Western Union Phish from Gmail

Posted by Dave Yadallee on Wednesday, September 28. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 27 Sep 2022 19:06:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1odLVa-000NWm-23

for dave@doctor.nl2k.ab.ca;

Tue, 27 Sep 2022 19:05:06 -0600

Resent-From: The Doctor

Resent-Date: Tue, 27 Sep 2022 19:05:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f180.google.com ([209.85.208.180]:41514)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1odK4h-000GXs-H2

for root@nk.ca;

Tue, 27 Sep 2022 17:33:22 -0600

Received: by mail-lj1-f180.google.com with SMTP id a14so12567724ljj.8

for ; Tue, 27 Sep 2022 16:32:54 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date;

bh=Yku7Q6aAMO8tN4pjRi9GPgn8J7DsJ06Do4srnXQDPyg=;

b=FmgTHLa+SujxyYGQ/HlzAe0Ty43ERSAriM8VC5XOQmm/ANeTHp3lCF9serwRC7OiGD

SmBbWbo3Bov7igjbpxJgpDp0FkWYNQwzP/MsBHsfwA7qVWobKSakI/lar90slO/RMSNe

W27McEhigObolyNkzxg2v0qu0b9JTGZha5ayRmHKIhielFsTMOIdTtUx1jx/H23GwhSn

+Db0pYdxHtvPCvbRMApCF4B6ISaZ3gPbCYqNdifBO61UgP/bD37erW2AFyemzyKtJ1Ay

LUHsbvd6YaaNSu/rJUc48SCNA3/rtlhMAZ/2qo7LtG/IFmzsqpOWbhR1+th0n0bplbhg

xZ/g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date;

bh=Yku7Q6aAMO8tN4pjRi9GPgn8J7DsJ06Do4srnXQDPyg=;

b=rQAGW7BC6OO8wiQudn5+W7JWdQCt9K8M7d9ayCQQZ/XcjD1xRDIHmCuHcXxftDz/a5

UMY1jUST/3aXTgLz1+xHE29PNw9XNHLuvLUNYHJ+ob5nu2Cr6UGTpscRzBu4WSmbTIlk

gSyRcSOK4+nJuYtceoslq+41rpcnf1vcqkEptmlPguyQL1k0x9mE8YZXer/FALKX9y27

LfDjPEGyAwJL+Zsfz2PMYyJfp7YjLXf1BTV24rh5UDEWTpoCWBbYhHLIznjC7kNu+Htd

3lNIB6kJlDMxpw+1Cw1snGSWljqPArxyF+9LVghO8eRM5L88KM6ycy9rzjLkAz28y7IY

wOfA==

X-Gm-Message-State: ACrzQf1o4u0Q2wbhz0y1nxAOZ0dTX5wOpUNWfufg6BLBXeilcSpVsYfs

XE3Qj7OK6ZqSQqPPcfkp1Wno2RisJKjhwXucyQU=

X-Google-Smtp-Source: AMsMyM7OPbIHEFKfMWCb4G9I3Ij/GLBzzRrCgrF47dF0cB3kF8PnJPdfQr9YQ12kEpRzIOl41CmQZDnBUY2UTmmWjio=

X-Received: by 2002:a2e:b8d2:0:b0:26c:34d8:a849 with SMTP id

s18-20020a2eb8d2000000b0026c34d8a849mr11316359ljp.274.1664321567110; Tue, 27

Sep 2022 16:32:47 -0700 (PDT)

MIME-Version: 1.0

Reply-To: w.uofficer.hq@gmail.com

From: WESTERN UNION

Date: Wed, 28 Sep 2022 00:32:29 +0100

Message-ID:

Subject: WESTERN UNION MONEY TRANSFER NOTIFICATION

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000ccbe6905e9b10f33"

Bcc: root@nk.ca

X-Spam_score: 20.4

X-Spam_score_int: 204

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Welcome to Western Union Worldwide Department of Western

Union United States of America. Address 1 Columbus Ave, Washington DC,

10006, United States of America

Content analysis details: (20.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.180 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[sakasalami34[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[sakasalami34[at]gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to

