National Bank Phish
Posted by Dave Yadallee on
From - Sat May 25 07:47:01 2013
X-Account-Key: account1
X-UIDL: 00001ac84f5d9180
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Received: from localhost by doctor.nl2k.ab.ca
with SpamAssassin (version 3.3.2);
Wed, 22 May 2013 04:42:51 -0600
From: "National City Bank"
Subject: [Norton AntiSpam]*SPAM* REF: YOUR PAYMENT VIA NATIONAL CITY BANK MASTERCARD DEBIT CARD
Date: Wed, 22 May 2013 05:24:35 -0500
Message-Id:
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca
X-Spam-Flag: YES
X-Spam-Level: **************************************************
X-Spam-Status: Yes, score=95.2 required=5.0 tests=BOTNET,FORGED_MUA_OUTLOOK,
FORGED_OUTLOOK_TAGS,RELAY_CHECKER_BADDNS,RELAY_CHECKER_IPHOSTNAME,
SARE_FRAUD_X3,SARE_FRAUD_X4 autolearn=unavailable version=3.3.2
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_519CA12B.8CE01B1D"
X-Antivirus: AVG for E-mail 10.0.1432 [3184/5854]
X-AVG-ID: ID4C23AC94-6C49845C
X-Brightmail-Tracker: AAAACx3E6AodxOgBHcU1oh3FMMEdxTEFHcU0UR3FYN4dxWDvHcVg8x3FYAwdxWDN
This is a multi-part message in MIME format.
------------=_519CA12B.8CE01B1D
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: National City Bank Group. No. 1, Idowu Taylor Street Victoria
Island, Lagos, Nigeria. [...]
Content analysis details: (95.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 BOTNET Relay might be a spambot or virusbot
[botnet0.8,ip=92.51.198.162,rdns=ip-92-51-198-162.broadband.digiweb.ie,baddns,client,ipinhostname,clientwords]
0.0 RELAY_CHECKER_IPHOSTNAME Hostname contains IP address
0.0 RELAY_CHECKER_BADDNS Doesn't have full circle DNS
0.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
45 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam
45 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam
4.2 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_519CA12B.8CE01B1D
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Return-Path:
X-Original-To: dave@doctor.nl2k.ab.ca
Delivered-To: dave@doctor.nl2k.ab.ca
Received: from nkcommunications.ie (unknown [92.51.198.162])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id E876712CFAFE
for; Wed, 22 May 2013 04:42:35 -0600 (MDT)
Received: from User ([97.67.199.242]) by nkcommunications.ie with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 22 May 2013 11:17:37 +0100
Reply-To:
From: "National City Bank"
Subject: REF: YOUR PAYMENT VIA NATIONAL CITY BANK MASTERCARD DEBIT CARD
Date: Wed, 22 May 2013 05:24:35 -0500
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID:
X-OriginalArrivalTime: 22 May 2013 10:17:38.0031 (UTC) FILETIME=[95B987F0:01CE56D5]
X-Virus-Scanned: clamav-milter 0.97.8-exp-debug at doctor.nl2k.ab.ca
X-Virus-Status: Clean
National City Bank Group.
No. 1, Idowu Taylor Street
Victoria Island, Lagos, Nigeria.
TEL: +234-708-901-5144
Email: ncb001@live.com
Ref: NCB/CMB/324/09
Dear Beneficiary,
REF: YOUR PAYMENT VIA NATIONAL CITY BANK MASTERCARD DEBIT CARD
This to acknowledge you that your e-mail address is found among those that have been scammed, and the competition have been approved from the supreme high court here in Nigeria and we are asked to contact you by the Nigeria president on how to send you the ($1,000,000.00) via ATM DEBIT MASTER CARD.
Due to the numerous fraudulent activities, we have resolved to implement the use of ATM DEBIT MasterCard for the release of your payment which will be issued by our bank National City Bank {NCB}.
In this proposed payment scheme, your funds will be credited into a Citibank MasterCard account which will enable you either to make withdrawals at any ATM point or at any Citibank branch close to you.
This is a Citibank new working initiative with the Nigeria government which was put in place to curb the constant fraud activities associated with payments such as this.
However for the purpose of official verification among other relevant details, it is imperative that you supply us with the following requirements:
1. YOUR FULL NAME(S) AS WOULD REFLECT ON YOUR CARD.
2. FULL ADDRESS (SAFE FOR THE DELIVERY OF YOUR CARD)
3. TELEPHONE AND FAX NUMBERS
4. ANY FORM OF IDENTIFICATION.
Your card will come with an already programmed pin. You will be required to change this pin to any four digit of your choice at any Citibank branch close to you.
All legal documentation including the anti money laundering your favor are intact. On receipt of your response, further directives shall be made available to you.
Yours Faithfully,
MR. Barry Wilson.
National City Bank Nigeria.
E-MAIL: ncb001@live.com
PRIVATE TEL: +234-708-901-5144
------------=_519CA12B.8CE01B1D
Content-Type: multipart/alternative;
boundary="=======AVGMAIL-1CE8D137======="
--=======AVGMAIL-1CE8D137=======
Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "Certification"
-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13=
--=======AVGMAIL-1CE8D137=======--
------------=_519CA12B.8CE01B1D
Content-Type: multipart/alternative;
boundary="=======AVGMAIL-17961AAB======="
--=======AVGMAIL-17961AAB=======
Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "Certification"
-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13=
--=======AVGMAIL-17961AAB=======--
------------=_519CA12B.8CE01B1D--
X-Account-Key: account1
X-UIDL: 00001ac84f5d9180
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Received: from localhost by doctor.nl2k.ab.ca
with SpamAssassin (version 3.3.2);
Wed, 22 May 2013 04:42:51 -0600
From: "National City Bank"
Subject: [Norton AntiSpam]*SPAM* REF: YOUR PAYMENT VIA NATIONAL CITY BANK MASTERCARD DEBIT CARD
Date: Wed, 22 May 2013 05:24:35 -0500
Message-Id:
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca
X-Spam-Flag: YES
X-Spam-Level: **************************************************
X-Spam-Status: Yes, score=95.2 required=5.0 tests=BOTNET,FORGED_MUA_OUTLOOK,
FORGED_OUTLOOK_TAGS,RELAY_CHECKER_BADDNS,RELAY_CHECKER_IPHOSTNAME,
SARE_FRAUD_X3,SARE_FRAUD_X4 autolearn=unavailable version=3.3.2
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_519CA12B.8CE01B1D"
X-Antivirus: AVG for E-mail 10.0.1432 [3184/5854]
X-AVG-ID: ID4C23AC94-6C49845C
X-Brightmail-Tracker: AAAACx3E6AodxOgBHcU1oh3FMMEdxTEFHcU0UR3FYN4dxWDvHcVg8x3FYAwdxWDN
This is a multi-part message in MIME format.
------------=_519CA12B.8CE01B1D
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: National City Bank Group. No. 1, Idowu Taylor Street Victoria
Island, Lagos, Nigeria. [...]
Content analysis details: (95.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 BOTNET Relay might be a spambot or virusbot
[botnet0.8,ip=92.51.198.162,rdns=ip-92-51-198-162.broadband.digiweb.ie,baddns,client,ipinhostname,clientwords]
0.0 RELAY_CHECKER_IPHOSTNAME Hostname contains IP address
0.0 RELAY_CHECKER_BADDNS Doesn't have full circle DNS
0.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
45 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam
45 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam
4.2 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_519CA12B.8CE01B1D
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Return-Path:
X-Original-To: dave@doctor.nl2k.ab.ca
Delivered-To: dave@doctor.nl2k.ab.ca
Received: from nkcommunications.ie (unknown [92.51.198.162])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id E876712CFAFE
for
Received: from User ([97.67.199.242]) by nkcommunications.ie with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 22 May 2013 11:17:37 +0100
Reply-To:
From: "National City Bank"
Subject: REF: YOUR PAYMENT VIA NATIONAL CITY BANK MASTERCARD DEBIT CARD
Date: Wed, 22 May 2013 05:24:35 -0500
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID:
X-OriginalArrivalTime: 22 May 2013 10:17:38.0031 (UTC) FILETIME=[95B987F0:01CE56D5]
X-Virus-Scanned: clamav-milter 0.97.8-exp-debug at doctor.nl2k.ab.ca
X-Virus-Status: Clean
National City Bank Group.
No. 1, Idowu Taylor Street
Victoria Island, Lagos, Nigeria.
TEL: +234-708-901-5144
Email: ncb001@live.com
Ref: NCB/CMB/324/09
Dear Beneficiary,
REF: YOUR PAYMENT VIA NATIONAL CITY BANK MASTERCARD DEBIT CARD
This to acknowledge you that your e-mail address is found among those that have been scammed, and the competition have been approved from the supreme high court here in Nigeria and we are asked to contact you by the Nigeria president on how to send you the ($1,000,000.00) via ATM DEBIT MASTER CARD.
Due to the numerous fraudulent activities, we have resolved to implement the use of ATM DEBIT MasterCard for the release of your payment which will be issued by our bank National City Bank {NCB}.
In this proposed payment scheme, your funds will be credited into a Citibank MasterCard account which will enable you either to make withdrawals at any ATM point or at any Citibank branch close to you.
This is a Citibank new working initiative with the Nigeria government which was put in place to curb the constant fraud activities associated with payments such as this.
However for the purpose of official verification among other relevant details, it is imperative that you supply us with the following requirements:
1. YOUR FULL NAME(S) AS WOULD REFLECT ON YOUR CARD.
2. FULL ADDRESS (SAFE FOR THE DELIVERY OF YOUR CARD)
3. TELEPHONE AND FAX NUMBERS
4. ANY FORM OF IDENTIFICATION.
Your card will come with an already programmed pin. You will be required to change this pin to any four digit of your choice at any Citibank branch close to you.
All legal documentation including the anti money laundering your favor are intact. On receipt of your response, further directives shall be made available to you.
Yours Faithfully,
MR. Barry Wilson.
National City Bank Nigeria.
E-MAIL: ncb001@live.com
PRIVATE TEL: +234-708-901-5144
------------=_519CA12B.8CE01B1D
Content-Type: multipart/alternative;
boundary="=======AVGMAIL-1CE8D137======="
--=======AVGMAIL-1CE8D137=======
Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "Certification"
-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13=
--=======AVGMAIL-1CE8D137=======--
------------=_519CA12B.8CE01B1D
Content-Type: multipart/alternative;
boundary="=======AVGMAIL-17961AAB======="
--=======AVGMAIL-17961AAB=======
Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "Certification"
-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13=
--=======AVGMAIL-17961AAB=======--
------------=_519CA12B.8CE01B1D--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments