andrewgmccabe@fbigov-usa.com

[firefly]

The fake site impersonates the Central Bank of Nigeria. The domain is used only for the email address.

From the fake site details - https://db.aa419.org/fakebanksview.php?key=128197:
Domain Name: CBNFOREIGNREMITTANCEDEPTS.ORG
Updated Date: 2017-09-11
Creation Date: 2017-09-11
Registrar Registration Expiration Date: 2018-09-11
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: ice victor
Registrant Organization: custltd
Registrant Street: 10 valentine street
Registrant City: lagos
Registrant State/Province: lagos
Registrant Postal Code: 234
Registrant Country: NG
Registrant Phone: +234.0383193615
Registrant Email: johnsonago@yahoo.com

The fake site maker was reported with at least 9 other fake sites used for online fraud between 2014 - 2016.


Other active sites he registered:

- ecb-europa.com - impersonating European Central Bank;
- diamondbenin.com - impersonating diamond Benin Bank.

[firefly]

The fake site used in scam impersonates The FBI. The domain is used only for the email address.

From the fake site details - https://db.aa419.org/fakebanksview.php?key=128200:

Domain Name: FBIGOV-USA.COM
Updated Date: 2017-06-28
Creation Date: 2017-04-28
Registrar Registration Expiration Date: 2018-04-28
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: uche victor
Registrant Organization: ICACU
Registrant Street: 3700 Southwest Fwy, Houston, TX 77027, ton, TX 77027,
Registrant City: Houston
Registrant State/Province: TX
Registrant Postal Code: 77027
Registrant Country: US
Registrant Phone: +1.7136354154
Registrant Email: ucheagain@yahoo.com

The same fake sites maker was reported at least 3 times before for registering fake site used in online fraud between 2015 - 2016.

The fake sites maker has also active another fake site - imf-fundtransfersecurity.org, used only for the email address.

[Big Al]

Same phone number:

From IMF Regional Office Nigeria,
Office of the Regional Director
Foreign Debt Settlement Unit


Attention:

My name is Mr.John Ekeh, i am the new head of operation officer of International Monetary Fund (IMF). Your File was brought to my table when I resumed to this office and during my official research last week I discovered an abandoned ATM Master card valued sum of US$10.5 Million belonging to you as the rightfully beneficiary.

I tried to know why this card has not been released to you but I was told that the former Head of operation department who just left this office dubiously enviously withheld your card for his own personal use without knowing that I will not approve or support him to take your card.Now that your ATM Debit Master card is still available for you to pick it up here, I want to know how you wish to receive your ATM card along with your four digits pin code number for withdrawing funds.

You can come down here to Nigeria in my office to pick up your card direct from my office or alternatively it can be send to your address through any registered reliable courier service company that you will take care of the courier charge, I don't know the cost of shipping the card to you now but if you permit me I will go to the courier company to find out the cost, but in that case you will be required to forward to me your address to enable me find out the shipment cost to your location.

Your direct telephone number and more details of your ATM cards payment will be made known to you as soon as I receive your swift positive response, to enable you know the amount programmed for your ATM daily withdrawals.

Get back to me as soon as you receive this message. you can also reach me on my direct line: Tel: +2348 13855 7931 and I would officially respond to your mail upon the receipt of your mail. Thanks For your anticipated co-operation and understanding. I will serve you better.

Yours Faithfully,
Mr.John Ekeh,

Header:

Delivered-To:
Received: by 2002:a19:25c9:0:0:0:0:0 with SMTP id l192-v6csp2554152lfl;
Mon, 16 Jul 2018 09:05:56 -0700 (PDT)
X-Google-Smtp-Source: AAOMgpdt6z6OgXoUwOevYfuOjKR50ukB96RWRQU3qh7cEYFPFj2+tvYfEDe+P1K7Cf6XPMyJ6SLc
X-Received: by 2002:a1c:958c:: with SMTP id x134-v6mr1212003wmd.86.1531757156580;
Mon, 16 Jul 2018 09:05:56 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1531757156; cv=none;
d=google.com; s=arc-20160816;
b=fqKB+JdRFQNazPCRqtq/LxK4jySJSooYQ9LWXJ8Rq7/eUEo6gxH/zpIArO8UF22Y3B
XlfzKF1i+EtLm16Zn744/fLhoG/wt2p8jzO9ER57o0y1tmvwHwhxiyjprkgEH5rdZ9NU
82cLWDY7KIJtIG+ryvJ7k5KIDT8P9BC1yWzxmQPc7w7tpqcW3TYASdbWpdpgGJ0bx9vl
/zd6ExhFADplJqIvIe2lHhbQZO7jlb/39vgHqKR0G8ff8R3HNkS4X/a9eL7qDkz51Tnu
l/h02svgkVuoHlAmquLaqY5ONmQlXWI64blZfqwag21YFc3q1yGf3efH+MwSDULhbOEs
ysmQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=user-agent:message-id:subject:to:from:date
:content-transfer-encoding:mime-version:dkim-signature
:arc-authentication-results;
bh=0sgndyxuoSTLc+uiKBUXNS69AVPupthdOYrpYrow/tc=;
b=ATSjDBAcpUc3AdEne7/1OH4ReN2NBUmmpLghZihRjOqO4EHxRUr/LdKdOZJN8KQjza
JfRSbb7u0LykKgM2lWD17EPqOmGDgLzeX4iduki6vBB2/1O1Z8gW75whDbi1jnkj2TxR
cfeVnxdXr8TL/M1CPd94F+QT1VMfSAS+4ys/czZZrXAU6eAW7PgwR//MCOM7RI+MMCKQ
QpBacGxEryj3FthEprAhCH8JZ+cD8dUs2gnfIeyrXCVOmUBHyTQaxMzK3SSv7Cxk7Z+d
zLNhstcPWrx+lRWzZlrj/U6VMv8jCVSeyw1bdXArGw50U4PDMVXwwL3+zkonCh7eT3UC
UwPw==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@imf-authority.org header.s=dkim header.b=b5mBfRdQ;
spf=neutral (google.com: 2a00:1ed0:1:500::a005 is neither permitted nor denied by best guess record for domain of info@imf-authority.org) smtp.mailfrom=info@imf-authority.org
Return-Path: <info@imf-authority.org>
Received: from mail.pipni.cz (mail.pipni.cz. [2a00:1ed0:1:500::a005])
by mx.google.com with ESMTPS id i17-v6si27824168wrs.103.2018.07.16.09.05.56
for < >
(version=TLS1 cipher=AES128-SHA bits=128/128);
Mon, 16 Jul 2018 09:05:56 -0700 (PDT)
Received-SPF: neutral (google.com: 2a00:1ed0:1:500::a005 is neither permitted nor denied by best guess record for domain of info@imf-authority.org) client-ip=2a00:1ed0:1:500::a005;
Authentication-Results: mx.google.com;
dkim=pass header.i=@imf-authority.org header.s=dkim header.b=b5mBfRdQ;
spf=neutral (google.com: 2a00:1ed0:1:500::a005 is neither permitted nor denied by best guess record for domain of info@imf-authority.org) smtp.mailfrom=info@imf-authority.org
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=imf-authority.org; s=dkim; h=Message-ID:Subject:To:From:Date: Content-Transfer-Encoding:Content-Type:MIME-Version:Sender:Reply-To:Cc: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;
bh=0sgndyxuoSTLc+uiKBUXNS69AVPupthdOYrpYrow/tc=; b=b5mBfRdQf4JQhs4Pa619kdbv1 2CIuPk6K0Hj8kF3nlBM0xj0+3drgOOZ5UMdY6Sh28ttSAxIA5Fy62tYCkxXs0Sej7GM/Lp0mmRPv8 uXk4u+DXt9SxYAaPGvC2C//WjlrVnMAnOGgcChXwoOV3fq89H9mIzfsIEmo3S0JXbUdcU=;
Received: from ns.pipni.cz ([93.185.104.4] helo=webmail.pipni.cz) id 1ff60Y-0003aK-2F by authid <info@imf-authority.org> for ; Mon, 16 Jul 2018 18:05:54
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII; format=flowed
Content-Transfer-Encoding: 7bit