customercare@deutschebnk.com

[Wayne]

Info

Richard Krull <richardkrull12@gmail.com>
Bcc:

Fri, 23 Apr at 14:08

This is to officially inform you that your fund has been deposited at
Deutsche Bank New York. You are by this notice to contact Mr James Von
Moltke on (customercare@deutschebnk.com) for advice and send your
banking details correctly.
Richard

[Wayne]

From James

jamesvon@deutschebnk.com <jamesvon@deutschebnk.com>
To:

Mon, 26 Apr at 14:05

Hi XXXX
We got a credit letter from Africa about your fund $15,5 million USD.
We have to apply and secure your wire approval, so as to sort out your
release documentation, which you shall receive by courier service soon.
A copy of the approval will be sent to you. You will send the fee for
the shipment fee from tomorrow. Send your residential address and cell
now. Send your banking details correctly, also send your Identification
and cell please confirm the receipt of these mail.
James V M

[Wayne]

Fund

George Benson <georgebenson2424@gmail.com>
Bcc:

Sat, 11 Sept at 20:39

This is to officially inform you that your fund has been deposited at
Deutsche Bank New York. You are by this notice required to contact Mr James Von
Moltke on (customercare@deutschebnk.com) +1 315 760 4956 for advice
and send your
banking details correctly. Also send your ID and phone to them. This
is your best opportunity
George

Phone: +13157604956
Number billable as mobile number
Country or destination United States
City or exchange location Syracuse, NY
Original network provider* Sprint Spectrum L.p.

[firefly]

The scammers are impersonating Deutsche Bank.

The fraudulent domain name deutschebnk.com is used only for the email address, as in customercare@deutschebnk.com or jamesvon@deutschebnk.com.

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=153377.

From the domain name registration:

Domain name: deutschebnk.com
Updated Date: 2021-03-08
Creation Date: 2021-03-08
Registrar Registration Expiration Date: 2022-03-08
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC

Registry Registrant ID:
Registrant Name: Withheld for Privacy Purposes
Registrant Organization: Privacy service provided by Withheld for Privacy ehf

The fraudulent domain name is used by scammers operating from Nigeria.

[firefly]

Recovery scam / identity theft.

Before i proceed i will like to introduce myself I am , George Benson
the new appointed Director of Finance in charge of overseeing
the payment of local and foreign beneficiaries of their contract or
inheritance Fund that is due for them approved by the office of the
Presidency and Federal Ministry Of Finance through the office of the
Honorable Minister of Finance.

Note i am writing to notify you that if you are among those
beneficiaries who have not received their fund over the years due to
corruptions that make the process by the past corrupts and
fraudulent officials who were given the responsibilities of paying
beneficiaries like you their fund instead they diverted it for their
own profit and benefit.
Charging beneficiaries unwarranted fees that was not proved, making
it difficult for them to receive their fund, which led to many of them
abandon the pursuit of their fund, and their corruption practices has
painted Nigeria a bad name in the eyes of the International Community.

In this regard I want to inform you today that most of them who have
been in practice have been arrested, prosecuted and sentenced to different
Jail terms. On behalf of the Federal Government Of Nigeria i sincerely
apologies whatever their actions might have caused you.

On this note you are advised to forward me with your full banking information
ID, telephone and exact amount expected.

And as soon as I acknowledge the details requested of you, you shall
be updated on the next step line of procedure on how to receive your
approved fund without any stress.total amount approved for you for an
immediate payment by the Federal Government Of Nigeria is the sum of
$10.5 Million USD only.

You are hereby strictly warned and advise to stop further
communications with any person or group of people who maybe contacting
you either through mail claiming to be government officials
responsible for your payment. Henceforth all correspondence should be
directed to this office for verification and confirmation before
responding.When I receive your details I shall forward them to the
office approved by the government to saddle with the responsibility of
your payment. Call the Zenith Bank Director Peter Olatunde on +234 806 172 1023. The bank has been nominated to carry on the assignment.

Thank you,
Mr Benson

Header:

Return-Path: <georgebenson2424@gmail.com>
From: George Benson <georgebenson2424@gmail.com>
Date: Thu, 6 Jul 2023 14:48:46 +0100
Message-ID: <CAASnMKzDDetkhTKmYxUwt3yFhtKTbh2e046m5dotvm8oCN=k7Q@mail.gmail.com>
Subject: Fund
To: undisclosed-recipients:;

+2348061721023
Number billable as mobile number
Country or destination Nigeria
Original network provider* MTN Nigeria Communications Ltd

[firefly]

Recovery scam.

If you don't want us to handle your wire then go for an online account with our sister bank.
Contact David Contad on support@melidenbk.com
Here is the site (melidenbk.com) register, fill their form completely and attach your photo. You will only pay for the activation which is also your initial deposit. You can transfer yourself.
Update me
George

Header:

Return-Path: <georgebenson2424@gmail.com>
From: George Benson <georgebenson2424@gmail.com>
Date: Thu, 3 Aug 2023 14:25:45 +0100
Message-ID: <CAASnMKw4NP5vVv+SyMevgizexsegpadGg-wCjs8FEWGN_=4Qxg@mail.gmail.com>
Subject: Online

[firefly]

The fake bank used in scam claims to be named Meliden Bank.

From their fake website:

Meliden Bank has stayed Over 36 years of existence and registered US/UK afflicted based financial institution that have been operating in so many countries with a high reputation. Meliden Bank is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority under registration number 293836.

Nedless to say that the registration number or the name of the bank cannot be found anywhere on the Financial Conduct Authority website...

Contact details:

+1 (315) 760-4956
(315) 760-4956
info@melidenbk.com
support@melidenbk.com

+13157604956 - the same phone number was previously reported above, while being used with another fake website impersonating Deutsche Bank, and also here: viewtopic.php?f=6&t=32250 with yet another fake website pretending to be Trust Kaloid Bank.

Entry in the aa419 database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=162695

From the domain name registration:

Domain Name: melidenbk.com
Updated Date: 2023-01-11
Creation Date: 2023-01-11
Registrar Registration Expiration Date: 2024-01-11
Registrar: GoDaddy.com, LLC

Registry Registrant ID: Not Available From Registry
Registrant Name: Registration Private
Registrant Organization: Domains By Proxy, LLC

This is what the fake bank website looks like:

[firefly]

Same recovery scam, new fake bank used.

Dear
You are among the seven beneficiaries listed to be paid a part payment of $14.5 million by the Federal ministry of finance FMF. . You are required to contact Bank of America North carolina on support@boaservices.co or michael@boaservices.co
Send your banking details and contact informations Mr Michael White
Benson

Header:

Return-Path: <georgebenson2424@gmail.com>
From: George Benson <georgebenson2424@gmail.com>
Date: Sat, 12 Aug 2023 20:24:55 -0700
Message-ID: <CAASnMKw-htERp_2oufuhnedPOoNFDowgdm-zKMNPrJvWdQ+8Qw@mail.gmail.com>
Subject: Fund

[Big Al]

Dear
How are you doing? Yes, we have already received a letter of credit to
that effect. Can you send your account name and that of your bank
address. Also send your ID and cellphone. We shall file for your wire
approval letter which can be out by Monday. I will send my
Identification that Monday.
Waiting to read from you.
Michael

Header:

Delivered-To:
Received: by 2002:a05:6130:2183:b0:79a:26ad:d6d7 with SMTP id cm3csp2019178uab;
Sat, 12 Aug 2023 15:39:11 -0700 (PDT)
X-Google-Smtp-Source: AGHT+IGOEzetS+FFGXxY4bb1bhAZ8S/IgB2I2fpjzJwj+wdUt7eSkKyC74LHB8EOnMw8+NEc0NeJ
X-Received: by 2002:a05:6a20:9151:b0:133:bbe0:312f with SMTP id x17-20020a056a20915100b00133bbe0312fmr7585688pzc.50.1691879950919;
Sat, 12 Aug 2023 15:39:10 -0700 (PDT)
ARC-Seal: i=2; a=rsa-sha256; t=1691879950; cv=pass;
d=google.com; s=arc-20160816;
b=EIq1aIWN+7Us9Fg9u2ec/YFnY2z+xsHnMe2iQVvD5XLRJWzinrwbc4k25IyFtqcW6c
jXwyiN7E8VJl57emoZ8xNYojH1y6FZ9mt5/2PL3R8rFZiDnooZvtnyRBQpGZtCrZrG2q
HKAUG8GWiEQzYufKkw0zCLW4sOl8zjhTG8dra8tyHsB0gY706jZ8kQOAV1KrJa8dMao1
egyDbxHCo0i22HCieOqDUrFZoC4lF+1tVobQ6NuWmxOj4RkUt+EHPg7iYJNqxs0IWUYZ
cLohXYvPA4U8S4Ial0xTnFdCnGg6DDnd+S876VJGvGKVmUzPSZmOP0zHDT8lPFHnp6x/
CM4Q==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=content-transfer-encoding:message-id:user-agent:references
:in-reply-to:subject:to:from:date:mime-version;
bh=saiztHcR9yu1+u8WjMkUcWnfUOi3qatD93JI4XWzPnc=;
fh=dK81pJBAvTc2BWrKvJiE6OL/m4GrhywNhliWII0rOos=;
b=a2fX4vClzmZrHK7fHYVDDwCwInjZm9YOR0onFawC/p/2yuVk96PnLwJXazyaqBbsTK
iZgUmhR68MFC2wiv+wAKwGflwhGb58tLGmIlnqkgGtWKigZLdKua4OQkj1UjFWMlpJWY
EPEOPQ7LCGm1Alh8ZxS2MJpmdpf4qsVuBni/vcSqu1O8Euf030FNfuQZU/k52eNEesDn
vi/vNozlG1qTGnH1ID/gVRuGFvR8LhAVFCj5aEIzHLVturW1MDh6sNS0I4rBK9XyA2yE
Xbtp0YGNxnnnGkf3inqcdOCaPt4vMjR5QGs5gsYqjT1EahCGqM9+cMUl0bp7OzdZffsK
DDzw==
ARC-Authentication-Results: i=2; mx.google.com;
arc=pass (i=1);
spf=pass (google.com: domain of support@boaservices.co designates 23.83.209.24 as permitted sender) smtp.mailfrom=support@boaservices.co
Return-Path: <support@boaservices.co>
Received: from buffalo.birch.relay.mailchannels.net (buffalo.birch.relay.mailchannels.net. [23.83.209.24])
by mx.google.com with ESMTPS id g6-20020a056a0023c600b006875eb8b080si5691583pfc.244.2023.08.12.15.39.09
for < >
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Sat, 12 Aug 2023 15:39:09 -0700 (PDT)
Received-SPF: pass (google.com: domain of support@boaservices.co designates 23.83.209.24 as permitted sender) client-ip=23.83.209.24;
Authentication-Results: mx.google.com;
arc=pass (i=1);
spf=pass (google.com: domain of support@boaservices.co designates 23.83.209.24 as permitted sender) smtp.mailfrom=support@boaservices.co
X-Sender-Id: whogohost|x-authuser|support@boaservices.co
Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 47302500C5C for < >; Sat, 12 Aug 2023 22:39:09 +0000 (UTC)
Received: from wgh13.wghservers.com (unknown [127.0.0.6]) (Authenticated sender: whogohost) by relay.mailchannels.net (Postfix) with ESMTPA id A3621500C33 for < >; Sat, 12 Aug 2023 22:39:07 +0000 (UTC)
ARC-Seal: i=1; s=arc-2022; d=mailchannels.net; t=1691879947; a=rsa-sha256; cv=none; b=rCiSkhc2Q3LCTY4HggMJUpQEWmB0iBwlCekCEvQS7HpO741BzV1B9eH0CeapnhIb6+sfEE bBKwMa8IJOFBSn0Cq/UDjJ2FNyClvSWAqS2JzYIwmt45YbhihsC64uh7ebcHzwapeA52v9 of3tHg9IUs8T0JsOe6lYkYiJuVCxrjE6OD9THqMAGI7qZTvVV/Gws/avuXFM6f+jQ27JAU yn4Kt3Q6nBlBYYUo2jaxUOw6s/ARgP4MYWuZ+VmTZ5B8/mmWbcJYt89tN5vkzKKrwTc1UE oMGUVsFncrXAW6FpRIr2CbN5ZyaVwoeIEbsi3kAcJ0OICSRJYCzKUUiuHX+cIg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1691879947; h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
to:to:cc:mime-version:mime-version:content-type:content-type:
content-transfer-encoding:content-transfer-encoding:
in-reply-to:in-reply-to:references:references; bh=saiztHcR9yu1+u8WjMkUcWnfUOi3qatD93JI4XWzPnc=; b=N1oUvIsz1rTy1C3Mig6tb2/vNKF7GaXYuTo4nVpPzeoXjkAo0XaLxIgZCXWRF/DK8RtX4D EBUzX7DnMMIqwKiVKNk+vblJlgRrFlFrbgJ7Q2JykKptA8us1rGhBnTJCP6fr+O4B0rv9u zZ1Wr14QYAg8q9ZlDnTGwKKEpezknB3MIxZBPWZ7VM1AKsQLjHHiuH6V0izQyqP291wsyz /3P/fwqeJkgjVV51qXVUqS0tr17aUiIrFwHK26ufOpwQQSZ0bKZx+h4NfiQev3eRgGZUX4 a0MG2eGp8M38dnkpRRHDw0rGllWnjGwlXpqcA8Da/REfPDuBUtJc+GVu+qFi0w==
ARC-Authentication-Results: i=1; rspamd-849d547c58-nlzvg; auth=pass smtp.auth=whogohost smtp.mailfrom=support@boaservices.co
X-Sender-Id: whogohost|x-authuser|support@boaservices.co
X-MC-Relay: Neutral
X-MailChannels-SenderId: whogohost|x-authuser|support@boaservices.co
X-MailChannels-Auth-Id: whogohost
X-Thread-Vacuous: 7e93a71f59ae0159_1691879948012_483980745
X-MC-Loop-Signature: 1691879948012:2092964101
X-MC-Ingress-Time: 1691879948011
Received: from wgh13.wghservers.com (wgh13.wghservers.com [192.3.137.194]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384) by 100.110.206.19 (trex/6.9.1); Sat, 12 Aug 2023 22:39:08 +0000
Received: from [::1] (port=33660 helo=wgh13.wghservers.com) by wgh13.wghservers.com with esmtpa (Exim 4.96) (envelope-from <support@boaservices.co>) id 1qUxGG-002Vjt-2c for ; Sat, 12 Aug 2023 23:39:06 +0100
MIME-Version: 1.0
Date: Sat, 12 Aug 2023 23:39:06 +0100
From: support@boaservices.co
To:
Subject: Re: FW: Fund
In-Reply-To: <CAG7vLpxiHuJM-KwGVo=sQTA24qjPB0C8_5dbasUpYhEHy2tcFw@mail.gmail.com>
References: <CAG7vLpxiHuJM-KwGVo=sQTA24qjPB0C8_5dbasUpYhEHy2tcFw@mail.gmail.com>
User-Agent: Roundcube Webmail/1.6.0
Message-ID: <52ba2e824b430aa2a312ed28ea93ed00@boaservices.co>
X-Sender: support@boaservices.co
Content-Type: text/plain; charset=US-ASCII; format=flowed
Content-Transfer-Encoding: 7bit

[Big Al]

Hello
We are still waiting for your Bank address and account name to proceed
with the securing of your wire approval. Do send it as soon as you get
this mail.
Thank you
Mich