airportauthority@lax-airport.us

[Wayne]

Re: Your Shipment!
Marvin Carradine <airportauthority@lax-airport.us> Today om 8:26
Message body
Los Angeles International Airport, LAX
#1 World Way, Los Angeles, CA 90045, United States.

Good Morning,

I am Mr. Marvin Carradine a former US Army Contractor presently working as the Assistant Director of Inspection, Los Angeles International Airport, LAX, California, USA. During our recent inspection, a package containing an ATM card was found. I discovered this abandoned shipment was left by a Courier Service agent who was supposed to deliver this package to you but failed to due to lack of necessary clearance papers needed by the US Customs and when we scanned the package, we discovered that the ATM card is valued a huge amount of money with some vital documents enclosed. The shipment was abandoned because the Contents of the package were not properly declared by the consignee as Monetary instrument, rather it was declared to be personal documents to avoid diversion of shipment by the Shipping Agent.

The further finding reveals that the Director of Los Angeles International Airport, LAX, California has contacted you earlier and the consignment is still left at our Storage House here at the Los Angeles International Airport, LAX, which was to be delivered by this registered shipping Company known as Speedway Courier Services, a division of Tran guard LTD. The details of the shipment include your name, your email address and the official yellow tag document tagged on the parcel.

However, to enable me to confirm if you are the original recipient of this consignment, I will advise you to provide your current Phone Number and Full Address, to enable us to ascertain your true identity, your nearest airport and other relevant details.

Please note that this package was supposed to have been returned to the United States Treasury Department as unclaimed shipment due to the delays in concluding on the clearance processes. However, you have been given another chance to receive it. Once i confirm you as the genuine recipient of the package, i will commence the delivery process of your package which will cost you only $120 being the Customs clearance fee within 24 hours upon receipt of the fee.

Kindly, forward all information/response to "lax.airportauthority@californiamail.com" to continue with the Clearance and shipping.

Thanks,
Mr. Marvin Carradine
Assistant Director of Inspection
LAX Airport, Los Angeles, CA 90045, United States

[Big Al]

Note: The same type of recovery scam using other fake websites was previously reported in viewtopic.php?f=6&t=87134.

To:

This message is to bring to your notice that the information reaching us from the delivering company (FASTLINK DIPLOMATIC AND COURIER SERVICES) is that your consignment has since arrived your country but was stopped at your country's airport for non payment of US$1,800 which is required to cover consignment certification and release to your given address.

Be informed that since it is a fund and was packaged as a consignment through diplomatic method, there is no way the airport authority will access or open the consignment because it has a diplomatic tag on it therefore i urge you to immediately proceed to make the payment for certification of the consignment to the delivering company via this email address: delivery@fastlinkdipandcour.com

NOTE: You and i only knows the content of the consignment so do not relent to have it stay longer at the airport for the security of the fund as well as your security.

Thank you for your understanding.

Sincerely,

Jason Bourne Williams
Intelligence, Enforcement and Authorization Division
British Financial Supervision Commission
Finch Hill House, Bucks Road
Douglas, IM99 1DT, United Kingdom

Header:

Delivered-To:
Received: by 2002:a17:90a:1ce:0:0:0:0 with SMTP id 14csp98553pjd;
Wed, 2 Dec 2020 04:22:22 -0800 (PST)
X-Google-Smtp-Source: ABdhPJz5w7kdmw2lPeYq/OsEe9Z/H3H6uMiHZ14VSSYeKyJHNs5K7B5dqsVVQVEThWGjbYmO3aWC
X-Received: by 2002:a05:6808:1c7:: with SMTP id x7mr1322163oic.47.1606911742536;
Wed, 02 Dec 2020 04:22:22 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1606911742; cv=none;
d=google.com; s=arc-20160816;
b=Ix/yOw6T5sbeiKfMlxZvZwwgJLOR2fBBI4r0hFlKiwOT5tSSxlf5+rjDcKHsdyhCOP
/lyIynTJsLn8YM6d1Hlj5l+rWO/wS9MR8lwCHpmTkpLEGe+qYj/Yg/TVXbPFYribZwKn
pzsAykDKw8c5Fvaq4YBew17vAw1jF/z8F2LaEivraTQPEpew4Ppf30Ks5lQDxKJRvxex
2gC7VnZ/GdqFdI6Fr7Qn3gEvHKdTd9UZtr64MTkGhuyuC5FlvY0kUlDkzYWm/wXXfqXD
GabLAMcac6gedZC8w4OyqQXEkBWoCgF/tsHbhqapZXs0xTnUynxo+ubCo9W9nKAwYlL1
DzKw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=message-id:user-agent:subject:to:from:date:mime-version;
bh=53cjFHBEmFXujjBAGrETJk5P5eoU5b7TjtBuSYs+Nk8=;
b=Qoq4JybZO18qjmClVTPXps+UTO235W0ZDAiEfVv7ClNn6p3iNN0Fdy+i1/WtdsL9np
xRb43GoywSSTAjPB5fOnFRxfJXYgnY4Dkge3eUXbE/q516eB6THgUru0xJOgHjvmiOAo
bdxPy6iLFWB9Vxy4IWGUupLcJQD1zZkXFyQQitILdX/4NFYGeh/P7k9JiUHroEMoq/39
v8Olgh8zOcxkdgHnHVM8Qh3xsa5740YwNSTySJM+/6V8GfHowZc18tTLNiFPT0p0HGUa
8G7WUCfNwUC6iC80x5cVrb5WI9vG3kATYG7HFVV7MWTX0PRcVpJn/p+DsQM0svwMnWZj
0xVQ==
ARC-Authentication-Results: i=1; mx.google.com;
spf=pass (google.com: domain of admindepartment@bfsc.uk designates 208.91.199.212 as permitted sender) smtp.mailfrom=admindepartment@bfsc.uk
Return-Path: <admindepartment@bfsc.uk>
Received: from us2-ob1-6.mailhostbox.com (us2-ob1-6.mailhostbox.com. [208.91.199.212])
by mx.google.com with ESMTPS id z4si965195ood.3.2020.12.02.04.22.22
for < >
(version=TLS1 cipher=AES128-SHA bits=128/128);
Wed, 02 Dec 2020 04:22:22 -0800 (PST)
Received-SPF: pass (google.com: domain of admindepartment@bfsc.uk designates 208.91.199.212 as permitted sender) client-ip=208.91.199.212;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of admindepartment@bfsc.uk designates 208.91.199.212 as permitted sender) smtp.mailfrom=admindepartment@bfsc.uk
Received: from localhost (unknown [162.215.254.243]) (Authenticated sender: admindepartment@bfsc.uk) by us2.outbound.mailhostbox.com (Postfix) with ESMTPA id 1E0D91827D8 for < >;
Wed, 2 Dec 2020
MIME-Version: 1.0
Date: Thu, 03 Dec 2020
From: British Financial Supervision Commission <admindepartment@bfsc.uk>
To:
Subject: To:
User-Agent: Roundcube Webmail/1.4.8
Message-ID: <3bfbfc378f4fb81eeb54b5e6e4dd2727@bfsc.uk>
X-Sender: admindepartment@bfsc.uk
Content-Type: multipart/alternative; boundary="=_82ea4b398352f4a44caf01bd9465458c"
X-CMAE-Score: 0
X-CMAE-Analysis: v=2.3 cv=ZIypZkzb c=1 sm=1 tr=0 a=JfrsFIBQTnJ3jzNV6393Aw==:117 a=JfrsFIBQTnJ3jzNV6393Aw==:17 a=XJk4dqLi9utdl3l9NBIA:9 a=CjuIK1q_8ugA:10 a=uWlHHwzk4jIA:10 a=m-B_ibXMjQ-hXT_o2jgA:9 a=_W_S_7VecoQA:10 a=QEXdDO2ut3YA:10

--=_82ea4b398352f4a44caf01bd9465458c
Content-Transfer-Encoding: 7bit

[Big Al]

Attn:

Use the link and tracking number to track your shipment tracking details
below-

https:/ /fastlinkdipandcour.com/track.php

Tracking Number:

Regards
Ms Candy Cole

Header:

Delivered-To:
Received: by 2002:a17:90a:1ce:0:0:0:0 with SMTP id 14csp264515pjd;
Thu, 3 Dec 2020 00:47:11 -0800 (PST)
X-Google-Smtp-Source: ABdhPJyJX7Tj07VPLgmBUT1aCVrNNtQ4BLmrIPO5LS+EmJHCRM0HOIdLnwZblVlHYrQavaMuOgnp
X-Received: by 2002:a05:6122:123:: with SMTP id a3mr924842vko.25.1606985231329;
Thu, 03 Dec 2020 00:47:11 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1606985231; cv=none;
d=google.com; s=arc-20160816;
b=Iee2jMAisV5080NNf1w0sO3/K1OFWJq0kqJD11lSlp8NOnn0IhwPCNql4xODghSMr6
jZSJgnlVbj8wLu/ASxpqyMdMGzk/rCaBResGpuvvP2KdHsVRltHPASR3naDHP+/7O2zp
/bgokmO16xmwaiJB1Cz6Ymltnu1gyOHuS+noU5a2iuUtPcwSd4LeWIoYlY/FAiwqH/VC
koUSIGn6gZfWiMYTMs8yAvKHdofmQw3SpUVvZ/Z5XCpjbVrkNc41TMHzdvqPCxzvo0C+
syQ8JD0IA53eJLQcK4XpXcvK3RiroszQyBZevbNVfcj6oxYtVAJSHV2hOwZOFXNIWCge
1rag==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=content-transfer-encoding:message-id:user-agent:references
:in-reply-to:subject:to:from:date:mime-version:dkim-signature;
bh=R8sNqfk14VDamnzxC/cHMCJdAwSuQ84I02iorwxgHws=;
b=ZLnIkCIWFcVsn0B1L5leiYAreEzV20sa1G/AGQT0ItnUO+48N1l2YUAOtOxOYtR37M
B/nYZN9rMGg5lwHP/yZGoqtY4A0h3z9GdzPfyCDIIOQnLoq9/1I6b0yDYzI77F9OyiN/
OSgCMFomLz79ek39PvjM6+VTD3zvccs0Se7ZZViz5ffFpJTi0dTebcY10NMMbCUy0ueV
aHIm+h4DCAI1KnXCACENh3e93gQ6suN2dmJsQ7MwCzC0vTcUWc8DlFXYqewwFl7FaOIW
w1kJVxcSlmDjvhLgy3bqAmtKgrRdnFIBtjHLtStYw5KpKcpTIejRq62tTVCaZ6So+NBB
QEOg==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@fastlinkdipandcour.com header.s=default header.b=iTztnPVK;
spf=pass (google.com: domain of delivery@fastlinkdipandcour.com designates 190.14.39.82 as permitted sender) smtp.mailfrom=delivery@fastlinkdipandcour.com
Return-Path: <delivery@fastlinkdipandcour.com>
Received: from cpanel16.offshoreracks.com ([190.14.39.82])
by mx.google.com with ESMTPS id v22si230280uar.195.2020.12.03.00.47.11
for < >
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Thu, 03 Dec 2020 00:47:11 -0800 (PST)
Received-SPF: pass (google.com: domain of delivery@fastlinkdipandcour.com designates 190.14.39.82 as permitted sender) client-ip=190.14.39.82;
Authentication-Results: mx.google.com;
dkim=pass header.i=@fastlinkdipandcour.com header.s=default header.b=iTztnPVK;
spf=pass (google.com: domain of delivery@fastlinkdipandcour.com designates 190.14.39.82 as permitted sender) smtp.mailfrom=delivery@fastlinkdipandcour.com
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fastlinkdipandcour.com; s=default; h=Content-Transfer-Encoding:Content-Type :Message-ID:References:In-Reply-To:Subject:To:From:Date:MIME-Version:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help: List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=R8sNqfk14VDamnzxC/cHMCJdAwSuQ84I02iorwxgHws=; b=iTztnPVKhWQ+rms9wVPCMmbZp0 qHJyizz/G/xTxhElw4lZXwUgc1NTSGQV8tAH90MCgEIuXAYd81Wbuf4kuUsLWM4uDfS5JYDw6TE4a b30hVmpBZTL+0VVVHEUe8wwnRExUf3oiTns58hIW4gFJpKHkSWN8cQeQB4kcONeUBHBArTcRJWZ6j jorIVAGetva0iyVMk+GYd8ZXZasLMdEZmeJerX21JP2F5P2BPOJ9BYZckSlYYdDiv3R3XfsOGGon7 fZ8SPUGm/U7FD7IfZ7ZxtZP0nWAV4HGxMfrA0lljTY/xHAdXQ2ji2J7tjx5/zVVwQqeSY7XCkJ152 TDM8VKwA==;
Received: from [::1] (port=34266 helo=cpanel16.offshoreracks.com) by cpanel16.offshoreracks.com with esmtpa (Exim 4.93) (envelope-from <delivery@fastlinkdipandcour.com>) id 1kkkGc-000eje-6V for ; Thu, 03 Dec 2020 03:47:10 -0500
MIME-Version: 1.0
Date: Thu, 03 Dec 2020
From: "Fastlink Diplomatic & Courier Services" <delivery@fastlinkdipandcour.com>
To:
Subject: Attn:
In-Reply-To: <CABd=3yjjsLT9xOj5NoK4DVuMUGtD_xUoc4WSN3T_e3QTHQRHGQ@mail.gmail.com>
References: <3bfbfc378f4fb81eeb54b5e6e4dd2727@bfsc.uk> <CABd=3yjjsLT9xOj5NoK4DVuMUGtD_xUoc4WSN3T_e3QTHQRHGQ@mail.gmail.com>
User-Agent: Roundcube Webmail/1.4.8
Message-ID: <36af90e2eb6009656d22abdc8feb0f23@fastlinkdipandcour.com>
X-Sender: delivery@fastlinkdipandcour.com
Content-Type: text/plain; charset=US-ASCII; format=flowed
Content-Transfer-Encoding: 7bit

[Big Al]

Attn:

From the status of the shipment, you will see that the consignment has
already arrived your country where the airport authority requires
certification of the consignment to enable it's airlift from the airport
for onward delivery to you.

Do the needful soonest to avoid eyebrow on the consignment.

Regards
Ms Candy Cole

The package status:

ON-HOLD At Detroit Metropolitan Wayne County Airport for non payment US$1,800 consignment certification. For more information contact us via this email: delivery@fastlinkdipandcour.com

[firefly]

The fake site used in fraud claims to be the British Financial Supervision Commission and used the domain name bfsc.uk.

The scammers stole the name and location from The Financial Supervision Commission, the financial regulator of the Isle of Man that merged in 2015 with the Insurance and Pensions Authority to form the Financial Services Authority (IOMFSA).

There is no content, the domain name is used only for the email address.

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=147240.

From the domain name registration:

Domain name:
bfsc.uk

Data validation:
Nominet was not able to match the registrant's name and/or address against a 3rd party source on 01-Dec-2020

Registrar:
PDR Ltd. d/b/a PublicDomainRegistry.com [Tag = PDR-IN]

Relevant dates:
Registered on: 01-Dec-2020
Expiry date: 01-Dec-2021
Last updated: 01-Dec-2020

Translating, the fake authority was created a day before the message posted above was received...

[Big Al]

Attn:
Send the $1,800 consignment certification fee to the banking details
below and provide evidence via this medium.


Bank Name: Regions Bank
Bank Address: 5858 w Northwest Hwy, Dallas, Texas 75225 USA
Account Number: 029763XXXX
Routing Number: 111900785
Swift Code: UPNBUS44
Account Holder: Peter B.
Address: Dallas, Texas 75231


Regards,
Ms. Candy Cole
For Delivery Department
Fastlink Diplomatic & Courier Services.

[Big Al]

Attn:

I forgot to let you know that we also have 2 methods of payment which
are by-

1) Ebay Gift Card , Google Play Gift Card or American Express Gift Card

2) Bitcoin

Regards
Ms Candy Cole

[Big Al]

Attn:

After the payment is made to the banking details provided to you, do
scan and send the receipt via this medium for record purpose so that we
will can follow up the consignment certification process at the airport
for onward delivery to your doorstep.

Regards
Ms Candy Cole

[Big Al]

Attn:

I don't understand why the transaction failed because we received some
funds in that account on friday anyways, you can send to this other
banking details below

Bank Name: BB&T Bank
Bank Address: 7 E.Congress St, Savannah, GA 31401
Account Number: 111001834XXXX
Routing Number: 061113415
Swift Code: BRBTUS33
Account Name: A. D.
Address: Savannah, GA 31401


Alternatively, you can enter any store and use the $1,800 to purchase
Ebay Gift Cards, $100 each, scractch and send via this medium.

We have to be fast on this payment process to avoid accumulated demo
rage at the airport.

Regards
Ms Candy Cole

[Big Al]

15th December, 2020

TO WHOM IT MAY CONCERN

At the instance of Agent Larry Selznick of Fastlink Diplomatic And Courier Services, we are write to inform to whom it may concern that we placed on-hold a consignment addressed to xxx

The consignment has been on-hold since the 25th November for certification which will soon become an offense liable for the penalties of money laundering and anti-terrorism crimes as stipulated in the international criminal court charters.

The consignment and Agent Larry Selznick are currently under our custody until the certification is secured or the addressee of xxx is physically present to face our panel for subsequent prosecution.

This information is to be treated with dispatch.

Yours Faithfully,
Erica Donerson
Spokesperson
Detroit Metropolitan Wayne County Airport
Detroit, MI 48242, United States

Header:

Delivered-To:
Received: by 2002:a17:90a:1ce:0:0:0:0 with SMTP id 14csp4189293pjd;
Tue, 15 Dec 2020 07:25:10 -0800 (PST)
X-Google-Smtp-Source: ABdhPJwzUFs843D7nH1PmcTIdLThWmP32TsUC45CjxclJIdEKeOjmYSM4z7CCCq+YAU9rAt0VV8M
X-Received: by 2002:aca:b145:: with SMTP id a66mr22086416oif.92.1608045910083;
Tue, 15 Dec 2020 07:25:10 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1608045910; cv=none;
d=google.com; s=arc-20160816;
b=YE017j9P7Ssyw5sKE3wO0HrWTzdTYhXmFsKXW4MCu55NKjMVMslTU7Kqu9nof0TgDs
5cvzDZfOKkY3sb0xBth4o+m8fKSzXmvreh8SFN4eRK13H9RAmTjo8OsFqbt/FZtuo2+6
W2o0DEoSAIExj6LEFZ7TKCLD1Pu3iAw9FCcZRMgFSArYhsngxSSBUvdG+vmJyqTijSF5
BafhTXKB8moC/hCUzWjS0+PS8Y3z9xEARpAkCxeJrz934beSY80Rrk9qifcP+UOOPh2u
1mB6qj6Hez9uhUbgo7gEKosBiNul0+MGwK4qSMfN3CO4EABxOsdvBvrMge4CiHbI/R1i
vCEA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=message-id:user-agent:subject:to:from:date:mime-version;
bh=FK3F7BjOFeDxztqTTsJmHoVV/YaAllsp0/TRwGl/P3A=;
b=xg9DClDHMhiegEkPVEUNtAGTBSrnin/n20Q4dYQXQuSTvG/35daqigJ/N6V1QMEmFy
BvjS5XIE63amumwhrNlWMSD5rUIULW/Ed7C0ilLDJW+XIp2Yu9xjPOILNlVdA20Xjglp
5eoyGeBIMeMdTcQ579/r46ulbIDNhaFzyMvKFxbo5HktZs28E86WI2edgczdE3ogStEU
S8UbYVbn/XQiY8ApcCpgHhI0TrceanhHkbMHzKyntyO8NFT3VdeptkMXKUmR4/m13xhT
1firc/2f4+pi74QItkVmm/2KoC7/jDXCHQaHuXCqL1CJbLYoWs7b2uH/h+RyXLmjitFT
BV/w==
ARC-Authentication-Results: i=1; mx.google.com;
spf=pass (google.com: domain of admin@airportauthority.info designates 208.91.199.207 as permitted sender) smtp.mailfrom=admin@airportauthority.info
Return-Path: <admin@airportauthority.info>
Received: from us2-ob2-6.mailhostbox.com (us2-ob2-6.mailhostbox.com. [208.91.199.207])
by mx.google.com with ESMTPS id f141si841230oib.74.2020.12.15.07.25.09
for < >
(version=TLS1 cipher=AES128-SHA bits=128/128);
Tue, 15 Dec 2020 07:25:10 -0800 (PST)
Received-SPF: pass (google.com: domain of admin@airportauthority.info designates 208.91.199.207 as permitted sender) client-ip=208.91.199.207;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of admin@airportauthority.info designates 208.91.199.207 as permitted sender) smtp.mailfrom=admin@airportauthority.info
Received: from localhost (unknown [162.215.254.242]) (Authenticated sender: admin@airportauthority.info) by us2.outbound.mailhostbox.com (Postfix) with ESMTPA id 8597F78347E for < >; Tue, 15 Dec 2020 15:25:09 +0000 (GMT)
MIME-Version: 1.0
Date: Tue, 15 Dec 2020
From: Airport Authority <admin@airportauthority.info>
To:
Subject: Attn:
User-Agent: Roundcube Webmail/1.4.8
Message-ID: <10adfbab0865fa7251a3e058a97a897e@airportauthority.info>
X-Sender: admin@airportauthority.info
Content-Type: multipart/alternative; boundary="=_8174ae0515035a1f838ccb184a514a70"
X-CMAE-Score: 0
X-CMAE-Analysis: v=2.3 cv=CvDBjUwD c=1 sm=1 tr=0 a=iNOZLxpNB2GopJmLYlOJDQ==:117 a=iNOZLxpNB2GopJmLYlOJDQ==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=H2UCuQ38OwoA:10 a=ZZnuYtJkoWoA:10 a=3ciL_MMWSPM1S38vZYgA:9 a=CjuIK1q_8ugA:10 a=eFKdQQt1m9szPdobGUwA:9 a=_W_S_7VecoQA:10 a=QEXdDO2ut3YA:10 a=pHzHmUro8NiASowvMSCR:22 a=xoEH_sTeL_Rfw54TyV31:22

--=_8174ae0515035a1f838ccb184a514a70
Content-Transfer-Encoding: 7bit