Beneficiary spam from Google
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 22 Aug 2022 15:35:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oQF3w-000ExW-Js
for dave@doctor.nl2k.ab.ca;
Mon, 22 Aug 2022 15:34:24 -0600
Resent-From: The Doctor
Resent-Date: Mon, 22 Aug 2022 15:34:24 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oa1-f66.google.com ([209.85.160.66]:37485)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1oQDhA-0006ND-K0
for doctor@doctor.nl2k.ab.ca;
Mon, 22 Aug 2022 14:06:52 -0600
Received: by mail-oa1-f66.google.com with SMTP id 586e51a60fabf-11d7a859b3aso3032293fac.4
for; Mon, 22 Aug 2022 13:06:31 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:mime-version:from:to:cc;
bh=Et75M7srEOPZ+5ItScZ2WXUKNdoxBRxIA/kwHlLrgBQ=;
b=aD3w2zKpHMjYxo48iB8dP+zFSXGkbjNSNcPXUSD4mKBk4A1TOWkge57+6lR7sXZC3I
+UgxEFECr813Ahu753o0oVPEpZzGSS7YVBXJfrfxi6/DKt8x9Q0eJvDgcDz5HkMWz8CF
RzERqgvgI0BzBAVl0zmknEtWTTqmjbbhpFA+4ODcl0sWB9FIP3JUsslE0XbQzxxImO0h
rbcNSfWXICNQX3bLR/Ps0ayX7H91gu81fjxwz+ocDhqGYGo51TyUGBd7C2tWJ3im1DKX
zgp0OWf3wnwRVriZvTfCM4Zn2M7hCaMB/k+xf5FXV6ItghaNE5XiLyBkcPAyjuDWvBk+
k5gg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc;
bh=Et75M7srEOPZ+5ItScZ2WXUKNdoxBRxIA/kwHlLrgBQ=;
b=2/HEKWnJs1PcGrjulk1I8K9vktZcq4Lpk539T5H3voWIssC9Pkxj+XA165Ghn63aB+
e9n8ZROPTeh2SUTL4Du1ephsMWjASjNBIRujg9u2Z6Of4FuSPCUB+Qd9jfXnkuYsmBM4
kkgX4+g+fTc7eKoIfA9dZa0BnaaHXeG1pCSFDgYeoQO/FltlVF8j5Sxau5BhWF0HQGZp
RRQZnJ73eluxax/fHf99i+3isJzfxoHx8l4kN3ZJ142w21oBXmJk22S+s0t7Kwur/Tim
L7nncza2OAu9vGqOUVyHDGezvdBSan4Pomnkx09nAShO/vEFLg7D3MWl+MvUj9+rPjF/
pUBg==
X-Gm-Message-State: ACgBeo0SlNN5sSa9f+903dYwuDUcWc+mi9G2Tf9i6ns6Q62UaCNp80s+
in9orFxghmbaB5aGAJ65au1s64Gq16+jiMSoqhI=
X-Google-Smtp-Source: AA6agR6h7rT8hB7TyW64HCf1757hJZ1ILUwLS/FZymT+Zf1p0435eFDcxunyfp2cdMkipIdG7sXq4Alo9OyrT4eIAus=
X-Received: by 2002:a05:6870:a997:b0:11c:5a86:e11a with SMTP id
ep23-20020a056870a99700b0011c5a86e11amr16734oab.270.1661198785058; Mon, 22
Aug 2022 13:06:25 -0700 (PDT)
MIME-Version: 1.0
From: Roberta Glenn
Date: Mon, 22 Aug 2022 21:06:13 +0100
Message-ID:
Subject: Re:Attention: Beneficiary,
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000007c1d0005e6d9fbca"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 16.0
X-Spam_score_int: 160
X-Spam_bar: ++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: KEYSTONE CAPITAL GROUP INC. 8777 N Gainey Center Dr Ste 245
Scottsdale, AZ, 85258-2154 USA. Attention: Beneficiary This is to officially
notify you that the International Monetary Fund (IMF) together with the US
Federal Reserve and is
Content analysis details: (16.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.160.66 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[robertaglenn01[at]gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[robertaglenn01[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
2.5 MILLION_USD BODY: Talks about millions of dollars
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 FILL_THIS_FORM Fill in a form with personal information
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
0.0 MONEY_FORM Lots of money if you fill out a form
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
1.8 ADVANCE_FEE_4_NEW_FRM_MNY Advance Fee fraud form and lots of
money
3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases
Subject: {SPAM?} Re:Attention: Beneficiary,
--0000000000007c1d0005e6d9fbca
Content-Type: text/plain; charset="UTF-8"
KEYSTONE CAPITAL GROUP INC.
8777 N Gainey Center Dr Ste 245
Scottsdale, AZ, 85258-2154 USA.
Attention: Beneficiary
This is to officially notify you that the International Monetary Fund (IMF)
together with the US Federal Reserve and is
compensating all the scam victims with the sum of USD1,000 000.00(One
Million United States Dollars) each and your email
address was found among the scam victims list that's why we are contacting
you. We have deposited your fund at the payment
director/agent location(Keystone Capital Group Inc.) where the
investigation started.
Reconfirm the below information to us to be sure of the person we are
paying and to update your files.
Your full name:
Address:
Age:
Occupation:
Contact telephone number:
Upon the receipt of the above information more details will be given to you.
Yours Sincerely.
Wilfred Bruce
Keystone Capital Group Inc.
8777 N Gainey Center Dr Ste 245
Scottsdale, AZ, 85258-2154 USA.
--0000000000007c1d0005e6d9fbca
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--0000000000007c1d0005e6d9fbca--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 22 Aug 2022 15:35:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oQF3w-000ExW-Js
for dave@doctor.nl2k.ab.ca;
Mon, 22 Aug 2022 15:34:24 -0600
Resent-From: The Doctor
Resent-Date: Mon, 22 Aug 2022 15:34:24 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oa1-f66.google.com ([209.85.160.66]:37485)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1oQDhA-0006ND-K0
for doctor@doctor.nl2k.ab.ca;
Mon, 22 Aug 2022 14:06:52 -0600
Received: by mail-oa1-f66.google.com with SMTP id 586e51a60fabf-11d7a859b3aso3032293fac.4
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:mime-version:from:to:cc;
bh=Et75M7srEOPZ+5ItScZ2WXUKNdoxBRxIA/kwHlLrgBQ=;
b=aD3w2zKpHMjYxo48iB8dP+zFSXGkbjNSNcPXUSD4mKBk4A1TOWkge57+6lR7sXZC3I
+UgxEFECr813Ahu753o0oVPEpZzGSS7YVBXJfrfxi6/DKt8x9Q0eJvDgcDz5HkMWz8CF
RzERqgvgI0BzBAVl0zmknEtWTTqmjbbhpFA+4ODcl0sWB9FIP3JUsslE0XbQzxxImO0h
rbcNSfWXICNQX3bLR/Ps0ayX7H91gu81fjxwz+ocDhqGYGo51TyUGBd7C2tWJ3im1DKX
zgp0OWf3wnwRVriZvTfCM4Zn2M7hCaMB/k+xf5FXV6ItghaNE5XiLyBkcPAyjuDWvBk+
k5gg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc;
bh=Et75M7srEOPZ+5ItScZ2WXUKNdoxBRxIA/kwHlLrgBQ=;
b=2/HEKWnJs1PcGrjulk1I8K9vktZcq4Lpk539T5H3voWIssC9Pkxj+XA165Ghn63aB+
e9n8ZROPTeh2SUTL4Du1ephsMWjASjNBIRujg9u2Z6Of4FuSPCUB+Qd9jfXnkuYsmBM4
kkgX4+g+fTc7eKoIfA9dZa0BnaaHXeG1pCSFDgYeoQO/FltlVF8j5Sxau5BhWF0HQGZp
RRQZnJ73eluxax/fHf99i+3isJzfxoHx8l4kN3ZJ142w21oBXmJk22S+s0t7Kwur/Tim
L7nncza2OAu9vGqOUVyHDGezvdBSan4Pomnkx09nAShO/vEFLg7D3MWl+MvUj9+rPjF/
pUBg==
X-Gm-Message-State: ACgBeo0SlNN5sSa9f+903dYwuDUcWc+mi9G2Tf9i6ns6Q62UaCNp80s+
in9orFxghmbaB5aGAJ65au1s64Gq16+jiMSoqhI=
X-Google-Smtp-Source: AA6agR6h7rT8hB7TyW64HCf1757hJZ1ILUwLS/FZymT+Zf1p0435eFDcxunyfp2cdMkipIdG7sXq4Alo9OyrT4eIAus=
X-Received: by 2002:a05:6870:a997:b0:11c:5a86:e11a with SMTP id
ep23-20020a056870a99700b0011c5a86e11amr16734oab.270.1661198785058; Mon, 22
Aug 2022 13:06:25 -0700 (PDT)
MIME-Version: 1.0
From: Roberta Glenn
Date: Mon, 22 Aug 2022 21:06:13 +0100
Message-ID:
Subject: Re:Attention: Beneficiary,
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000007c1d0005e6d9fbca"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 16.0
X-Spam_score_int: 160
X-Spam_bar: ++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: KEYSTONE CAPITAL GROUP INC. 8777 N Gainey Center Dr Ste 245
Scottsdale, AZ, 85258-2154 USA. Attention: Beneficiary This is to officially
notify you that the International Monetary Fund (IMF) together with the US
Federal Reserve and is
Content analysis details: (16.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.160.66 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[robertaglenn01[at]gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[robertaglenn01[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
2.5 MILLION_USD BODY: Talks about millions of dollars
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 FILL_THIS_FORM Fill in a form with personal information
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
0.0 MONEY_FORM Lots of money if you fill out a form
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
1.8 ADVANCE_FEE_4_NEW_FRM_MNY Advance Fee fraud form and lots of
money
3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases
Subject: {SPAM?} Re:Attention: Beneficiary,
--0000000000007c1d0005e6d9fbca
Content-Type: text/plain; charset="UTF-8"
KEYSTONE CAPITAL GROUP INC.
8777 N Gainey Center Dr Ste 245
Scottsdale, AZ, 85258-2154 USA.
Attention: Beneficiary
This is to officially notify you that the International Monetary Fund (IMF)
together with the US Federal Reserve and is
compensating all the scam victims with the sum of USD1,000 000.00(One
Million United States Dollars) each and your email
address was found among the scam victims list that's why we are contacting
you. We have deposited your fund at the payment
director/agent location(Keystone Capital Group Inc.) where the
investigation started.
Reconfirm the below information to us to be sure of the person we are
paying and to update your files.
Your full name:
Address:
Age:
Occupation:
Contact telephone number:
Upon the receipt of the above information more details will be given to you.
Yours Sincerely.
Wilfred Bruce
Keystone Capital Group Inc.
8777 N Gainey Center Dr Ste 245
Scottsdale, AZ, 85258-2154 USA.
--0000000000007c1d0005e6d9fbca
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
KEYSTONE CAPITAL GROUP INC.
8777 N Gainey Center Dr Ste=
245
Scottsdale, AZ, 85258-2154 USA.
Attention: Beneficiary
r>
This is to officially notify you that the International Monetary =
Fund (IMF) together with the US Federal Reserve and is
compensating=
all the scam victims with the sum of USD1,000 000.00(One Million United St=
ates Dollars) each and your email
address was found among the scam =
victims list that's why we are contacting you. We have deposited your f=
und at the payment
director/agent location(Keystone Capital Group I=
nc.) where the investigation started.
Reconfirm the below informatio=
n to us to be sure of the person we are paying and to update your files.
>
Your full name:
Address:
Age:
Occupation:
Contact tele=
phone number:
Upon the receipt of the above information more detail=
s will be given to you.
Yours Sincerely.
Wilfred Bruce
Key=
stone Capital Group Inc.
8777 N Gainey Center Dr Ste 245
Scottsdale, =
AZ, 85258-2154 USA.
8777 N Gainey Center Dr Ste=
245
Scottsdale, AZ, 85258-2154 USA.
Attention: Beneficiary
r>
This is to officially notify you that the International Monetary =
Fund (IMF) together with the US Federal Reserve and is
compensating=
all the scam victims with the sum of USD1,000 000.00(One Million United St=
ates Dollars) each and your email
address was found among the scam =
victims list that's why we are contacting you. We have deposited your f=
und at the payment
director/agent location(Keystone Capital Group I=
nc.) where the investigation started.
Reconfirm the below informatio=
n to us to be sure of the person we are paying and to update your files.
>
Your full name:
Address:
Age:
Occupation:
Contact tele=
phone number:
Upon the receipt of the above information more detail=
s will be given to you.
Yours Sincerely.
Wilfred Bruce
Key=
stone Capital Group Inc.
8777 N Gainey Center Dr Ste 245
Scottsdale, =
AZ, 85258-2154 USA.
--0000000000007c1d0005e6d9fbca--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments