customercare@unibafri.com

[firefly]

Recovery scam.

Attention

Attention

This is to notify you that your funds valued Seven Million Five
Hundred Thousand united states dollars (U.S. $7,500,000.00) has been released today to the UBA BANK.

For your convenience, You will have to start transferring your fund within 24hrs online by yourself to your local account. By Online Banking with this method you will monitor the movement of the local funds online till your account is duly credited.

So Contact the UBA BANK to receive the login details of your Online account so you can commence the transfer by yourself.

CONTACT PERSON:
MR. JAMES CLINTON
UBA BANK CORPORATION
EMAIL: customercare@unibafri.com

Header:

Received: from static-68-235-33-125.cust.tzulo.com (static-68-235-33-125.cust.tzulo.com [68.235.33.125])
Date: Sat, 09 Mar 2024 10:05:07 +0100
Message-ID: <20240309100507.Horde.U9s7CmpXU4aUDubNBCxT9g1@webmail.telekom.hu>
From: UBA BANK <kovacsarpad1em@t-online.hu>
Subject: Attention
Reply-to: infoubaba21@zohomail.com
User-Agent: Horde Application Framework 5

Originating IP: 68.235.33.125
Originating ISP: Tzulo
City: Evanston
Country of Origin: United States

[firefly]

Reply received:

Welcome to United Bank for Africa Lagos.
United Bank for Africa
Address: Head Office: 57 Marina, Lagos Island, Lagos
Foreign Reserve Escrow Account Officer
Tel/Whats-app: +(234)901-619-3435

I am glad to announce to you today that a new payment policy has been
adopted and you have been shortlisted for payment via Online Banking
United Bank for Africa, We hereby inform you that United Bank for Africa
Marina, Lagos Island, have instructed to open online account on your
behalf to credit your account with the approved amount of
US$7,500,000.00 Million United States Dollars only deposited from World
Bank Group of Berlin In Europe as instructed by United Nation
organization, Further more Endeavor to email us the following
information for immediate processing.

Full Names:
Address:
State of Origin:
Nationality:
Social Security Number:
Marital Status:
Birthday:
Residential Address:
Office Address:
Age:
Country:
Phone no:
ID:

These are the requirements that you need to be aware of before you
contact us. You will fill the online account opening information's, in
regards to your funds $7.5 Million that has been approved by the Federal
Government of Germany also Federal Government of United State and United
Nation Organization. Note that you pay $150 for crediting and processing
fee.

Thank you

Regards,
Mr. James Clinton
Foreign Reserve Escrow Account Officer
United Bank for Africa

Header:

Return-Path: <customercare@unibafri.com>
Received: from caracal.birch.relay.mailchannels.net (caracal.birch.relay.mailchannels.net. [23.83.209.30])
Authentication-Results: mx.google.com;
dkim=pass header.i=@unibafri.com header.s=default header.b=yJh3pO9k;
arc=pass (i=2);
spf=pass (google.com: domain of customercare@unibafri.com designates 23.83.209.30 as permitted sender) smtp.mailfrom=customercare@unibafri.com
X-Sender-Id: interserver|x-authuser|customercare@unibafri.com
X-Originating-IP: [46.4.98.169]
Date: Mon, 11 Mar 2024 16:42:06 +0300
From: customercare@unibafri.com
Subject: Re: From United Bank for Africa
User-Agent: Roundcube Webmail/1.6.0
Message-ID: <45f694ed9368e79c620ca4f3c3c64f53@unibafri.com>

Originating IP: 46.4.98.169
Originating ISP: Hetzner Online Gmbh
City: Rostock
Country of Origin: Germany

+2349016193435
Number billable as mobile number
Country or destination Nigeria
Original network provider* Cellular Mobile (ETACS)

[firefly]

The fake site used in scam is a spoof of United Bank for Africa; the fraudulent domain name is active at en.unibafri.com.

Contact details shown on the fake website:

9C2G+XVF,
Cocondji Gbedromede Cocotome,
Cotonou, Benin Rep
+229 58 743 012
info@unibafri.com

+22958743012 - invalid Benin phone number

Entry in the aa419 database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=166140

From the domain name registration:

Domain Name: unibafri.com
Updated Date: 2024-03-07
Creation Date: 2024-01-21
Registrar Registration Expiration Date: 2025-01-21
Registrar: NameSilo, LLC
Reseller: HostPinnacle Support Team

Registry Registrant ID:
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: PrivacyGuardian.org llc

This is what the fake bank website looks like:

[firefly]

Replies received:

March 16:

Below is Western Union or MoneyGram information you will use to send the
fee.

Receiver Name: Alex Agu
Country: Benin
City: Porto Novo
Amount: $375

Note; you will take you 2 to 3 hours for you to start enjoying your
funds

Thank you

Mr. James Clinton

March 17:

We do have an account, but to avoid delay or time wasted that is the
reason we direct you to make the payment through Western Union or
MoneyGram,

March 23:

How do you want to have the fee sent?

March 26:

Below is bank account information you will use to make the payment;

ACCOUNT NAME : I. S. I.
Account NUMBER : 000005394xxxx
BANK NAME : security bank
Recipient Address: ccc taguig city manila Philippines
Bank address : H248+JH7, Legazpi Street, Legazpi Village, Makati,
Kalakhang Maynila makati manila Philippines
Swift code : SETCPHMM
ZIP CODE : 1630
Amount: $375

Look forward to hear from you along with bank payment details slip.

Thank you

Bank management

Header:

Return-Path: <customercare@unibafri.com>
Received: from relay1-k.mailbaby.net (relay1-k.mailbaby.net. [206.72.200.42])
Received: from rs5.rcnoc.com ([46.4.98.169]
Date: Tue, 26 Mar 2024 11:55:42 +0300
From: customercare@unibafri.com
User-Agent: Roundcube Webmail/1.6.0
Message-ID: <9b3cfc1684dca2b05cb2bf89faf5e33b@unibafri.com>

Originating IP: 46.4.98.169
Originating ISP: Hetzner Online Gmbh
City: Rostock
Country of Origin: Germany