eT6mc8R31WwApE6UShvEN
J2lg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=message-id:user-agent:references:in-reply-to:subject:to:from:date
:mime-version:dkim-signature;
bh=WJOrzukenZ3dr6sZXpgsyyqMDgBJHks3omNPuZ8z4iA=;
fh=uHqxDQoNIgHX7a1kOtYnDCrUAd5sJ28cwvJhn12wlzY=;
b=ZtkzREVsXWSnOlk2G1hIDD0zgbwsRBM/OqPHbJ626IKuz924vjCza6lecXt26aNbMa
qGTVlmgCzCB/hYtt7cCEiXEJeV6YnZM24o9Azbzx9Twtx9TrcqIp3EFd3GTPMXz+Vk2R
9+W8nMqfKmgr/UrZJRE18ZDE9I/Z1pp5rUON2ToemTDQHuHqG7oV4qNZeTrTMpmFyApA
zob13CUfR7PeOmJRs8UAXgloeNLk9OiTShl7Bx+yJJBBsuKc1JAubeVlWUdUzHiLhmtE
IsoArpBleYhXPX1xmsSbE6+AaycuLNB72QdSPVO/K3M4oP7D58+4xto3qVxvgX5GoQDc
xL7Q==;
dara=google.com
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@imf-int.org header.s=20240112 header.b=WkMqhzaT;
spf=pass (google.com: domain of kristalina@imf-int.org designates 162.210.70.57 as permitted sender) smtp.mailfrom=kristalina@imf-int.org
Return-Path: <kristalina@imf-int.org>
Received: from us2-ob1-4.mailhostbox.com (us2-ob1-4.mailhostbox.com. [162.210.70.57])
by mx.google.com with ESMTPS id 8926c6da1cb9f-4b1030fa35csi1242609173.101.2024.05.29.03.09.08
for < >
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Wed, 29 May 2024 03:09:08 -0700 (PDT)
Received-SPF: pass (google.com: domain of kristalina@imf-int.org designates 162.210.70.57 as permitted sender) client-ip=162.210.70.57;
Authentication-Results: mx.google.com;
dkim=pass header.i=@imf-int.org header.s=20240112 header.b=WkMqhzaT;
spf=pass (google.com: domain of kristalina@imf-int.org designates 162.210.70.57 as permitted sender) smtp.mailfrom=kristalina@imf-int.org
Received: from localhost (unknown [10.25.144.106]) (Authenticated sender: kristalina@imf-int.org) by us2.outbound.mailhostbox.com (Postfix) with ESMTPA id A61DD64107E for < >; Wed, 29 May 2024 10:09:07 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=imf-int.org; s=20240112; t=1716977347; bh=WJOrzukenZ3dr6sZXpgsyyqMDgBJHks3omNPuZ8z4iA=; h=Date:From:To:Subject:In-Reply-To:References; b=WkMqhzaTu7Cv2VxLSfwiVqYeLau+YaR4gU7Ql7bS1bV0hgNXUICuGuhUniQi66M6Z
cJSEKVnl6Tjq9ejoheZiOfXVwWaA1T7NcT6oWl7pH1u1i6I9B+eGY9gUcBxeWA3e0o
ytoDJPW62RBNcIZnioXU/2b8PnQH85lF/X9kpz/A=
MIME-Version: 1.0
Date: Wed, 29 May 2024 03:09:07 -0700
From: International Monetary Fund <kristalina@imf-int.org>
To:
Subject: Re: Fwd: From The Desk of Ms.Kristalina Georgieva,
In-Reply-To: <CAKfcJWqpo=5cApnG3Thaeec9UKYsR7mNapizad6woPCkykbDJA@mail.gmail.com>
References: <CAKzG_OjowC2-Y+nqUHvto51qkrxQ35ZyXTJDaSAGihNjUSFctA@mail.gmail.com> <CAKfcJWoj80U9VKWfkP=0r8HCGVRnriZOs-pNhBup+Ph9sqg1nA@mail.gmail.com> <CAJL3KYn-KKz_FL-fV1konDQpvrxNwahjJe3qd5qUVyeAacj=ZQ@mail.gmail.com> <CAKfcJWqpo=5cApnG3Thaeec9UKYsR7mNapizad6woPCkykbDJA@mail.gmail.com>
User-Agent: Roundcube Webmail/1.4.8
Message-ID: <76c95d0b56c00843e21836a4330aa2c8@imf-int.org>
X-Sender: kristalina@imf-int.org
Content-Type: multipart/alternative; boundary="=_995f7a76769c2a6a6f2dad02530fd9aa"
X-CMAE-Score: 0
X-CMAE-Analysis: v=2.4 cv=Abl6HGXG c=1 sm=1 tr=0 ts=6656fec3 a=brnr/LCjQpBuhh0OfwEfPw==:117 a=L2Sq6p5WgXxIMDpx:21 a=7YwPSukMAAAA:8 a=DqvoN1GjAAAA:8 a=YX2W6fxNReEAP0DZ750A:9 a=CjuIK1q_8ugA:10 a=hu5kBE4ekKwA:10 a=zgiPjhLxNE0A:10 a=ZXulRonScM0A:10 a=1XWaLZrsAAAA:8 a=fys2sDa9AAAA:8 a=PB1uTeP3AAAA:20 a=LbTtou-gAAAA:8 a=OuifgOkSAAAA:8 a=AIdGRi5Chb9Wcr1rjekA:9 a=gWnZDhkbZ4IPJstZ8otrS1qon+0=:19 a=lUf1kcX6qoVPYHeD:21 a=_W_S_7VecoQA:10 a=lqcHg5cX4UMA:10 a=QEXdDO2ut3YA:10 a=4P5SZw4gbaYA:10 a=r42-7boQk_xTh3uoJ2Gk:22 a=sNN6L9r9ezO867fwOB3O:22 a=7YpECbvlQQReuXKdpsOb:22 a=sWGU-FjQPJPvVGeeyMHt:22 a=_d7Xlb5M3weKTO3M7kVK:22

--=_995f7a76769c2a6a6f2dad02530fd9aa
Content-Transfer-Encoding: 7bit

Orig IP: 162.210.70.57 | Orig ISP: Public-domain-registry | City: n/a | Country: United States