2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.0 LOTTO_DEPT Claims Department

0.0 XFER_LOTSA_MONEY Transfer a lot of money

0.0 FILL_THIS_FORM Fill in a form with personal information

2.2 FILL_THIS_FORM_LOAN Answer loan question(s)

0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)

0.0 MONEY_FORM Lots of money if you fill out a form

0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.8 ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of

money

1.5 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} WESTERN UNION MONEY TRANSFER NOTIFICATION

X-Antivirus: AVG (VPS 220927-10, 9/27/2022), Inbound message

X-Antivirus-Status: Clean

--000000000000ccbe6905e9b10f33

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Welcome to Western Union Worldwide

Department of Western Union United States of America.

Address 1 Columbus Ave, Washington DC, 10006, United States of America

Our Ref: IMF/WB/UN/XWFD/0611/X012

Greetings from the Western Union Office Department.

Attention: Beneficiary, Our Ref: IMF/WB/UN/XWFD/0611/X012

We have sent this mail to you several times without getting any reply from

you.

This is to inform you that the United State Government under President Joe

Biden=E2=80=99s Administration has instructed Western Union Office Headquar=

ters

here in the United States to transfer 4.5 Million Dollars ($4,500,000.00)

compensating for all the CORONA-VIRUS (COVID-19) VICTIMS WORLDWIDE, SCAM

VICTIMS WORLDWIDE, Having reviewed thousands of extortion/delayed payment,

cases on all the UNPAID INHERITANCE, LOTTERY WINNERS and CONTRACT

BENEFICIARIES, CORONA-VIRUS PANDEMIC and ECONOMIC CRISES ravaging the world

and your email was found as one of the VICTIMS by the American Security

Leading team, World Health Organization (W.H.O) and American representative

officers, the European Union (EU) in collaboration with the International

Monetary Fund (IMF), United Nations (UN), FBI and the World Bank, has

joined forces as Global Fund Recovery Management and Payment Bureau to

tackle the present CORONA-VIRUS PANDEMIC and ECONOMIC CRISES ravaging the

world, by compensating you as one of the selected verified beneficiaries

that is to enjoy a wonderful philanthropy gesture from billionaires within

Asia, America, Africa, Oceania and Europe.

Therefore from now onward you will be receiving the sum of $5000 per day

till you receive your total compensation fund of 4.5 Million Dollars

($4,500,000.00). However, we inform you that we have already sent the first

$5000 this morning to avoid cancellation of your payment, Remain the total

sum of 4.5 Million Dollars ($4,500,000.00). You have only six hours to

reply to this office upon the receipt of this Email, the maximum amount you

will be receiving per day starting from today is $5000 and the money

transfer reference number of today=E2=80=99s is below

HERE IS THE INFORMATION ABOUT YOUR FIRST PAYMENT

Track the MTCN track by

visiting https://www.westernunion.com/global-service/track-transfer

Money Transfer Control Number (M.T.C.N): #236-015-****

Sender First Name: Martin

Sender Last Name: Cole

Amount Sent=3D $5000 USD

NOTE; That your first $5000 is on hold because of the instruction from the

IMF office, they asked us to place it on hold by requesting the Clean Bill

Record Certificate to fulfill the entire necessary obligation So that we

will start sending you the payment through Western union Office Money

transfer, the necessary Obligation I mean here is to obtain the Clean Bill

Record Certificate from the Federal High Court. We need the below details

from you to enable us to place the payment in your name and transfer the

fund to you.

KINDLY FORWARD THE FOLLOWING INFORMATION FOR PAYMENT PROCESSING

1: Your Full Name: ----------------

2: Your Complete Home Address: ---------------

3. Your Country of Residence / Origin: -----------

4: Your WhatsApp Phone Number: ------------

5: Your date of birth (D.O.B): -------------

6: Your Occupation: ----------------

7: Sex / Gender: -----------------

8: Marital Status: ------------

9: Copy of Identification: ---------------

CONTACT

Name: MR. Martin I. Cole

Director, of the Compensation and Benefits Committee.

Western Union Headquaters, USA

E-mail: w.uofficer.hq@gmail.com

WhatsApp Number: +1 (586)-500-3265

NOTE: IF YOU FIND THIS MESSAGE IN YOUR SPAM FOLDER OR JUNK BY ERROR, KINDLY

OPEN AS SAME

--000000000000ccbe6905e9b10f33

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

xt-align:justify;line-height:normal;background-image:initial;background-pos=

ition:initial;background-size:initial;background-repeat:initial;background-=

origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,s=

ans-serif">
MT Bold",sans-serif;color:rgb(14,16,26)">=C2=A0

yle=3D"margin:0in 0in 0.0001pt;text-align:justify;line-height:normal;backgr=

ound-image:initial;background-position:initial;background-size:initial;back=

ground-repeat:initial;background-origin:initial;background-clip:initial;fon=

t-size:11pt;font-family:Calibri,sans-serif">
ont-family:"Arial Rounded MT Bold",sans-serif">

line-height:normal;background-image:initial;background-position:initial;bac=

kground-size:initial;background-repeat:initial;background-origin:initial;ba=

ckground-clip:initial;font-size:11pt;font-family:Calibri,sans-serif">
an style=3D"font-size:16pt;font-family:"Arial Rounded MT Bold",sa=

ns-serif;color:rgb(14,16,26)">This is to inform you

that the United State Government under President Joe Biden=E2=80=99s Admini=

stration has

instructed Western Union Office Headquarters here in the United States to

transfer 4.5 Million Dollars ($4,500,000.00) compensating for all the=C2=A0=

CORONA-VIRUS (COVID-19) VICTIMS WORLDWIDE=

, SCAM

VICTIMS WORLDWIDE, Having reviewed thousands of extortion/delayed

payment, cases on all the=C2=A0UNPAID

INHERITANCE, LOTTERY WINNERS and CONTRACT BENEFICIARIES, CORONA-VIRUS PANDE=

MIC

and ECONOMIC CRISES=C2=A0ravaging the world and your email was found=

as

one of the VICTIMS by the=C2=A0American

Security Leading team, World Health Organization (W.H.O) and American

representative officers, the European Union (EU) in collaboration with the

International Monetary Fund (IMF), United Nations (UN), FBI and the World B=

ank,

has joined forces as Global Fund Recovery Management and Payment Bureau to

tackle the present=C2=A0CORONA-VIRUS PAND=

EMIC=C2=A0and=C2=A0ECONOMIC CRISES=

=C2=A0ravaging the world, by

compensating you as one of the selected verified beneficiaries that is to e=

njoy

a wonderful philanthropy gesture from billionaires within Asia, America,

Africa, Oceania and Europe.
mily:"Arial Rounded MT Bold",sans-serif">

round-image:initial;background-position:initial;background-size:initial;bac=

kground-repeat:initial;background-origin:initial;background-clip:initial;ma=

rgin:0in 0in 8pt;font-size:11pt;font-family:Calibri,sans-serif">
yle=3D"font-size:16pt;font-family:"Arial Rounded MT Bold",sans-se=

rif;color:rgb(14,16,26)">E-mail:=C2=A0
.com">w.uofficer.hq@gmail.com
ont-family:"Arial Rounded MT Bold",sans-serif">

height:107%;font-size:11pt;font-family:Calibri,sans-serif">
ont-size:14pt;line-height:107%;font-family:"Arial Rounded MT Bold"=

;,sans-serif">=C2=A0

--000000000000ccbe6905e9b10f33--

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Name

Homepage

In reply to

Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.

Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enter the string from the spam-prevention image above:

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.

Standard emoticons like :-) and ;-) are converted to images.

Enter the string from the spam-prevention image above:

Remember Information?

Subscribe to this entry

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	April '24					Forward →
1	2	3	4	5	6	7
8	9	10	11	12	13	14
15	16	17	18	19	20	21
22	23	24	25	26	27	28
29	30