Well Fargo UN Phish
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 22 Jul 2022 08:14:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oEtPB-000Pq1-Sy
for dave@doctor.nl2k.ab.ca;
Fri, 22 Jul 2022 08:13:25 -0600
Resent-From: The Doctor
Resent-Date: Fri, 22 Jul 2022 08:13:25 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oi1-f194.google.com ([209.85.167.194]:33521)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1oEpLW-000KrW-BB
for root@doctor.nl2k.ab.ca;
Fri, 22 Jul 2022 03:53:27 -0600
Received: by mail-oi1-f194.google.com with SMTP id s188so5125205oie.0
for; Fri, 22 Jul 2022 02:53:01 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:reply-to:from:date:message-id:subject:to
:content-transfer-encoding;
bh=Lievo06A9L+P0KlnGB9eb2eUU/0FWAP3zf3ejZPmgDM=;
b=fUhC7CbYL+3rHJAo+sTABh3stUPOq2/CiTIRLJcZIGnThDHHfUQNAbPGbqDtsmaLw0
Zz+//3TithQzAinnB5sVN1RKTRjL48gXeRdPE+vT399LOzqY7n3SvdhOcwMGZlsI2PeK
dqrSgHGKwvpA0qP6j/QoXv57a9We67JMYb2O5p39OtMH9ZICwmE6Y0sjpq0FxcTqaV+k
sbBOG0D+ye4w4bCdvT/YaFKf3vmfaE+ukSL9b8oALMEQa9KlpsNcJyyOLFNCXPID3D1S
YSmsuj+QJB8t5YLZpXf83pCgVCr69KaxcaXoZh1TrpMlyHu/vUR04SsPGTbqhh0WyQRO
X21Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:reply-to:from:date:message-id
:subject:to:content-transfer-encoding;
bh=Lievo06A9L+P0KlnGB9eb2eUU/0FWAP3zf3ejZPmgDM=;
b=hB6M+HLmu8tHKzdQHnEjF+c9MH/rM7N+w6wdsuf2yx8m4rFzGCP9u5rewX4q/i76eX
duDDrdrAYU/9YDbNzEItuoF3KXJOwTEIcRIi3L9iWu1s7MDXtPBgl28zLQe3X2LKPpof
zlu5MhHzRg0cUqVfLcf6B042gbVnLJXSnIHhICj+fnelZi8e9vX4gi89w/RqE5/yEOlb
rzSKXPGNUi2QwhkiQuwzTK/4sQDOrImJq16t1iZOh41fHuIP1eN94MxWN42r78AXGgEU
ODjoRtAMS5JcVQ7Z5gyGqbXEI7vrLVE9VUjGy4GR3mmisb34XKgnZtFWbF4Ht5aqhRcJ
mUeQ==
X-Gm-Message-State: AJIora+b1/eQnvQ3z7/1aZ5nojiy1dl/27IBL3Rr0Ga0JzjpHIQ1GoLO
u/3oOeGMsgmRBmgAO02C7K6rNsSlZCr1IPxgIow=
X-Google-Smtp-Source: AGRyM1uxd+TK2PxOgiI12M4FGCXQoExssPE/kv/lsBhan/5VOkG1W7JJt9lj/OGfEyoez8CcwJWDrd+U/J+Dde7nc5M=
X-Received: by 2002:aca:eb45:0:b0:33a:6c4a:3224 with SMTP id
j66-20020acaeb45000000b0033a6c4a3224mr6737273oih.272.1658483575042; Fri, 22
Jul 2022 02:52:55 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6358:9103:b0:af:d05f:987e with HTTP; Fri, 22 Jul 2022
02:52:54 -0700 (PDT)
Reply-To: fargobank@yahoo.com
From: Wells Fargo Bank
Date: Fri, 22 Jul 2022 02:52:54 -0700
Message-ID:
Subject: Wells Fargo Notify You
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Bcc: root@doctor.nl2k.ab.ca
X-Spam_score: 24.4
X-Spam_score_int: 244
X-Spam_bar: ++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Congratulations!! Your payment has been approved and endorsed
by the United Nation Organization authorities, Your details information has
been confirmed with the instruction and approvals given from International
Monetary Fund and Federal Bureau Investigation (FBI, Washington DC, USA regards
the deposited of [...]
Content analysis details: (24.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.167.194 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[unionw366[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[unionw366[at]gmail.com]
1.1 HK_SCAM_N3 BODY: No description available.
2.0 TVD_PH_REC BODY: Message includes a phrase commonly used in
phishing mails
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as
"accounts suspended", "account credited",
"account verification"
2.0 HK_SCAM No description available.
2.9 YOU_INHERIT Discussing your inheritance
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.1 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal
information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Wells Fargo Notify You
Congratulations!!
Your payment has been approved and endorsed by the United Nation
Organization authorities,
Your details information has been confirmed with the instruction and
approvals given from International Monetary Fund and Federal Bureau
Investigation (FBI, Washington DC, USA regards the deposited of fund
from IMF, sum US$10,700,000.00. as full payment of your inheritance
fund.
Due to the incessant scam activities going around the globe, Federal
Bureau Investigation (FBI) and Homeland Security Director, MG Timothy
J. Weinberg, Adjutant General and Director State Military Department
,Washington Military Dept., Bldg 1 Camp Murray, WA 98430-5000 has
instructed our Financial Institution to use high Performance in
Banking System set up Barclay=E2=80=99s Personal On-line Banking Account.
The sum of US$10,700,000.00 was was deposited in our bank and we have
been instructed to pay your directly via personal on-line bank
The Management has resolved to open Personal On-line Banking Account
for you with our bank and then give you the on-line access which will
enable you to check and make electronics wire transfer out to any part
of the world of your choice.
We are going to have this account open on your name as soon as you
reply to this important e-mail and give you your new open account
information=E2=80=99s for your record.
Once we show you prove of fund by giving you the new Personal On-line
Account and your real account balance of US$10,700,000.00 which is
your Part payment of the full amount credited to you
We are only given you the benefit of doubt by agreeing in showing you
that we are capable of opening the new account on your behalf and give
you the full on line access for your record.
Let me know that you agree and understand the important of this matter
before we go ahead and get this matter completed for you because we
are professional in handling international matters like this.
Kindly Send the Above information to enable us set the account open for you=
.
Full Name:
Full Address:
Direct Telephone Number:
Please, reconfirm your direct cell phone number to enable voice communicati=
on
Looking forward for your next letter
Thank you for your patient.
Regards
Mr Steven Sharma
PLEASE SEND YOUR NAME AS IT IS CLEARLY WRITTEN IN YOUR PASSPORT AND ID
CARDS SO THAT WE WILL NOT MAKE MISTAKE IN OPENING OF THE NON
RESIDENTIAL BANK ACCOUNT UNDER YOUR NAME
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 22 Jul 2022 08:14:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oEtPB-000Pq1-Sy
for dave@doctor.nl2k.ab.ca;
Fri, 22 Jul 2022 08:13:25 -0600
Resent-From: The Doctor
Resent-Date: Fri, 22 Jul 2022 08:13:25 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oi1-f194.google.com ([209.85.167.194]:33521)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1oEpLW-000KrW-BB
for root@doctor.nl2k.ab.ca;
Fri, 22 Jul 2022 03:53:27 -0600
Received: by mail-oi1-f194.google.com with SMTP id s188so5125205oie.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:reply-to:from:date:message-id:subject:to
:content-transfer-encoding;
bh=Lievo06A9L+P0KlnGB9eb2eUU/0FWAP3zf3ejZPmgDM=;
b=fUhC7CbYL+3rHJAo+sTABh3stUPOq2/CiTIRLJcZIGnThDHHfUQNAbPGbqDtsmaLw0
Zz+//3TithQzAinnB5sVN1RKTRjL48gXeRdPE+vT399LOzqY7n3SvdhOcwMGZlsI2PeK
dqrSgHGKwvpA0qP6j/QoXv57a9We67JMYb2O5p39OtMH9ZICwmE6Y0sjpq0FxcTqaV+k
sbBOG0D+ye4w4bCdvT/YaFKf3vmfaE+ukSL9b8oALMEQa9KlpsNcJyyOLFNCXPID3D1S
YSmsuj+QJB8t5YLZpXf83pCgVCr69KaxcaXoZh1TrpMlyHu/vUR04SsPGTbqhh0WyQRO
X21Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:reply-to:from:date:message-id
:subject:to:content-transfer-encoding;
bh=Lievo06A9L+P0KlnGB9eb2eUU/0FWAP3zf3ejZPmgDM=;
b=hB6M+HLmu8tHKzdQHnEjF+c9MH/rM7N+w6wdsuf2yx8m4rFzGCP9u5rewX4q/i76eX
duDDrdrAYU/9YDbNzEItuoF3KXJOwTEIcRIi3L9iWu1s7MDXtPBgl28zLQe3X2LKPpof
zlu5MhHzRg0cUqVfLcf6B042gbVnLJXSnIHhICj+fnelZi8e9vX4gi89w/RqE5/yEOlb
rzSKXPGNUi2QwhkiQuwzTK/4sQDOrImJq16t1iZOh41fHuIP1eN94MxWN42r78AXGgEU
ODjoRtAMS5JcVQ7Z5gyGqbXEI7vrLVE9VUjGy4GR3mmisb34XKgnZtFWbF4Ht5aqhRcJ
mUeQ==
X-Gm-Message-State: AJIora+b1/eQnvQ3z7/1aZ5nojiy1dl/27IBL3Rr0Ga0JzjpHIQ1GoLO
u/3oOeGMsgmRBmgAO02C7K6rNsSlZCr1IPxgIow=
X-Google-Smtp-Source: AGRyM1uxd+TK2PxOgiI12M4FGCXQoExssPE/kv/lsBhan/5VOkG1W7JJt9lj/OGfEyoez8CcwJWDrd+U/J+Dde7nc5M=
X-Received: by 2002:aca:eb45:0:b0:33a:6c4a:3224 with SMTP id
j66-20020acaeb45000000b0033a6c4a3224mr6737273oih.272.1658483575042; Fri, 22
Jul 2022 02:52:55 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6358:9103:b0:af:d05f:987e with HTTP; Fri, 22 Jul 2022
02:52:54 -0700 (PDT)
Reply-To: fargobank@yahoo.com
From: Wells Fargo Bank
Date: Fri, 22 Jul 2022 02:52:54 -0700
Message-ID:
Subject: Wells Fargo Notify You
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Bcc: root@doctor.nl2k.ab.ca
X-Spam_score: 24.4
X-Spam_score_int: 244
X-Spam_bar: ++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Congratulations!! Your payment has been approved and endorsed
by the United Nation Organization authorities, Your details information has
been confirmed with the instruction and approvals given from International
Monetary Fund and Federal Bureau Investigation (FBI, Washington DC, USA regards
the deposited of [...]
Content analysis details: (24.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.167.194 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[unionw366[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[unionw366[at]gmail.com]
1.1 HK_SCAM_N3 BODY: No description available.
2.0 TVD_PH_REC BODY: Message includes a phrase commonly used in
phishing mails
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as
"accounts suspended", "account credited",
"account verification"
2.0 HK_SCAM No description available.
2.9 YOU_INHERIT Discussing your inheritance
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.1 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal
information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Wells Fargo Notify You
Congratulations!!
Your payment has been approved and endorsed by the United Nation
Organization authorities,
Your details information has been confirmed with the instruction and
approvals given from International Monetary Fund and Federal Bureau
Investigation (FBI, Washington DC, USA regards the deposited of fund
from IMF, sum US$10,700,000.00. as full payment of your inheritance
fund.
Due to the incessant scam activities going around the globe, Federal
Bureau Investigation (FBI) and Homeland Security Director, MG Timothy
J. Weinberg, Adjutant General and Director State Military Department
,Washington Military Dept., Bldg 1 Camp Murray, WA 98430-5000 has
instructed our Financial Institution to use high Performance in
Banking System set up Barclay=E2=80=99s Personal On-line Banking Account.
The sum of US$10,700,000.00 was was deposited in our bank and we have
been instructed to pay your directly via personal on-line bank
The Management has resolved to open Personal On-line Banking Account
for you with our bank and then give you the on-line access which will
enable you to check and make electronics wire transfer out to any part
of the world of your choice.
We are going to have this account open on your name as soon as you
reply to this important e-mail and give you your new open account
information=E2=80=99s for your record.
Once we show you prove of fund by giving you the new Personal On-line
Account and your real account balance of US$10,700,000.00 which is
your Part payment of the full amount credited to you
We are only given you the benefit of doubt by agreeing in showing you
that we are capable of opening the new account on your behalf and give
you the full on line access for your record.
Let me know that you agree and understand the important of this matter
before we go ahead and get this matter completed for you because we
are professional in handling international matters like this.
Kindly Send the Above information to enable us set the account open for you=
.
Full Name:
Full Address:
Direct Telephone Number:
Please, reconfirm your direct cell phone number to enable voice communicati=
on
Looking forward for your next letter
Thank you for your patient.
Regards
Mr Steven Sharma
PLEASE SEND YOUR NAME AS IT IS CLEARLY WRITTEN IN YOUR PASSPORT AND ID
CARDS SO THAT WE WILL NOT MAKE MISTAKE IN OPENING OF THE NON
RESIDENTIAL BANK ACCOUNT UNDER YOUR NAME
