Beneficiary phish from Outlook

Posted by Dave Yadallee on Saturday, October 22. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Oct 2022 17:59:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1om1u9-0001vY-Fw

for dave@doctor.nl2k.ab.ca;

Fri, 21 Oct 2022 17:58:21 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Oct 2022 17:58:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oln040092064020.outbound.protection.outlook.com ([40.92.64.20]:13408 helo=EUR01-DB5-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1olwyA-00052D-3H

for doctor@doctor.nl2k.ab.ca;

Fri, 21 Oct 2022 12:42:15 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=d8/GUsnrwMZz9DWPb3SRcLzpIFbfN8IxRNxL6PQFlpIDrf/UjXfR3dTVjTL3AybIu1Pp/ZUyJpcvv/HRkZFdvk0AgE6IKtQQi2j3Uq5oJRcJyj8TWBoIqFyQQHyXiD7y7NxTfRgEBXE/WrOYSOfbYxvLD4CRnaQmzNFLzRlaW6IKwwQUoAxN/gnQ58DcU9+MSq3eLNg835IzPWNI+NnfaNJtfgE50c5GIBHud1+GV1UCsHcreA/GQ+KlL68KxVaVZ73NY5Nu5QyEa5/AjPE0oc0wZqOu5M0sbz97Y2DK+03L5kEl+NPt1THEmmAhPeaMOkPyVtSsy7oUg+mrux0ZxQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=Uev5Hz5jqzBxpXiWquZZfr/6S+3/FrGfJIig6Ajmln0=;

b=bfMMRdR+9Ixhv9/3yEW5SAYpHLzHboCMa+krYbBzHZRDjy/l8QKX1fU5LxjzD0R6Ix822+Ts0KyzYPymc0417l3n8rqmT/XwFsjr12VBf2GCXf8nnBFd1jTYrXpAAgnCLlnnQ7PSL9/ksjwLOgjPBD54LZIwptZFq/O6jVhJenOGcRmPIXtYSJumPW6lUqT/XXAJbn7ETecv/eYl/4XqdDOcunHgF6XdZRPoYFum5Ho/sb3HeKG5WSweW9MEqp8ldlC4soF2DGt7AP+HkBNhgTL1F91xRv5IUXMA3z1ekcTUj6N/95HKELGjNQBwnZYgD4nh+32yAapC7zGc/UvSUQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=Uev5Hz5jqzBxpXiWquZZfr/6S+3/FrGfJIig6Ajmln0=;

b=kmuPntdElWP9cwovJAuvv+MotOYyLqkI1vXS0Whl/RJ2Rvruzyfq7dg9cXqMKL1DPNbpi1z5XNUoLOYdDfGIDPUXK1gnhMdxihQtLNNC1DYhInMvGvQq13lkCrdVOCeYIgLbd8OT+LVRQ6Oppo6akDvzIIOhFuMCEkjv/slJ6NtV/o/mj5jujWP87v59JyaeiLVE98R91X5eA1FGkzATjOuwsLd+omHgGDC0mJUMrq/3fIh8rHxeNve8v/xQB5SOmVgbmpnLVT38KkTTeasNUq4MqDR1Z0diBSD8cZPAnGhy2/xnL/TVMTEpUcOvdR3r7pJ7LKN4wkbK9gmK+/v1bQ==

Received: from DB8P194MB0822.EURP194.PROD.OUTLOOK.COM (2603:10a6:10:168::10)

by VE1P194MB0781.EURP194.PROD.OUTLOOK.COM (2603:10a6:800:162::9) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5723.35; Fri, 21 Oct

2022 18:39:15 +0000

Received: from DB8P194MB0822.EURP194.PROD.OUTLOOK.COM

([fe80::b50:9be:faaa:8f13]) by DB8P194MB0822.EURP194.PROD.OUTLOOK.COM

([fe80::b50:9be:faaa:8f13%9]) with mapi id 15.20.5746.021; Fri, 21 Oct 2022

18:39:15 +0000

From: Gmx Insurance Loan Company

Subject: Attention Beneficiary, Ref1001/Code:00843839

Thread-Topic: Attention Beneficiary, Ref1001/Code:00843839

Thread-Index: AQHY5XxrffoVz1y3o06bDvtD1axdSA==

Date: Fri, 21 Oct 2022 18:39:15 +0000

Message-ID:

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-tmn: [Um8de4qwUxfv4e4CXwf4yIbKTd73xoIcDSWzaQbvXDv2GRZNAdYJyw==]

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: DB8P194MB0822:EE_|VE1P194MB0781:EE_

x-ms-office365-filtering-correlation-id: 287a55ec-6806-4550-1b2a-08dab3938e76

x-microsoft-antispam: BCL:0;

x-microsoft-antispam-message-info:

blpOb/3cRIJcvFpI0TdlsP1lEyzaH/BLB4uap4pZaRDRlbIPWzRZABXFGpIa8yX4MG4Ksw69OWNyw0kqdQKMClCUonTYcvmCP4y0cTUGdhiosVJ15Q3LwncLDPf8Pt+ff9+tM6/4RtkiS3hv2Es1QbuUN1ZPsD4S1mdBMQ1Ur5qOltjCnbX2u1Ac0UwJ8Saly3mx3b52KrRbNlFO/dTlhXhTLsSjQn4nJ3naOCNk9uasDUWC2mwDdKaAYIcaZ4zBNwBbTAxgbojIpXz6gDwlUESkmRSbArewJGNsgl11nWDY/3XpcZ2HPqv2VwvBx7RDTFVeyG8sNZhVaMKv9+zKrJpr6UsgJyuCeUHDnKfTmDXQildRa23L2xNKfcR5qzOGyJidQDr5IcfnEaMMFeq8EEBLBqQS8R4ZExrQ2MVsGGUr1ZqBz90pk5BOQ5OOXwhEkQuosgUnhpm3rLVOdTdbRvCuu/n1l3HrMu6Ay66i1/Az3+kBIGcDnn0x/gEH0m+ajoJo3lZqMkokZWWe1nsyz4y62Vokvjt/JBdKyxBfh/Xu36McYovn0xmanYDE6Ek9+nkCmgYvNciWbuY9MUHMYfsvTb/GAocOVRE8ATyzCCieVDTiDwyqW7CoBJtn8tBK

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?3orloAPm8wjE/GvvdAJkMXh6XF/VBFxUL2fyThk+7LWfskRb3pEk4iYWOO?=

=?iso-8859-1?Q?oawNVyWlKOF0ZqIPpcdIub1x4wrhiREObKC8I8dNR9LMC2v30bs4zw4Qo1?=

=?iso-8859-1?Q?Q9LNDAw1fdYzjzwRrRTkwlvkgE0pk2jCkvwDdIjoWYmxtz3OxVDXSZtv+R?=

=?iso-8859-1?Q?LbH8DYIiGsRdEhH073Fwl+TDzN2EMXh3kTe/F9daB+6yFE8nR0wKE68sPy?=

=?iso-8859-1?Q?wK7886yUluJa0ujmSWRzZLvshFUUMPTjcDOnke8d8BaAD3cZkrSPe+ApgA?=

=?iso-8859-1?Q?BWquL/cLh4EOILYd2vGDnqCcAqbWlg0UQz+oGefz4d717f24cPp7xJIZQG?=

=?iso-8859-1?Q?896oBeRV86ihXddU/KV7CogPwaHmyK0EGE1JfJ40yIsYlWI1R4JUWZImFk?=

=?iso-8859-1?Q?eFvyKe2unjOFhxObOH4ncDhXLkRVfDqBgrcX3K9m+Rhudt5fl10FsemdS7?=

=?iso-8859-1?Q?NfFKKj8eqQnU/g0St3A1VZzuSrmaJpPs5AahIYSP/MIx9Vr4TGM1pBK2uI?=

=?iso-8859-1?Q?Lg0l1qO4wHRGfwzOH6Vj433GMpfDTFR954hsui6cLIH38mKiRMVEb6nQaW?=

=?iso-8859-1?Q?mAFMDbj5xpjFucDHqAeF/SSWs0n907voJS0/r5bWIrOlAVWAY1Htswq3CC?=

=?iso-8859-1?Q?QN3VX1AhuaDjgtBIh6yvyYAc1Wq2gGrmeJIm2EiYtnfV05s365K3jq7Djb?=

=?iso-8859-1?Q?HRtwMlOThGGswwWWxtY5GKQvZ4YzyoWr5qfprf8Xtd+8prmo5G3XA4BJZh?=

=?iso-8859-1?Q?3+3aOeY/B4D5yDQ/YxCQo6in/AgHNwD8XM51DC+43GzLToMASMuEgR0Nz3?=

=?iso-8859-1?Q?0FGYOynpQoEvtvg0pVJugfNVB0tcnLZwIJfRIaMtK5L9Djmx2PD9dXCp6j?=

=?iso-8859-1?Q?P5ZEk/HJ1q93I2cQgCa6mvqzBxkojSekXOdCnIXO6wDsAuuOSoiNV7zSzf?=

=?iso-8859-1?Q?ylSxGVQXAupob11K7dizCUQ8+Ti1gw1IGYGcH+dyU4T5AsEOR5EVUUTKYE?=

=?iso-8859-1?Q?CJJyQbmTujPKr1hUNs+ziagHehq7ruSoegoVmW9khpG3WBUnQkNKgN3JRy?=

=?iso-8859-1?Q?GLqC2BAUhCfgGKuEGuJaeJZVNSDZsIC7Dg77xRF+DWhN1twEZEqGT1cKPZ?=

=?iso-8859-1?Q?cypggFV3wnEdI5jY58/gAp+qG77adUgqnXiy1/zsHN6z2xPAdNRAlm4Hi0?=

=?iso-8859-1?Q?mPVotGz/CkU3m+iR/nBDKw9pmyOI9a5pF4XBGwEysudI2BsPOpMWsCu2Xr?=

=?iso-8859-1?Q?ubVD5TpQXD+Jhv/bsbd0UR6OReFILyStMkYcxgIP/wsYTqcMphi/eFFDki?=

=?iso-8859-1?Q?J9ZpaeBQgnJHnT16DBuSFbhaKg1XmJwXTDvOE76k29fKSfE=3D?=

Content-Type: multipart/alternative;

boundary="_000_DB8P194MB0822AFA19FAD03DA4282FEA6A72D9DB8P194MB0822EURP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: DB8P194MB0822.EURP194.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 287a55ec-6806-4550-1b2a-08dab3938e76

X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Oct 2022 18:39:15.7390

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: VE1P194MB0781

X-Spam_score: 11.4

X-Spam_score_int: 114

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: { Citizenship programmers {jack Port} With Western Union

Payment *World Bank*} Congratulations !!! Worldwide Beneficiary Benefit

Program. Attention Beneficiary : Compliment of the Season to you and your

family. Congratulations we wish to inform you the release of Citizenship programmers

{jack Port} With Western Union Payment World B [...]

Content analysis details: (11.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.92.64.20 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

1.2 MISSING_HEADERS Missing To: header

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[europeinternalglo[at]outlook.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

0.0 HTML_MESSAGE BODY: HTML included in message

1.4 MALFORMED_FREEMAIL Bad headers on message from free email

service

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 HK_LOTTO No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 FREEMAIL_REPLY From and body contain different freemails

0.0 LOTTO_DEPT Claims Department

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Attention Beneficiary, Ref1001/Code:00843839

--_000_DB8P194MB0822AFA19FAD03DA4282FEA6A72D9DB8P194MB0822EURP_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

{ Citizenship programmers {jack Port} With Western Union Payment =

World Bank*}

Congratulations !!!

Worldwide Beneficiary Benefit Program.

Attention Beneficiary : Compliment of the Season to you and your fami=

ly. Congratulations we wish to inform you the release of Citizenship progra=

mmers {jack Port} With Western Union Payment World Bank held on the 20t=

h September 2022 and your email-id has been chosen at random among the 10,0=

00 beneficiaries all around the world from America, Canada, Asia, Australia=

, Europe and Africa, which you consequently won in the 2ND category and all=

participants were selected through a computer ballot system drawn. This is=

a life time opportunity to bring to your immediate desire with the total s=

um of $US 410,000.00 { Four Hundred and Ten Thousand United State Dollar } =

been approved that your Email-id was luckily picked among others that was o=

rganized by the Citizenship programmers {jack Port} With Western Union Pay=

ment World Bank to support individual due to the worldwide economy meltd=

own COVID19. this fund compensation as part of our effort to protect human =

rights all over the world. Congratulations once again .

{ /Ref1001/Code:00843839/*2022/Citizenship programmers {jack Port} .

This is very urgent and you are hereby advised to contact Director Inter=

national Remittance Department, for security reasons, So that the funds can=

be transferred to you immediately. While we looking forward to serving you=

with the best of our service. Regards Attention Beneficiary, Ref1001/Cod=

e:00843839

Sign

Benefit Program

Citizenship programmers {jack Port}

Lottery winners

With Western Union Payment World Bank

Director International Remittance Department

Contact Via Email : signalglobal@gmx.com

=A92004-2022 worldwide All Rights Reserved

--_000_DB8P194MB0822AFA19FAD03DA4282FEA6A72D9DB8P194MB0822EURP_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

1">

: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class=

=3D"elementToProof">

0px;background-color:rgb(255, 255, 255)">
, Arial, Helvetica, sans-serif, serif, EmojiFont;margin:0px">
"margin:0px">
style=3D"margin:0px">
cx_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_elementToProof" style=3D"margin:0px">
style=3D"margin:0px">
>
n:0px">
"margin:0px"><=

span style=3D"font-size:18pt;margin:0px;color:rgb(23, 78, 134) !important">=

span>
px;color:rgb(23, 78, 134) !important">

t;background-color:rgb(255, 255, 0) !important">
d0" style=3D"font-size:16pt;margin:0px;color:rgb(23, 78, 134) !important;ba=

ckground-color:rgb(255, 255, 255) !important">
ss=3D"ContentPasted0" style=3D"font-size:16pt;margin:0px;color:rgb(23, 78, =

134) !important">{

Citizenship programmers {jack Port} With Western Union Payment *World Ba=

nk*}

<=

/span>

px;background-color:rgb(255, 255, 255)">

n:0px">

style=3D"margin:0px">

jiFont;margin:0px;background-color:rgb(255, 255, 255)">

!important">
ial, Helvetica, sans-serif, serif, EmojiFont">
;margin:0px;color:rgb(33, 33, 33) !important">
ze:15px;margin:0px;color:rgb(33, 33, 33) !important">
font-size:15px;margin:0px;color:rgb(33, 33, 33) !important">
yle=3D"font-size:15px;margin:0px;color:rgb(33, 33, 33) !important"><=

span style=3D"font-size:15px;margin:0px;color:rgb(33, 33, 33) !important"><=

/span>

<=

b>
gb(23, 78, 134) !important"> =

;
=3D"font-size:14pt;margin:0px;color:rgb(23, 78, 134) !important">
s=3D"ContentPasted0" style=3D"font-size:16pt;margin:0px">
style=3D"margin:0px;border-radius:2px">
dius:2px">
size:18pt;margin:0px;border-radius:2px">
dius:2px">
n:0px;padding:1px 0px;border-radius:2px">
0px 1px;border-radius:2px">
-radius:2px"><=

span style=3D"margin:0px;padding:0px 1px;border-radius:2px">
margin:0px;padding:0px 1px;border-radius:2px">
ding:0px 1px;border-radius:2px">
order-radius:2px">
px">
e=3D"margin:0px;padding:0px 1px;border-radius:2px">
x;padding:0px 1px;border-radius:2px">
1px;border-radius:2px">
ius:2px">
style=3D"margin:0px;padding:0px 1px;border-radius:2px">
in:0px;padding:0px 1px;border-radius:2px">
:0px 1px;border-radius:2px">
r-radius:2px">
:0px;padding:0px 1px;border-radius:2px">Congratulations
>
an>
span>
px">
6pt;margin:0px;color:rgb(23, 78, 134) !important">!!!
margin:0px;color:rgb(0, 0, 0) !important;background-color:rgb(255, 255, 0) =

!important">
px;color:rgb(23, 78, 134) !important;background-color:rgb(255, 255, 255) !i=

mportant">

n style=3D"font-size:18pt;margin:0px">

<=

span style=3D"margin:0px;color:rgb(0, 0, 0) !important">
ontentPasted0" style=3D"font-size:16pt;margin:0px;color:rgb(23, 78, 134) !i=

mportant"> &n=

bsp;Worldwide Beneficiary

Benefit Program.

<=

br class=3D"ContentPasted0">

<=

span class=3D"ContentPasted0" style=3D"font-size:16pt;margin:0px"> &n=

bsp; Attention Beneficiary : Compliment of the Season to you and you=

r family.
in:0px">
le=3D"margin:0px;border-radius:2px">
:2px">
le=3D"margin:0px;border-radius:2px">
:2px">
yle=3D"margin:0px;padding:0px 1px;border-radius:2px">
0px;padding:0px 1px;border-radius:2px">
x 1px;border-radius:2px">
adius:2px">
an style=3D"margin:0px;padding:0px 1px;border-radius:2px">
rgin:0px;padding:0px 1px;border-radius:2px">
ng:0px 1px;border-radius:2px">
der-radius:2px">
">
=3D"margin:0px;padding:0px 1px;border-radius:2px">
;padding:0px 1px;border-radius:2px">
px;border-radius:2px">
us:2px">
style=3D"margin:0px;padding:0px 1px;border-radius:2px">
n:0px;padding:0px 1px;border-radius:2px">
le=3D"font-size:16pt;margin:0px;padding:0px 1px;border-radius:2px">Congratu=

lations
n>
pan>
=3D"font-size:16pt;margin:0px">
style=3D"font-size:16pt;margin:0px">we

wish to inform you the release of Citizenship programmers {jack Port} With=

Western Union Payment World Bank held on the 20th September 2022 and y=

our email-id has been chosen at random among the 10,000 beneficiaries all a=

round the world from America, Canada,

Asia, Australia, Europe and Africa, which you consequently won in the 2ND =

category and all participants were selected through a computer ballot syste=

m drawn. This is a life time opportunity to bring to your immediate desire =

with the total sum of $US 410,000.00

{ Four Hundred and Ten Thousand United State Dollar } been approved that y=

our Email-id was luckily picked among others that was organized by the Citi=

zenship programmers {jack Port} With Western Union Payment World Bank t=

o support individual due to the

worldwide economy meltdown COVID19. this fund compensation as part of our =

effort to protect human rights all over the world.
tentPasted0" style=3D"font-size:16pt;margin:0px">
=3D"margin:0px;border-radius:2px">
px">
4pt;margin:0px;border-radius:2px">
px">
padding:1px 0px;border-radius:2px">
x;border-radius:2px">
s:2px">
tyle=3D"margin:0px;padding:0px 1px;border-radius:2px">
:0px;padding:0px 1px;border-radius:2px">
px 1px;border-radius:2px">
radius:2px">
pan style=3D"margin:0px;padding:0px 1px;border-radius:2px">
argin:0px;padding:0px 1px;border-radius:2px">
ing:0px 1px;border-radius:2px">
rder-radius:2px">
x">
=3D"margin:0px;padding:0px 1px;border-radius:2px">
;padding:0px 1px;border-radius:2px">
px;border-radius:2px">
us:2px">
adding:0px 1px;border-radius:2px">Congratulations
n>
pan><=

/span>&n=

bsp;
x">once

again .

<=

span style=3D"font-size:14pt;margin:0px">

<=

span class=3D"ContentPasted0" style=3D"font-size:16pt;margin:0px"> &n=

bsp;
ContentPasted0" style=3D"font-weight:600;font-size:16pt;margin:0px;color:rg=

b(50, 49, 48) !important;background-color:rgb(250, 249, 248) !important">{

/Ref1001/Code:00843839/*2022/Citizenship programmers {jack Port} .<=

/span>