Beneficiary spam from Google
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 21 Aug 2022 00:54:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oPepg-0007zZ-Er
for dave@doctor.nl2k.ab.ca;
Sun, 21 Aug 2022 00:53:16 -0600
Resent-From: The Doctor
Resent-Date: Sun, 21 Aug 2022 00:53:16 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pf1-f193.google.com ([209.85.210.193]:41573)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1oPcLp-000AFy-Tv
for doctor@doctor.nl2k.ab.ca;
Sat, 20 Aug 2022 22:14:23 -0600
Received: by mail-pf1-f193.google.com with SMTP id g129so4209685pfb.8
for; Sat, 20 Aug 2022 21:14:00 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=content-transfer-encoding:to:subject:message-id:date:from:reply-to
:mime-version:from:to:cc;
bh=2qtSM8xa4mSc1V9Z2jmQsjOhGcJrrnmVEKtl/AENu8w=;
b=DGZkje8Bi4hR7fQj/RH7eadOf/RQHONoyJZ1QyxrK9lLHKmS3so7mLwdVn3Omd2WE0
s7DWuD0mNABhru3gLpUK4kPpq4N+Ogad+8A7vgvPl5fRVz/rxDgBAYTTcQYgJvqneh9b
32b3/d6JviALQC5A8GObgS60bwKlwSBIQJy1vTkBtKfu0QTOYYcnhJ/tAmu9jKCKKhep
WlGhx2SLElLfL1Nl/f1yD3sb9oMai2PLCudhQahCt4UtM4CzZ9IMHJCzUwMorBPvTEqz
2lzD1T9/A8oQ0GecsYvrgklIYUjrt/KqS+yjBCFthYvJ3BdWgRCQIzjGi0tJ0iUNF/wc
HDDg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=content-transfer-encoding:to:subject:message-id:date:from:reply-to
:mime-version:x-gm-message-state:from:to:cc;
bh=2qtSM8xa4mSc1V9Z2jmQsjOhGcJrrnmVEKtl/AENu8w=;
b=iSrWm6yljJGxG2f3adMpA4B9opVI21WfCnph3y2F/FTRVCJnh7DIShqLA1YC9eKdcL
K4od4NV0T3PoORQmDEQ3djY9mLtdzzEst+kQX/6AA/W23WfoiV4g2tfvuu2JBrMHPiUc
mkSu7KUGba8DPlYQ3s2C4MGwpUYge86rLzRt5ap5IQ+HnfDnRpOXVDpSsaDvxHsabqXl
Lm84AslErWpzAdPe+XqV7JDTloEjefZzRUjyHsIreG25aj5Hh/tKNW9GOpBtJAighgr8
Mf/ThrPLatsrMJpQ5aTPaAG1nlmyf4JLS2ANbyAtbZMESSn048QFrW8YJ/BKVH2CEf4u
Fx6A==
X-Gm-Message-State: ACgBeo10NGY1Jnq2NxYur/378KuWPTFykluNUCYwi5blMY+zK633jTHF
3E3RbZEo3jdqmRORbbEvvfHEyVRBmTCmZp+ifNc=
X-Google-Smtp-Source: AA6agR6zw1YvTRqbRXQmT1kPdpazEbaDaI3Yag7XCH/68u9WXU7lPoWKsxOfwlZ8PQuQjxb2NVN2QnvwNlP8JsjJ5pg=
X-Received: by 2002:a63:ad0d:0:b0:41d:433:8c42 with SMTP id
g13-20020a63ad0d000000b0041d04338c42mr12043451pgf.105.1661055234859; Sat, 20
Aug 2022 21:13:54 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a17:902:710e:b0:172:93a0:516 with HTTP; Sat, 20 Aug 2022
21:13:54 -0700 (PDT)
Reply-To: assetscontrol89@gmail.com
From: Global Offshore Financial Centre
Date: Sun, 21 Aug 2022 05:13:54 +0100
Message-ID:
Subject: ARE YOU DEAD OR ALIVE ? CONFIRMATION OF YOUR FUND TRANSFER
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 17.6
X-Spam_score_int: 176
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attn: Funds Beneficiary, ARE YOU DEAD OR ALIVE ? CONFIRMATION
OF YOUR FUND TRANSFER Our Ref: gofc/frb/bofa/643-12-XX Q1/X/200696/101 Dear
Funds Beneficiary,
Content analysis details: (17.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.6 HK_RANDOM_ENVFROM Envelope sender username looks random
1.0 HK_RANDOM_FROM From username looks random
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: vtb.ru]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.210.193 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[remitdiptworldbnk[at]gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[assetscontrol89[at]gmail.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
-0.0 SPF_PASS SPF: sender matches SPF record
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
1.1 HK_SCAM_N3 BODY: No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 HK_SCAM No description available.
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal
information
2.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} ARE YOU DEAD OR ALIVE ? CONFIRMATION OF YOUR FUND TRANSFER
Attn: Funds Beneficiary, ARE YOU DEAD OR ALIVE ? CONFIRMATION OF YOUR
FUND TRANSFER
Our Ref: gofc/frb/bofa/643-12-XX Q1/X/200696/101
Dear Funds Beneficiary,
RE: ARE YOU DEAD OR ALIVE ? CONFIRMATION OF YOUR FUND TRANSFER
In the course of our General Auditing and Accounts revision of this
new quarter of the year 2022, we discovered that the Bank Accounts
belonging to some Beneficiaries have been changed on the basis that
the owners have DIED after contacting COVID =E2=80=9919 (without leaving a
WILL) some time last year (2021) or have given out an authorization
note of change of data shortly before their death.
After the investigations however, it was revealed that there are
Foreigners who are collaborating with Retired or former Staff to make
these changes illegally without the knowledge of the Bonafide
Beneficiaries and there is one suck alterations traced to your data
been changed to one Mr. Gubochkin Andrei Nikolaevich of Address-
Russia city Naberezhnye Chelny, RUSSIA who said you are dead, hence
they have tried to prove bearing your name so as to divert your
proposed funds, IT WAS STATED THAT YOU DIED OF HEART FAILURE caused by
COVID=E2=80=9919 Infection.
They have also forwarded the bank account below as the new account
that will receive this fund / money.
Account details:
Beneficiary account number: 40817840922646001045
Number VISACard: 4893 4704 3599 3388
Beneficiary: Gubochkin Andrei Nikolaevich
Beneficiary`s bank: VTB (Public Joint- Stok Company)
Beneficiary SWIFT: VTBRRUM2SA3
Address - 191144, St. Petersburg, Degtyarny lane, 11, lit. A
Tel 8 (800) 100-24-24 (free call within Russia) 8 (495) 777-24-24
Email: info@vtb.ru (for inquiries and suggestions) compliance@vtb.ru
(for insiders)
Website: www.vtb.ru
Correspondent bank: CITIBANK NA, New York, USA
Correspondent SWIFT: CITIUS33
Account with correspondent bank number: 36208997
But we wanted to confirm once again if actually this is true and
decided to write to your email address for confirmation, which after
48 hours from today and there is no response, we shall then carry out
payment in their favour.
If proved otherwise by you that you did not die, please forward to us
all your related details including your full names, direct telephone
numbers, contact address, copy of your ID and also details of your
payment. These details from you will help to assist us reach a
conclusion that you are not dead and that the fund in question belongs
to you.
Anything contrary to this claim will help us charge this man to court
and prosecute him while your fund will be paid to you immediately
without any further delay. You have to get back to us on time for us
to commence legal proceedings against Mr. Gubochkin Andrei Nikolaevich
of Address- Russia city Naberezhnye Chelny, RUSSIA and his criminal
associates.
You have 24hours to respond to this message or else we carry out
payment in their favour as the fund has been programmed for payment
this week.
Thanks,
Sincerely Yours,
Senior Manager, Int'l Services
Global Offshore Financial Centre (GOFC)
Add: Columbus, GA 31909, USA
Remarks: The information contained in this message may be privileged
and confidential and protected from disclosure. If the reader of this
message is not the intended recipient, or an employee or agent
responsible for delivering this message to the intended recipient, you
are hereby notified that any dissemination, distribution or copying of
this communication is strictly prohibited. If you have received this
communication in error, please notify us immediately by replying to
this message and deleting it from your computer. Thank you. Copyright
=C2=A9 2022 - Global Offshore Financial Centre, Columbus, GA 31909, USA.
All Rights Reserved.
CC: File
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 21 Aug 2022 00:54:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oPepg-0007zZ-Er
for dave@doctor.nl2k.ab.ca;
Sun, 21 Aug 2022 00:53:16 -0600
Resent-From: The Doctor
Resent-Date: Sun, 21 Aug 2022 00:53:16 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pf1-f193.google.com ([209.85.210.193]:41573)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1oPcLp-000AFy-Tv
for doctor@doctor.nl2k.ab.ca;
Sat, 20 Aug 2022 22:14:23 -0600
Received: by mail-pf1-f193.google.com with SMTP id g129so4209685pfb.8
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=content-transfer-encoding:to:subject:message-id:date:from:reply-to
:mime-version:from:to:cc;
bh=2qtSM8xa4mSc1V9Z2jmQsjOhGcJrrnmVEKtl/AENu8w=;
b=DGZkje8Bi4hR7fQj/RH7eadOf/RQHONoyJZ1QyxrK9lLHKmS3so7mLwdVn3Omd2WE0
s7DWuD0mNABhru3gLpUK4kPpq4N+Ogad+8A7vgvPl5fRVz/rxDgBAYTTcQYgJvqneh9b
32b3/d6JviALQC5A8GObgS60bwKlwSBIQJy1vTkBtKfu0QTOYYcnhJ/tAmu9jKCKKhep
WlGhx2SLElLfL1Nl/f1yD3sb9oMai2PLCudhQahCt4UtM4CzZ9IMHJCzUwMorBPvTEqz
2lzD1T9/A8oQ0GecsYvrgklIYUjrt/KqS+yjBCFthYvJ3BdWgRCQIzjGi0tJ0iUNF/wc
HDDg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=content-transfer-encoding:to:subject:message-id:date:from:reply-to
:mime-version:x-gm-message-state:from:to:cc;
bh=2qtSM8xa4mSc1V9Z2jmQsjOhGcJrrnmVEKtl/AENu8w=;
b=iSrWm6yljJGxG2f3adMpA4B9opVI21WfCnph3y2F/FTRVCJnh7DIShqLA1YC9eKdcL
K4od4NV0T3PoORQmDEQ3djY9mLtdzzEst+kQX/6AA/W23WfoiV4g2tfvuu2JBrMHPiUc
mkSu7KUGba8DPlYQ3s2C4MGwpUYge86rLzRt5ap5IQ+HnfDnRpOXVDpSsaDvxHsabqXl
Lm84AslErWpzAdPe+XqV7JDTloEjefZzRUjyHsIreG25aj5Hh/tKNW9GOpBtJAighgr8
Mf/ThrPLatsrMJpQ5aTPaAG1nlmyf4JLS2ANbyAtbZMESSn048QFrW8YJ/BKVH2CEf4u
Fx6A==
X-Gm-Message-State: ACgBeo10NGY1Jnq2NxYur/378KuWPTFykluNUCYwi5blMY+zK633jTHF
3E3RbZEo3jdqmRORbbEvvfHEyVRBmTCmZp+ifNc=
X-Google-Smtp-Source: AA6agR6zw1YvTRqbRXQmT1kPdpazEbaDaI3Yag7XCH/68u9WXU7lPoWKsxOfwlZ8PQuQjxb2NVN2QnvwNlP8JsjJ5pg=
X-Received: by 2002:a63:ad0d:0:b0:41d:433:8c42 with SMTP id
g13-20020a63ad0d000000b0041d04338c42mr12043451pgf.105.1661055234859; Sat, 20
Aug 2022 21:13:54 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a17:902:710e:b0:172:93a0:516 with HTTP; Sat, 20 Aug 2022
21:13:54 -0700 (PDT)
Reply-To: assetscontrol89@gmail.com
From: Global Offshore Financial Centre
Date: Sun, 21 Aug 2022 05:13:54 +0100
Message-ID:
Subject: ARE YOU DEAD OR ALIVE ? CONFIRMATION OF YOUR FUND TRANSFER
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 17.6
X-Spam_score_int: 176
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attn: Funds Beneficiary, ARE YOU DEAD OR ALIVE ? CONFIRMATION
OF YOUR FUND TRANSFER Our Ref: gofc/frb/bofa/643-12-XX Q1/X/200696/101 Dear
Funds Beneficiary,
Content analysis details: (17.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.6 HK_RANDOM_ENVFROM Envelope sender username looks random
1.0 HK_RANDOM_FROM From username looks random
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: vtb.ru]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.210.193 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[remitdiptworldbnk[at]gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[assetscontrol89[at]gmail.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
-0.0 SPF_PASS SPF: sender matches SPF record
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
1.1 HK_SCAM_N3 BODY: No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 HK_SCAM No description available.
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal
information
2.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} ARE YOU DEAD OR ALIVE ? CONFIRMATION OF YOUR FUND TRANSFER
Attn: Funds Beneficiary, ARE YOU DEAD OR ALIVE ? CONFIRMATION OF YOUR
FUND TRANSFER
Our Ref: gofc/frb/bofa/643-12-XX Q1/X/200696/101
Dear Funds Beneficiary,
RE: ARE YOU DEAD OR ALIVE ? CONFIRMATION OF YOUR FUND TRANSFER
In the course of our General Auditing and Accounts revision of this
new quarter of the year 2022, we discovered that the Bank Accounts
belonging to some Beneficiaries have been changed on the basis that
the owners have DIED after contacting COVID =E2=80=9919 (without leaving a
WILL) some time last year (2021) or have given out an authorization
note of change of data shortly before their death.
After the investigations however, it was revealed that there are
Foreigners who are collaborating with Retired or former Staff to make
these changes illegally without the knowledge of the Bonafide
Beneficiaries and there is one suck alterations traced to your data
been changed to one Mr. Gubochkin Andrei Nikolaevich of Address-
Russia city Naberezhnye Chelny, RUSSIA who said you are dead, hence
they have tried to prove bearing your name so as to divert your
proposed funds, IT WAS STATED THAT YOU DIED OF HEART FAILURE caused by
COVID=E2=80=9919 Infection.
They have also forwarded the bank account below as the new account
that will receive this fund / money.
Account details:
Beneficiary account number: 40817840922646001045
Number VISACard: 4893 4704 3599 3388
Beneficiary: Gubochkin Andrei Nikolaevich
Beneficiary`s bank: VTB (Public Joint- Stok Company)
Beneficiary SWIFT: VTBRRUM2SA3
Address - 191144, St. Petersburg, Degtyarny lane, 11, lit. A
Tel 8 (800) 100-24-24 (free call within Russia) 8 (495) 777-24-24
Email: info@vtb.ru (for inquiries and suggestions) compliance@vtb.ru
(for insiders)
Website: www.vtb.ru
Correspondent bank: CITIBANK NA, New York, USA
Correspondent SWIFT: CITIUS33
Account with correspondent bank number: 36208997
But we wanted to confirm once again if actually this is true and
decided to write to your email address for confirmation, which after
48 hours from today and there is no response, we shall then carry out
payment in their favour.
If proved otherwise by you that you did not die, please forward to us
all your related details including your full names, direct telephone
numbers, contact address, copy of your ID and also details of your
payment. These details from you will help to assist us reach a
conclusion that you are not dead and that the fund in question belongs
to you.
Anything contrary to this claim will help us charge this man to court
and prosecute him while your fund will be paid to you immediately
without any further delay. You have to get back to us on time for us
to commence legal proceedings against Mr. Gubochkin Andrei Nikolaevich
of Address- Russia city Naberezhnye Chelny, RUSSIA and his criminal
associates.
You have 24hours to respond to this message or else we carry out
payment in their favour as the fund has been programmed for payment
this week.
Thanks,
Sincerely Yours,
Senior Manager, Int'l Services
Global Offshore Financial Centre (GOFC)
Add: Columbus, GA 31909, USA
Remarks: The information contained in this message may be privileged
and confidential and protected from disclosure. If the reader of this
message is not the intended recipient, or an employee or agent
responsible for delivering this message to the intended recipient, you
are hereby notified that any dissemination, distribution or copying of
this communication is strictly prohibited. If you have received this
communication in error, please notify us immediately by replying to
this message and deleting it from your computer. Thank you. Copyright
=C2=A9 2022 - Global Offshore Financial Centre, Columbus, GA 31909, USA.
All Rights Reserved.
CC: File