africanunion@afriunion.org

[firefly]

Posted on the behalf of the victim.

After experiencing a previous scam, the victim received an email out of the blue offering her a compensation after being scammed. Ther one contacting her claimed he is Mr.Edwin John Udenze, from Lagos, Nigeria. During the correspondence, the scammer notified the victim he will sent an ATM card for her, having the entire amount of compensation, that card being sent with a courier company. The company, called FastLink Diplomatic And Courier Services, got in contact with the victim providing her a link and an option to track her delivery.

Begin of April, the victim knew her card left Nigeria for London, next programmed stop being US.
Before receiving her card the victim received instead an email from the delivery company:

There is urgent need for the (2) document below

(1.) Anti-Legality Clearance Certificate
(2.) Africa Investment Tax Clearance Certificate

Contact Mrs.Lilian Egojolu from the Office of Africa Union Abuja Nigeria to obtain the two documents needed below for the release of your package Or your Gold ATM Card will be confiscated within Seven working days.

Email: africanunion@afriunion.org

[firefly]

About the fake delivery company used in scam:

FastLink Diplomatic And Courier Services offers to its clients a comprehensive range of International Freight Services backed by a global logistics network, wide expertise and resources to support shipping requirements across the world.

The fake site was registered on October last year, through a reseller linked to French speaking countries.

Details of the registrant:

Registry Registrant ID: RL557
Registrant Name: Rock Larry
Registrant Street: 4607 White Church Rd
Registrant City: CHAMBERSBURG
Registrant State/Province:
Registrant Postal Code: 17202
Registrant Country: US
Registrant Phone: +1.7175527600
Registrant Phone Ext:
Registrant Fax: +1.7175527600
Registrant Fax Ext:
Registrant Email: acaibma@yahoo.com

+17175527600 - mobile phone, Chambersburg, PA

This is what the fake site is looking like:

One of the scammer characters is profiled here:
viewtopic.php?f=6&t=69246&p=170724#p170724

[firefly]

About the main site used in scam: afriunion.org - it is a fake domain created for the email address only, impersonating The African Union, a continental union consisting of 54 countries in Africa, founded in 2001.

The fake one was registered in December last year:

Domain Name: AFRIUNION.ORG
Domain ID: D178858687-LROR
WHOIS Server:
Referral URL: http://www.PublicDomainRegistry.com
Updated Date: 2016-02-15T03:47:06Z
Creation Date: 2015-12-16T17:32:02Z
Registry Expiry Date: 2016-12-16T17:32:02Z
Sponsoring Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
Sponsoring Registrar IANA ID: 303
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Registrant ID: DI_49195744
Registrant Name: Mendel Reizes
Registrant Organization: N/A
Registrant Street: 1615 Carroll St
Registrant City: Brooklyn
Registrant State/Province: Other
Registrant Postal Code: 11213
Registrant Country: US
Registrant Phone: +1.3476157966
Registrant Email: chrislee758@yahoo.com

+13476157966 - mobile number from New York.

[firefly]

Posted on the behalf of the victim.

The victim received an email from someone pretending to be Ambassador James Francis Entwistle, from the U.S Embassy located in Central District Area, Abuja, Nigeria.

The email was a recovery scam - the victim being notified she will be receive an amount of money as compensation for the money she lost in a previous scam. After sending her details, the victim got in contact with a delivery company who supposedly was sending her an ATM card for the amount. The delivery company is the same already reported here.

The parcel left Nigeria but it was stopped in the final Airport destination, being held by Homeland Security for not having a clearance paper. The victim was asked to pay for that clearance:

For more details, Contact-
Craig John
International Payment Department
Email: craighomelandinfo@homemail.com

[Big Al]

Delivery to the following recipient failed permanently:

craighomelandinfo@homemail.com