While this is not technically a Nigerian Prince phishing email – its claimed country of origin is two countries South of Nigeria – like the beautiful masterpiece we talked about in a previous post, it is one in spirit. Take a look at the email, posted here in glorious ASCII, and see if you agree with me.
Date: Sep 4, 2023, 00:23 From: sam.thong@fidconsults.org To: Clueless Phish <cluelessphish@example.com> Subject: Confidential Dear Sir/Madam, I am writing to you from Gabon, I am a personal cook to the Deposed President of Gabon who is under house arrest. I have a vital information I can release to you now , You will stand the position to claim the consignment that is in Turkey as the owner of the consignment, Is deposited as a Personal Valuable Item and bonded by the chief of staff to the president who is also under arrest, during the arrest he gave me the file to keep, from there I got this information and the receipt of the deposit. I have all the full details, the reference number, the security code numbers, if you mention this information you will reclaim the consignment. Confidentiality what is in the boxes (Two) is cash valued ($26m) each. We are under house arrest now in Gabon in Central Africa. If you are interested contact me so I will give you the details of the Security Company so you can reach them with the information as the owner of the consignment, the security code number is the title proving you as the owner. When received I and you will invest it as partners in your company. Regards -- Sam Thong -Consultant
Identifying this as a phishing email in easy steps
Clearly is it not in the same league as the true blood Nigerian phishing email we looked at some weeks ago, but you must admit it has its own charm:
- The consignment of the consignment is a consignment?
- This is not about royalty; it deals with a lesser rank: president. But he was deposed and is in house arrest. Close enough, don’t you think?
- However, there was a real military coup in Gabon. On August 30, President Ali Bongo Ondimba was removed from power. Our phisher is aware of the news; props for that.
- No kindly today. I feel sad.
- This phisher is pretending to be just a lowly cook. Can’t be that lowly because he is personal cook and is also supposed to be in the same house arrest as Mr. President. Also, he signs off as a “consultant.”
- We cannot rely on the odd grammar as indicator of phishing because our phisher phriend is supposed to be from Gabon, were they speak French and not English (in addition to local languages). Still, “Confidentiality what is in the boxes (Two) is cash valued ($26m) each” gives a smile to my face.
Overall, it is a bit convoluted to the point I do not know if it would be an effective phishing email. However, as entertainment I give it high marks.