goodluckmary@hotmail.com marilobouabre9@yahoo.co.jp

[Big Al]

Dear Friend,

Thank you for your message and interest in the proposed transaction. How are you today and all your family?I hope everyone is excellent.The fund belongs to a daughter of my late clients.

As for the transfer of the fund,it will take place as soon as possible.

The modalities of the transaction is that you will take 20% of the total amount for your acceptance to help in the transaction.5% will be for the reimbursement of expenses if there will be expenses to be make in the course of the transfer of the fund while the remaining 75% will be for the joint venture between you and the young lady.

Do not hesitate to send to me the informations below,
a) Your full legal name
b) your address
c) Your phone numbers
d) Your age and profession.
e) A scanned copy of your identity card.

Do try to send the above informations so that I will link you up with the bank in Asia for the transfer of the fund.

Waiting for your quick response.Attached here is my professional identity card for your perusal and security in the transaction.

Barister.Nelson Douglas Esq
Tel. 00225 4380 6352
Abidjan Cote D'Ivoire(Ivory Coast)

[Big Al]

Dear

Thanks for your message and the informations.The Asian bank will soon contact you for the transfer of the fund.Do always reach me for the my update on the run of events.

Best Regards,

Barister.Nelson Douglas Esq
Tel. 00225 4380 6352

Kind Attention:

Dear Sir,
We hereby confirm transfer instructions referenced number ICBCPPKH/JZ79919 received from our ordering customer M/s Biao Bank Abidjan Cote D'Ivoire as advised by Barrister Nelson Douglas to transfer the sum of USD3,500,000.00 (Three Million Five Hundred Thousand USD Only) into your bank account for investments purposes.
To release the fund to you: you are required to re-confirm the following details of your nominated bank account.
1. Name of your bank
2. Address of your bank
3. Your account number
4. Your account name
5. Swift code of your bank
We will make a direct bank to bank transfer of the fund into your bank account once we receive your re-confirmed details as above along with a scanned copy of any of your identification documents.
You should contact our director Dr. Vong Kou through phone if you need any further clarification/s.
Meanwhile, please confirm receipt of this message.
Sincerely Yours'
Ms. Leiz Soem (secretary, foreign transfers department).
International Credit & Banking Corporation Plc,
No. 45 Street 709, Preah Phsar,
Phnom Penh Cambodia
Tel: +855 966 351 098/+855 1 181 9212
Fax: +855 1 182 0380
E-mail: icbcplc@icbcplc.com
Website: icbcplc.com

Header:

Delivered-To:
Received: by 2002:a25:1208:0:0:0:0:0 with SMTP id 8csp5497670ybs;
Wed, 30 Oct 2019 02:48:19 -0700 (PDT)
X-Received: by 2002:a05:620a:2102:: with SMTP id l2mr4507612qkl.363.1572428659777;
Wed, 30 Oct 2019 02:44:19 -0700 (PDT)
X-Google-Smtp-Source: APXvYqxbdBVXMpii79hExd8f3jj0lC9L7rEUbFN75VlR7kA1897Mz/eTN2P2he8pzmj1JdIjFuvg
X-Received: by 2002:a05:620a:2102:: with SMTP id l2mr4507514qkl.363.1572428657562;
Wed, 30 Oct 2019 02:44:17 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1572428657; cv=none;
d=google.com; s=arc-20160816;
b=haeyB9GKh8L3M+OUCyJboLXur9Jj33vYfBeTMc4nw4cZvyoPq/PUFOocyys/lEFqRz
XtH1lXAviiDsFhKOqMMx7grIDA8qnHVlhvnY4D/4n3lZLeHJCiFInRYtB8jdfIYo7GPk
8lB0BXwlMZCNrNFJz43ke5bwBV1FXRP2KcyPwaIOZblbM2PgSjIEYT68NiAH29Wo/4O1
C0XZCPMvaIARUk1G7NXK8yXeF9BxAKSGjIm1ns0/JYrrGgDsexJh6nuf30RjCAvspff8
QZqIqkpNomewx48U2gITWiuKP9DVWA5T0PAfnAjG/GcoQatXijt4qIG7bTjhijpcRaCj
5gEg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=user-agent:message-id:subject:to:from:date
:content-transfer-encoding:mime-version:dkim-signature;
bh=puYsH6FA8gJL/RvhbFZDJT1xXHXwpCgl2+Pu+lqHIWc=;
b=gTzZOpCdCu8+/L8URSg944fy9kghDrU22NidxzPJP74k5AZ2Xel2B3hBm82rN8XdC2
IAtuH4g9F4u3C7BxITuCq+40T2vm+tSWs2S642BVaZ2UEQr1ByHRy94UzXZGxHS4XI24
e7ixcm72XIrBCyGUK4/cHWQKOkiwr3C9ReU5BiSE4RffIfc032gtVrWclRUOhgzbmxeN
EfiwUtCyMEG9SYU22ATCnpgcet86I4v3rgL+ex8ADU0ssAQpWldSAZrBiu1ozZhURjWh
8R3PxQ+9qiyJTkC6GeT/lCrREwmkCDswUjE9t8qEsmJCDDLlif5AWYsU29nlBLzylHmb
M8Fw==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@icbcplc.com header.s=default header.b=kC3Uo3HG;
spf=neutral (google.com: 198.54.115.114 is neither permitted nor denied by best guess record for domain of icbcplc@icbcplc.com) smtp.mailfrom=icbcplc@icbcplc.com
Return-Path: <icbcplc@icbcplc.com>
Received: from server233-2.web-hosting.com (server233-2.web-hosting.com. [198.54.115.114])
by mx.google.com with ESMTPS id o47si1618017qvc.11.2019.10.30.02.44.17
for < >
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Wed, 30 Oct 2019 02:44:17 -0700 (PDT)
Received-SPF: neutral (google.com: 198.54.115.114 is neither permitted nor denied by best guess record for domain of icbcplc@icbcplc.com) client-ip=198.54.115.114;
Authentication-Results: mx.google.com;
dkim=pass header.i=@icbcplc.com header.s=default header.b=kC3Uo3HG;
spf=neutral (google.com: 198.54.115.114 is neither permitted nor denied by best guess record for domain of icbcplc@icbcplc.com) smtp.mailfrom=icbcplc@icbcplc.com
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=icbcplc.com ; s=default; h=Message-ID:Subject:To:From:Date:Content-Transfer-Encoding: Content-Type:MIME-Version:Sender:Reply-To:Cc:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=puYsH6FA8gJL/RvhbFZDJT1xXHXwpCgl2+Pu+lqHIWc=; b=kC3Uo3HGnFPTQmtm4B1hkqIDVD 8sNNyceRml5DXVvi5jcVeJ6xkANhMzzXjOWvtzN3gB/fF/JEWtNzIrVn9Y0UZzS07i+dQANsuAEch wkh4NxdTPUt0HNSHbak2YC9UuqT5IozheIm4hSHJIOjoSQHSwfSVyEfyKj+i1XcCKWQtBmWceCaQH 6jrfnN0rRXQhSTaGK0tT6ou3pwBvwdqkZmJZNiwcHn91oHMT7kYy5divcpmh8E8f//mwKmeeoLqS6 T/daJ2IN4Q4eIvn9qFCzsyIAmn+0jdtrVienSUTYOl8bI4jlbXXV0LfzUp7u/cVsBW2DOo/8YClLA fWUgG4zg==;
Received: from [::1] (port=40002 helo=server233.web-hosting.com) by server233.web-hosting.com with esmtpa (Exim 4.92) (envelope-from <icbcplc@icbcplc.com>) id 1iPkWS-000YeK-FI for ; Wed, 30 Oct 2019 05:44:16 -0400
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII; format=flowed
Content-Transfer-Encoding: 7bit
Date: Wed, 30 Oct 2019
From: "Inter. Credit & Banking Corporation Cambodia Plc" <icbcplc@icbcplc.com>
To:
Subject: Kind Attention:
Message-ID: <f6ecfa165a001646601ce1e0436fc3df@icbcplc.com>
X-Sender: icbcplc@icbcplc.com
User-Agent: Roundcube Webmail/1.3.7
X-OutGoing-Spam-Status: No, score=10.5
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server233.web-hosting.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - icbcplc.com
X-Get-Message-Sender-Via: server233.web-hosting.com: authenticated_id: icbcplc@icbcplc.com
X-Authenticated-Sender: server233.web-hosting.com: icbcplc@icbcplc.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-From-Rewrite: unmodified, already matched

Phones:
+855966351098
Cambodia Mobile

+85511819212
Number billable as mobile number
Country or destination Cambodia
City or exchange location Phnum Pénh
Original network provider* Mfone Co Ltd

+85511820380
Number billable as mobile number
Country or destination Cambodia
City or exchange location Phnum Pénh
Original network provider* Mfone Co Ltd

[Big Al]

Kind Attention:

Dear Sir,
Follow up to your re-confirmed bank account details received, be advised that we have started processing the transfer of your fund. We expect to be through tomorrow Friday 01 November 2019 and will update you accordingly.
You should contact our director Dr. Vong Kou through phone if you need any further clarification/s.
Meanwhile, please confirm receipt of this message.
Sincerely Yours'
Ms. Leiz Soem (secretary, foreign transfers department).
International Credit & Banking Corporation Plc,
No. 45 Street 709, Preah Phsar,
Phnom Penh Cambodia
Tel: +855 966 351 098/+855 1 181 9212
Fax: +855 1 182 0380
E-mail: icbcplc@icbcplc.com
Website: icbcplc.com

[Big Al]

Dear

Thanks for your message.I do not have any of your email address if not this.May I know if the bank in Cambodia has contacted you because their bank here told me this morning that they are sure that by now you must have been contacted by the Asian bank so please update me.
Best Regards,

Barister.Nelson Douglas Esq
Tel. 00225 4380 6352

[firefly]

From the fake website:

International Credit & Banking Corporation Plc was established in 1998 . It was the catalyst to Cambodia economic development.
Since then, International Credit & Banking Corporation Plc has transformed into a successful financial services institution, offering a comprehensive range of innovative products and solutions to meet its clients needs. With operations in 10 markets, the bank has a regional network spanning more than 120 branches and over 1,100 ATMs across 45 cities.

Contact details:

International Credit & Banking Corporation Plc Call Center
+855 966 351 098/+855 1 181 9212
Email: customercare@icbcplc.com
Office
No. 45 Street 709, Preah Phsar,
Phnom Penh Cambodia
Tel: +855 966 351 098
Fax:+855 1 182 0380

"established in 1998" is a lie - the fake bank was created in 2017.

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=140538.

From the domain name registration:

Domain name: icbcplc.com
Updated Date: 2018-11-03
Creation Date: 2017-11-03
Registrar Registration Expiration Date: 2019-11-03
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC

Registry Registrant ID:
Registrant Name: WhoisGuard Protected
Registrant Organization: WhoisGuard, Inc.

This is what the fake website looks like:

[Big Al]

Dear

Thanks for your message.Last time you told me that you are contact with the bank in Cambodia of which I am happy for the fact that you will receive the fund very soon but now you sent a message telling me that they did not send anything toyou today.I did not understand.Did they promise to wire the fund to you yesterday?

Please try and explain things very well for me.

Have a nice day and a wonderful weekend relaxation while I wait to hear from you.

Best Regards,

Barister.Nelson Douglas Esq
Tel. 00225 4380 6352

Dear

Please may I know how far you have gone with the bank in Cambodia on the transfer of the fund.

I am waiting for your immediate response

Barister.Nelson Douglas Esq
Tel. 00225 4380 6352
Abidjan Cote D'Ivoire(Ivory Coast)

[Big Al]

They will surely contact you.May be they have been so busy, arranging for the transfer of the fund so that as they contact you they will transfer the fund to you at the same time.

I am waiting for your immediate response as you hear from the Cambodia bank.

Best Regards,

Barister.Nelson Douglas Esq
Tel. 00225 4380 6352
Abidjan Cote D'Ivoire(Ivory Coast)

[Big Al]

Does it mean that they have not yet contacted you?Please let me know as quick as possible.Make it a point of duty to call me as you get this message

Barrister Nelson Douglas Esq

Tel 00225 4380 6352

[Big Al]

Dear

Thanks for your message.Sorry for the delay so far on the transfer of the fund but I was assured by the bank here that the Cambodian bank will soon transfer the fund to you and all things been equal I hope the transfer will take place by next week.

I look forward for your updates.

Best Regards

Barister.Nelson Douglas Esq
Tel. 00225 4380 6352
Abidjan Cote D'Ivoire(Ivory Coast)

[Big Al]

Kind Attention:

Dear Sir,
Can you please update us on your efforts to complete your pending fund transfer with us?
Your urgent reaction to this message is highly expected.
You should contact our director Dr. Vong Kou through phone if you need any further clarification/s.
Meanwhile, please confirm receipt of this message.
Sincerely Yours'
Ms. Leiz Soem (secretary, foreign transfers department).
International Credit & Banking Corporation Plc,
No. 45 Street 709, Preah Phsar,
Phnom Penh Cambodia
Tel: +855 966 351 098/+855 1 181 9212
Fax: +855 1 182 0380
E-mail: icbcplc@icbcplconline.com

Header:

Delivered-To:
Received: by 2002:a25:fc15:0:0:0:0:0 with SMTP id v21csp1069533ybd;
Thu, 7 Nov 2019 06:37:52 -0800 (PST)
X-Google-Smtp-Source: APXvYqwowsTmQjOPUB3VzcepIDF61qt3/VyWRcWb3dtWgGy4wR+LbkwEvbcE8OI39wj2/7krUsNi
X-Received: by 2002:a0c:f807:: with SMTP id r7mr3808401qvn.48.1573137471888;
Thu, 07 Nov 2019 06:37:51 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1573137471; cv=none;
d=google.com; s=arc-20160816;
b=fctEF0Ijf/Lh9ZjoIDCg56mTu65qtRBYZIUy7vIn//VRamHpUbfr/TNUpuE2hhsGpq
ic+H9y1qUHK6CMfBoyaFFZAhkzQMRyRXOkHg9hw/NJi5PP6HGE4N695k/zYgv0SwbjBe
ALEa6NdBMyBxc0nCah85ssF+OfeOw1pYMwnhkURuLJ3c7itYLvwr2UFQyEiD6QEgKfoN
X2T+rkSCliqs0BI/OTwIyCXv6sHiWEe/uYdtEe6aChEkKlfffjZXgykPwRpBfZykigez
e/DkmG68AQ15kppYM/gwMjMTHdy3ts/JDy8mFeXZac4f+EEwf522WPULdwMYghkTuFgb
VbYw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=user-agent:message-id:subject:to:from:date
:content-transfer-encoding:mime-version:dkim-signature;
bh=yWsofZuInJFchJW9UhCySyyPyvzej2/axsQ71UUAIX8=;
b=K2DbCsYnUhLb7vXLpN7xDr0kCtdjaOTx3w+NuieUqay5/XMggjR40Z+Y1ZIOabzbbw
eYa/dbkZXakIDz74aUYulCRcXsoUTM1hMQ4Vvz6dZ8QK7XqwAwf8jXhs6n0oOsZind81
KQ2GQDu6OITtrnlsODBTG3Gurgxp9e3Tbii59nmWl3lB1maIm7Yz6XVupuq7l6ZeC6IQ
2JEcBi6mhF+KZ4+ks2kSXKUNKnrqncEYagWD74efT/KEoF8+Mt0SvznYLyLaXWZfoxef
VTaWk70yhu0Ye3QHGCNxFHdlpR7gZvqgn0Bo/vZO8qMG2bzes7019mrpqzq1ygXm6cyP
G6yg==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@icbcplconline.com header.s=default header.b=Lk22G0G4;
spf=neutral (google.com: 199.188.201.79 is neither permitted nor denied by best guess record for domain of icbcplc@icbcplconline.com) smtp.mailfrom=icbcplc@icbcplconline.com
Return-Path: <icbcplc@icbcplconline.com>
Received: from server60-m.web-hosting.com (server60-m.web-hosting.com. [199.188.201.79])
by mx.google.com with ESMTPS id o47si1204377qvc.11.2019.11.07.06.37.51
for < >
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Thu, 07 Nov 2019 06:37:51 -0800 (PST)
Received-SPF: neutral (google.com: 199.188.201.79 is neither permitted nor denied by best guess record for domain of icbcplc@icbcplconline.com) client-ip=199.188.201.79;
Authentication-Results: mx.google.com;
dkim=pass header.i=@icbcplconline.com header.s=default header.b=Lk22G0G4;
spf=neutral (google.com: 199.188.201.79 is neither permitted nor denied by best guess record for domain of icbcplc@icbcplconline.com) smtp.mailfrom=icbcplc@icbcplconline.com
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=icbcplconline.com; s=default; h=Message-ID:Subject:To:From:Date: Content-Transfer-Encoding:Content-Type:MIME-Version:Sender:Reply-To:Cc: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;
bh=yWsofZuInJFchJW9UhCySyyPyvzej2/axsQ71UUAIX8=; b=Lk22G0G47GaY9ppjf6W3DFcWM bzZorE/RxcN6LuHvi/gxClcXsgTGU7YDC6RtRXBFITTajeYatIpI/exFYLKFV4Qc/qMm1SrFsmXCW HwXX0cOSjWrGreYu1A3klcvpH+VCCLknt9h89NXoQ/UhcZubBwY9OLTkQfxX2Nmap1aHaAtNYlzZk UtO3NG8cp+hdE9FEYVRF8Vk0PNuVvCm1QC0BR9z+EG0Qgt24czo/p/a3R2ETj0nxY4i78kbqnUPQ8 oO8zrdF/262dQtZXrmHG9THPhtmK9udvIyacpAtjpSAVZDep9hBqYaWWKHz7Rkd607zTnv2I9lcE3 cv12JFp0w==;
Received: from [::1] (port=40090 helo=server60.web-hosting.com) by server60.web-hosting.com with esmtpa (Exim 4.92) (envelope-from <icbcplc@icbcplconline.com>) id 1iSiuv-003MMR-Hc for ; Thu, 07 Nov 2019
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII; format=flowed
Content-Transfer-Encoding: 7bit
Date: Thu, 07 Nov 2019
From: "Inter. Credit & Banking Corporation Plc" <icbcplc@icbcplconline.com>
To:
Subject: Kind Attention:
Message-ID: <19bd97998670b9b6f9b65184d66dba50@icbcplconline.com>
X-Sender: icbcplc@icbcplconline.com
User-Agent: Roundcube Webmail/1.3.7
X-OutGoing-Spam-Status: No, score=2.6
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server60.web-hosting.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - icbcplconline.com
X-Get-Message-Sender-Via: server60.web-hosting.com: authenticated_id: icbcplc@icbcplconline.com
X-Authenticated-Sender: server60.web-hosting.com: icbcplc@icbcplconline.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-From-Rewrite: unmodified, already matched