Google User Award Grant - helpdesk@xanthakiis.com

[Big Al]

Payment details ...

Account Name : S. T.
Account Number : 4203204XXXX
Routing number: 321171184
Bank Name : Citi Bank
Bank Address : 700 Bellevue Rd Atwater, CA 95301 United state

Use this now and get back to me I'm waiting for you here.
Regards,
John Henry.

[Big Al]

Good Day,
How are you today? This is to bring to your notice that we have been mandated to transfer your Google User Award Grant worth $250,000.00. Get Back to me for more information.
Regards,
Kelly Balafia.

Header:

Delivered-To:
Received: by 2002:ab0:7a67:0:0:0:0:0 with SMTP id c7csp4370187uat;
Mon, 20 Dec 2021 06:42:31 -0800 (PST)
X-Google-Smtp-Source: ABdhPJyiyWVvOSCMHKBc1T9Cw1mo7gOrJiptvcHPZQlFOjYApZwt2xTlXib7xMV2z6tCkkcOBpe0
X-Received: by 2002:a17:903:1103:b0:143:a593:dc41 with SMTP id n3-20020a170903110300b00143a593dc41mr16960374plh.5.1640011351663;
Mon, 20 Dec 2021 06:42:31 -0800 (PST)
ARC-Seal: i=2; a=rsa-sha256; t=1640011351; cv=pass;
d=google.com; s=arc-20160816;
b=XH/ROPdf7TCKC8wJ/A2REXUKlwmkgdViXmw3N6FGFLcd4SDg/4C2mBOTdix6104RDx
thPfBKZ0pZC4agl/Kn4/gcdTOkcUN35dLWkbRAnmMkn6b+CaOypIgG48Om9KAVxAr+kV
xLodUxdB0/2TUd9WS9yNkGiFk5IxDaPZfMebUx1VpXdNPcOaDieQPg/ssApwZB2u4piX
mDg5YexVqyRSq0HPZJVdPLtudFdSvoHaCSb6DOuAIPgHGPbHj23AtjoJKFeSxxrzF3Ro
T8NvNovLemPUaxXA1rJfZzqA2ucpIB+SshO4Nz2VKSIPJz6zCtISBIdd09gi/iFZm8hZ
PH7g==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=user-agent:importance:mime-version:subject:message-id:to:from:date;
bh=mPa6huda09LSz9mkQaB47IIEU2a5rFJP1LT6QX/zSog=;
b=ufRebcF4hUcKGwAU1RCRZC5krNRQaSTvKbXcU8DtE1kPY0aB8GijGCPcXOgpHnvaz5
3A78STrSQ/Whor1FL0+FhCO0w8/ra8wc3VXdEvlB9nLNoVBK8Nybo1PwwEwtbYdv7CUe
0RPd7mcpGeRiYEieJinv5CzX1HZec9XyFbBXEnJBJ+3dWoGHYQ75roEqp0U0PBPdL2r6
pCAKmmdxVceV8ySGir8lQD/8k29h8aST9M5Rq++FsYeOPpzvHjWN5s8CUgHBwRKw5Hb7
KT7cX1xEs6dL1l6lkoBsxwGirY5s/XTfsrUlpevql654hSGz1JHL3jSrZ5fLRHflP/OH
PNEg==
ARC-Authentication-Results: i=2; mx.google.com;
arc=pass (i=1 spf=pass spfdomain=rbofc.online dmarc=pass fromdomain=rbofc.online>);
spf=neutral (google.com: 136.143.184.51 is neither permitted nor denied by best guess record for domain of transferdept@rbofc.online) smtp.mailfrom=transferdept@rbofc.online
Return-Path: <transferdept@rbofc.online>
Received: from sender3-of-o51.zoho.com (sender3-of-o51.zoho.com. [136.143.184.51])
by mx.google.com with ESMTPS id x28si21023558pgl.70.2021.12.20.06.42.31
for < >
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Mon, 20 Dec 2021 06:42:31 -0800 (PST)
Received-SPF: neutral (google.com: 136.143.184.51 is neither permitted nor denied by best guess record for domain of transferdept@rbofc.online) client-ip=136.143.184.51;
Authentication-Results: mx.google.com;
arc=pass (i=1 spf=pass spfdomain=rbofc.online dmarc=pass fromdomain=rbofc.online>);
spf=neutral (google.com: 136.143.184.51 is neither permitted nor denied by best guess record for domain of transferdept@rbofc.online) smtp.mailfrom=transferdept@rbofc.online
ARC-Seal: i=1; a=rsa-sha256; t=1640011349; cv=none; d=zohomail.com; s=zohoarc; b=lXou9L/5jFYqJSt56ynpAwvpna3GenFHAO7fgGAfeAnT6BhLlQb/idWhJAHdzLtIOiG+obWrA/NtYKTpFvucNJ7fv1jgWSVb+bXlFA3zohGwzVL7PmEHfBXupwVHjaFBlJGH4St5F8R+TWUi0Ko34RkbwMfsIcdJEBqe2cPar+8=
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1640011349; h=Content-Type:Date:From:MIME-Version:Message-ID:Subject:To; bh=mPa6huda09LSz9mkQaB47IIEU2a5rFJP1LT6QX/zSog=; b=lIKNZ1TgNdkaLa88FDf/kEry0f3QcNyPMQsisgJZAeFN5rP7t1upDyBshyGM/PEEJLKJbyEaLlVfZ6DxybLyVQpfWIxZS4e5qjq0apiirBniGmZ1itoblR+/VPm5pElDcyUdSYdzQIVO2m+AoipBgwTLMiuUIVNvpz7SsvH/XvY=
ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass
smtp.mailfrom=transferdept@rbofc.online; dmarc=pass header.from=<transferdept@rbofc.online>
Received: from mail.zoho.com by mx.zohomail.com with SMTP id 1640011347268483.41905144519797; Mon, 20 Dec 2021 06:42:27 -0800 (PST)
Date: Mon, 20 Dec 2021 15:42:27 +0100
From: RBC Online <transferdept@rbofc.online>
To:
Message-Id: <17dd84b349c.da47d8b5582679.9021864373149419403@rbofc.online>
Subject: HELLO
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_Part_1841422_1908756372.1640011347100"
Importance: Medium
User-Agent: Zoho Mail
X-Mailer: Zoho Mail

------=_Part_1841422_1908756372.1640011347100
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit

Orig IP: 136.143.184.51 | Orig ISP: Zoho-as | City: n/a | Country: United States

[Big Al]

I still await your response regards to the payment. Update me now .
Regards,
John Henry.

[Big Al]

OFFICIAL NOTIFICATION LETTER

Your details was forwarded to me by Kelly Balafia from FUNDS RECORVERY UNIT.
It is obvious that this notification will come to you as a surprise but please find time to read it carefully as we congratulate you over your success in the following official publication of results of the E-mail Electronic Online Sweepstakes Organized by Google, in conjunction with the foundation for the Promotion of Software Products, (EPS) held in UK for the year 2021.

We wish to congratulate you again, for being among the Twelve (12) winners in the ongoing end of year Google user award, E-mail Electronic Sweepstakes. Bank Check have been issued in your favor, hence you have won for yourself the sum of 250,000.00. Two Hundred and Fifty Thousand Dollars. You have also been enlisted as One of the Google Ambassadors for 2021.

We have two methods of sending you your money, One is a direct wire transfer to your account.
The other is we set up an online account for you here in our Bank, then deposit the entire money into it, Then give you the log in details to enable you transfer the money to your account by yourself. So if it's direct wire transfer you need. Send down your account details and also these bellow informations for proper documentation.

Your full name:
Your Contact Address:
Your Contact Telephone Mobile Number:
Your Nationality Country:
Regards,

[Big Al]

We will go for direct deposit. I will update you soon.

Good day,
In response to your email regarding the final process of your claims. On the attached file is the legality of funds certificate and also my working Id card for recognition. This document certify you to use this money freely as soon as it enters your account without any interference of any financial laws.


Before we will effect that transfer you will have to pay $1300 for Proof of funds certificate and International Funds Transfer Approval Order Clearance Certificate. From the Foreign affairs Department. As soon as this payment is made you are to send down your account detail for immediate funding.

You are to get back to me immediately so we can proceed.
Regards,
John Henry.

[Big Al]

Let me hear from you now, reconfirm to me you got the account details an tell me your plans we have just today and tomorrow to conclude your transfer. If nothing happens today or tomorrow, then that will be from 27th. Update me now and tell me the plans.
Regards,
John Henry.

[Big Al]

Account Name : S. T.
Account Number : 645697XXXX
Routing number: 121042882
Bank Name : Wellsfargo Bank
Bank Address : 420 Montgomery street, CA United state

As soon as you send get me the scanned copy of the payment slip to forward to them, so they can send us the needed documents to conclude your transfer today.
I await your response.
John Henry.

If you got the account details I sent to you, do not make any pàyment till on 28th. And update me when you are ready for the payment because the payment information might change from 28th. We are on holidays now. Merry Christmas.
John Henry.

[firefly]

The fake site used in scam claims to be the Royal Bank of Canada.

From the fake bank website:

Our history began in 1983 with a group of International Business Owners that decided national banks were unable to fulfill their lending needs due to their unique business conditions. The national banks stayed away from the large acreage, hobby farms, horse farms, non-electrified homes, unique properties and rural properties that dot the countryside. Therefore, these local businessmen decided to join together and create a bank where financial decisions and advice were made locally by people that understood the local environment. Hence, RBC Bank was born.

Contact details:

New York , United States
customercare@rbofc.online
+1-800.898.5999

+18008985999
Number billable as freephone number
Country or destination United States

Entry in the aa419 database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=154389

From the domain name registration:

Domain Name: rbofc.online
Updated Date: 2021-12-21
Creation Date: 2021-11-25
Registrar Registration Expiration Date: 2022-11-25
Registrar: NameSilo, LLC

Registry Registrant ID:
Registrant Name: Domain Administrator
Registrant Organization: See PrivacyGuardian.org

This is what the fake bank website looks like:

[Big Al]

How are you today? I want to know if you have made the payment for your transfer. Our official email has technical issues since yesterday. You are to comunicate with me here directly. Get back to me as soon as possible.
Regards,
John Henry.

[Big Al]

Happy new year, What's the update regards to the payment for your claims? I want you to give me a concrete information on when you will conclude this payment so we can concluded your transfer .
John Henry.