istanbulmachine@istanbulmachine.com

by **Big Al** » Wed Apr 01, 2020 12:40 am

This is to bring to your notice that, THE UNITED NATIONS, WORLD HEALTH ORGANIZATION AND ISTANBUL MACHINE Has selected you as a beneficiary of the COVID-19 Donation, Get back to us for more details on how much was donated to you and distribution method. Regards.
Alva White.

Header:

Delivered-To:
Received: by 2002:a9f:3703:0:0:0:0:0 with SMTP id z3csp2044933uad;
Sun, 29 Mar 2020 15:08:22 -0700 (PDT)
X-Google-Smtp-Source: ADFU+vt5DBgZGQKtVr59O9VqEsLvUOar4/f13SK4s+laOoz5nOU4M+sZOycE2JVVdNkPOz5US0gm
X-Received: by 2002:a50:9e66:: with SMTP id z93mr8549336ede.279.1585519702419;
Sun, 29 Mar 2020 15:08:22 -0700 (PDT)
ARC-Seal: i=2; a=rsa-sha256; t=1585519702; cv=pass;
d=google.com; s=arc-20160816;
b=WHL4mCxV6Fj0QTkYEV4mEhODHY/NVQv5BESx92R2lO0sd+sPB0LXmegVeaKtM7AZgX
1xaa1fJVFNsZ2lf5BiqzoTM0v830PWJ3CZ7jIk7s2f/4bqiCLpqSTVYI4FQOPgJfg5kk
m2QeC/+/FNkZvpkWzZDJh/hB68lNlq+hoLJ3KoAIzgMSjSIDCFmNPUhwMoUgsVf3mKH8
z2Qfz4ORrM1DPvu/qJxqve81mSQTKBVzbB6pBnmza/KqndWwudVDmVAc54tJ8WXp3qCG
jvGtwvPkNVqhsLYsnMDSpyMsSuy44bIwEej5M8GC9iPWQeX0Umh1pfsAwsW/1qdyLqGz
kxbA==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=user-agent:importance:mime-version:subject:message-id:to:from:date;
bh=sho4j56Pr7VkTOTUI7czsKW5yANXJaTVkEDDhXizmdc=;
b=I8ObeaJSUZWYjeC9IgATyR+g1577iGWpf8tWBnaUILZ2cNZWaHSJiQyft1m5GfHYkw
wjm/3jIw9XpZucrxx/TFub1e/VLWQmiMZ1D2l1TWA3S81+gjbn/nQznshQYJIy1whrpL
u+XSgrak1XDzlkzqiB/wYz+EdM84ObRWbP5qQaQ2ILcOnHLGgo8G4aHEqN0ocyFDf/P2
lbGHvxfPjswwbwcwKp7QtJm2qjUAEgT1T3mu1y7FfdgoxWJBd6+5B0CE4bAvlJNcZ3yE
qbSpRVqg/rTwTD6U9VTYHGeG7sHOyhU89YxspMtx96GQDJVfQFlYd2OhsHoUFilR2PAD
oD2A==
ARC-Authentication-Results: i=2; mx.google.com;
arc=pass (i=1 spf=pass spfdomain=istanbulmachine.com dmarc=pass fromdomain=istanbulmachine.com>);
spf=pass (google.com: domain of istanbulmachine@istanbulmachine.com designates 136.143.188.57 as permitted sender) smtp.mailfrom=istanbulmachine@istanbulmachine.com
Return-Path: <istanbulmachine@istanbulmachine.com>
Received: from sender4-of-o57.zoho.com (sender4-of-o57.zoho.com. [136.143.188.57])
by mx.google.com with ESMTPS id i19si416102edr.235.2020.03.29.15.08.21
for <
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sun, 29 Mar 2020 15:08:22 -0700 (PDT)
Received-SPF: pass (google.com: domain of istanbulmachine@istanbulmachine.com designates 136.143.188.57 as permitted sender) client-ip=136.143.188.57;
Authentication-Results: mx.google.com;
arc=pass (i=1 spf=pass spfdomain=istanbulmachine.com dmarc=pass fromdomain=istanbulmachine.com>);
spf=pass (google.com: domain of istanbulmachine@istanbulmachine.com designates 136.143.188.57 as permitted sender) smtp.mailfrom=istanbulmachine@istanbulmachine.com
ARC-Seal: i=1; a=rsa-sha256; t=1585519698; cv=none; d=zohomail.com; s=zohoarc; b=Q0kO1aJNN0R3reX2g/7LQXp0WokpO/dJYezFFil6DGSmocONQ6DnYxAO2JsvSYW1cdzUe9NQnm2iM/q+uuOogCLIKa9Ff31OjPCIDxvvW/lPj16BqJ/Jx+bCtOpTq889+d0YmJBWHDC7DYxXFLgG2eXnLd01SwqaF8H66B23WP8=
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1585519698; h=Content-Type:Date:From:MIME-Version:Message-ID:Subject:To; bh=sho4j56Pr7VkTOTUI7czsKW5yANXJaTVkEDDhXizmdc=; b=f4WmSjKYkF7612mfwahQiWgkUAZfZXaOkxnd295KO+hvQzXlgL3LIZpr+VgUD1b/JeWcv4MLar2HDkL94emfPVMDM4Y4nr1aJWiDXHr1tz6Idi6Chc63+3oiMX0/vnS2WlwEUm9Cgw6u8jQTfzUTPA73wZaxnvWegh/kIA9Q5gQ=
ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass
smtp.mailfrom=istanbulmachine@istanbulmachine.com; dmarc=pass header.from=<istanbulmachine@istanbulmachine.com> header.from=<istanbulmachine@istanbulmachine.com>
Received: from mail.zoho.com by mx.zohomail.com with SMTP id 1585519698222491.11412182991387; Sun, 29 Mar 2020 15:08:18 -0700 (PDT)
Date: Sun, 29 Mar 2020
From: istanbul machine <istanbulmachine@istanbulmachine.com>
To:
Message-Id: <1712856a12c.f1d45d33444024.8762072725866615318@istanbulmachine.com>
Subject: Good day
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_Part_1474689_981605132.1585519698220"
Importance: Medium
User-Agent: Zoho Mail
X-Mailer: Zoho Mail

------=_Part_1474689_981605132.1585519698220
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

by **firefly** » Wed Apr 15, 2020 4:14 pm

Email received:

Attention:

This is to acknowledge the receipt of your mail. In case you still have doubts arising from the angle of how you got selected, note that the selection process was carried out through an electronic email ballot system, You have emerged a Beneficiary as far as you are the original proprietor to the email account which you have received the notification letter as distributed.

This is to acknowledge the receipt of your mail. First your donation amount of $1,000000.00 will be credited into an online account with our transferring bank, Then the online details will be given to you, to enable you transfer your money into your personal account by your self.

We want your immediate response with your information below to enable the transferring bank proceed with the online account process.
Send a copy of your verification information to them on this email... customercare@truistfinancials.com

Full Name....................
Home Address..........
Valid Phone number............
Country/State..............

Your reply is urgently needed.
Best Regards.
Alva White.

Header:

Return-Path: <istanbulmachine@istanbulmachine.com>
Received: from sender4-of-o53.zoho.com (sender4-of-o53.zoho.com. [136.143.188.53])
Received: from mail.zoho.com by mx.zohomail.com with SMTP id 1586850960611914.2066081962193; Tue, 14 Apr 2020 00:56:00 -0700 (PDT)
From: istanbul machine <istanbulmachine@istanbulmachine.com>
Message-Id: <17177b014de.dc0c281a407304.4555981814799110821@istanbulmachine.com>
References: <CAPqXmjdBV7FExZuZcKYWLik8vfnFZkkXQeMHH_7aSWzWxoqb9w@mail.gmail.com>
X-Mailer: Zoho Mail

by **firefly** » Wed Apr 15, 2020 4:42 pm

Send a copy of your verification information to them on this email... customercare@truistfinancials.com

The fake bank used in fraud claims to be Truist Financial Bank and is active from the fraudulent domain name truistfins.com.

From the fake website:

We are a team driven to deliver the utmost in customer service.
We are synonymous with innovation, building excellence and superior financial performance and creating role models for society.

Contact details:

info@truistfinancials.com
+1 (219) 208-6000
Head Office
1445 New York Ave NW, Washington, DC 20005

The location is stolen from SunTrust Bank.

+12192086000
Type: Non-Fixed VoIP (e.g. Skype or Google Voice)
Original carrier: Verizon Wireless - In

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=143244.

From the domain name registration:

Domain Name: truistfins.com
Updated Date: 2020-03-16
Creation Date: 2020-03-16
Registrar Registration Expiration Date: 2021-03-16
Registrar: TLDS LLC. d/b/a SRSPlus

Registry Registrant ID:
Registrant Name: John Bill
Registrant Organization: John Bill
Registrant Street: 190 River Rd,
Registrant City: Edgewater
Registrant State/Province: NJ
Registrant Postal Code: 07020
Registrant Country: US
Registrant Phone: +1.7605370768
Registrant Email: johnbill1144@gmail.com

This is what the fake bank looks like:

by **Big Al** » Sun Apr 26, 2020 4:54 pm

Attention-
Sequel to my last email and with the new development with the allotted funds, i am glade to announce to you that the fund which was allotted in your name was a total sum of 1,000,000 Euro, (One Million Euro),
As the officer in charge of your claim process, i also want to inform you that your payment will be release in our affiliate bank
NOTE: Kindly indicate which option will be convenient for you to receive your 1,million Euro to assist people with covid-19 in your region.
1. Bank to Bank Transfer
2. Draft issued in your name and delivered to your nominated address
3. Come over to our fiduciary agent office in Germany to pick up your funds in person.
4. Our representative will bring the total amount to your home address

We want your immediate response with your information below to enable us proceed immediately with the process of your Donation !!!!!!

Full Name....................
Home Address..........
Valid Phone number............
Country/State..............

Your reply is urgently needed.
Best Regards.
Alva White.

by **firefly** » Sat May 23, 2020 6:26 pm

Emails received:

Your online account is ready. You are to come up with $750 for the needed documents before we can grant you access to transfer your money .

Good day,
Sorry for the late response, I was actually waiting for the IMF to send me the details you need to make the payment with before responding to you.
Back to your question, when money will get to your account, as soon as you make this payment and they send us the needed document, we will immediately give you the online account logging details to enable you transfer the money to your account by your self. Bellow is the account details you need to immediately send the $750 ... For everything to be fast I will advice you to download world remit. Then initiate the payment using world remit so it will reflect immediately you sent it, so there will be no delays in giving you your online account logging details.

Payment details.

Account name G. A
Account number 3606479xxxx
Routing number 301176110
Account address 3xxx 10467 bronx
Bank name capital one

Regards,
I await your response regards to the payment.