Lotter winner phish
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 27 Sep 2022 06:30:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1od9iG-00024A-UB
for dave@doctor.nl2k.ab.ca;
Tue, 27 Sep 2022 06:29:24 -0600
Resent-From: The Doctor
Resent-Date: Tue, 27 Sep 2022 06:29:24 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from dslb-188-104-178-201.188.104.pools.vodafone-ip.de ([188.104.178.201]:50550 helo=zenbis.de)
by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))
(envelope-from)
id 1od6nV-000DLd-At
for bin@nl2k.ab.ca;
Tue, 27 Sep 2022 03:22:45 -0600
Received: from User ([103.133.111.146]) by zenbis.de with Microsoft SMTPSVC(10.0.17763.1697);
Tue, 27 Sep 2022 11:11:00 +0200
Reply-To:
From: "Mrs. Rachael Adams."
Subject: Attention: Claim/Pyment Update.
Date: Tue, 27 Sep 2022 02:11:01 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Bcc:
Message-ID:
X-OriginalArrivalTime: 27 Sep 2022 09:11:00.0929 (UTC) FILETIME=[0FF46B10:01D8D251]
X-Spam_score: 39.9
X-Spam_score_int: 399
X-Spam_bar: +++++++++++++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: BMW LOTTERY DEPARTMENT 5070 WILSHIRE BLVD LOS ANGELES.CA 90036
UNITED STATES OF AMERICA. NOTE: If you received this message in your SPAM/JUNK
folder, that is because of the restrictions implemented by your Internet
Service Provider, we (BMW) urge you to treat it genuinely.
Content analysis details: (39.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP
address
[188.104.178.201 listed in dnsbl.sorbs.net]
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.2 MISSING_HEADERS Missing To: header
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=srvexchtcl01%40transoceanica.com.ec;ip=188.104.178.201;r=doctor.nl2k.ab.ca]
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.4 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
0.0 FROM_MISSP_USER From misspaced, from "User"
1.0 FROM_MISSP_SPF_FAIL No description available.
1.9 REPLYTO_WITHOUT_TO_CC No description available.
3.0 BIGNUM_EMAILS Lots of email addresses/leads
0.0 LOTS_OF_MONEY Huge... sums of money
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
0.8 HK_LOTTO No description available.
0.0 HK_NAME_MR_MRS No description available.
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.7 FROM_MISSP_DYNIP From misspaced + dynamic rDNS
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
3.0 BIGNUM_EMAILS_FREEM Lots of email addresses/leads, free email
account
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
2.5 LOTTO_AGENT Claims Agent
0.0 LOTTO_DEPT Claims Department
0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 FILL_THIS_FORM Fill in a form with personal information
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
2.5 TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool
2.2 FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 MONEY_FORM Lots of money if you fill out a form
1.8 ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of
money
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
Subject: {SPAM?} Attention: Claim/Pyment Update.
BMW LOTTERY DEPARTMENT
5070 WILSHIRE BLVD
LOS ANGELES.CA 90036
UNITED STATES OF AMERICA.
NOTE: If you received this message in your SPAM/JUNK folder, that is because of the restrictions implemented by your Internet Service Provider, we (BMW) urge you to treat it genuinely.
Dear Winner,
This is to inform you that you have been selected for a prize of a brand new 2022 Model BMW 7 Series Car and a Cheque of $1,500,000.00 USD from the international balloting programs held on the 2nd section in the UNITED STATE OF AMERICA.
Description of prize vehicle, Model: 530iA Color (exterior): Metallic Silver Mileage: 5 Transmission: Automatic 6 Speed Options: Cold weather package, premium package, fold down rear seats w/ski bag, am fm stereo with single in dash compact disc player.
The selection process was carried out through random selection in our computerized email selection system (ESS) from a database of over 250,000 email addresses drawn from all the continents of the world which you were selected.
The BMW Lottery is approved by the British Gaming Board and also Licensed by the International Association of Gaming Regulators (IAGR). To begin the processing of your prize you are to contact our fiduciary claims agent for more information as regards procedures to the claim of your prize.
Contact Name: Mr.Bray Williams
E-mail Address: bray_williams@aol.com
Contact him by providing him with the below listed information's, also your secret pin code number BMW:255125HGDY03/23.
1. Name In Full :
2. Residential Address :
3. Nationality :
4. Age :
5. Sex
6. Occupation :
7. Direct Phone :
8. Present Country :
9. Email address :
10. pin code Number BMW:255125HGDY03/23
Please you are to provide him with the above listed information's as soon as possible so he can begin with the processing of your prize winnings.
Congratulations again from all our staff and thank you for being part of our promotional program.
Mrs. Rachael Adams.
THE DIRECTOR PROMOTIONS
BMW LOTTERY DEPARTMENT
UNITED STATES OF AMERICA
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 27 Sep 2022 06:30:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1od9iG-00024A-UB
for dave@doctor.nl2k.ab.ca;
Tue, 27 Sep 2022 06:29:24 -0600
Resent-From: The Doctor
Resent-Date: Tue, 27 Sep 2022 06:29:24 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from dslb-188-104-178-201.188.104.pools.vodafone-ip.de ([188.104.178.201]:50550 helo=zenbis.de)
by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))
(envelope-from
id 1od6nV-000DLd-At
for bin@nl2k.ab.ca;
Tue, 27 Sep 2022 03:22:45 -0600
Received: from User ([103.133.111.146]) by zenbis.de with Microsoft SMTPSVC(10.0.17763.1697);
Tue, 27 Sep 2022 11:11:00 +0200
Reply-To:
From: "Mrs. Rachael Adams."
Subject: Attention: Claim/Pyment Update.
Date: Tue, 27 Sep 2022 02:11:01 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Bcc:
Message-ID:
X-OriginalArrivalTime: 27 Sep 2022 09:11:00.0929 (UTC) FILETIME=[0FF46B10:01D8D251]
X-Spam_score: 39.9
X-Spam_score_int: 399
X-Spam_bar: +++++++++++++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: BMW LOTTERY DEPARTMENT 5070 WILSHIRE BLVD LOS ANGELES.CA 90036
UNITED STATES OF AMERICA. NOTE: If you received this message in your SPAM/JUNK
folder, that is because of the restrictions implemented by your Internet
Service Provider, we (BMW) urge you to treat it genuinely.
Content analysis details: (39.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP
address
[188.104.178.201 listed in dnsbl.sorbs.net]
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.2 MISSING_HEADERS Missing To: header
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=srvexchtcl01%40transoceanica.com.ec;ip=188.104.178.201;r=doctor.nl2k.ab.ca]
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.4 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
0.0 FROM_MISSP_USER From misspaced, from "User"
1.0 FROM_MISSP_SPF_FAIL No description available.
1.9 REPLYTO_WITHOUT_TO_CC No description available.
3.0 BIGNUM_EMAILS Lots of email addresses/leads
0.0 LOTS_OF_MONEY Huge... sums of money
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
0.8 HK_LOTTO No description available.
0.0 HK_NAME_MR_MRS No description available.
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.7 FROM_MISSP_DYNIP From misspaced + dynamic rDNS
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
3.0 BIGNUM_EMAILS_FREEM Lots of email addresses/leads, free email
account
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
2.5 LOTTO_AGENT Claims Agent
0.0 LOTTO_DEPT Claims Department
0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 FILL_THIS_FORM Fill in a form with personal information
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
2.5 TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool
2.2 FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 MONEY_FORM Lots of money if you fill out a form
1.8 ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of
money
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
Subject: {SPAM?} Attention: Claim/Pyment Update.
BMW LOTTERY DEPARTMENT
5070 WILSHIRE BLVD
LOS ANGELES.CA 90036
UNITED STATES OF AMERICA.
NOTE: If you received this message in your SPAM/JUNK folder, that is because of the restrictions implemented by your Internet Service Provider, we (BMW) urge you to treat it genuinely.
Dear Winner,
This is to inform you that you have been selected for a prize of a brand new 2022 Model BMW 7 Series Car and a Cheque of $1,500,000.00 USD from the international balloting programs held on the 2nd section in the UNITED STATE OF AMERICA.
Description of prize vehicle, Model: 530iA Color (exterior): Metallic Silver Mileage: 5 Transmission: Automatic 6 Speed Options: Cold weather package, premium package, fold down rear seats w/ski bag, am fm stereo with single in dash compact disc player.
The selection process was carried out through random selection in our computerized email selection system (ESS) from a database of over 250,000 email addresses drawn from all the continents of the world which you were selected.
The BMW Lottery is approved by the British Gaming Board and also Licensed by the International Association of Gaming Regulators (IAGR). To begin the processing of your prize you are to contact our fiduciary claims agent for more information as regards procedures to the claim of your prize.
Contact Name: Mr.Bray Williams
E-mail Address: bray_williams@aol.com
Contact him by providing him with the below listed information's, also your secret pin code number BMW:255125HGDY03/23.
1. Name In Full :
2. Residential Address :
3. Nationality :
4. Age :
5. Sex
6. Occupation :
7. Direct Phone :
8. Present Country :
9. Email address :
10. pin code Number BMW:255125HGDY03/23
Please you are to provide him with the above listed information's as soon as possible so he can begin with the processing of your prize winnings.
Congratulations again from all our staff and thank you for being part of our promotional program.
Mrs. Rachael Adams.
THE DIRECTOR PROMOTIONS
BMW LOTTERY DEPARTMENT
UNITED STATES OF AMERICA
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments