Nigerian Spam from Microsoft outlook
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 24 Mar 2024 05:43:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1roMEu-00000000IaE-0wyE
for dave@doctor.nl2k.ab.ca;
Sun, 24 Mar 2024 05:42:12 -0600
Resent-From: The Doctor
Resent-Date: Sun, 24 Mar 2024 05:42:12 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-lo4gbr01rlhn2184.outbound.protection.outlook.com ([40.95.115.184]:52807 helo=GBR01-LO4-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1roLbI-00000000FGW-35Ss
for doctor@doctor.nl2k.ab.ca;
Sun, 24 Mar 2024 05:01:20 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=GB+vzMQxplBPkTRFSMhwYnauhUN3RGrnw8VmSBbhGx4EJuLp3/L0P9ZhL8glGzB5Q5mGZS6G9FfWfsxEoMCzS7T8YpA0XmGrivhbpFh4PyHc4m8g7V5qbVjP/a12LNG0gB/IS3E4OKBPWYNuHs2+O9/m85qj/w+397yll/MeaROwbAJkjgEwDeZV4ErgKYqyg5JrmvzAqnyj4Gn7tRP0wgBo++RrlJrw7fEwttdPWWqRIBikcnJo8SFDT+Cke6lHzjp3wKIQ6Eyxd/39Vr/AQARnEsdbOrH2/X6grSdN205lF/g8JcGOzOxOrPWHZJrdSZe3RSi+DKqL8XVBUMFB+w==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=KOYlofxoeno+mXY12bZn7zRugj7bRZ3E5xvL3LShNPo=;
b=G5YA3RK0Wcfc4wimM4YizdULR0dmVpqbKQGAgP3ce0l5EsAh07XAy12Q3aBtakDXex1UdSoQdRHVZTr/ZMSx4N1ngtfPeb5xMnQPHit5fb9VY+xP/8vng2Wjh3r0Yayk9dBdkXz96NxcGWoLe4umFKK33OH7XfV3Eswg6NqUn6TbZJK4kDqg+khfRjVAyIGHIB0mdsPeVKSXzQk948/jlWDZxKnyxdRIDM43kXHV9MLhB640ESM1gIpIvveoNVCYATg54GndfYeFO6hGlWweKMdX9sIlxlM4jP+HunzzuKR/bSXVmwqoTJ/ZYNrn7nG7fUVoFhIoEybKsG+jrBhK9g==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is
193.39.172.206) smtp.rcpttodomain=banque-france.fr smtp.mailfrom=office.net;
dmarc=none action=none header.from=office.net; dkim=none (message not
signed); arc=none (0)
Received: from LO2P265CA0499.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:13b::6)
by LO0P123MB3898.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:13f::9) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7409.31; Sun, 24 Mar
2024 10:59:14 +0000
Received: from LO1PEPF000022FF.GBRP265.PROD.OUTLOOK.COM
(2603:10a6:600:13b:cafe::fc) by LO2P265CA0499.outlook.office365.com
(2603:10a6:600:13b::6) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7409.13 via Frontend
Transport; Sun, 24 Mar 2024 10:59:14 +0000
X-MS-Exchange-Authentication-Results: spf=none (sender IP is 193.39.172.206)
smtp.mailfrom=office.net; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=office.net;
Received-SPF: None (protection.outlook.com: office.net does not designate
permitted sender hosts)
Received: from ebyst.gwynedd.llyw.cymru (193.39.172.206) by
LO1PEPF000022FF.mail.protection.outlook.com (10.167.240.23) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.7409.10 via Frontend Transport; Sun, 24 Mar 2024 10:59:14 +0000
Received: from HQ-EX19-1.gwynedd.rhwydwaith (172.18.4.3) by
HQ-EX19-1.gwynedd.rhwydwaith (172.18.4.3) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.2.1258.28; Sun, 24 Mar 2024 10:59:13 +0000
Received: from User (172.18.4.86) by HQ-EX19-1.gwynedd.rhwydwaith (172.18.4.3)
with Microsoft SMTP Server id 15.2.1258.28 via Frontend Transport; Sun, 24
Mar 2024 10:59:12 +0000
Reply-To:
From: Federal Reserve Bank
Subject: Dead Or ALIVE....4s
Date: Sun, 24 Mar 2024 03:59:11 -0700
MIME-Version: 1.0
Content-Type: text/html; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID:
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: LO1PEPF000022FF:EE_|LO0P123MB3898:EE_
X-MS-Office365-Filtering-Correlation-Id: a1b3f2eb-b1d9-48c9-8cf9-08dc4bf17173
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?29cBUL7tUnQLaPygG4z81RRBITjvBOvdEKpg1AMc92tTPlaTmXXkfmiL?=
=?windows-1251?Q?eZg8kmL4/Owz87s2Pt7vat4oketmvH5H8IB8d78cQm82Oj7b9p/cuaGa?=
=?windows-1251?Q?KSQWVoWsFNqxuBcHDTyykbdb9oqR5UD/DTu8Ah8BZd3SDEhx3gHd7sxk?=
=?windows-1251?Q?NKVPWS3ijwl5g3hxgLnI5JMGRZsDRS6T+NxO3wUQMPo5KdUtcTaM4Lst?=
=?windows-1251?Q?mNcPHv8n+EGD/cZVGN6SWNLyiBzQeb9DMdBcO/7ZJQuMvM3MLFpKkRg3?=
=?windows-1251?Q?JtELPODmE4Ye9Rn0A5xFge8nIv7/YemTnqw0A8tUM8591yX+AGNits2f?=
=?windows-1251?Q?j7W93fChV+8vEzGFyB/CjWW23ZxD3A+WtfvYtx2DeS5bvYVUpCv0fLyC?=
=?windows-1251?Q?6Kul0RVztiLX0Zag+3SbmrtVeVxodQL8O9hYn7AF971EArBJ7V1fH+zG?=
=?windows-1251?Q?tiLDdqeK+7OrJfmPd3YIn07buyN6ksAu3ZKmlwvxx01mArQ/kmDIc0gC?=
=?windows-1251?Q?xEfgZ6RGQOczrWp0o+kmyHsaxASQwK5z3/rC2lQsPVvQLbQsHYU4XWRr?=
=?windows-1251?Q?NgtIXlU4QO0uOvGV7zz48OPrpQB7yBECxVaPlbqhAWFDvaUnUwVFiP46?=
=?windows-1251?Q?6wU6pRozNck2EXctnX4gSg6zldY0oGKq9FMFac2pzUzqELy2YvX8CLs6?=
=?windows-1251?Q?i+gvx7Gk82o7t7cfkqQTClfHQtv+k/1VvaCG7Hxo1j5vcZlvtw1cB3q+?=
=?windows-1251?Q?bApabNCPg4PCG+x9xsOX886UnoA3yv4iDGBnaEvsMBT3JX2Lu/+y8Nco?=
=?windows-1251?Q?WpaCRI5dl5ryIujJ/NTW6vyvvd2gZj2VHT8K7pIFZUm1HBC/CnlWUF1z?=
=?windows-1251?Q?VMf9IrYK0nvTdtcVdLLfpaTlqlWkCs7omWd+G7ScHlWdogwFgvs+GZvm?=
=?windows-1251?Q?L0bGrgfRmCsoZ2x7nLPqVLyCeoMzhykcNgOMFPII49UVuMbCg+f/LhLk?=
=?windows-1251?Q?m4FnygebgYJb87cEcfXoGnJLBRDZvP4GCNDw1g6KJS+UdiQDuJiLIdi5?=
=?windows-1251?Q?X/dVNBjJoaeBjHA3xoLCIgrv4Vm+Q/lPII3DWJ/JT2t/AdbReNjZv+E6?=
=?windows-1251?Q?N3snaKyp/Di85IGuLZ5duiBSHjAqDi1ba50LSJmbU1WZvxvmwu6xDB9X?=
=?windows-1251?Q?XyceEN4cyX14F1QKnEkcK2xFlJmBtZjH/x/cBdtN2szhoeT9UgbHIzDX?=
=?windows-1251?Q?H4j8CD6qA9MZJ3tEel8mhpsQiLCQ2w6TlQbHTOoMcBcwS+E+2tS6CRqO?=
=?windows-1251?Q?VvmUOg=3D=3D?=
X-Forefront-Antispam-Report:
CIP:193.39.172.206;CTRY:GB;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:ebyst.gwynedd.llyw.cymru;PTR:systemau.gwynedd.llyw.cymru;CAT:OSPM;SFS:(13230031)(61400799018)(48200799009)(376005)(82310400014)(35950700004)(32650700005)(7416005)(2700400011);DIR:OUT;SFP:1023;
X-OriginatorOrg: cyngorgwynedd.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Mar 2024 10:59:14.1429
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: a1b3f2eb-b1d9-48c9-8cf9-08dc4bf17173
X-MS-Exchange-CrossTenant-Id: 99841289-67fd-4e8e-b813-12b22f782ece
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=99841289-67fd-4e8e-b813-12b22f782ece;Ip=[193.39.172.206];Helo=[ebyst.gwynedd.llyw.cymru]
X-MS-Exchange-CrossTenant-AuthSource: LO1PEPF000022FF.GBRP265.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO0P123MB3898
X-Spam_score: 30.8
X-Spam_score_int: 308
X-Spam_bar: ++++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Beneficiary, We wish to inform you that a power of attorney
was forwarded to our office this morning, by two gentlemen regarding your
unclaimed fund of $5.5 Million Dollar. One of them is an American citizen
named [...]
Content analysis details: (30.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.95.115.184 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[40.95.115.184 listed in bl.score.senderscore.com]
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
[40.95.115.184 listed in bl.score.senderscore.com]
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=GBR01-LO4-obe.outbound.protection.outlook.com;ip=40.95.115.184;r=doctor.nl2k.ab.ca]
0.0 ARC_VALID Message has a valid ARC signature
0.0 ARC_SIGNED Message has a ARC signature
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[williamtash1949(at)gmail.com]
2.7 UNCLAIMED_MONEY BODY: People just leave money laying around
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 LOTS_OF_MONEY Huge... sums of money
0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.2 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
1.9 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Dead Or ALIVE....4s
Dear Beneficiary,
We wish to inform you that a power of attorney was forwarded to our office this morning, by two gentlemen regarding your unclaimed fund of $5.5 Million Dollar. One of them is an American citizen named Mr. Robert Porter and the other is Mr. Wilhelm Berg a Swedish citizen.
The document claims these gentlemen to be your authorized representatives, and the power of attorney states that you are already deceased. It further states that your death was due to lung cancer, with your date of death being March 27th, 2019.
They have now submitted a new account to replace the receiving account that was in the original claim of funds. These funds have remained unclaimed for quite some time and the need for resolution is pressing.
Below is the new account they have submitted.
Account Name: Robert Porter /Wilhelm Berg
Account: 5007-29 438 66
IBAN-nr: SE4150000000050072943866
Bic-kod: ESSESESS
Skandinaviska Enskilda Banken. (SEB
SWEDEN.
In the event that you are in fact still alive, we ask that you confirm your existence by responding to this email. You are to view this as a matter requiring immediately attention and response. We have 48 hours monitoring of all activities within Federal Reserve Bank.
We have contacted the bank in the Sweden asking them to wait for further directives from Federal Reserve Bank, prior to authorizing any withdrawals in any form. Our request is based entirely on our attempt to verify that you are in fact deceased, before money is wrongly disbursed.
Finally, we forewarn you that if we do not hear back from you shortly, we will have to assume that you are in fact deceased and Federal Reserve Bank will proceed with release funds to the above newly submitted account.
Sincerely,
Lorie K. Logan (frbdallasdistrict@outlook.com)
Federal Reserve System2200 N Pearl St, Dallas, TX 75201, USA
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 24 Mar 2024 05:43:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1roMEu-00000000IaE-0wyE
for dave@doctor.nl2k.ab.ca;
Sun, 24 Mar 2024 05:42:12 -0600
Resent-From: The Doctor
Resent-Date: Sun, 24 Mar 2024 05:42:12 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-lo4gbr01rlhn2184.outbound.protection.outlook.com ([40.95.115.184]:52807 helo=GBR01-LO4-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1roLbI-00000000FGW-35Ss
for doctor@doctor.nl2k.ab.ca;
Sun, 24 Mar 2024 05:01:20 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=GB+vzMQxplBPkTRFSMhwYnauhUN3RGrnw8VmSBbhGx4EJuLp3/L0P9ZhL8glGzB5Q5mGZS6G9FfWfsxEoMCzS7T8YpA0XmGrivhbpFh4PyHc4m8g7V5qbVjP/a12LNG0gB/IS3E4OKBPWYNuHs2+O9/m85qj/w+397yll/MeaROwbAJkjgEwDeZV4ErgKYqyg5JrmvzAqnyj4Gn7tRP0wgBo++RrlJrw7fEwttdPWWqRIBikcnJo8SFDT+Cke6lHzjp3wKIQ6Eyxd/39Vr/AQARnEsdbOrH2/X6grSdN205lF/g8JcGOzOxOrPWHZJrdSZe3RSi+DKqL8XVBUMFB+w==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=KOYlofxoeno+mXY12bZn7zRugj7bRZ3E5xvL3LShNPo=;
b=G5YA3RK0Wcfc4wimM4YizdULR0dmVpqbKQGAgP3ce0l5EsAh07XAy12Q3aBtakDXex1UdSoQdRHVZTr/ZMSx4N1ngtfPeb5xMnQPHit5fb9VY+xP/8vng2Wjh3r0Yayk9dBdkXz96NxcGWoLe4umFKK33OH7XfV3Eswg6NqUn6TbZJK4kDqg+khfRjVAyIGHIB0mdsPeVKSXzQk948/jlWDZxKnyxdRIDM43kXHV9MLhB640ESM1gIpIvveoNVCYATg54GndfYeFO6hGlWweKMdX9sIlxlM4jP+HunzzuKR/bSXVmwqoTJ/ZYNrn7nG7fUVoFhIoEybKsG+jrBhK9g==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is
193.39.172.206) smtp.rcpttodomain=banque-france.fr smtp.mailfrom=office.net;
dmarc=none action=none header.from=office.net; dkim=none (message not
signed); arc=none (0)
Received: from LO2P265CA0499.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:13b::6)
by LO0P123MB3898.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:13f::9) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7409.31; Sun, 24 Mar
2024 10:59:14 +0000
Received: from LO1PEPF000022FF.GBRP265.PROD.OUTLOOK.COM
(2603:10a6:600:13b:cafe::fc) by LO2P265CA0499.outlook.office365.com
(2603:10a6:600:13b::6) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7409.13 via Frontend
Transport; Sun, 24 Mar 2024 10:59:14 +0000
X-MS-Exchange-Authentication-Results: spf=none (sender IP is 193.39.172.206)
smtp.mailfrom=office.net; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=office.net;
Received-SPF: None (protection.outlook.com: office.net does not designate
permitted sender hosts)
Received: from ebyst.gwynedd.llyw.cymru (193.39.172.206) by
LO1PEPF000022FF.mail.protection.outlook.com (10.167.240.23) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.7409.10 via Frontend Transport; Sun, 24 Mar 2024 10:59:14 +0000
Received: from HQ-EX19-1.gwynedd.rhwydwaith (172.18.4.3) by
HQ-EX19-1.gwynedd.rhwydwaith (172.18.4.3) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.2.1258.28; Sun, 24 Mar 2024 10:59:13 +0000
Received: from User (172.18.4.86) by HQ-EX19-1.gwynedd.rhwydwaith (172.18.4.3)
with Microsoft SMTP Server id 15.2.1258.28 via Frontend Transport; Sun, 24
Mar 2024 10:59:12 +0000
Reply-To:
From: Federal Reserve Bank
Subject: Dead Or ALIVE....4s
Date: Sun, 24 Mar 2024 03:59:11 -0700
MIME-Version: 1.0
Content-Type: text/html; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID:
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: LO1PEPF000022FF:EE_|LO0P123MB3898:EE_
X-MS-Office365-Filtering-Correlation-Id: a1b3f2eb-b1d9-48c9-8cf9-08dc4bf17173
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?29cBUL7tUnQLaPygG4z81RRBITjvBOvdEKpg1AMc92tTPlaTmXXkfmiL?=
=?windows-1251?Q?eZg8kmL4/Owz87s2Pt7vat4oketmvH5H8IB8d78cQm82Oj7b9p/cuaGa?=
=?windows-1251?Q?KSQWVoWsFNqxuBcHDTyykbdb9oqR5UD/DTu8Ah8BZd3SDEhx3gHd7sxk?=
=?windows-1251?Q?NKVPWS3ijwl5g3hxgLnI5JMGRZsDRS6T+NxO3wUQMPo5KdUtcTaM4Lst?=
=?windows-1251?Q?mNcPHv8n+EGD/cZVGN6SWNLyiBzQeb9DMdBcO/7ZJQuMvM3MLFpKkRg3?=
=?windows-1251?Q?JtELPODmE4Ye9Rn0A5xFge8nIv7/YemTnqw0A8tUM8591yX+AGNits2f?=
=?windows-1251?Q?j7W93fChV+8vEzGFyB/CjWW23ZxD3A+WtfvYtx2DeS5bvYVUpCv0fLyC?=
=?windows-1251?Q?6Kul0RVztiLX0Zag+3SbmrtVeVxodQL8O9hYn7AF971EArBJ7V1fH+zG?=
=?windows-1251?Q?tiLDdqeK+7OrJfmPd3YIn07buyN6ksAu3ZKmlwvxx01mArQ/kmDIc0gC?=
=?windows-1251?Q?xEfgZ6RGQOczrWp0o+kmyHsaxASQwK5z3/rC2lQsPVvQLbQsHYU4XWRr?=
=?windows-1251?Q?NgtIXlU4QO0uOvGV7zz48OPrpQB7yBECxVaPlbqhAWFDvaUnUwVFiP46?=
=?windows-1251?Q?6wU6pRozNck2EXctnX4gSg6zldY0oGKq9FMFac2pzUzqELy2YvX8CLs6?=
=?windows-1251?Q?i+gvx7Gk82o7t7cfkqQTClfHQtv+k/1VvaCG7Hxo1j5vcZlvtw1cB3q+?=
=?windows-1251?Q?bApabNCPg4PCG+x9xsOX886UnoA3yv4iDGBnaEvsMBT3JX2Lu/+y8Nco?=
=?windows-1251?Q?WpaCRI5dl5ryIujJ/NTW6vyvvd2gZj2VHT8K7pIFZUm1HBC/CnlWUF1z?=
=?windows-1251?Q?VMf9IrYK0nvTdtcVdLLfpaTlqlWkCs7omWd+G7ScHlWdogwFgvs+GZvm?=
=?windows-1251?Q?L0bGrgfRmCsoZ2x7nLPqVLyCeoMzhykcNgOMFPII49UVuMbCg+f/LhLk?=
=?windows-1251?Q?m4FnygebgYJb87cEcfXoGnJLBRDZvP4GCNDw1g6KJS+UdiQDuJiLIdi5?=
=?windows-1251?Q?X/dVNBjJoaeBjHA3xoLCIgrv4Vm+Q/lPII3DWJ/JT2t/AdbReNjZv+E6?=
=?windows-1251?Q?N3snaKyp/Di85IGuLZ5duiBSHjAqDi1ba50LSJmbU1WZvxvmwu6xDB9X?=
=?windows-1251?Q?XyceEN4cyX14F1QKnEkcK2xFlJmBtZjH/x/cBdtN2szhoeT9UgbHIzDX?=
=?windows-1251?Q?H4j8CD6qA9MZJ3tEel8mhpsQiLCQ2w6TlQbHTOoMcBcwS+E+2tS6CRqO?=
=?windows-1251?Q?VvmUOg=3D=3D?=
X-Forefront-Antispam-Report:
CIP:193.39.172.206;CTRY:GB;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:ebyst.gwynedd.llyw.cymru;PTR:systemau.gwynedd.llyw.cymru;CAT:OSPM;SFS:(13230031)(61400799018)(48200799009)(376005)(82310400014)(35950700004)(32650700005)(7416005)(2700400011);DIR:OUT;SFP:1023;
X-OriginatorOrg: cyngorgwynedd.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Mar 2024 10:59:14.1429
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: a1b3f2eb-b1d9-48c9-8cf9-08dc4bf17173
X-MS-Exchange-CrossTenant-Id: 99841289-67fd-4e8e-b813-12b22f782ece
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=99841289-67fd-4e8e-b813-12b22f782ece;Ip=[193.39.172.206];Helo=[ebyst.gwynedd.llyw.cymru]
X-MS-Exchange-CrossTenant-AuthSource: LO1PEPF000022FF.GBRP265.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO0P123MB3898
X-Spam_score: 30.8
X-Spam_score_int: 308
X-Spam_bar: ++++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Beneficiary, We wish to inform you that a power of attorney
was forwarded to our office this morning, by two gentlemen regarding your
unclaimed fund of $5.5 Million Dollar. One of them is an American citizen
named [...]
Content analysis details: (30.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.95.115.184 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[40.95.115.184 listed in bl.score.senderscore.com]
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
[40.95.115.184 listed in bl.score.senderscore.com]
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=GBR01-LO4-obe.outbound.protection.outlook.com;ip=40.95.115.184;r=doctor.nl2k.ab.ca]
0.0 ARC_VALID Message has a valid ARC signature
0.0 ARC_SIGNED Message has a ARC signature
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[williamtash1949(at)gmail.com]
2.7 UNCLAIMED_MONEY BODY: People just leave money laying around
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 LOTS_OF_MONEY Huge... sums of money
0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.2 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
1.9 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Dead Or ALIVE....4s
Dear Beneficiary,
We wish to inform you that a power of attorney was forwarded to our office this morning, by two gentlemen regarding your unclaimed fund of $5.5 Million Dollar. One of them is an American citizen named Mr. Robert Porter and the other is Mr. Wilhelm Berg a Swedish citizen.
The document claims these gentlemen to be your authorized representatives, and the power of attorney states that you are already deceased. It further states that your death was due to lung cancer, with your date of death being March 27th, 2019.
They have now submitted a new account to replace the receiving account that was in the original claim of funds. These funds have remained unclaimed for quite some time and the need for resolution is pressing.
Below is the new account they have submitted.
Account Name: Robert Porter /Wilhelm Berg
Account: 5007-29 438 66
IBAN-nr: SE4150000000050072943866
Bic-kod: ESSESESS
Skandinaviska Enskilda Banken. (SEB
SWEDEN.
In the event that you are in fact still alive, we ask that you confirm your existence by responding to this email. You are to view this as a matter requiring immediately attention and response. We have 48 hours monitoring of all activities within Federal Reserve Bank.
We have contacted the bank in the Sweden asking them to wait for further directives from Federal Reserve Bank, prior to authorizing any withdrawals in any form. Our request is based entirely on our attempt to verify that you are in fact deceased, before money is wrongly disbursed.
Finally, we forewarn you that if we do not hear back from you shortly, we will have to assume that you are in fact deceased and Federal Reserve Bank will proceed with release funds to the above newly submitted account.
Sincerely,
Lorie K. Logan (frbdallasdistrict@outlook.com)
Federal Reserve System2200 N Pearl St, Dallas, TX 75201, USA
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments