More gullible money spam from GMail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 26 Apr 2022 08:03:01 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1njLmJ-000L4F-4W
for dave@doctor.nl2k.ab.ca;
Tue, 26 Apr 2022 08:02:55 -0600
Resent-From: The Doctor
Resent-Date: Tue, 26 Apr 2022 08:02:55 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-io1-f65.google.com ([209.85.166.65]:33552)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1njL7r-000CBc-Jm
for sales@nk.ca;
Tue, 26 Apr 2022 07:21:12 -0600
Received: by mail-io1-f65.google.com with SMTP id p62so19692262iod.0
for; Tue, 26 Apr 2022 06:20:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:from:date:message-id:subject:to;
bh=ydP/WAPjGjmUnBa8dVVJjdzzmsqB+MVMgOOY8lHQYto=;
b=NvedZ1masjorMrITMFvE9RkQyn3kWSC5Ubicew0xFLe2q9X4F1JdrqypK8c8AZLFwc
Fr8i40MhlBn2z1BEe+vFSkhHnLMp6X8VhKDc0l3soKzgvQT7RBqx1VDbkUWM1ZcKbg4U
ChIT64j87f/CIXa/v0hKbsOGU6mGuxSHmU4lf07x3rCgVrILjtib2Z5hE3mIjgx2gFqp
CaBwB8RREjvPcr45WaQkVXMc+nTwrsfZJyrXKRO22eu3NlHuTPWVifASLe3TMjeSKT42
o44hkV78dufxdn23Gu17ESGq+xlHqKT5VKphzCWcs3MLjVp52nnSsSnaPUQOrK0DViAV
k4GQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
bh=ydP/WAPjGjmUnBa8dVVJjdzzmsqB+MVMgOOY8lHQYto=;
b=OvY5qr9d4Bpj07hpx1JLcy5ve9q8GCta/7eSWBA320v22XKWF7WSCnuLMZw/X0HbR7
28IU5PJQrrPod84sOLU006C8cxttDIaczbbiQCoB3wkmBcgAOWcdaDDdqQxajd4NzC50
zjwnW7DZavUaor8uDYlIRuYTmjrKGrDlfV5ulRkC0FQ0KdCepCS7hSuvKeY6HsYtrRGo
M5a906J0gcd8xEzThzHg8oN7/v5HNUwMAOw7bDnuEIXQ5Bq4cCZySwN1RUK6T0idmR6E
0mGsOAUlzOkK1PyFm9sgYbGDX4+LtbfVO/NGYTUZy6WC0wf2kdhgBRkC5rpWDNCfLh+b
/qqQ==
X-Gm-Message-State: AOAM530rjVCvXIN5p/XIicMEVk1sP7IdHuDEOtaTBjJ510VixlLVVCUX
FE7wr8BXBXn9j8W63i4VfljO6qwfwi8tR3U2cQ==
X-Google-Smtp-Source: ABdhPJzW7F/R9lGlrFCOcI+l8VYJzlHHI2FSXaf3+2w5713+ueDKC30jHs16xHwSZY4itUU5DxtuhCLp2RxJzhjpXpE=
X-Received: by 2002:a05:6638:4190:b0:326:81b3:b793 with SMTP id
az16-20020a056638419000b0032681b3b793mr10172398jab.193.1650979244599; Tue, 26
Apr 2022 06:20:44 -0700 (PDT)
MIME-Version: 1.0
From: Andrew McHattie
Date: Tue, 26 Apr 2022 14:20:31 +0100
Message-ID:
Subject: LETTER
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="00000000000067eb3b05dd8e8f98"
Bcc: sales@nk.ca
X-Spam_score: 13.8
X-Spam_score_int: 138
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: My name is Andrew McHattie, A Management Accountant and an
External Auditor for financial institutes. I currently work with a team of
external auditors who were retained after the outbreak of covid-19 [...]
Content analysis details: (13.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.166.65 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[andrewmchattie6[at]gmail.com]
0.2 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
2.5 MILLION_USD BODY: Talks about millions of dollars
2.7 UNCLAIMED_MONEY BODY: People just leave money laying around
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_MONEY_PERCENT X% of a lot of money for you
1.0 XFER_LOTSA_MONEY Transfer a lot of money
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
3.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} LETTER
--00000000000067eb3b05dd8e8f98
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
My name is Andrew McHattie, A Management Accountant and an External Auditor
for financial institutes. I currently work with a team of external auditors
who were retained after the outbreak of covid-19 pandemic to audit
financial activities.
In the course of a routine audit of our books last quarter, I discovered
some investment accounts that have been dormant for one year now. Most of
the accounts belong to a single beneficiary who died during the covid-19
pandemic. (Four million five hundred thousand united states dollars)in the
intent of the deceased depositor who died intestate and as such, no
next-of-kin has come forward all these Months to lay claim to the
investment.( Names now withheld for security reasons ) Since this is our
second letter to you.
I contacted you because you bear the same last name with the deceased
expatriate investor/depositor who died as a result if covid-19 and
therefore I can present you as the beneficiary to the inheritance since
there is no written will from our late investor. My service's aim is to
provide you with a complete service as I'm prepared to provide you with all
the documents required by the holding Bank to enable them to release these
inheritance funds to you . we can secure the funds in this bank account for
ourselves instead of allowing it to be transmitted as =E2=80=9Cunclaimed fu=
nds=E2=80=9D
into the Treasury of the Government.
All the papers required will be processed in your acceptance of this deal
as we are prepared to offer you 40%,50% for me, while 10% should be given
to any orphanage Home/Hospitals/clinics to support the needy worldwide.
I request that you kindly respond to me with acceptance:
Your prompt response is highly imperative.
Andrew McHattie
--00000000000067eb3b05dd8e8f98
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--00000000000067eb3b05dd8e8f98--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 26 Apr 2022 08:03:01 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1njLmJ-000L4F-4W
for dave@doctor.nl2k.ab.ca;
Tue, 26 Apr 2022 08:02:55 -0600
Resent-From: The Doctor
Resent-Date: Tue, 26 Apr 2022 08:02:55 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-io1-f65.google.com ([209.85.166.65]:33552)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1njL7r-000CBc-Jm
for sales@nk.ca;
Tue, 26 Apr 2022 07:21:12 -0600
Received: by mail-io1-f65.google.com with SMTP id p62so19692262iod.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:from:date:message-id:subject:to;
bh=ydP/WAPjGjmUnBa8dVVJjdzzmsqB+MVMgOOY8lHQYto=;
b=NvedZ1masjorMrITMFvE9RkQyn3kWSC5Ubicew0xFLe2q9X4F1JdrqypK8c8AZLFwc
Fr8i40MhlBn2z1BEe+vFSkhHnLMp6X8VhKDc0l3soKzgvQT7RBqx1VDbkUWM1ZcKbg4U
ChIT64j87f/CIXa/v0hKbsOGU6mGuxSHmU4lf07x3rCgVrILjtib2Z5hE3mIjgx2gFqp
CaBwB8RREjvPcr45WaQkVXMc+nTwrsfZJyrXKRO22eu3NlHuTPWVifASLe3TMjeSKT42
o44hkV78dufxdn23Gu17ESGq+xlHqKT5VKphzCWcs3MLjVp52nnSsSnaPUQOrK0DViAV
k4GQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
bh=ydP/WAPjGjmUnBa8dVVJjdzzmsqB+MVMgOOY8lHQYto=;
b=OvY5qr9d4Bpj07hpx1JLcy5ve9q8GCta/7eSWBA320v22XKWF7WSCnuLMZw/X0HbR7
28IU5PJQrrPod84sOLU006C8cxttDIaczbbiQCoB3wkmBcgAOWcdaDDdqQxajd4NzC50
zjwnW7DZavUaor8uDYlIRuYTmjrKGrDlfV5ulRkC0FQ0KdCepCS7hSuvKeY6HsYtrRGo
M5a906J0gcd8xEzThzHg8oN7/v5HNUwMAOw7bDnuEIXQ5Bq4cCZySwN1RUK6T0idmR6E
0mGsOAUlzOkK1PyFm9sgYbGDX4+LtbfVO/NGYTUZy6WC0wf2kdhgBRkC5rpWDNCfLh+b
/qqQ==
X-Gm-Message-State: AOAM530rjVCvXIN5p/XIicMEVk1sP7IdHuDEOtaTBjJ510VixlLVVCUX
FE7wr8BXBXn9j8W63i4VfljO6qwfwi8tR3U2cQ==
X-Google-Smtp-Source: ABdhPJzW7F/R9lGlrFCOcI+l8VYJzlHHI2FSXaf3+2w5713+ueDKC30jHs16xHwSZY4itUU5DxtuhCLp2RxJzhjpXpE=
X-Received: by 2002:a05:6638:4190:b0:326:81b3:b793 with SMTP id
az16-20020a056638419000b0032681b3b793mr10172398jab.193.1650979244599; Tue, 26
Apr 2022 06:20:44 -0700 (PDT)
MIME-Version: 1.0
From: Andrew McHattie
Date: Tue, 26 Apr 2022 14:20:31 +0100
Message-ID:
Subject: LETTER
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="00000000000067eb3b05dd8e8f98"
Bcc: sales@nk.ca
X-Spam_score: 13.8
X-Spam_score_int: 138
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: My name is Andrew McHattie, A Management Accountant and an
External Auditor for financial institutes. I currently work with a team of
external auditors who were retained after the outbreak of covid-19 [...]
Content analysis details: (13.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.166.65 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[andrewmchattie6[at]gmail.com]
0.2 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
2.5 MILLION_USD BODY: Talks about millions of dollars
2.7 UNCLAIMED_MONEY BODY: People just leave money laying around
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_MONEY_PERCENT X% of a lot of money for you
1.0 XFER_LOTSA_MONEY Transfer a lot of money
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
3.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} LETTER
--00000000000067eb3b05dd8e8f98
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
My name is Andrew McHattie, A Management Accountant and an External Auditor
for financial institutes. I currently work with a team of external auditors
who were retained after the outbreak of covid-19 pandemic to audit
financial activities.
In the course of a routine audit of our books last quarter, I discovered
some investment accounts that have been dormant for one year now. Most of
the accounts belong to a single beneficiary who died during the covid-19
pandemic. (Four million five hundred thousand united states dollars)in the
intent of the deceased depositor who died intestate and as such, no
next-of-kin has come forward all these Months to lay claim to the
investment.( Names now withheld for security reasons ) Since this is our
second letter to you.
I contacted you because you bear the same last name with the deceased
expatriate investor/depositor who died as a result if covid-19 and
therefore I can present you as the beneficiary to the inheritance since
there is no written will from our late investor. My service's aim is to
provide you with a complete service as I'm prepared to provide you with all
the documents required by the holding Bank to enable them to release these
inheritance funds to you . we can secure the funds in this bank account for
ourselves instead of allowing it to be transmitted as =E2=80=9Cunclaimed fu=
nds=E2=80=9D
into the Treasury of the Government.
All the papers required will be processed in your acceptance of this deal
as we are prepared to offer you 40%,50% for me, while 10% should be given
to any orphanage Home/Hospitals/clinics to support the needy worldwide.
I request that you kindly respond to me with acceptance:
Your prompt response is highly imperative.
Andrew McHattie
--00000000000067eb3b05dd8e8f98
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
My name is Andrew McHattie, A Management Accountant and an=
External Auditor for financial institutes. I currently work with a team of=
external auditors who were retained after the outbreak of covid-19 pandemi=
c to audit financial activities.
In the course of a routine audit of=
our books last quarter, I discovered some investment accounts that have be=
en dormant for one year now. Most of the accounts belong to a single benefi=
ciary who died during the covid-19 pandemic. (Four million five hundred tho=
usand united states dollars)in the intent of the deceased depositor who die=
d intestate and as such, no next-of-kin has come forward all these Months t=
o lay claim to the investment.( Names now withheld for security reasons ) S=
ince this is our second letter to you.
I contacted you because you b=
ear the same last name with the deceased expatriate investor/depositor who =
died as a result if covid-19 and therefore I can present you as the benefic=
iary to the inheritance since there is no written will from our late invest=
or. My service's aim is to provide you with a complete service as I'=
;m prepared to provide you with all the documents required by the holding B=
ank to enable them to release these inheritance funds to you . we can secur=
e the funds in this bank account for ourselves instead of allowing it to be=
transmitted as =E2=80=9Cunclaimed funds=E2=80=9D into the Treasury of the =
Government.
All the papers required will be processed in your accept=
ance of this deal as we are prepared to offer you 40%,50% for me, while 10%=
should be given to any orphanage Home/Hospitals/clinics to support the nee=
dy worldwide.
I request that you kindly respond to me with acceptanc=
e:
Your prompt response is highly imperative.
Andrew McHa=
ttie
External Auditor for financial institutes. I currently work with a team of=
external auditors who were retained after the outbreak of covid-19 pandemi=
c to audit financial activities.
In the course of a routine audit of=
our books last quarter, I discovered some investment accounts that have be=
en dormant for one year now. Most of the accounts belong to a single benefi=
ciary who died during the covid-19 pandemic. (Four million five hundred tho=
usand united states dollars)in the intent of the deceased depositor who die=
d intestate and as such, no next-of-kin has come forward all these Months t=
o lay claim to the investment.( Names now withheld for security reasons ) S=
ince this is our second letter to you.
I contacted you because you b=
ear the same last name with the deceased expatriate investor/depositor who =
died as a result if covid-19 and therefore I can present you as the benefic=
iary to the inheritance since there is no written will from our late invest=
or. My service's aim is to provide you with a complete service as I'=
;m prepared to provide you with all the documents required by the holding B=
ank to enable them to release these inheritance funds to you . we can secur=
e the funds in this bank account for ourselves instead of allowing it to be=
transmitted as =E2=80=9Cunclaimed funds=E2=80=9D into the Treasury of the =
Government.
All the papers required will be processed in your accept=
ance of this deal as we are prepared to offer you 40%,50% for me, while 10%=
should be given to any orphanage Home/Hospitals/clinics to support the nee=
dy worldwide.
I request that you kindly respond to me with acceptanc=
e:
Your prompt response is highly imperative.
Andrew McHa=
ttie
--00000000000067eb3b05dd8e8f98--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments