Advert.

Do NOT tell your scammer he is posted here, or report their accounts as it puts others at risk!

francisco.tello@metrocreditcapital.com

Post up any 419 emails you received. All persons/companies depicted in these emails are either fictitious or have had their identities copied/stolen by the scammers. Emails posted by staff are received unsolicited to their "catcher" accounts.

francisco.tello@metrocreditcapital.com

Unread postby Big Al » Sat Jun 03, 2023 9:57 pm

Recovery Scam:

Dear Sir/Ma,

We have received an Instruction from the Nigerian Government for immediate payment of your outstanding contract/inheritance funds to you.

We therefore request that you forward to us your DEDUCTION CERTIFICATE which will empower us to deduct all outstanding upfront charges from your funds and remit the balance to your account since your funds is attached with protective clauses which makes it illegal for us to deduct, split or alter your contract sum.

If you do not have this Deduction Certificate then you must come forward to our Office to swore an affidavit of Deduction Authorization through a Notary Public at your cost to secure the Deduction Certificate.

We hope to read from you asap.

Regards,

Mr. Francisco Tello

Account Service Directorate.


Header:

Received: from 10.197.41.14
by atlas219.free.mail.bf1.yahoo.com pod-id NONE with HTTPS; Sat, 3 Jun 2023 17:40:03 +0000
Return-Path: <clickreply@metrocreditcapital.com>
X-Originating-Ip: [74.220.222.55]
Received-SPF: softfail (domain of transitioningmetrocreditcapital.com does not designate 74.220.222.55 as permitted sender)
Authentication-Results: atlas219.free.mail.bf1.yahoo.com;
dkim=unknown;
spf=softfail smtp.mailfrom=metrocreditcapital.com;
dmarc=unknown header.from=metrocreditcapital.com;
X-Apparently-To: ; Sat, 3 Jun 2023 17:40:04 +0000
X-YMailAVSC: g.P9qTM3bBt83.odw8b.fDn3PAfLjeFCeTbXypzm7wmSqu.
z2dlkINoQxyMsxmDX4QL5sEKnM0QbbhVGia_jwBKqfui4h1ief0PJZG7ESv1
J9Vqq6OJyTsxXs1gP1NhI5nLOdm.VbfghrpP7TuDdhrz.LHhWf2CFMjI2uZQ
aGl1y_zVtDn2DzynCfesArCK75NEyEpKunuizlcj5tWn_6b4s0KFjSlDalsf
jccgiHHnSmbUZf_AKDeltdOBRj2C4jh1WFaRToIGr.sltf3zXy8ChLCTmVTC
gPdPdtGWKrVQcP9nc0EbMInpntzRxrRnoyZ1KCujLw_tD6HnFqIwPnCRXxKe
WWBVOYxrt6kNJXAJFOMH60Vx_fcMKDYYzvkyReebK3zI69RBLQvnS8W9XX1R
A3vgaCrc0xbifOj4m_7qcQQDvV4CIXMcKPUvwtOy1nNw3bMSfSYrO8nEsMo2
qEpEHfG.0foI7O._Zp_jucUA6jd0.he2Efyc0WcyA4bR0DVnn7VFSTE02xcE
urMRxdzp29DvTIOz9Xkxs358GtuDNEhtFfo5_F3ej0MUeouY.pcGz3Yo23ei
TsqG_LB3CwpTypaVESizLiVLtip0amcmxe5Q_dSF47iV.iSDxPpJhUKVlGxS
YaZ22kzN.3ZBZrpwhgHZyAuhDqbgX7u4.dGeB08.A8Bkd2VxPJq1ZPdxxSTM
8HZpImj7_UVzB1czKaijI9BJ_.eL3zTO7Hkvl4WmfpQY0tJEoFfjPV5fIFjO
GEBuQDtOA1P0DvXB593PG529aUBSJsNj2dVm2ylQGHqdGtW3f0Em_aaaVbpE
aJ0J11NhxmugIS2wLGbRYD9AWBHO41DQqjIZqOxfBJ_JNLYodKssaTPFafU1
CSDMcuIbWmt3o_TACh.e7X7Y2efEwpyQ_5NmkRIccA4Sh4ocgulL8YwsotzY
dKx_rxEuIm_oX2xr3JsstV2MG154plaiOkRFC8z6orkzBUPvQpWO0s9qwyND
DLe_ZtHQzP.zHPviG_lx1FGwlnGHKUnAgZZuEhtCxVTGyp3M_Bf35QTnj8hb
qYY5nPnV4G1S9LHnowa68COj8ShGI4bY7cd4eIVMRjJ5hRY3jJAhr9mpP0Wb
JwgEt18zAEfpQMY15.ZS0h6pMsRzY1IU.zD4tE_0StpE31T1RLZRgo9fVKS5
LXH39RCRybJLH6.yuTMbteBbTYEk1aUS6qnLY4MIijsovrdhsNaV.50CDzcz
Nf5T9HlB1wOl8s1PeYxCrqI4x2odpmrwYQ7jZ_cArmfZVXPiInfdfUQRg4A-
-
X-YMailISG: LzdxFc0WLDsBbF9LcFV661ZBRi_bTKcYr5eFoPGw3QJaD6Ix
rxdTeaXqFn7wxqG6c3DXPGBoXfqFPA6geSsuxjoSOJlJbMQpsFpG0yaQP6s6
YIgvSQpsM8vngFn.H3fLFuWga3zjcIuogq.pyKnXB_xQbTuX9ZYOJh2tmwDb
QR3_oNkHPGGYph_2qrpCPgGk3eHzyft2jd49wzAuf407PsMN4Yz7os9618aC
cq3AUk27P_MC5VYxAcCoCcmVgPNrBCq.YE196lO1UjztbgBFxyYrQDDlopvM
zEIhculT7wCLQpCytLd_Y.OlwgrdaZWf1y7jBenqmsDwW5NCi8tA8XDIQKZs
LX_gXEH62bDuSxUAcAfN.byrIhrcG1Gyl32gK6_VbLDBnAltmkseHl0xtDpx
wah_RW5qK06rOg9eEPSSIUiFxCacOWxKon1aUkumpn64t1q3DRYb28wAHdUG
qm4x8LtOZJnfs2J0WUduFwHoisy4ocy.8BFKS1ZAKqC7r3I8VwhJACfza2o6
oyCMIDI9npgIy_UJEwXQxUiKoh0f_xkNhhM.LDgH.2X3x9RTa1A6KbshKxz3
Wpo00p80SKozzlrqxJwEQj80O31FLv4s7_4QqnMTc81EpkY5W7C.Vx5cV7Dd
U0hYimippo99tDX_Vn8camk09D4.cevrVEUlG6ZLE1woekBM_TCbiscw9AUZ
c19LvewaWV7V48yTuz_Ajh1Obg0kn9ueKzjPnQ5NlBf3y2LeGaa2_ggBstT.
t586QHNnZz.APdY4c1h27J.dccLwUDmm5TUA9pzpWguQ1G3PixOnWnDMs8X5
iFckopeZgEYn7mWK_6IyCuQ2YryUmvzIYL2A6M_vU0ia9iQDikT9MBG2i5Eu
kq1.LlI1Pi2BSv6_Be.E0K6OiPwXFFdaKYvsoYB8JD5lC_wiOt901mxMy.VP
4YMFqWexAYr56xuBYl3YISrzYq4x6273J5bA_Tx.ZvihjhEBTP8xuX2ItL9k
YBkbnKm1Te5vilUT7R1Act86jAav8SWOhP.e_v1uhS93UQ_9eXw_C0mUR70Z
q62KuBF9d.UU2tvxIo9.W36m05vmmvOko_HCgT8xtT7PKX4jQfKsWWIVzNOt
MhCFJuCysLTXxC2TJm8asDP.ACTCHDhE3a6zWPf.24XzSC8YZGF4k4HXwyGW
W0k67y.Kfum4S2_6PB17h.O0ygEvYn_c0L5pUcBHxscvbA--
Received: from 74.220.222.55 (EHLO outbound-ss-2090.hostmonster.com)
by 10.197.41.14 with SMTP;
Sat, 03 Jun 2023 17:40:03 +0000
Received: from cmgw15.mail.unifiedlayer.com (cmgmt1.unifiedlayer.com [67.20.127.199])
by soproxy4.mail.unifiedlayer.com (Postfix) with ESMTP id 3273E8033517
for <>; Sat, 3 Jun 2023 17:40:03 +0000 (UTC)
Received: from sh003.webhostingservices.com ([162.214.80.6])
by cmsmtp with ESMTP
id 5VERqDNUNUc4M5VERqdkPB; Sat, 03 Jun 2023 17:40:03 +0000
X-Authority-Reason: ss=1
X-Authority-Reason: s=1
X-Authority-Analysis: v=2.4 cv=U4lXscnu c=1 sm=1 tr=0 ts=647b7af3
a=ZNTHTSoC0XwKz15p3bZCjg==:117 a=9hqVuTJwW4W8hFCYKS+27Q==:17
a=of4jigFt-DYA:10:nop_rcvd_month_year
a=BlsYXiu-FkgA:10:endurance_base64_authed_username_1 a=NLidWGPkQzkuEpkeIfUA:9
a=CjuIK1q_8ugA:10:nop_charset_2 a=zgiPjhLxNE0A:10:nop_mobile_phish_fin_what
a=kKL6x31_AAAA:8 a=iEMJgZi9Hq-oT3Q5igoA:9 a=BpwJqwct7bky1ZHq:21
a=_W_S_7VecoQA:10:nop_html a=lqcHg5cX4UMA:10:nop_bhvr_url2_hostname_empty
a=QEXdDO2ut3YA:10:nop_charset_2 a=8nPY9lw53A8bRWzMru8A:9
a=b_7WGFvY1ghUAJfq:18 a=HXjIzolwW10A:10:nop_png a=t9Nr6NNaVi_TNYDCUMWt:22
a=OdPIaXKLL8XiAu9fGHbP:22
Received: from sh003.webhostingservices.com ([162.214.80.6]:16754)
by sh003.webhostingservices.com with esmtpa (Exim 4.95)
(envelope-from <clickreply@metrocreditcapital.com>)
id 1q5VEP-0013on-Nr;
Sat, 03 Jun 2023 23:10:01 +0530
Received: from [107.170.46.19]
by mail.berrycotts.com
with HTTP (HTTP/1.1 POST); Sat, 03 Jun 2023 23:10:00 +0530
MIME-Version: 1.0
Date: Sat, 03 Jun 2023 23:10:00 +0530
From: Metro Credit Bank <clickreply@metrocreditcapital.com>
To: undisclosed-recipients:;
Subject: Our Ref: FMF/FGN/NNPC-CBN/83546/ANC/2015/22
Reply-To: francisco.tello@metrocreditcapital.com
User-Agent: Roundcube Webmail/1.4.12
Message-ID: <080abe2bc146569a8c6f17514b8f508e@metrocreditcapital.com>
X-Sender: clickreply@metrocreditcapital.com
Content-Type: multipart/alternative;
boundary="=_327df3c39c40a4286cf0aeef6e6121b7"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - sh003.webhostingservices.com
X-AntiAbuse: Original Domain - yahoo.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - metrocreditcapital.com
X-BWhitelist: no
X-Source-IP: 162.214.80.6
X-Source-L: No
X-Exim-ID: 1q5VEP-0013on-Nr
X-Source:
X-Source-Args:
X-Source-Dir:
X-Source-Sender: sh003.webhostingservices.com [162.214.80.6]:16754
X-Source-Auth: pankaj.jha@berrycotts.com
X-Email-Count: 129
X-Source-Cap: d2V6cm5lbXk7d2V6cm5lbXk7c2gwMDMud2ViaG9zdGluZ3NlcnZpY2VzLmNvbQ==
X-Local-Domain: no
Content-Length: 89485

--=_327df3c39c40a4286cf0aeef6e6121b7
Content-Transfer-Encoding: 7bit


Orig IP: 107.170.46.19 | Orig ISP: Digitalocean-asn | City: New York | Country: United States
"Look for the lies."
Being Blackmailed? Go here and do this first: https://blackmailscams.com/
The information you supply can help others from becoming Victims.
Image
User avatar
Big Al
"Little pee nut" admin.
 
Posts: 84973
Joined: Fri Apr 27, 2012 10:48 pm

Re: metrocreditcapital.com

Unread postby firefly » Sun Jun 04, 2023 3:27 pm

The fake bank used in scam claims to be named Metro Credit Capital.

Contact details on their fake website:

141, First Floor, 12 St RootsTerrace,
Los Angeles USA 90010
+61 3 8376 6284
support@metrocreditcapital.com

Union Capital Trust,
San Fransisco
24/7, 1st Floor Global Str, 2nd Cross,
SF 94112.
+415 67 890 12


+61383766284
Number billable as geographic number
Country or destination Australia
City or exchange location Craigieburn

+14156789012
Number billable as geographic number
Country or destination United States
City or exchange location San Francisco, Central DA, CA
Original network provider* Pacific Bell

Entry in the aa419 database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=161510

From the domain name registration:

Domain Name: METROCREDITCAPITAL.COM
Updated Date: 2023-04-24
Creation Date: 2023-04-24
Registrar Registration Expiration Date: 2024-04-24
Registrar: Hostinger, UAB

Registry Registrant ID: Not Available From Registry
Registrant Name: Domain Admin
Registrant Organization: Privacy Protect, LLC

This is what the fake bank website looks like:

Image
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

unioncapitaltrust.com

Unread postby firefly » Sun Jun 04, 2023 3:31 pm

A clone of the fake bank is active online under the name Union Capital Trust.

Contact details on their fake website:

141, First Floor, 12 St RootsTerrace,
Los Angeles USA 90010
+447418361399
contactunioncapitaltrust@gmail.com
San Fransisco
24/7, 1st Floor Global Str, 2nd Cross,
SF 94112.


+447418361399
Number billable as mobile number
Country or destination United Kingdom
Original network provider* Tismi BV

Entry in the aa419 database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=161511

From the domain name registration:

Domain Name: unioncapitaltrust.com
Updated Date: 2023-05-19
Creation Date: 2023-01-29

Registrar Registration Expiration Date: 2024-01-29
Registrar: NameSilo, LLC

Registry Registrant ID:
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: PrivacyGuardian.org llc

This is what the fake bank website looks like:

Image
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe


Return to Scammer 419 emails.

Who is online

Users browsing this forum: Google [Bot] and 62 guests