prd242424@gmail.com

[firefly]

Recovery scam.

Compensation payment of US$500,000.00

This is to bring to your notice that I have been appointed as the Scam Victim Compensation Payment Attache with International Monetary Fund (IMF) Office in London, United Kingdom.

We have been mandated by World Bank/International Monetary Fund Debt Liquidation Team to pay all listed victims of scam US$500,000.00 (Five Hundred Thousand Dollars) as compensation within this first quarter of the year. I am happy to inform you that you are listed and approved to benefit from this payment exercise as one of the scammed victims.

Furthermore, we advise you to stop further communication with any other person(s) or office(s) concerning such transactions to avoid loosing more of your hard earned money to other group of scammers on the FBI and British Intelligence Agencies wanted list. We also want to warn you not to communicate or duplicate this message to anyone for any reason whatsoever to afford jeopardizing our effort because the security agencies are already on the trace for those criminals. You are strongly warned, be guided.

You are hereby advised to contact me to receive your Compensation without further delay..

I will appreciate your cooperation to help us serve you better.

Yours Faithfully,


Patrick Walker
Payment Processing Officer.

Header:

Message-ID: <64138b8c.170a0220.1c178.b2fbSMTPIN_ADDED_MISSING@mx.google.com>
Received: from [140.228.29.113] (n49-198-169-223.meb4.vic.optusnet.com.au [49.198.169.223])
Subject: To all shortlisted victims
To: Recipients <jazz90@optusnet.com.au>
From: Patrick Walker <jazz90@optusnet.com.au>
Date: Thu, 16 Mar 2023 14:34:24 -0700
Reply-To: prd242424@gmail.com

Originating IP: 49.198.169.223
Originating ISP: Microplex Pty Ltd
City: Brisbane
Country of Origin: Australia

[firefly]

The email sent to prd242424@gmail.com received a reply from patwalker0202@imf-scamvictims.org:

World Bank/International Monetary Fund Debt Liquidation Team
Scam Victim Compensation Payment Attache
London, United Kingdom.


Ref/Payment Code: WB&IMF/02354
Approved Amount: US$500,000.00

To: xxx

Dear madam,


Compensation payment of US$500,000.00

I have received your message and your payment is being process. Please
we will like you to choose how you will prefer to receive your payment
(either through bank transfer or ATM card that will be delivered to
your address).

I will appreciate your urgent response to help serve you faster.

Yours Faithfully,


Patrick Walker
Payment Processing Officer.

Header:

Return-Path: <patwalker0202@imf-scamvictims.org>
Received: from aspen.nocdirect.com (aspen.nocdirect.com. [69.73.181.112])
Received: from [41.190.2.22] ([41.190.2.22]) by www.prosegursecurity.org (Horde Framework)
Date: Sat, 18 Mar 2023 03:41:35 -0400
Message-ID: <20230318034135.Horde.gsztEgVwk4g8ytgOZIZjJO7@www.prosegursecurity.org>
From: patwalker0202@imf-scamvictims.org
To: xxx
Subject: Re: To all shortlisted victims
User-Agent: Horde Application Framework 5

Originating IP: 41.190.2.22
Originating ISP: Emts-nigeria-as
City: Lagos
Country of Origin: Nigeria

[firefly]

International Monetary Fund Scam Victim Compensation Payment is a fake institution and impersonates the International Monetary Fund.

The domain name shows no content and is used only for the email address, as in patwalker0202@imf-scamvictims.org.

The bogus organisation allegedly located in London, UK, sends their emails from a Nigerian IP.

Entry in the aa419 database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=160572

From the domain name registration:

Domain Name: imf-scamvictims.org
Updated Date: 2022-10-22
Creation Date: 2022-10-21
Registrar Registration Expiration Date: 2023-10-21
Registrar: Onlinenic Inc
Domain Status: ok
Registry Registration ID:
Registration Name: Peter Ayo
Registration Street: 10 Downing StreetN/A
Registration City: London
Registration State/Province: London
Registration Postal Code: WC2N 5DU
Registration Country: GB
Registration Phone: +44.6734598124
Registration Fax: +44.6734598124
Registration Email: kconsis12@yahoo.com

The Registrar missed to notice that the fraudster creating this domain name used a wrong postal code for the UK Prime Minister's Office where he pretends to be living...

[firefly]

Replies received:

World Bank/International Monetary Fund Debt Liquidation Team
Scam Victim Compensation Payment Attache
London, United Kingdom.


Ref/Payment Code: WB&IMF/02354
Approved Amount: US$500,000.00

To: xxx

I have received your email and your preferred mode of payment noted.
We have commenced processing of your payment and will like you to
provide us with your full name, physical address that will be used to
process your delivery and the nearest airport to you.

You will be notified once your delivery is ready.

[firefly]

Reply received:

World Bank/International Monetary Fund Debt Liquidation Team
Scam Victim Compensation Payment Attache
London, United Kingdom.

Ref/Payment Code: WB&IMF/02354
Approved Amount: US$500,000.00

To: xxx

We have processed your payment and and your card containing the total
sum of $500,000 handed over to the courier company working with us for
delivery to you. The name of the courier company is: Ren Parcel
Delivery Courier Company and contact person: William Jones.

Please let me know once you hear from the company.

Yours Faithfully,


Patrick Walker
Payment Processing Officer.
Email: patwalker0202@imf-scamvictims.org
Telephone number: +44-7441448811

+447441448811
Number billable as mobile number
Country or destination United Kingdom
Original network provider* Tismi BV

[firefly]

Reply received:

Hi xxx

I am Mr william jones working with Ren parcel courier company, a parcel
deposited on your name for us to ship to you to

your address in United States and we also want to inform you that the
shipping cost is $650 we accept payment by bank to bank transfer, money
order or bitcoin. below is the tracking informtion of your parcel which
as soon as we confirm the payment the parcel will leave to be deliver
to your address.

This is their website <http: // redel.in.net/index/track.php >
Tracking Number: AxxxxC6xxx

Mr william jones

Header:

Return-Path: <unitedkingdom@redell.in.net>
Received: from aspen.nocdirect.com (aspen.nocdirect.com. [69.73.181.112])
Date: Thu, 23 Mar 2023 07:16:37 -0400
From: unitedkingdom@redell.in.net
Subject: Hi xxx
Message-ID: <edc3d9dffd66e3e74c6ace3d38a7e536@redell.in.net>
X-Sender: unitedkingdom@redell.in.net
User-Agent: Roundcube Webmail/1.3.15

Originating IP: 69.73.181.112
Originating ISP: Nthl
Country of Origin: United States

[firefly]

The fake delivery company claims to be Ren Parcel Delivery Courier Company.

They are using the fraudulent domain name redell.in.net only for the email address, as in unitedkingdom@redell.in.net.

Entry in the aa419 database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=160631

From the domain name registration:

Domain Name: REDELL.IN.NET
Updated Date: 2023-03-23
Creation Date: 2023-02-13
Registry Expiry Date: 2024-02-13
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

[firefly]

The fake delivery company fake website is active at redel.in.net.

From their fake website:

We have been in the courier business since 1993 and look forward to many more successful years.

We are pleased to confirm that we are fully licensed by the Office of Fair Trading on licence Number 486771.

Contact details:

100 Awolowo Rd,Bryanston & Lagos Island Lagos
Tel: 234-818-797-1673.
E-Mail: nigeria@redell.in.net
41734 Gwynn Oak Avenue Gwynn Oak MD 21207
Tel: 1 424 333 3447.
E-Mail: usa@redell.in.net
9, 217 Regent St, Mayfair, London W1B 3HH, United Kingdom
Tel: 44 745 227 6338.
E-Mail: unitedkingdom@redell.in.net
Rue de Fiennes 5, 2270 Bruxelles, Belgium
Tel: 32 466 219 802.
E-Mail: belgium@redell.in.net
335, Huan Shi Dong Road Yue Xiu District Guangzhou 510060, China
Tel: 86 18658282713.
E-Mail: china@redell.in.net
Rua Itatiba 9100 casa 4\12
Garden Petrônio District São Bernardo do Campo São Paulo
Tel: 55 1107 157 2188.
E-Mail: brazil@redell.in.net

+2348187971673
Number billable as mobile number
Country or destination Nigeria
Original network provider* Emerging Markets Telecommunication Services Ltd (Etisalat)

+14243333447
Number billable as geographic number
Country or destination United States
City or exchange location Beverly Hills, CA
Original network provider* Telcentris Communications, Llc - Ca

+447452276338
Number billable as mobile number
Country or destination Isle of Man
Original network provider* Manx Telecom Trading Limited

+32466219802
Number billable as mobile number
Country or destination Belgium

+8618658282713
Number billable as mobile number
Country or destination China
Original network provider* China Unicom

+5511071572188
Number billable as geographic number
Country or destination Brazil
City or exchange location São Paulo, SP

Entry in the aa419 database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=160630

From the domain name registration:

Domain Name: REDEL.IN.NET
Updated Date: 2022-09-29
Creation Date: 2021-07-02
Registry Expiry Date: 2023-07-02
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

This is what the fake courier website looks like:

[firefly]

Reply received:

Hi xxx

send the money to our agent who is in your country with the account
information's below as soon you sent send the payment improve so that we
can dispatch your parcel to your address.

Name: W. L.
IBAN: DE26 2004 1111 0662 0xxx xx
BIC: COBADEHDXXX
Account number : 06620xxx
Bank name : Comdirect bank

Sincerely,
Mr william jones

Header:

Return-Path: <unitedkingdom@redell.in.net>
Received: from aspen.nocdirect.com (aspen.nocdirect.com. [69.73.181.112])
Date: Thu, 23 Mar 2023 17:27:00 -0400
From: unitedkingdom@redell.in.net
Subject: Re: Hi xxx
Message-ID: <5c3fbcca1dcaac2651129ced09a6069e@redell.in.net>
User-Agent: Roundcube Webmail/1.3.15