A bank scam that goes to ponyfarm...

If my bank has a problem with my account, they call me. They even call me when they want to offer a bad deal of a visa for the 11th time a year, just to check if I'd be interested in it now. But no real bank would ever email me (and never to undisclosed recipients for sure) - and I've never even been in a Alliance & Leicester bank - so good, they can glady keep the acount I don't have, blocked.

Internet Banking Access Blocked
From: "Alliance & Leicester Internet Banking Service"
To: undisclosed-recipients

Dear Valued Customer,
We use the very latest industry-standard technology, plus multiple levels of security to safeguard your personal and transaction details, so that you can bank online with confidence.
We are committed to continually developing our security systems to ensure that Internet Banking remains safe and secure. We hope that you will also take the necessary precautions to protect your computer and your personal security details.
Internet Banking access blocked. For your protection Internet Banking access to your accounts has been blocked. Your security details have been incorrectly entered 3 times. Please follow the reference below and you will be guided to where you can instantly To re-establish access.
Log in to Internet Banking
it will only take about five minutes.

Thank you.
Online Banking Security Team

"Service" means the Alliance & Leicester Internet Banking Service We provide which enables You to give Instructions to Us relating to Your Account by logging on at www.alliance-leicester.co.uk or alternatively https://www.mybank.alliance-leicester.co.uk
"We" / "Our" / "Us" means Alliance & Leicester plc

The domain they direct you, www.cv-ponyfarm.de, for sure isn't owned by a UK bank, but the German whois queries returned only MS server errors.

Banca di Roma scam

From: servizi.clienti@bancadiroma.it
Subject: Oggetto: Comunicazione nr. 53841 del 13 08 2007 - Leggere con attenzione
Date: August 13, 2007 7:24:38 AM GMT+01:00
To: 5@lora.pns.networktel.net
Return-Path:
Received: [...] from lora.pns.networktel.net (jor-l.pns.networktel.net [216.83.236.236]) by isp (Xserve/smtpin026/MantshX 4.0) with ESMTP id l7D6LjD2006504for [email]; Sun, 12 Aug 2007 23:21:45 -0700 (PDT)
Received: from server2k.corp.landcrafters.com (72-12-63-158.wan.networktel.net [72.12.63.158])by lora.pns.networktel.net (8.13.6/8.12.11) with ESMTP id l7D6IShr008859; Mon, 13 Aug 2007 06:18:34 +0000 (GMT)
Received: from User ([71.251.120.98]) by server2k.corp.landcrafters.com with Microsoft SMTPSVC(5.0.2195.6713); Mon, 13 Aug 2007 01:19:34 -0500
Message-Id:
Mime-Version: 1.0
X-Mimeole: Produced By Microsoft MimeOLE V6.00.2800.1081
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
Content-Type: text/html; charset=Windows-1251
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-Msmail-Priority: Normal
Original-Recipient: [my email]
X-Originalarrivaltime: 13 Aug 2007 06:19:34.0234 (UTC) FILETIME=[EAB853A0:01C7DD71]


Gentile Cliente,


Il codice segreto del suo conto on-line e stato inserito incorretto piu di tre volte.
Per proteggere suo conto abbiamo sospeso il acceso.
Per recuperare il acceso prego di entrare e completare la pagina di attivazione.

Se scegliete di ignorare la nostra richiesta, purtroppo non avremo altra scelta che bloccare temporaneamente il suo account.

Grazie ancora per aver scelto i servizi on-line di Banca di Roma.



Banca di Roma garantisce il corretto trattamento dei dati personali degli utenti ai sensi dell'art. 13 del D. Lgs 30 giugno 2003 n. 196 'Codice in materia di protezione dei dati personali'.


Considerazioni migliori.

With a few images added for the authentic look.

Sure, Banca di Roma obviously uses some shady cox.net scriptkiddy address for authentication...

'Standard Bank' in 'Southafrica' with someone trying to offer you $ 52m...

From: frank.mark1@zipmail.com.br
Subject: Good day,
Date: July 17, 2007 2:20:01 AM GMT+01:00
To: frank.mark1@zipmail.com.br

Good day,

Thanks for finding time to read this proposal. After thinking about this
transaction and the need to make contact with someone to assist me do it,
I found it interesting and decided to contact you for this business transaction.
Be so kind to contact me at your earliest convenience for a possible business
deal involving money transfer of about $52,000,000.00.

I am presently in Southafrica working as an Auditor General with the below
bank at their offshore department. With your sincere assistant and co-operation,
I am determined to work this deal out if we can do business. As at this
moment, I am constrained to issue more details about this business until
your response is received.

If you are not familiar with the above information which I believe is scanty
for security purposes, please contact me for further details.

This deal is worth taking and highly profitable. Thank you for your time
and attention.

Do redirect you positive response to my private email: frankmark_private@yahoo.com


Warmest regards,
Frank Mark
........................

..........................................
Auditor General,
Dept.of Offshore Mortgage Services,
Standard Bank,
Southafrica

Uh, sure. Talking so openly about scamming the bank he works for $ 52 million, and can't even spell South Africa crrectly. And 'Standard Bank'? That has got to be the worst name for a bank ever, you'd think that even an advance fee scammer would be able to be a bit more creative...

SunTrust Bank phishing attempt

From: businessservice.ref73250944520406.nf@suntrust.com
Subject: SunTrust Bank: please confirm your online banking records! (message id: 83603923766)
Date: July 14, 2007 8:55:46 PM GMT+01:00
To: [someone else's email]
Return-Path:
Received: ... from 23.pool85-59-64.dynamic.orange.es (23.pool85-59-64.dynamic.orange.es [85.59.64.23]) by [isp] (Xserve/smtpin49/MantshX 4.0) with SMTP id l6EJtk2u014914; Sat, 14 Jul 2007 12:55:48 -0700 (PDT)
Received: from never.kellychen.com (manley.kellychen.com [14.88.204.68]) by kerio.com with SMTP id 2HVQ0190FT for [that other user's email]; Sat, 14 Jul 2007 12:55:43 -0800
Message-Id: <200707141955.l6EJtk2u014914@mac.com>
Mime-Version: 1.0
X-Mailer: Microsoft Internet Mail 4.70.1155
Content-Type: multipart/alternative; boundary=--1UZQ6E4EO_WCCZXUU2IVA361
X-Priority: 3 (Normal)
X-User_Ip: 24.114.1.202
User-Agent: Microsoft Internet Mail 4.70.1155
Original-Recipient: [my email]

Dear SunTrust Bank customer,

SunTrust Client Service Team requests you to complete Online Treasury Customer Form.

This procedure is obligatory for all business and corporate clients of SunTrust Bank.

Please click hyperlink below to access Online Treasury Customer Form.

http://onlinetreasurymanager-id7365548.suntrust.com/ibswebsuntrust/cmserver/customer.cfm

Thank you for choosing SunTrust Bank for your business needs.

Please do not respond to this email.

This mail generated by an automated service.

__________________________________________________________________________

0x99, 0x3, 0x3796, 0x1, 0x3 media hex U1L S5Z rev 8PG RAR 9UD U3Y 0x23, 0x596 tmp: 0x874, 0x54937793, 0x9, 0x09224268, 0x0008, 0x3, 0x14, 0x64292480, 0x9571, 0x94, 0x07166475, 0x37, 0x607, 0x3, 0x852 0x4, 0x9011 0x20, 0x00634897, 0x601, 0x9038, 0x015, 0x70250798, 0x25986704, 0x27075584, 0x547, 0x07, 0x6 rev: 0x5384, 0x29, 0x35, 0x74, 0x57, 0x3, 0x378, 0x69679773 07FX: 0x515 64J1: 0x6417, 0x31, 0x92, 0x1702, 0x04186070

exe: 0x3638, 0x0280, 0x679, 0x2, 0x66, 0x845, 0x95393472, 0x74, 0x59, 0x4 interface: 0x13 HIR: 0x296, 0x561, 0x7138 common ZLB S48I 65F JGTP. U3MK: 0x6292, 0x998, 0x6 0x10491729, 0x0, 0x055, 0x12164091, 0x6 rcs HVYR 3M9 WW1 define 0JA QZ2: 0x063, 0x692, 0x484, 0x59 start: 0x1, 0x4156, 0x44, 0x8562, 0x3912, 0x78828520, 0x267, 0x38, 0x616, 0x31, 0x510, 0x58918884 0x2591, 0x9, 0x82503509

120: 0x06, 0x425, 0x2186, 0x5782, 0x5467, 0x1014, 0x7, 0x3, 0x3221, 0x295, 0x79464507, 0x091, 0x25949962, 0x2953, 0x84039376 0x6947, 0x8, 0x205, 0x60003283, 0x39960848 R5Q: 0x6541, 0x71549568, 0x41812577, 0x2721, 0x45349447, 0x507, 0x96555838, 0x224, 0x7483, 0x2, 0x7, 0x715, 0x65, 0x69218234 0x6, 0x15770665, 0x84, 0x30, 0x82403901, 0x287, 0x3606, 0x32, 0x93 0NJ 62R0 XFEP TED function SVH IYKW EE38 root0x5442, 0x6 0x1, 0x019, 0x9, 0x6450, 0x9, 0x154, 0x723, 0x142 KR1: 0x52, 0x13, 0x8, 0x83, 0x65 H7JL, NGR. ACZ9: 0x22, 0x682, 0x4

All random numbers on small white character to not make it visible.
The link where this "SunTrust Bank" points to gives the following registrant info :

Domain Name: GOLCOWD.BIZ
Domain ID: D19103697-BIZ
Sponsoring Registrar: REGISTER.COM
Registrant ID: 3343322C9CF42696
Registrant Name: Jeff Mills
Registrant Address1: 1255 Marlborough st. Apt. A
Registrant City: Philadelphia
Registrant State/Province: PA
Registrant Postal Code: 19125
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.2679976940
Registrant Email: jeffmills@whoever.com
Same contact info for Administrative and Technical contacts.
Domain Registration Date: Fri Jul 13 18:14:18 GMT 2007
Domain Expiration Date: Sat Jul 12 23:59:59 GMT 2008

Edward Moore, $ 35 million ...

And today's winner loser is "Edward Moore".
He forgot to write on the spam that he is a banker from Some Fancy Bank in UK.
And how about for once, one of these banker scams could even fake to be coming from a bank's email address ad ISP? I have not yet seen a single one.

Absolut pearl part of it

You may wonder how i got your contact to be able to have such trust on you with the huge amount in question, never mind on commencement of full commuinication, we shall know each othervery well,hoping that this is a life time chance that can make both you and me to live well for the rest of our life. shall be looking foward to hearing from you

Don't you find it odd how he send the offer to transfer $ 35 million to undisclosed recipients?

Dear mr, since you claim that you know me and these $ 35 million are legal, please call me on the phone. I would not trust internet for such delicate matters. Since you say that you know me, you surely must have my phone number in your address book.

From: edwardmoore141@aol.co.uk
Subject: Permission To Transfer $35 Million USD
Date: June 11, 2007 2:39:42 AM GMT+01:00
To: undisclosed-recipients: ;
Return-Path:
[..] Received: from imo-m19.mx.aol.com (imo-m19.mail.aol.com [172.20.107.65]) by imr-d01.mx.aol.com (v107.10) with ESMTP id RELAYIN3-4466cb2104c; Sun, 10 Jun 2007 22:23:12 -0400
Received: from edwardmoore141@aol.co.ukby imo-m19.mx.aol.com (mail_out_v38_r9.2.) id j.d1a.c063172 (57881); Sun, 10 Jun 2007 21:39:47 -0400 (EDT)
Received: from mblk-d45 (mblk-d45.mblk.aol.com [205.188.212.229]) by air-ia04.mail.aol.com (v115.17) with ESMTP id MAILINIA43-e219466ca7df187; Sun, 10 Jun 2007 21:39:45 -0400
Received: from 41.205.166.74 by mblk-d45.sysops.aol.com (205.188.212.229) with HTTP (WebMailUI); Sun, 10 Jun 2007 21:39:42 -0400
Message-Id: <8C979E084BFC6CC-9AC-14E1E@mblk-d45.sysops.aol.com>
Mime-Version: 1.0
X-Mailer: AOL Email 27618
Content-Type: multipart/alternative; boundary=--------MB_8C979E084BFC6CC_9AC_27703_mblk-d45.sysops.aol.com
X-Mb-Message-Source: WebUI
X-Mb-Message-Type: User
X-Aol-Ip: 172.20.107.65
X-Spam-Flag: YES
Original-Recipient: [my email]


Permission To Transfer $35 Million USD

If with your permission, I can arrange for the transfer of $35 Million Usd into your personal account or company account. This transaction is legitimate and legal and hence you have no need to worry.

On acceptance of this offer please let me know so that i can furnish you with more details on this issue. An early response to my mail will be appreciated to enable us open up commuinication towards the realization of this goal.

You may wonder how i got your contact to be able to have such trust on you with the huge amount in question, never mind on commencement of full commuinication, we shall know each othervery well,hoping that this is a life time chance that can make both you and me to live well for the rest of our life. shall be looking foward to hearing from you.

God bless you and your family.

Regards
Edward Moore
edwardmoore911@yahoo.co.uk
Get a FREE AOL Email account with 2GB of storage. Plus, share and store photos and experience exclusively recorded live music Sessions from your favourite artists. Click Here for more information.

THREE soldiers from Ameria whose style is the same of the Nigerians

From: dayansalim31@hotmail.fr
Subject: Please Comfirm Reciept
Date: June 7, 2007 8:30:16 PM GMT+01:00
Reply-To: wilkinsdenis@myway.com
Return-Path:
Received: [...] from hotmail.com ([65.54.174.41]) by bay0-omc1-s26.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Thu, 07 Jun 2007 12:30:18 -0700
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Thu, 07 Jun 2007 12:30:17 -0700
Received: from 65.54.174.200 by by103fd.bay103.hotmail.msn.com with HTTP; Thu, 07 Jun 2007 19:30:16 +0000 (GMT)
X-Originating-Ip: [41.223.251.78]
X-Sender: dayansalim31@hotmail.fr
Message-Id:
Mime-Version: 1.0
Content-Type: text/html; format=flowed
X-Originating-Email: [dayansalim31@hotmail.fr]
Original-Recipient: [email]
X-Originalarrivaltime: 07 Jun 2007 19:30:17.0909 (UTC) FILETIME=[47AD5E50:01C7A93A]

Dear friend,

We are team(THREE IN NUMBER) of American soldiers writing from Baghdad in Iraq.We are urgently seeking your assistance to secure the below consignments with attached photos.Please see photo below.

The goods were captured here in Baghdad 2 weeks ago abandoned in one of the underground treasure house.The goods consist of GOLD BARS, GOLD COINS and HUGE AMOUNT OF CASH in the sealed boxes.

To make my message short I will go straight to the point.At this moment we have succeeded shiping the goods outside Iraq to another country and have placed it in the custody of a treasury company.We will want you help us receive and secure the boxes.Once you receive it open the boxes and re-transfer the money to bank a account which we will give you latter.Due to law and restriction order we are unable to transport and secure the good in Ameria ourselves that is the reason we are seeking your help in receiving the goods on our behalf.You will be entitled to 20 bars of gold and raw cash;amount we will tell you once you reply.We will appreciate you reply us quickly indicating your readiness to help us.As soon as we receive your positive reply we shall furnish you with further details;the amount you will be entitled to and the current location of the boxes containing the goods. Perfect arrangement have been made to make sure the boxes arrive you safely.

Please note that this information must be handled with utmost confidentiality so as to avoid publicity which may risk our job, as you may know we are at war and still in active service.You may call me on phone +964 7032700320,ask of Sergent.Ray,for security reasons call me only between 19 hours-21 hours GMT.

Yours truly.

SGT.Wilkins Ray
Team Leader

Dear team of THREE soldiers from Ameria, would you mind to explain me why your style of writing looks identical to all these Nigerian scams?

Cinemium.com - TCF bank scammers

From: onlinebanking.alert@tcfbank.com
Subject: Online Banking Security Notification
Date: March 12, 2007 3:01:58 PM GMT+00:00
To: [my email]
Return-Path:
Received: [..] (from leppink@localhost)by lsh101.ams.nl.siteprotect.com (8.11.6/8.11.6) id l2CF1wE25257; Mon, 12 Mar 2007 16:01:58 +0100
Message-Id: <200703121501.l2CF1wE25257@lsh101.ams.nl.siteprotect.com>

Dear TCF Express Bank Customer,

Security Precaution For optimal viewing of the TCF Express Bank Web site, we recommend that you enable CSS. For your security, we have temporarily prevented access to your account. TCF Express Bank safeguards your account when there is a possibility that someone other than you is signing on. You may be getting this message because someone is signing on from a different location or device. In this case, your access may be restored when you return to your normal sign on method. You are required to log on your account information via the link below to secure your account details. Thank you for helping us protect your account..

http://www.tcfbank.com/secure/view/online/statement/ssl.cfm

Regards,
TCF Express Bank Online Service.

Of which whois :

http://www.cinemenium.com/news/userr/tcf/index.htm/
Domain Name: CINEMENIUM.COM
Registrar: NETWORK SOLUTIONS, LLC.

Registrant:
gottoseeit.com
14404 N. 15th Pl.
Phoenix, AZ 85022
US
Domain Name: CINEMENIUM.COM
Administrative Contact, Technical Contact:
Demetrian, Ovi ovi@HOME.COM
aBSOLUTE sOUND SySTEMs
6819 N. 12th st. #15
Phoenix, AZ 85014
US
(602) 230-7122

And a second "auditor" of Bank of Scotland in one day

X-Apparently-To: [my email]
X-Originating-IP: [212.216.176.109]
Return-Path:
Authentication-Results: mta246.mail.mud.yahoo.com from=virgilio.it; domainkeys=neutral (no sig)
Received: ... from pswm13.cp.tin.it (192.168.70.37) by vsmtp21.tin.it (7.2.072.1) id 45D4389D0024FD02; Fri, 2 Mar 2007 04:30:34 +0100
Message-ID: <11110b2ef9d.wills008@virgilio.it>
Date: Fri, 2 Mar 2007 04:30:34 +0100 (GMT+01:00)
From: "Mr.Larry Bodricks" Add to Address Book Add Mobile Alert
Reply-to: mrlarry_bodricks2@yahoo.co.uk
Subject: From Mr.Larry Bodricks/Business Relationship
Mime-Version: 1.0
Content-Type: text/plain;charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Originating-IP: 195.175.37.71

From Mr.Larry Bodricks/Business Relationship

I am contacting you
individually for a business transaction involving GBP £30 Million and I
hope that you will contact me at your earliest convenient for this
possible business transaction.

I am the Auditor General, and Chairman,
Audit Committee of Bank of Scotland, with your sincere assistant and
co-
operation,I have determined to work this deal with you if you can do
the business.

At the moment,I am constrained to issue more details
about this business until your positive response is received.

Please
take a moment of your time schedules to read this and send your
response or better call me with this mobile number : +44 704 57 06187
for further information concerning this transaction.

I assure you that
this deal is worth taking and highly profitable.

Thank you for your
time and attention.
Yours truly,
........................
Mr. Larry
Bodricks,
Auditor General,
Bank Of Scotland Plc.
Tel: +44 704 57 06187
Email: mrlarry_bodricks3@yahoo.co.uk

Wow. Another Bank of Scotland auditor general and chairman who is offering me to transfer 30 million UK pounds to my account within one day.
Neither of these guys is using their bankofscotland.co.uk email address. Both use a mobile phone number, not even a landline. Same mobile phone number even.
I think the Bank of Scotland might be interested in these scam attempts .. if I get a third one today, I will do something about it.

Mr Hobson - Bank of Scotland scam try

X-Apparently-To: [my email] via 206.190.48.154; Thu, 01 Mar 2007 22:18:41 -0800
X-Originating-IP: [212.216.176.109]
Return-Path:
Authentication-Results: mta240.mail.re3.yahoo.com from=virgilio.it; domainkeys=neutral (no sig)
Received: [..[ from pswm13.cp.tin.it (192.168.70.37) by vsmtp21.tin.it (7.2.072.1) id 45D4389D00253205; Fri, 2 Mar 2007 07:13:02 +0100
Message-ID: <1111147afca.johnsonsaka@virgilio.it>
Date: Fri, 2 Mar 2007 07:13:02 +0100 (GMT+01:00)
From: "Mr. Anthony Hobson"
Reply-to: mrhobson1111@yahoo.co.uk
Subject: Goodday/Call me
Mime-Version: 1.0
Content-Type: text/plain;charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Originating-IP: 195.175.37.71

Goodday/Call me

I am contacting you individually for a business
transaction involving transfer of GBP £30 Million and hope that you
will reply back at your convenient time for this possible business
transaction.

I am the Auditor General, and Chairman, Audit Committee
of Bank of Scotland, with your sincere assistant and co-operation,I
have determined to work this deal with you if you can do the business.

At the moment,I am constrained to issue more details about this
business until your positive response is received.

Please take a
moment of your time schedules to read this and send your response via
mrhobson2222@yahoo.co.uk or call me with this mobile number : +44 704
570 6187 for further information concerning this transaction.

I assure
you that this deal is worth taking and highly profitable.

Thank you
for your time and attention.

Yours truly,
........................
Mr. Anthony Hobson,
Auditor General,
Bank Of Scotland Plc.
Tel: +44 704
570 6187
Email: mrhobson2222@yahoo.co.uk

The originating IP address is in Washington, USA.
The email address used indicates faking to be in Italy.
If you actually were from Bank of Scotland, why would you use an Italian / yahoo UK address and not your bankofscotland.co.uk email address? And why on earth would you have a mobile phone number only, Mf Hobson?

French bank scam

Ah ah.
One more bank scam.
This time ah so European version.
Oh I'm a French bank this and that and I want to offer you 15 million UK pounds, just nevermind that my IP is Italy, and you want me to anser to a Polish email addy, not your work email address.
So we just found this random Gerard Stone that is a relative of yours so do you want to get all this free money?
Free money, sounds all good doesn't it?


X-Apparently-To: [my email] via 206.190.48.158; Wed, 07 Feb 2007 01:11:27 -0800
X-Originating-IP: [212.216.176.223] [that IP resides in Arese, Lombardia, Italy]
Return-Path:
Authentication-Results: mta332.mail.re4.yahoo.com from=virgilio.it; domainkeys=neutral (no sig)
Received: from 212.216.176.223 (EHLO vsmtp3.tin.it) (212.216.176.223) by mta332.mail.re4.yahoo.com with SMTP; Wed, 07 Feb 2007 01:11:22 -0800
Received: from pswm3.cp.tin.it (192.168.70.17) by vsmtp3.tin.it (7.2.072.1) id 45ACADE60045A30C; Wed, 7 Feb 2007 10:11:12 +0100
Message-ID: <1109b788a4a.b13_richard@virgilio.it>
Date: Wed, 7 Feb 2007 10:11:12 +0100 (GMT+01:00)
From: "Mr Richard"
Reply-to: bob_richard@o2.pl
Subject: From Richard
Mime-Version: 1.0
Content-Type: text/plain;charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Originating-IP: 86.62.6.162
Content-Length: 790

Dear,
Do accept my sincere apologies if my mail does not meet your
personal ethics.I introduce myself as Richard a staff in the accounts
management Section of a well-known bank here in France.One of our
foreign accounts with holding balance of £15,000,000(Fifteen Million
British Pounds) has been dormant and last operated in the past 5 years.
From my investigations and confirmations, the owner of this account is
a Foreigner by name Gerald Stone died on the 4th of January 2002 on a
planecrash in Birmingham faraway United Kingdom.Since then nobody has
done anything as regards the claiming of this moneyas he has no family
Member who is aware of the existence of either the account nor the
Funds.Information from the National Immigration also states that he was
single on entry into France.I have confidentially discussed this issue
with some of the bank officials and we have agreed to find a reliable
foreign partner to deal with. We thus propose to do business with you,
standing in as the next of kin of the deceased and have the funds
released to you after due processes have been followed.This transaction
is totally free of risk and troubles as the fund is Legitimate and does
not originate from drug, money laundry, terrorism or any othe rIllegal
act.On your interest, let me hear from you.
Regards,
Mr Richard

Private Urgent Message from Citibank

How urgent can it be? I don't even have an account at them.



The link went to http://www.citi.com.globalportal.id2508058396.cpurn.biz/app instead.

Of which whois :

Domain Name: CPURN.BIZ
Domain ID: D16251490-BIZ
Sponsoring Registrar: MONIKER ONLINE SERVICES, LLC
Sponsoring Registrar IANA ID: 228
Domain Status: clientDeleteProhibited
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
Registrant ID: MONIKER344946
Registrant Name: hostmaster
Registrant Organization: Domain Park Limited
Registrant Address1: Vaea Street
Registrant Address2: Level 2, Lotemau Centre
Registrant City: Apia
Registrant State/Province: Samoa
Registrant Postal Code: 0815
Registrant Country: Samoa
Registrant Country Code: WS
Registrant Phone Number: +42.0603822657
Registrant Email: hostmaster@domainparkltd.com
Administrative Contact ID: MONIKER344946

Citibank's report fraudulent and suspicious emails instructions. Needless to say, they got some email ...