Money Phish from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 17 Mar 2024 19:45:00 -0600
Received: from mail-ua1-f43.google.com ([209.85.222.43]:42307)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rm239-000000008AB-3eMI
for dave@doctor.nl2k.ab.ca;
Sun, 17 Mar 2024 19:44:32 -0600
Received: by mail-ua1-f43.google.com with SMTP id a1e0cc1a2514c-7e043f577c5so809841241.1
for; Sun, 17 Mar 2024 18:42:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1710726146; x=1711330946; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=/XMJfvIFh3hE2nQIuR3SkLXyBsnuOsH7K8Hr+ejfBaA=;
b=W5hR/6R4gklGcPiQFqs/PMxnomE8fvIsGtDFSl+OZt4OTxybE1FKcvkIv5Su4eqyA3
BuvUS4kSrPWwGAIlJCWH5yDtb+SB8OX+HRZ0UoqimFHWelChXYTsJba11IR3WFMPpcpJ
0QtuRvpcmd6MpzHKXXe9v3xIz71AanG9FU+GrMqhu3mTX/n3VFto87tLWS+OWe1HNpZy
ybuIXzlamNboupzKCP5MOgoIW/Cg2Bn+HwDW53LprOR+GXi04Q6zlysI63hRDfrBcNxT
xY8yem55/wFqMIZo2qJLHQmL8YENQOF+3CMncjk8wqqUai16AbVzA4AHJGFKqqweek2f
3kRQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1710726146; x=1711330946;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=/XMJfvIFh3hE2nQIuR3SkLXyBsnuOsH7K8Hr+ejfBaA=;
b=ehjgLlx/GIc6DxUWRt4KKbLLMJV2fJPQCZk1D8wbpurHaH+EZNtZr6Jh5cZpMkQ7KL
o3eH7e2d4QISbZURiamQBNO7o/m5je0h1M0Lbezs3N3xfwAFrWXpnHFWm/b68223Sfdw
YnoqumAFCaZy9PmwoxUUpGefEae/+2WBSNRV1eqzhq4NkcUQLGI68yoac8jH0wPrc0UV
p9IKMG1iWKcj1qyhUQuT4AovzBWhpXNOa5jcKnY8KKA0tPpiymp9jiKB6DWroOt8diVv
w1eu3qNYjjErD0Bj1L0qpdQKFqWl94cGGF67O4dYygShWINnZQkeV8SeRHbRSjMJtRKk
JHAQ==
X-Forwarded-Encrypted: i=1; AJvYcCVB9TOWLw2FPj011SymOvOqKQl8yt73os2yirSIOAKTSGi8Xwmo8o/hqPU8kPNe5vPC8PWkJ4cRBsmOxIkI+kVDfWULGo5G
X-Gm-Message-State: AOJu0Yzqg3ykv7h1CNaibMvGcelF33jFSLJ1gEt70ZTYWJssMU/eqPR7
VyJuEL6CTEXMPe45Da+VeA1qVKKTo+PlL6Y5ZybVJ+Bpt75XfN0Yxoh2Scg5aIPR5JAibVtRfpX
axhsdDWYKze1Jle5R9XE0Uwix0LY=
X-Google-Smtp-Source: AGHT+IGLNhF2XdSVkvlKpayYeZcc3QYk7wKf46DmBx0jopAO3kivS0xBmNCDRWxJKb2xwymv5IYl5ME+Sym7u55HZtk=
X-Received: by 2002:a05:6102:365:b0:474:c681:9380 with SMTP id
f5-20020a056102036500b00474c6819380mr7227260vsa.15.1710726146041; Sun, 17 Mar
2024 18:42:26 -0700 (PDT)
MIME-Version: 1.0
Reply-To: AdeleElla1@mail.com
From: European Investment Bank
Date: Sun, 17 Mar 2024 18:42:10 -0700
Message-ID:
Subject: European Investment Bank
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000003e312f0613e57868"
Bcc: dave@doctor.nl2k.ab.ca
X-Spam_score: 16.5
X-Spam_score_int: 165
X-Spam_bar: ++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: *Attention: beneficiary of the fund,We have mandated the European
Investment Bank in London and the IMF to investigate the reason for the unnecessary
delay in disbursements authorized by law. During o [...]
Content analysis details: (16.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.222.43 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.222.43 listed in wl.mailspike.net]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[adeleella1(at)mail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[michaelstan449(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[michaelstan449(at)gmail.com]
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.9 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 XFER_LOTSA_MONEY Transfer a lot of money
2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
Subject: {SPAM?} European Investment Bank
--0000000000003e312f0613e57868
Content-Type: text/plain; charset="UTF-8"
Attention: beneficiary of the fund,We have mandated the European
Investment Bank in London and the IMF to investigate the reason for the
unnecessary delay in disbursements authorized by law. During our
investigation, we discovered that your payment was delayed by corrupt bank
officials who tried to divert your money to their personal accounts.To
prevent this suspicious act, we have agreed with the European Investment
Bank in London and the International Monetary Fund (IMF) that we can manage
and monitor this payment. Avoid desperate situations with banks and other
authorities in criminal cases.We have received an irrevocable payment
guarantee for your MFD payment. We hereby inform you that the European
Investment Bank has decided to compensate you in the amount of USD
2,000,000.00 and transfer it to your bank account via bank transfer.please
contact the Corresponding Bank Customer care services, Ms. Adele Ella via
the email belowemail: AdeleElla1@mail.comBe sure to
contact the above bank immediately for final release and transfer of funds.
The European Investment Bank must transfer its funds to your bank account
without delay.I expect your prompt cooperation.Thank you.
--0000000000003e312f0613e57868
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 17 Mar 2024 19:45:00 -0600
Received: from mail-ua1-f43.google.com ([209.85.222.43]:42307)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rm239-000000008AB-3eMI
for dave@doctor.nl2k.ab.ca;
Sun, 17 Mar 2024 19:44:32 -0600
Received: by mail-ua1-f43.google.com with SMTP id a1e0cc1a2514c-7e043f577c5so809841241.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1710726146; x=1711330946; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=/XMJfvIFh3hE2nQIuR3SkLXyBsnuOsH7K8Hr+ejfBaA=;
b=W5hR/6R4gklGcPiQFqs/PMxnomE8fvIsGtDFSl+OZt4OTxybE1FKcvkIv5Su4eqyA3
BuvUS4kSrPWwGAIlJCWH5yDtb+SB8OX+HRZ0UoqimFHWelChXYTsJba11IR3WFMPpcpJ
0QtuRvpcmd6MpzHKXXe9v3xIz71AanG9FU+GrMqhu3mTX/n3VFto87tLWS+OWe1HNpZy
ybuIXzlamNboupzKCP5MOgoIW/Cg2Bn+HwDW53LprOR+GXi04Q6zlysI63hRDfrBcNxT
xY8yem55/wFqMIZo2qJLHQmL8YENQOF+3CMncjk8wqqUai16AbVzA4AHJGFKqqweek2f
3kRQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1710726146; x=1711330946;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=/XMJfvIFh3hE2nQIuR3SkLXyBsnuOsH7K8Hr+ejfBaA=;
b=ehjgLlx/GIc6DxUWRt4KKbLLMJV2fJPQCZk1D8wbpurHaH+EZNtZr6Jh5cZpMkQ7KL
o3eH7e2d4QISbZURiamQBNO7o/m5je0h1M0Lbezs3N3xfwAFrWXpnHFWm/b68223Sfdw
YnoqumAFCaZy9PmwoxUUpGefEae/+2WBSNRV1eqzhq4NkcUQLGI68yoac8jH0wPrc0UV
p9IKMG1iWKcj1qyhUQuT4AovzBWhpXNOa5jcKnY8KKA0tPpiymp9jiKB6DWroOt8diVv
w1eu3qNYjjErD0Bj1L0qpdQKFqWl94cGGF67O4dYygShWINnZQkeV8SeRHbRSjMJtRKk
JHAQ==
X-Forwarded-Encrypted: i=1; AJvYcCVB9TOWLw2FPj011SymOvOqKQl8yt73os2yirSIOAKTSGi8Xwmo8o/hqPU8kPNe5vPC8PWkJ4cRBsmOxIkI+kVDfWULGo5G
X-Gm-Message-State: AOJu0Yzqg3ykv7h1CNaibMvGcelF33jFSLJ1gEt70ZTYWJssMU/eqPR7
VyJuEL6CTEXMPe45Da+VeA1qVKKTo+PlL6Y5ZybVJ+Bpt75XfN0Yxoh2Scg5aIPR5JAibVtRfpX
axhsdDWYKze1Jle5R9XE0Uwix0LY=
X-Google-Smtp-Source: AGHT+IGLNhF2XdSVkvlKpayYeZcc3QYk7wKf46DmBx0jopAO3kivS0xBmNCDRWxJKb2xwymv5IYl5ME+Sym7u55HZtk=
X-Received: by 2002:a05:6102:365:b0:474:c681:9380 with SMTP id
f5-20020a056102036500b00474c6819380mr7227260vsa.15.1710726146041; Sun, 17 Mar
2024 18:42:26 -0700 (PDT)
MIME-Version: 1.0
Reply-To: AdeleElla1@mail.com
From: European Investment Bank
Date: Sun, 17 Mar 2024 18:42:10 -0700
Message-ID:
Subject: European Investment Bank
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000003e312f0613e57868"
Bcc: dave@doctor.nl2k.ab.ca
X-Spam_score: 16.5
X-Spam_score_int: 165
X-Spam_bar: ++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: *Attention: beneficiary of the fund,We have mandated the European
Investment Bank in London and the IMF to investigate the reason for the unnecessary
delay in disbursements authorized by law. During o [...]
Content analysis details: (16.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.222.43 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.222.43 listed in wl.mailspike.net]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[adeleella1(at)mail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[michaelstan449(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[michaelstan449(at)gmail.com]
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.9 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 XFER_LOTSA_MONEY Transfer a lot of money
2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
Subject: {SPAM?} European Investment Bank
--0000000000003e312f0613e57868
Content-Type: text/plain; charset="UTF-8"
Attention: beneficiary of the fund,We have mandated the European
Investment Bank in London and the IMF to investigate the reason for the
unnecessary delay in disbursements authorized by law. During our
investigation, we discovered that your payment was delayed by corrupt bank
officials who tried to divert your money to their personal accounts.To
prevent this suspicious act, we have agreed with the European Investment
Bank in London and the International Monetary Fund (IMF) that we can manage
and monitor this payment. Avoid desperate situations with banks and other
authorities in criminal cases.We have received an irrevocable payment
guarantee for your MFD payment. We hereby inform you that the European
Investment Bank has decided to compensate you in the amount of USD
2,000,000.00 and transfer it to your bank account via bank transfer.please
contact the Corresponding Bank Customer care services, Ms. Adele Ella via
the email belowemail: AdeleElla1@mail.com
contact the above bank immediately for final release and transfer of funds.
The European Investment Bank must transfer its funds to your bank account
without delay.I expect your prompt cooperation.Thank you.
--0000000000003e312f0613e57868
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Attention: beneficiary of=
the fund,
We have mandated the European Investment Bank in London and t=
he IMF to investigate the reason for the unnecessary delay in disbursements=
authorized by law. During our investigation, we discovered that your payme=
nt was delayed by corrupt bank officials who tried to divert your money to =
their personal accounts.
To prevent this suspicious act, we have agr=
eed with the European Investment Bank in London and the International Monet=
ary Fund (IMF) that we can manage and monitor this payment. Avoid desperate=
situations with banks and other authorities in criminal cases.
We h=
ave received an irrevocable payment guarantee for your MFD payment. We here=
by inform you that the European Investment Bank has decided to compensate y=
ou in the amount of USD 2,000,000.00 and transfer it to your bank account v=
ia bank transfer.
please contact the Corresponding Bank Customer care se=
rvices, Ms. Adele Ella via the email below
email: =C2=A0
o:AdeleElla1@mail.com">AdeleElla1@mail.com
Be sure to contact the ab=
ove bank immediately for final release and transfer of funds. The European =
Investment Bank must transfer its funds to your bank account without delay.=
I expect your prompt cooperation.
Thank you.
<=
/div>
--0000000000003e312f0613e57868--
the fund,
We have mandated the European Investment Bank in London and t=
he IMF to investigate the reason for the unnecessary delay in disbursements=
authorized by law. During our investigation, we discovered that your payme=
nt was delayed by corrupt bank officials who tried to divert your money to =
their personal accounts.
To prevent this suspicious act, we have agr=
eed with the European Investment Bank in London and the International Monet=
ary Fund (IMF) that we can manage and monitor this payment. Avoid desperate=
situations with banks and other authorities in criminal cases.
We h=
ave received an irrevocable payment guarantee for your MFD payment. We here=
by inform you that the European Investment Bank has decided to compensate y=
ou in the amount of USD 2,000,000.00 and transfer it to your bank account v=
ia bank transfer.
please contact the Corresponding Bank Customer care se=
rvices, Ms. Adele Ella via the email below
email: =C2=A0
o:AdeleElla1@mail.com">AdeleElla1@mail.com
Be sure to contact the ab=
ove bank immediately for final release and transfer of funds. The European =
Investment Bank must transfer its funds to your bank account without delay.=
I expect your prompt cooperation.
Thank you.
<=
/div>
--0000000000003e312f0613e57868--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments