Charity Nigerian Spam from Outlook
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 05 Feb 2023 05:15:07 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pOduv-000JoY-0V
for dave@doctor.nl2k.ab.ca;
Sun, 05 Feb 2023 05:14:45 -0700
Resent-From: The Doctor
Resent-Date: Sun, 5 Feb 2023 05:14:45 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-psaapc01rlhn2189.outbound.protection.outlook.com ([40.95.53.189]:6435 helo=APC01-PSA-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
id 1pOdDW-0001bh-2o
for doctor@doctor.nl2k.ab.ca;
Sun, 05 Feb 2023 04:30:30 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=ggmJ2JxqIuMM9xn4Rbk+QZCq//p0+6s8+MDdt39CjkGgCYvk8Y2cIayRKs1aIOMNKP7JPG8Re6iu2Puytk8VAw0qTLtiP/H8Asi7C+tk3Bc6XqDJYy9lBIAcEK9Lxn3pNHW64mS5o7mmtHOHlwayaRbx8cirtZiD/SJJE1dPLCPh8lg7MxpSY6FLYnf7ax367DiYGw/cqSMX5Uj60BrP99tG76cRo7IkbPlNuyZjsAuMDEJRMmkHXeymq2z9udWvlj+71z5ql7fTjJmq5NgfOoQMBMEJaa3HjanOOCNf9qT7qWz3k3H5SIQ0Nm/Awy8VfC1Oj9Mi9ESU4qbopuLYvg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=/WLJg1J6XeEenLCvwsd5vHnU4Yj9roCiuw7p8mVrNE8=;
b=k52/qLW5oa/PJuXNYnKZlp6YaPES0Zd0KFpuyNNuFXWDs8t/9oRsuMYxZH/pYfhTWHw0ivwTwiHBuPQkCOBOnw+Qxa3i6xaKd/gESw8mboAzSSKjcXiocDT7EE4U4NqmuhMe84sfngBw7E8SWu2+dx9ek4fxrklwQfuYlxcYxmKJt/r5sk5mmjw4grW/UqIDhzo4/kWjBI0b2ThadMVb+dgOHYmaMrUCnNRAzkP/3n3xYpuu8sNXblMTxlY9iOTOEgasLgQfpd2cM0oueUwliFcwguPLNg4KzLJ9oKmMg23PrCJuYAZZW6zy1gbUXhcTDz4dNB38RXBX7TcPUz52+A==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is
210.14.4.59) smtp.rcpttodomain=gsoft.com.au smtp.helo=eop.pldt.com.ph;
dmarc=none; dkim=none (message not signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=PLDT365.onmicrosoft.com; s=selector2-PLDT365-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=/WLJg1J6XeEenLCvwsd5vHnU4Yj9roCiuw7p8mVrNE8=;
b=Y1KZZTNshwo26NJHU6S8FY9SnvDlpxN+HoGKd+tDpPTZH784SyH5AgaAtHSb9+2AbfyfK8jD1o3LbRAT7ER3UGdLI7hv1Tokx5qcNQ9cO6B1SRUjcyMcMIxjlJES+FiySMDVGxkcfcuTcHW9RdS+7OH/9kqo1yU6FNKxpvV6tjI=
Received: from SG2PR02CA0075.apcprd02.prod.outlook.com (2603:1096:4:90::15) by
PUZPR06MB5888.apcprd06.prod.outlook.com (2603:1096:301:11c::15) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6086.11; Sun, 5 Feb
2023 11:27:39 +0000
Received: from SG2APC01FT0034.eop-APC01.prod.protection.outlook.com
(2603:1096:4:90:cafe::96) by SG2PR02CA0075.outlook.office365.com
(2603:1096:4:90::15) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6064.34 via Frontend
Transport; Sun, 5 Feb 2023 11:27:38 +0000
X-MS-Exchange-Authentication-Results: spf=none (sender IP is 210.14.4.59)
smtp.helo=eop.pldt.com.ph; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=;
Received-SPF: None (protection.outlook.com: eop.pldt.com.ph does not designate
permitted sender hosts)
Received: from eop.pldt.com.ph (210.14.4.59) by
SG2APC01FT0034.mail.protection.outlook.com (10.13.37.87) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id
15.20.6064.32 via Frontend Transport; Sun, 5 Feb 2023 11:27:38 +0000
Received: from svrmdbexch01.pldt.pldtgroup.net (10.40.25.45) by
vsmmdbexch04.pldt.pldtgroup.net (10.35.17.53) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id
15.1.2375.17; Sun, 5 Feb 2023 19:27:07 +0800
Received: from vsmmdbexch04.pldt.pldtgroup.net (10.35.17.54) by
svrmdbexch01.pldt.pldtgroup.net (10.40.25.45) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id
15.1.2375.34; Sun, 5 Feb 2023 19:27:06 +0800
Received: from User (10.30.122.252) by vsmmdbexch04.pldt.pldtgroup.net
(10.35.17.53) with Microsoft SMTP Server id 15.1.2375.17 via Frontend
Transport; Sun, 5 Feb 2023 19:26:49 +0800
Reply-To:
From: Marisa Smith
Subject: Requisition Order...
Date: Sun, 5 Feb 2023 03:27:05 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <2e75c8b1-d5a4-458d-92a1-41aadf900665@vsmmdbexch04.pldt.pldtgroup.net>
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: SG2APC01FT0034:EE_|PUZPR06MB5888:EE_
X-MS-Office365-Filtering-Correlation-Id: d1ee0dc0-bc9a-4a09-152f-08db076bfc8e
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 1
X-Forefront-Antispam-Report:
CIP:210.14.4.59;CTRY:PH;LANG:en;SCL:6;SRV:;IPV:NLI;SFV:SPM;H:eop.pldt.com.ph;PTR:InfoDomainNonexistent;CAT:OSPM;SFS:(13230025)(136003)(376002)(396003)(39860400002)(346002)(5005620100009)(109986016)(451199018)(40470700004)(46966006)(41110700001)(31686004)(78352004)(2860700004)(316002)(8676002)(70586007)(7116003)(70206006)(8936002)(41300700001)(31696002)(40460700003)(356005)(81166007)(82740400003)(6666004)(9686003)(26005)(2906002)(7406005)(35950700001)(47076005)(7366002)(40480700001)(7416002)(5660300002)(82310400005)(508600001)(83380400001)(336012)(45080400002)(42882007)(3480700007)(107034002);DIR:OUT;SFP:1023;
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?VMUaTg539LqyaWBZ6YVNrHErm7/+/GEpYFrjtl46OSKNpYvivvz0fqYv?=
=?windows-1251?Q?QdKV4t0C0XNNb2dOzLByJU8QBfDi1EfhCJFILuRdTbDQdgF9jmLIYdwU?=
=?windows-1251?Q?7vetyhDcF98I+PL7yerMkZYTkLBW4ZYtMrbsWgqtWwJvDgpqSd9opMES?=
=?windows-1251?Q?MqENcQTO8tmpRquXnHbVpE2fHl0RZ86B58r9gGNHi3sYoz9OEc5VPlJa?=
=?windows-1251?Q?Je/WU7PmoD2LtuWcbwymmQlQzaH1XBXmnlxoYnvoHWJba0OHruQ+cJ+o?=
=?windows-1251?Q?EgmZz29d2pYA5dU4LoRYXYxPHh5b5BrpXKFcDShCwRWENe/5bVVzxE28?=
=?windows-1251?Q?XbgGArYzGqmw5DiDJFJpYM6M10zSHvky/CnbSHK+4DXqlCvkrqMlWnZv?=
=?windows-1251?Q?sXeLfurm3DpVLWpy3K/d1yrdYGQnClfOuxbi734IWVC9/LDqlIcbRxJb?=
=?windows-1251?Q?0KxTOFL1oHFAwdUoKqV1rCAik7FgrWhvkoHYSFOZI+UCHqUvu2Pbis+g?=
=?windows-1251?Q?QITOPUNyz4tGwyLAqujeMo72JMmRqD/Pt9UBbp6Sn8MRBNYHjZVkJT8+?=
=?windows-1251?Q?c0JrA7C+7Pbx5nW/IzohfcZY/pcU05CqmcSV66eXFaYzTYgWGDzb++if?=
=?windows-1251?Q?uJmKHHQHqmRXbYH58Zdm692SBcK4MhncKi3ogH6DAKfiw602V8OxH6+M?=
=?windows-1251?Q?mFy4hCOsoXssdoj1bJxVxUAkHHQoPCpj/8rRDS6sYh5DbDpv8zQnfxlE?=
=?windows-1251?Q?qX6tqpqDXArGpaUe4ZgTQ054Yw9CGtFBMqd5IA6n4VxL/3CiXVYRPEKH?=
=?windows-1251?Q?ltN01M/GVU+W0W0zMqitG0wGY5a3cCr2FPQd50L0E6bvsIydrG8LH/Hz?=
=?windows-1251?Q?PQ7Oq2oLGUrlHkGkEzV/NePLeXiPJ1Y/FBPuA4OQmXA0hlMJe+rxorfO?=
=?windows-1251?Q?cxraVofDHbGapufgjAuVzcW8LJWsHuYOSWCntxN9YfYzJ90FwboGUoWS?=
=?windows-1251?Q?sHk3fSM6YrtifStL4vaCDLc63P6odQd/tTMiiCzLEfigHFf2iQuZZRq5?=
=?windows-1251?Q?nGnkogvQcE0NJicS/PbKznRzECrM5EPfHpVRJCIOF5NUrBcsKsi3uUi6?=
=?windows-1251?Q?hTU5OWemiXNXKFQlLpQ8QhLW2EsriDCe//wERWsJfbikpRhCtAQxN+e5?=
=?windows-1251?Q?8QhnHPxc6ZRaq1kMmwE4xpbIWE8hZUbzZ0/wBTrwWUuteZLXCfHYIg?=
=?windows-1251?Q?=3D=3D?=
X-OriginatorOrg: PLDT365.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Feb 2023 11:27:38.2184
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: d1ee0dc0-bc9a-4a09-152f-08db076bfc8e
X-MS-Exchange-CrossTenant-Id: dca43453-b963-4ff1-9f4d-75c0dffda839
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=dca43453-b963-4ff1-9f4d-75c0dffda839;Ip=[210.14.4.59];Helo=[eop.pldt.com.ph]
X-MS-Exchange-CrossTenant-AuthSource:
SG2APC01FT0034.eop-APC01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PUZPR06MB5888
X-Spam_score: 18.7
X-Spam_score_int: 187
X-Spam_bar: ++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attn: Beloved Please use this Money for the churches and the
less privileged. Greetings to you and your family in the name of God Almighty.
In my search for a reliable and God fearing person and having gotten your
contact through prayers and painstaking efforts. I have decided [...]
Content analysis details: (18.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.95.53.189 listed in wl.mailspike.net]
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=APC01-PSA-obe.outbound.protection.outlook.com;ip=40.95.53.189;r=doctor.nl2k.ab.ca]
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[marisasmith2023(at)hotmail.com]
2.5 MILLION_USD BODY: Talks about millions of dollars
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 T_MONEY_PERCENT X% of a lot of money for you
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Requisition Order...
Attn: Beloved
Please use this Money for the churches and the less privileged.
Greetings to you and your family in the name of God Almighty. In my search for a reliable and God fearing person and having gotten your contact through prayers and painstaking efforts. I have decided to seek your help in carrying out my last wishes. My name is Mrs. Marisa Smith. I'm a 65 years old woman from London, UK. I was a merchant and owned two businesses in London, UK. I was also married with two children.
My husband and two children died in a car accident six years ago. Before this happened, my business and concern for making money was all I lived for. I never really cared about other values in life. But since the loss of my family, I have found a new desire to assist the needy and helpless families. I have been helping Orphans in the Orphanage/Motherless homes. I have also donated some money for humanitarian needs in London, UK, South Africa, Cameroon, Uganda, Brazil, Spain, Austria, Germany and some Asian Countries.
I was moved with great pity and compassion that I decided to make this contribution on assisting people over there, I kept Fifteen Million United States Dollars ($15,000,000.00) in a long-term deposit account in a Finance company. Presently, I'm in a hospital where I have been undergoing treatment for Esophageal Cancer. I have since lost my ability to talk and my doctors have told me that I have only a few months to live. It is my last wish to see this money distributed to the less privileged and Charity organizations. Because relatives and friends have plundered so much of my wealth since my illness, I cannot live with the agony entrusting this huge responsibility to any of them.
Please, I beg you in the name of God to help me collect the deposit and distribute it accordingly. Use your Jurisdiction to distribute the Money and keep 40% of it to yourself. Feel free to reimburse yourself when you have the Money for any cost you incur during the process of collecting and distributing the money. If you are willing to help, please reply as soon as possible. May the good LORD bless you and your family.
Please, send a reply and all correspondence through this e-mail: (marisasmith2023@hotmail.com) to enable me to instruct my Lawyer on what to do based on the fact that I do not have much time left to live.
You praying on my behalf will also be appreciated at this point in time.
Thank you and God Bless us all.
Yours, Sincerely
Mrs. Marisa Smith.
________________________________
The information contained in this communication is intended solely for the use of the addressee and may contain confidential and/or privileged material. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, be advised that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender by return email or by telephone and delete this communication and all copies, including all attachments.
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 05 Feb 2023 05:15:07 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pOduv-000JoY-0V
for dave@doctor.nl2k.ab.ca;
Sun, 05 Feb 2023 05:14:45 -0700
Resent-From: The Doctor
Resent-Date: Sun, 5 Feb 2023 05:14:45 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-psaapc01rlhn2189.outbound.protection.outlook.com ([40.95.53.189]:6435 helo=APC01-PSA-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
id 1pOdDW-0001bh-2o
for doctor@doctor.nl2k.ab.ca;
Sun, 05 Feb 2023 04:30:30 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=ggmJ2JxqIuMM9xn4Rbk+QZCq//p0+6s8+MDdt39CjkGgCYvk8Y2cIayRKs1aIOMNKP7JPG8Re6iu2Puytk8VAw0qTLtiP/H8Asi7C+tk3Bc6XqDJYy9lBIAcEK9Lxn3pNHW64mS5o7mmtHOHlwayaRbx8cirtZiD/SJJE1dPLCPh8lg7MxpSY6FLYnf7ax367DiYGw/cqSMX5Uj60BrP99tG76cRo7IkbPlNuyZjsAuMDEJRMmkHXeymq2z9udWvlj+71z5ql7fTjJmq5NgfOoQMBMEJaa3HjanOOCNf9qT7qWz3k3H5SIQ0Nm/Awy8VfC1Oj9Mi9ESU4qbopuLYvg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=/WLJg1J6XeEenLCvwsd5vHnU4Yj9roCiuw7p8mVrNE8=;
b=k52/qLW5oa/PJuXNYnKZlp6YaPES0Zd0KFpuyNNuFXWDs8t/9oRsuMYxZH/pYfhTWHw0ivwTwiHBuPQkCOBOnw+Qxa3i6xaKd/gESw8mboAzSSKjcXiocDT7EE4U4NqmuhMe84sfngBw7E8SWu2+dx9ek4fxrklwQfuYlxcYxmKJt/r5sk5mmjw4grW/UqIDhzo4/kWjBI0b2ThadMVb+dgOHYmaMrUCnNRAzkP/3n3xYpuu8sNXblMTxlY9iOTOEgasLgQfpd2cM0oueUwliFcwguPLNg4KzLJ9oKmMg23PrCJuYAZZW6zy1gbUXhcTDz4dNB38RXBX7TcPUz52+A==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is
210.14.4.59) smtp.rcpttodomain=gsoft.com.au smtp.helo=eop.pldt.com.ph;
dmarc=none; dkim=none (message not signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=PLDT365.onmicrosoft.com; s=selector2-PLDT365-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=/WLJg1J6XeEenLCvwsd5vHnU4Yj9roCiuw7p8mVrNE8=;
b=Y1KZZTNshwo26NJHU6S8FY9SnvDlpxN+HoGKd+tDpPTZH784SyH5AgaAtHSb9+2AbfyfK8jD1o3LbRAT7ER3UGdLI7hv1Tokx5qcNQ9cO6B1SRUjcyMcMIxjlJES+FiySMDVGxkcfcuTcHW9RdS+7OH/9kqo1yU6FNKxpvV6tjI=
Received: from SG2PR02CA0075.apcprd02.prod.outlook.com (2603:1096:4:90::15) by
PUZPR06MB5888.apcprd06.prod.outlook.com (2603:1096:301:11c::15) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6086.11; Sun, 5 Feb
2023 11:27:39 +0000
Received: from SG2APC01FT0034.eop-APC01.prod.protection.outlook.com
(2603:1096:4:90:cafe::96) by SG2PR02CA0075.outlook.office365.com
(2603:1096:4:90::15) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6064.34 via Frontend
Transport; Sun, 5 Feb 2023 11:27:38 +0000
X-MS-Exchange-Authentication-Results: spf=none (sender IP is 210.14.4.59)
smtp.helo=eop.pldt.com.ph; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=;
Received-SPF: None (protection.outlook.com: eop.pldt.com.ph does not designate
permitted sender hosts)
Received: from eop.pldt.com.ph (210.14.4.59) by
SG2APC01FT0034.mail.protection.outlook.com (10.13.37.87) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id
15.20.6064.32 via Frontend Transport; Sun, 5 Feb 2023 11:27:38 +0000
Received: from svrmdbexch01.pldt.pldtgroup.net (10.40.25.45) by
vsmmdbexch04.pldt.pldtgroup.net (10.35.17.53) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id
15.1.2375.17; Sun, 5 Feb 2023 19:27:07 +0800
Received: from vsmmdbexch04.pldt.pldtgroup.net (10.35.17.54) by
svrmdbexch01.pldt.pldtgroup.net (10.40.25.45) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id
15.1.2375.34; Sun, 5 Feb 2023 19:27:06 +0800
Received: from User (10.30.122.252) by vsmmdbexch04.pldt.pldtgroup.net
(10.35.17.53) with Microsoft SMTP Server id 15.1.2375.17 via Frontend
Transport; Sun, 5 Feb 2023 19:26:49 +0800
Reply-To:
From: Marisa Smith
Subject: Requisition Order...
Date: Sun, 5 Feb 2023 03:27:05 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <2e75c8b1-d5a4-458d-92a1-41aadf900665@vsmmdbexch04.pldt.pldtgroup.net>
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: SG2APC01FT0034:EE_|PUZPR06MB5888:EE_
X-MS-Office365-Filtering-Correlation-Id: d1ee0dc0-bc9a-4a09-152f-08db076bfc8e
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 1
X-Forefront-Antispam-Report:
CIP:210.14.4.59;CTRY:PH;LANG:en;SCL:6;SRV:;IPV:NLI;SFV:SPM;H:eop.pldt.com.ph;PTR:InfoDomainNonexistent;CAT:OSPM;SFS:(13230025)(136003)(376002)(396003)(39860400002)(346002)(5005620100009)(109986016)(451199018)(40470700004)(46966006)(41110700001)(31686004)(78352004)(2860700004)(316002)(8676002)(70586007)(7116003)(70206006)(8936002)(41300700001)(31696002)(40460700003)(356005)(81166007)(82740400003)(6666004)(9686003)(26005)(2906002)(7406005)(35950700001)(47076005)(7366002)(40480700001)(7416002)(5660300002)(82310400005)(508600001)(83380400001)(336012)(45080400002)(42882007)(3480700007)(107034002);DIR:OUT;SFP:1023;
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?VMUaTg539LqyaWBZ6YVNrHErm7/+/GEpYFrjtl46OSKNpYvivvz0fqYv?=
=?windows-1251?Q?QdKV4t0C0XNNb2dOzLByJU8QBfDi1EfhCJFILuRdTbDQdgF9jmLIYdwU?=
=?windows-1251?Q?7vetyhDcF98I+PL7yerMkZYTkLBW4ZYtMrbsWgqtWwJvDgpqSd9opMES?=
=?windows-1251?Q?MqENcQTO8tmpRquXnHbVpE2fHl0RZ86B58r9gGNHi3sYoz9OEc5VPlJa?=
=?windows-1251?Q?Je/WU7PmoD2LtuWcbwymmQlQzaH1XBXmnlxoYnvoHWJba0OHruQ+cJ+o?=
=?windows-1251?Q?EgmZz29d2pYA5dU4LoRYXYxPHh5b5BrpXKFcDShCwRWENe/5bVVzxE28?=
=?windows-1251?Q?XbgGArYzGqmw5DiDJFJpYM6M10zSHvky/CnbSHK+4DXqlCvkrqMlWnZv?=
=?windows-1251?Q?sXeLfurm3DpVLWpy3K/d1yrdYGQnClfOuxbi734IWVC9/LDqlIcbRxJb?=
=?windows-1251?Q?0KxTOFL1oHFAwdUoKqV1rCAik7FgrWhvkoHYSFOZI+UCHqUvu2Pbis+g?=
=?windows-1251?Q?QITOPUNyz4tGwyLAqujeMo72JMmRqD/Pt9UBbp6Sn8MRBNYHjZVkJT8+?=
=?windows-1251?Q?c0JrA7C+7Pbx5nW/IzohfcZY/pcU05CqmcSV66eXFaYzTYgWGDzb++if?=
=?windows-1251?Q?uJmKHHQHqmRXbYH58Zdm692SBcK4MhncKi3ogH6DAKfiw602V8OxH6+M?=
=?windows-1251?Q?mFy4hCOsoXssdoj1bJxVxUAkHHQoPCpj/8rRDS6sYh5DbDpv8zQnfxlE?=
=?windows-1251?Q?qX6tqpqDXArGpaUe4ZgTQ054Yw9CGtFBMqd5IA6n4VxL/3CiXVYRPEKH?=
=?windows-1251?Q?ltN01M/GVU+W0W0zMqitG0wGY5a3cCr2FPQd50L0E6bvsIydrG8LH/Hz?=
=?windows-1251?Q?PQ7Oq2oLGUrlHkGkEzV/NePLeXiPJ1Y/FBPuA4OQmXA0hlMJe+rxorfO?=
=?windows-1251?Q?cxraVofDHbGapufgjAuVzcW8LJWsHuYOSWCntxN9YfYzJ90FwboGUoWS?=
=?windows-1251?Q?sHk3fSM6YrtifStL4vaCDLc63P6odQd/tTMiiCzLEfigHFf2iQuZZRq5?=
=?windows-1251?Q?nGnkogvQcE0NJicS/PbKznRzECrM5EPfHpVRJCIOF5NUrBcsKsi3uUi6?=
=?windows-1251?Q?hTU5OWemiXNXKFQlLpQ8QhLW2EsriDCe//wERWsJfbikpRhCtAQxN+e5?=
=?windows-1251?Q?8QhnHPxc6ZRaq1kMmwE4xpbIWE8hZUbzZ0/wBTrwWUuteZLXCfHYIg?=
=?windows-1251?Q?=3D=3D?=
X-OriginatorOrg: PLDT365.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Feb 2023 11:27:38.2184
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: d1ee0dc0-bc9a-4a09-152f-08db076bfc8e
X-MS-Exchange-CrossTenant-Id: dca43453-b963-4ff1-9f4d-75c0dffda839
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=dca43453-b963-4ff1-9f4d-75c0dffda839;Ip=[210.14.4.59];Helo=[eop.pldt.com.ph]
X-MS-Exchange-CrossTenant-AuthSource:
SG2APC01FT0034.eop-APC01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PUZPR06MB5888
X-Spam_score: 18.7
X-Spam_score_int: 187
X-Spam_bar: ++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attn: Beloved Please use this Money for the churches and the
less privileged. Greetings to you and your family in the name of God Almighty.
In my search for a reliable and God fearing person and having gotten your
contact through prayers and painstaking efforts. I have decided [...]
Content analysis details: (18.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.95.53.189 listed in wl.mailspike.net]
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=APC01-PSA-obe.outbound.protection.outlook.com;ip=40.95.53.189;r=doctor.nl2k.ab.ca]
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[marisasmith2023(at)hotmail.com]
2.5 MILLION_USD BODY: Talks about millions of dollars
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 T_MONEY_PERCENT X% of a lot of money for you
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Requisition Order...
Attn: Beloved
Please use this Money for the churches and the less privileged.
Greetings to you and your family in the name of God Almighty. In my search for a reliable and God fearing person and having gotten your contact through prayers and painstaking efforts. I have decided to seek your help in carrying out my last wishes. My name is Mrs. Marisa Smith. I'm a 65 years old woman from London, UK. I was a merchant and owned two businesses in London, UK. I was also married with two children.
My husband and two children died in a car accident six years ago. Before this happened, my business and concern for making money was all I lived for. I never really cared about other values in life. But since the loss of my family, I have found a new desire to assist the needy and helpless families. I have been helping Orphans in the Orphanage/Motherless homes. I have also donated some money for humanitarian needs in London, UK, South Africa, Cameroon, Uganda, Brazil, Spain, Austria, Germany and some Asian Countries.
I was moved with great pity and compassion that I decided to make this contribution on assisting people over there, I kept Fifteen Million United States Dollars ($15,000,000.00) in a long-term deposit account in a Finance company. Presently, I'm in a hospital where I have been undergoing treatment for Esophageal Cancer. I have since lost my ability to talk and my doctors have told me that I have only a few months to live. It is my last wish to see this money distributed to the less privileged and Charity organizations. Because relatives and friends have plundered so much of my wealth since my illness, I cannot live with the agony entrusting this huge responsibility to any of them.
Please, I beg you in the name of God to help me collect the deposit and distribute it accordingly. Use your Jurisdiction to distribute the Money and keep 40% of it to yourself. Feel free to reimburse yourself when you have the Money for any cost you incur during the process of collecting and distributing the money. If you are willing to help, please reply as soon as possible. May the good LORD bless you and your family.
Please, send a reply and all correspondence through this e-mail: (marisasmith2023@hotmail.com) to enable me to instruct my Lawyer on what to do based on the fact that I do not have much time left to live.
You praying on my behalf will also be appreciated at this point in time.
Thank you and God Bless us all.
Yours, Sincerely
Mrs. Marisa Smith.
________________________________
The information contained in this communication is intended solely for the use of the addressee and may contain confidential and/or privileged material. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, be advised that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender by return email or by telephone and delete this communication and all copies, including all attachments.