info@fxcourier.us

[Big Al]

Dear

Be informed that your ATM Card with the documents has left our office to
the destination. You are advised to always track the shipment to know
when it will arrive at your address.

You are advised to copy the website below and paste to your browser
and follow the instruction with the Tracking

Number THE NAME OF THE COURIER COMPANY IS: FX COURIER SERVICE

WEBSITE: https:/ /fxcourier.us
Tracking Number: FX1631696XXXXX
Thank you for using FX Courier Company Services.

Yours Sincerely.
Edwin Clark.
Admin Customers Service.
FX Courier

Header:

Delivered-To:
Received: by 2002:a17:90a:5206:0:0:0:0 with SMTP id v6csp326797pjh;
Wed, 15 Sep 2021 02:29:50 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJwJagmjQp1MelH8f/hMVzX1k+yrhZyQ2xByNGzCTcki1A3c9ckGHfUfWuqgTYkzR4IAmfUq
X-Received: by 2002:a5d:6551:: with SMTP id z17mr3871674wrv.414.1631698190335;
Wed, 15 Sep 2021 02:29:50 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1631698190; cv=none;
d=google.com; s=arc-20160816;
b=c1CJNPdxrUQd+ONutOEPXTzCsU/S8Cnu4U87/GpjdGdy6FC+HbawSZ8WFugENIf4Jc
SZhIaJnF6p7gT1yyNH/j0ic5fkHMMNegHAk5PIV8OlEM84iY7sxaCcdY3BS3Cm1PIY0V
vvp6atk60+uoWukYWN7EvDzdb8X0D5dLLhTjtaFc/XNn4hx3k+5oJ2sX+QKWqbd3LaXW
4faNG+mecCQdbrY3sU8ECuhtEdiXcV499WpQl8GaXTPuIJGB2qKsnq4LAYxAvnH9o07X
ghXbRTrGJkY7HASIi6b2xk/5iZjpjZbl0XpcrzNAC83Jy60qAt8p/1TvYWmRYOCPu3vx
egdw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=content-transfer-encoding:message-id:user-agent:subject:to:from
:date:mime-version:dkim-signature;
bh=Dy1zsj98jg3LtqViXuEjyVu+ptMspY9SbZWU9zNV3aI=;
b=mOd1icf1ijA01obm71gLQWdywTA1HdoOlzjCy3WQ4XgHHK6nnqCTODXSClGnuL2yc7
8c+dRd5JkMroTLAjqBBrYPOjBgajjq/UNqk8/i9XpojsnR5CBBXJo6M+uDKSHJoJGkgK
JAgOuDWC/zroH3qK0t7esTXtIf53sWAs/tTvuMw4XlM6FpcaFbDK6NGGBC8qqCYM3hIO
YgxSVWVRfaqO4W2mop+2q++8VmfY5TLHKNu3ip7UnuUYTOO17ks3anzKDW9VPBGRgA4s
YMls5dIy9tHsdcf/U8XB6HjxQR8vsIb2dt7e32wpbFQbfkXE6BVbHhzhiGhKkPpUpgyT
UgcA==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@fxcourier.us header.s=default header.b=YmJeieUw;
spf=pass (google.com: domain of info@fxcourier.us designates 145.239.3.48 as permitted sender) smtp.mailfrom=info@fxcourier.us
Return-Path: <info@fxcourier.us>
Received: from lim106.truehost.cloud (lim106.truehost.cloud. [145.239.3.48])
by mx.google.com with ESMTPS id v20si2878583wrf.349.2021.09.15.02.29.49
for <>
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Wed, 15 Sep 2021 02:29:49 -0700 (PDT)
Received-SPF: pass (google.com: domain of info@fxcourier.us designates 145.239.3.48 as permitted sender) client-ip=145.239.3.48;
Authentication-Results: mx.google.com;
dkim=pass header.i=@fxcourier.us header.s=default header.b=YmJeieUw;
spf=pass (google.com: domain of info@fxcourier.us designates 145.239.3.48 as permitted sender) smtp.mailfrom=info@fxcourier.us
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fxcourier.us; s=default; h=Content-Transfer-Encoding:Content-Type: Message-ID:Subject:To:From:Date:MIME-Version:Sender:Reply-To:Cc:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=Dy1zsj98jg3LtqViXuEjyVu+ptMspY9SbZWU9zNV3aI=; b=YmJeieUwQgcX4ThPMruoy8kqS3 kStdpfEDLcrJ4chCskeluNApyep8YFsHnqJzuQDCKuQGjKBItDqEF4Q2RT7QZYbv8pu2DFzsWbhAR NQOeBWBZVwtIDBQgpcFRcwlf2FeXfajpjI0epPX43rCa8uqqenSG3ZYmqvdY9PMcjtEK2GHXdphpn X81lz3qAa+Do6S0Yxl5dkdYAR61rAjzf/iiooT4dMNtEW2b5HpldLCtng+cRYAERB8it6eanXgBTv CAjUtGYJd6HK0NAus3NkMnQWziTklwoaCh3gQJcuqHEhEFXBMjCarmSCju4Wg5qI5+pN1Rj2N1jfV weE1HWSw==;
Received: from [::1] (port=48188 helo=lim106.truehost.cloud) by lim106.truehost.cloud with esmtpa (Exim 4.94.2) (envelope-from <info@fxcourier.us>) id 1mQREj-0004jd-L9 for; Wed, 15 Sep 2021 09:29:48 +0000
MIME-Version: 1.0
Date: Wed, 15 Sep 2021 09:29:48 +0000
From: info@fxcourier.us
Subject: FROM
FX Courier Company Services.
User-Agent: Roundcube Webmail/1.4.11
Message-ID: <2bb0af7b2b8749dd83cfe5d1076ae62b@fxcourier.us>
X-Sender: info@fxcourier.us
Content-Type: text/plain; charset=US-ASCII; format=flowed
Content-Transfer-Encoding: 7bit

Orig IP: 145.239.3.48 | Orig ISP: Ovh Sas | City: n/a | Country: Germany

[firefly]

The fake delivery company claims to be FX Courier / Sunrise Shipping.

From the fake website:

We take pride in being regarded as one of the most reliable and affordable logistic and warehousing service providers in the country. As a third party logistic service provider, we excel at a range of logistic services, which includes trucking services, warehousing services, logistic services, and a range of other ancillary services. We have years of experience in the business of logistics, warehousing, distribution, trucking and supply chain management services, and aim to provide our clients with convenience, reliability and affordability through our premium logistic services.

Sunrise Shipping Compnay is one of the world’s largest provider of ocean freight services. In 2013, we expedited nearly 1.5 million TEUs via ocean freight. The company’s relationship with customers is moving away from purely transactional business to value-added propositions.

Contact details:

1667 K Street NW,
Washington,
DC 20006, USA
Email: info@fxcourier.us
Tel: +1 202 503 1901

+12025031901
Number billable as geographic number
Country or destination United States
City or exchange location Westchester, DC
Original network provider* Cbeyond Communications, Llc - Dc

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=153068.

From the domain name registration:

Domain Name: fxcourier.us
Updated Date: 2021-07-02
Creation Date: 2021-06-27
Registry Expiry Date: 2022-06-27
Registrar: NameCheap, Inc.

Registry Registrant ID: CE62F000815004E1690DF072C0973658E-NSR
Registrant Name: John Rae
Registrant Street: 3415 Jenna Lane
Registrant City: Des Moines,
Registrant State/Province: Iowa
Registrant Postal Code: IA 50309
Registrant Country: NG
Registrant Phone: +1.515203986
Registrant Email: fast.weight09@gmail.com
Registrant Application Purpose: P1
Registrant Nexus Category: C11

This is what the fake courier website looks like:

The email address fast.weight09@gmail.com is reported online since 2010 for being used to register fake websites.

[Big Al]

Dear

This is to inform you that your package has arrived At John F. Kennedy
International Airport New York United States of America At 7:08 Am
package on-hold by the Security Agents demanding for Fund Declaration
from the US Treasury Department before they will allow us to deliver to
your receiving address.

So you are hereby advised to get back to this office upon receipt of
this message to enable us obtain the needed Clearance. And the cost of
the Clearance is $1,77.00.

Awaiting your immediate response.

Yours Sincerely,

Edwin Clark

[Big Al]

Reference to your last email, your ATM Card is still with the Security
Agent at your International airport and the officials are still
demanding for the clearance. You should therefore hasten up to raise the
US$1,770 required so that we can obtain the Clearance and forward it to
the Security Agent at the airport for the immediate release of your ATM
Card.

You should try and raise US$1,000 and I will help you with the US$770.
You should send the money through the bank account information that I
sent to you or through the Bitcoin wallet address that you have already.

We are giving you 48 hours to finalize this or we return the Card back
to UK.

Thanks,

Edwin Clark

[Big Al]

Sir,
you are advise to send the $1,770 through bank transfer with the account
information below.

Bank Name: Bank of AMERICA
ACCOUNT NAME: Q. M.
ACCT NUMBER: 33406219XXXX
ROUTING NUMBER: 061000052
SWIFT CODE: BOFAUS3N
BANK ADDRESS: 152 PLEASANT HILL ROAD DULUTH GA 30096

Go to back immediately and transfer the $1,770 united state dollars. and
send me the payment slip.

Thanks,

Clark.

[Big Al]

Dear

We received your email, send me the payment slip as soon as you make the
transfer tomorrow

Yours Sincerely.
Edwin Clark.

[Big Al]

Dear sir,
You are advised to send the fee through Western Union Money Transfer in
Two ways $1,000 and $770 with the same name below information.

Receiver's Name: Q. M.
Address: matine GA 30557 USA ($1,000)

Receiver's Name: Q. M.
Address: matine GA 30557 USA ($770)

and send the payment information to us as soon as you send the money.

or you can send the money through our Bitcoin wallet address below.

Address; 1AgHDhj5t6xcd2jBbL4xfDfBAYcx2VkjBg

and send the screenshot of the transaction.

Yours Faithful

Edwin Clark.