suthakarrungta@gmail.com

[Big Al]

Recovery Scam

I am Suthakar Rungta from Tamil Nadu, Chennai South India.

And I am a human right peoples Lawyer and I have come in peace to
voluntarily help you if you may permit me to do so by given a little
trust. My message is short and simple.

NOTE: You must stop communicating and listening to those that has been
demanding you to pay transfer charges, account activation fees,
insurance bill and pay money to get clearance certificates and anti
terrorist certificates, stamp duty fess, demurrage charges , delivery
charges and money launder cost before they will release and transfer
your funds. Because you do not need to pay any thing at all to any of
them anymore and stop them from continuous misleading into spending
and getting nothing ever since.

I was commission and empowered to fight for your right, and your
consignment which was passed through PHOTOGRAPHIC X-RAY machine
indicated and showed clearly the content which is TOO MUCH MONEY and I
overtake and recovered them all.

NOTE: You do not need to travel out of your city or country stop
expecting anyone to come to your house, but easy at your home with
your computers, you can transfer your fund into your appointed bank
account by Tel banking international system provided and accessible
with Emirates National Bank of Dubai.

When I hear from you, I will do the needful with no waste of energy and saliva.

Header:

Return-Path: <suthakarrungta@gmail.com>
Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65])
From: Suthakar Rungta <suthakarrungta@gmail.com>
Date: Wed, 10 Jan 2018
Subject: happy 2018 AND my message is short and simple.

[Big Al]

I hope you understood very well my first mail to you? or you can get
it and read again.
I suggest for you immediately the Tel banking international system
provided and accessible with Emirates National Bank of Dubai and yours
$5,000,000.00 USD you can only transfer.

Are you ready?

[Big Al]

You will only claim it when I will put you across and in communication
with the Tel banking international system provided and accessible with
Emirates National Bank of Dubai and if you are ready let's go?

[Big Al]

Please if you do not trust yourself you are free to back off.

[Big Al]

In line with what I have already writing in my previous email, I have
made it clear to you that you are not going to pay any transfer
charges or any kind of fees but you should bear in mind that in other
for this fund to be transferred to you via Tel banking transmission we
have to settle for the re-establishment of credit reimbursement to
posses the International Credit Invoice - ICI and that's what they
call it in other for the fund to be transferred to you electronically.
To this effect I will like to let you know that no charges is attached
to the fund but you regulating the officials banking requirement
mentioned herein; and that will help in transmitting the fund to your
designated account. Understand that the below Overseas Investment Bank
(OIB) knows this as a deal and therefore am using this medium to let
you know that the your contact information has been sent to the OIB
that finally accept this transaction and they will contact you any
moment and they will open the platform in which you can transmit the
transfer electronically into your chosen resident bank account; the
bank details as stated below.
Overseas Investment Bank (OIB)
Tel / Fax: +442033225745.
Email: customercare@overseasindex.com / transfer@overseasindex.com
Contact Person: Mr. Heart A. Heskey / Foreign Operations Unit.
ww w.overseasindex.com

Phone:
+442033225745
Number billable as geographic number
Country or destination United Kingdom
City or exchange location
Original network provider* (aq) Limited trading as aql

[Big Al]

Attn:

Thanks for your email with regards to the transaction of Mr. Suthakar Rungta. I am glad that the consignment arrived the UK intact and has since been deposited in a secure storage facility.

As you are well aware, we have an express instruction from Mr. Suthakar Rungta to hand over the custody of the consignment to you. Consequently, we have mapped out a comprehensive strategy to ensure the process of transferring the funds to you is hitch free and conforms to necessary legalities.

It’s important to note that the consignment contains the total sum of US$ 5,000,000.00 USD only and the fund needs to be legalized and introduced to the financial system in a manner that will not contravene the existing money laundry law, this is basically the reason our knowledge in the financial service industry will be invaluable in this transaction

As per our procedural rules, the Treasurer/Auditing Department and Risk Control Unit shall make verification's at the Debt Management and Wire Clearance office for confirmations and necessary authorization/approvals.To facilitate the process as applied for, download the wire transfer form attached herewith to complete with information required and return back to this office.

The process will be completed and funds transferred to your designated Bank account as the completed form is received here and our verification concluded.

Expecting your reply,

Sincerely,

Mr. HEART A. HESKEY
FOR MANAGEMENT.
1st March,2018
E-mail: mr.heartaheskey@overseasindex.com

Header:

Delivered-To:
Received: by 10.46.0.218 with SMTP id e87csp3396360lji;
Thu, 1 Mar 2018
X-Google-Smtp-Source: AG47ELu+9gDwBXEQYkjwxbv1nlV1bb1WpZG+UuwUScyDf/2MV1pHYwEpHJgrR4Z751OFJSw6u9bb
X-Received: by 10.36.211.145 with SMTP id n139mr2560428itg.29.1519914878038;
Thu, 01 Mar 2018
ARC-Seal: i=1; a=rsa-sha256; t=1519914877; cv=none;
d=google.com; s=arc-20160816;
b=L2koPeNO6qgTaku3O8mqUL66gCXlt8Qck8CG7JXKuHCrbl90uUh1lkwHsx9eCKIb+/
5nFcO/0X1YnBemj1S6HaUeGW3UGaSn6AvHiGjhH4eJUHL9Hhp8Ks1gVygFFeuDJVontf
ZxV9x1CK90RgyGMWTSvYQMOFQd8yhmfFEOfwjFbFE7H/hD9O4J8ZJSHiM8vmYnXtQavI
Xdv8ZG4H3iaaFO8OshfiDeuk/jqewIAkOVMcw4idws/XLCcsVZQ8V7E9Qo2USYhMURnq
fZ2sQFG8tEv78ccA5y/GoDoBz2ihqTsPLgyuWMRubyB07t0U7VTUPTuJy4DCOoZGfSd0
++Pg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=mime-version:subject:references:in-reply-to:message-id:to:reply-to
:from:date:dkim-signature:arc-authentication-results;
bh=yEbT56ffy/eqIkbohNqEiuH8q38ge8d1HStBHRs9thQ=;
b=X0VSYEiC1WsVuYA1+4QlRWeZ2CoRTEt1vvxQiDvuqf0i/q9w55BVMjszy3TF71z3iU
tIkS009DKWsOr19cT1ADLyL5xXlhnit5JSaYrScAxauLNa8v+wWAOJLs6FQeJOyGIJ8N
XDaesncCiy1A7HsqjKKyvglwjzoNI8PI3gQ162oqZw3ctZ5ah5GmiznUeLSUBlGgRnzA
s79LafKj9D8wbACg2l1v8q9erxAnoYh4QfzE9EjKU8ZOaCZmTrbG9qyZGgODp5yAKUcg
lfTRAVtg7V17y5iiNaIuBd821NPQlbBMBZ0t7EkeAy60NCCMkbZ336IFmVVg5WEYU51B
0rAQ==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@yahoo.com header.s=s2048 header.b=JwoZlCo5;
spf=softfail (google.com: domain of transitioning transfer@overseasindex.com does not designate 66.163.185.47 as permitted sender) smtp.mailfrom=transfer@overseasindex.com
Return-Path: <transfer@overseasindex.com>
Received: from sonic313-24.consmr.mail.ne1.yahoo.com (sonic313-24.consmr.mail.ne1.yahoo.com. [66.163.185.47])
by mx.google.com with ESMTPS id w1si2517681iof.215.2018.03.01.06.34.36
for <>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Thu, 01 Mar 2018
Received-SPF: softfail (google.com: domain of transitioning transfer@overseasindex.com does not designate 66.163.185.47 as permitted sender) client-ip=66.163.185.47;
Authentication-Results: mx.google.com;
dkim=pass header.i=@yahoo.com header.s=s2048 header.b=JwoZlCo5;
spf=softfail (google.com: domain of transitioning transfer@overseasindex.com does not designate 66.163.185.47 as permitted sender) smtp.mailfrom=transfer@overseasindex.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1519914876; bh=yEbT56ffy/eqIkbohNqEiuH8q38ge8d1HStBHRs9thQ=; h=Date:From:Reply-To:To:In-Reply-To:References:Subject:From:Subject; b=JwoZlCo53pYt8yyJTNKWLv3P5wEkCKw3RD88gJjW+VNgFwg6SXzjQNIlZlFv9f5OVgt5K4okNg9P4t9qLAd7LtmWmRSOmWcZ166A1MblcQi5lniv6mxMDnxrKDZCqzMKI5WY0QSsC/MPNfjBiJJF3MZaxQH3SIq1U9OOIXOopPmTbcKaMxQp4/gN0w6PIx/zoj9/JU6WzWoj1tYamBUpizb8nTgBVUFYW5okrQ6MIvoqK3fabzUCLl/4KAcgdXj/0zPYQN26nJG0oHiUZEymSBomy/gkzKETXFd3xtDaN9xXKCrFZji7kbDNa/viVfnDgJ8/hKwp7oo1j7Rs0Bcr1A==
X-YMail-OSG: wX39Y.QVM1nzVw5kR7Wr1of_jyEmeNyknCK1cDhjNFNXjZSaXBn2CsyzdN8TQLd c2poEy9vx_.n90_v0kC5t4_brJti2loQyng7vqJQZ8u.gpl8lET6ks8yxH5LAAdXjN.tqgnW7_Gb CfTd1WD8YGNFBiGpvVmpEGsgrKwAze3ytEGp24_OBjs.tgzfgXIn3thM0gEgISWF6wZHllAngr__ 6mY4GqriHk6TgI0P36gGjb_D5yOQNLKar0sNKPnGSd4CYKORzRkETJstbdvQuwvSspVxO_IPOJOd f9lkzSkt_6T4L8rkfqMlfhUBbGUrsZ.xDGbYxD59Jt9NecKQoXYn8y7Q21O0CNb5p434pIF7tf5A ..AaVbOilE4Ehs1oRKrOubmLu.jeCJ0GbADEGyBSFdJGUN.TrE0mb5TAkefGhsmYGeukJuX7NNAY GC1SROcMe9E1E8LbIixqQEdGGodk6PFd_4jQnlf7MbmANpe8nRw--
Received: from sonic.gate.mail.ne1.yahoo.com by sonic313.consmr.mail.ne1.yahoo.com with HTTP; Thu, 1 Mar 2018
Date: Thu, 1 Mar 2018
From: Oveereas Investment Bank <transfer@overseasindex.com>
Reply-To: Oveereas Investment Bank <transfer@overseasindex.com>
To: >
Message-ID: <1406943516.7775094.1519914870300@mail.yahoo.com>
In-Reply-To: <CAKfcJWpX6ZtTQNgbQ_jGXP9N7e2vHdndLD22cEX3E=5jPs2mog@mail.gmail.com>
References: <CAOxeVS74TyFaeVvPLBt3R11ix9kSkjt-bBP9QTzas=4H_DA+yg@mail.gmail.com> <CAKfcJWpX6ZtTQNgbQ_jGXP9N7e2vHdndLD22cEX3E=5jPs2mog@mail.gmail.com>
Subject: Transfer Notifcation
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_Part_7775093_1900072248.1519914870300"
X-Mailer: WebService/1.1.11419 YMailNorrin Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36
Content-Length: 721479

------=_Part_7775093_1900072248.1519914870300
Content-Type: multipart/alternative; boundary="----=_Part_7775078_678186580.1519914869022"

------=_Part_7775078_678186580.1519914869022
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

[firefly]

The fake site claims to be Overseas Investment Bank. The fraudster creating the fake site stole the content from Bank of Blue Valley Corp, the identification details (registration numbers) from Barclays Bank, edited the logo and created his own fictitious bank.

From the fake site:

Overseas Investment Bank began as an idea of what a community bank focused on the success of local residents and businesses should be. Bob Regnier, President, Chairman and CEO of Overseas Investment Bank, wanted to create a community bank where convenience, community partnerships and personal relationships were principal tenets supported by the best banking services available.

In 1989, Bob founded Overseas Investment Bank as a locally-owned, locally-managed community bank ready to assist residents and businesses in Johnson County and the Crawley City area with their banking and lending needs. Through building lasting relationships based on quality customer service, Overseas Investment Bank has been able to expand to the current five banking locations today in England,Northern Ireland,Belfast and Scotland.

Overseas Investment Bank . Authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority (Financial Services Register number: 122702). Overseas Investment Bank subscribes to the Lending Code which is monitored and enforced by the Lending Standards Board and is licensed and regulated by the Office of Fair Trading for the provision of credit products to consumers and related services.
Overseas Investment Bank . Registered in England. Registered no. 1026167. Registered office: 90 Tilgate Forest Business Park, Brighton Road, Crawley, RH11 9BP, United Kingdom.

The registration numbers are copied from Barclays Bank site.

Contact details:

Head Office Address:
90 Tilgate Forest Business Park,
Brighton Road, Crawley, RH11 9BP, United Kingdom.
Email: e-banking@overseasindex.com

The bank "founded in 1989" has no online presence outside the fake site used in scams - and the fake site, created a year ago, was just recently renewed for another year of fraudulent activity.

From the fake site details - https://db.aa419.org/fakebanksview.php?key=130349; the registrant uses the privacy protection given by the registrar to hide his real identity and location:

Domain Name: overseasindex.com
Updated Date: 2018-03-11
Creation Date: 2017-02-13
Registrar Registration Expiration Date: 2019-02-13
Registrar: NameSilo, LLC
Reseller: QHOSTER.COM
Registry Registrant ID:
Registrant Name: Domain Administrator
Registrant Organization: See PrivacyGuardian.org

This is what the fake site looks like:

[firefly]

At the same location we find another bank, using the same stolen content and credentials, same edited logo and another name: Kasland Bank.

Kasland Bank began as an idea of what a community bank focused on the success of local residents and businesses should be. Bob Regnier, President, Chairman and CEO of Kasland Bank, wanted to create a community bank where convenience, community partnerships and personal relationships were principal tenets supported by the best banking services available.

In 1989, Bob founded Kasland Bank as a locally-owned, locally-managed community bank ready to assist residents and businesses in Johnson County and the Crawley City area with their banking and lending needs. Through building lasting relationships based on quality customer service, Kasland Bank has been able to expand to the current five banking locations today in England,Northern Ireland,Belfast and Scotland.

Kasland Bank . Authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority (Financial Services Register number: 122702). Kasland Bank subscribes to the Lending Code which is monitored and enforced by the Lending Standards Board and is licensed and regulated by the Office of Fair Trading for the provision of credit products to consumers and related services.
Kasland Bank . Registered in England. Registered no. 1026167. Registered office: 90 Tilgate Forest Business Park, Brighton Road, Crawley, RH11 9BP, United Kingdom.

Contact details:

Head Office Address:
90 Tilgate Forest Business Park,
Brighton Road, Crawley, RH11 9BP, United Kingdom.
Email: kaslandbanking@consultant.com

This time Tilgate Forest Business Park is in Accra, Ghana...

From the fake site details - https://db.aa419.org/fakebanksview.php?key=130350:

Domain Name: KASLANDONLINE.COM
Updated Date: 2018-03-10
Creation Date: 2017-03-02
Registrar Registration Expiration Date: 2019-03-02
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: Felix Brungs
Registrant Street: Plot 920 Hassan Kissman Cir
Registrant City: Accra
Registrant State/Province: Accra
Registrant Postal Code: 00233
Registrant Country: GH
Registrant Phone: +233.0208562803
Registrant Email: kaslandirect@mail.com

This is what the fake site looks like: