Chinese phish pretending to be the British King
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 03 Nov 2022 14:15:01 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oqgbX-000L0G-4o
for dave@doctor.nl2k.ab.ca;
Thu, 03 Nov 2022 14:14:23 -0600
Resent-From: The Doctor
Resent-Date: Thu, 3 Nov 2022 14:14:23 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [180.163.38.98] (port=15871 helo=mail.mahk.top)
by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oqbVd-0000bg-2G
for doctor@netknow.ca;
Thu, 03 Nov 2022 08:48:03 -0600
Received: from [192.168.8.102] (unknown [154.118.41.117])
by mail.mahk.top (Postfix) with ESMTP id E2D631C64A2;
Thu, 3 Nov 2022 22:27:13 +0800 (CST)
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Greetings. 180.163.41.100
To: Recipients
From: "His Majesty Charles III"
Date: Thu, 03 Nov 2022 15:26:58 +0100
Reply-To: mrkevinbenqq@gmail.com
X-Spam_score: 17.6
X-Spam_score_int: 176
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings. My names are His Majesty Charles III, by the Grace
of God, of the United Kingdom of Great Britain and Northern Ireland and of
His other Realms and Territories King, Head of the Commonwealth, Defender
[...]
Content analysis details: (17.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[180.163.38.98 listed in psbl.surriel.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[180.163.38.98 listed in bl.score.senderscore.com]
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[180.163.38.98 listed in bb.barracudacentral.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[180.163.38.98 listed in wl.mailspike.net]
0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
1.0 BITCOIN_SPAM_04 BitCoin spam pattern 04
0.0 LOTS_OF_MONEY Huge... sums of money
0.1 MISSING_MID Missing Message-Id: header
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.8 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
1.0 BITCOIN_SPAM_07 BitCoin spam pattern 07
0.0 FILL_THIS_FORM Fill in a form with personal information
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
2.2 FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 MONEY_FORM Lots of money if you fill out a form
0.0 FORM_FRAUD Fill a form and a fraud phrase
Subject: {SPAM?} Greetings. 180.163.41.100
Greetings.
My names are His Majesty Charles III, by the Grace of God, of the United Ki=
ngdom of Great Britain and Northern Ireland and of His other Realms and Ter=
ritories King, Head of the Commonwealth, Defender of the Faith.
I'm the longest-serving heir apparent and the oldest person to accede to th=
e British throne, at the age of 73, following the death of my mother, Eliza=
beth II, on 8 September 2022.
Based on the meeting held today 28th October, 2022. We have concluded it to=
compensate all Covid-19 victims with Economic Devastation Relief Package. =
As of mid-October, the Federal Trade Commission (FTC) had logged nearly 754=
,000 consumer complaints related to COVID-19 and stimulus payments since th=
e start of the pandemic.
After the meeting we have decided to pay out sum of =A3500,000.00 each as p=
art of unprecedented time in modern history that will require the best of m=
y humanity to overcome. =
The funds has been delivered down to the distribution points and currently =
secured by the International Committee of Red Cross (ICRC) Vault Operations=
, Centurion, United Kingdom, as you can see on the following Web-video page=
below:
https://drive.google.com/file/d/1P1TUPuxFnusug3Da8MpyaFoHUbS7GVEm/view?usp=
=3Dsharing
Remember you will be asked to pay them sum of =A3150 only to secure your sw=
orn affidavit of funds claim and insurance coverage.
Therefore, you can forward your details as stated below for your claim.
1. Your full names.
2. Your address.
3. Your telephone.
4. Your age.
5. Your occupation.
This is your Reference Code: GBP/DDCS0011001300-ICRC
Best Regards,
His Majesty Charles III
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 03 Nov 2022 14:15:01 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oqgbX-000L0G-4o
for dave@doctor.nl2k.ab.ca;
Thu, 03 Nov 2022 14:14:23 -0600
Resent-From: The Doctor
Resent-Date: Thu, 3 Nov 2022 14:14:23 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [180.163.38.98] (port=15871 helo=mail.mahk.top)
by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))
(envelope-from
id 1oqbVd-0000bg-2G
for doctor@netknow.ca;
Thu, 03 Nov 2022 08:48:03 -0600
Received: from [192.168.8.102] (unknown [154.118.41.117])
by mail.mahk.top (Postfix) with ESMTP id E2D631C64A2;
Thu, 3 Nov 2022 22:27:13 +0800 (CST)
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Greetings. 180.163.41.100
To: Recipients
From: "His Majesty Charles III"
Date: Thu, 03 Nov 2022 15:26:58 +0100
Reply-To: mrkevinbenqq@gmail.com
X-Spam_score: 17.6
X-Spam_score_int: 176
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings. My names are His Majesty Charles III, by the Grace
of God, of the United Kingdom of Great Britain and Northern Ireland and of
His other Realms and Territories King, Head of the Commonwealth, Defender
[...]
Content analysis details: (17.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[180.163.38.98 listed in psbl.surriel.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[180.163.38.98 listed in bl.score.senderscore.com]
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[180.163.38.98 listed in bb.barracudacentral.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[180.163.38.98 listed in wl.mailspike.net]
0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
1.0 BITCOIN_SPAM_04 BitCoin spam pattern 04
0.0 LOTS_OF_MONEY Huge... sums of money
0.1 MISSING_MID Missing Message-Id: header
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.8 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
1.0 BITCOIN_SPAM_07 BitCoin spam pattern 07
0.0 FILL_THIS_FORM Fill in a form with personal information
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
2.2 FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 MONEY_FORM Lots of money if you fill out a form
0.0 FORM_FRAUD Fill a form and a fraud phrase
Subject: {SPAM?} Greetings. 180.163.41.100
Greetings.
My names are His Majesty Charles III, by the Grace of God, of the United Ki=
ngdom of Great Britain and Northern Ireland and of His other Realms and Ter=
ritories King, Head of the Commonwealth, Defender of the Faith.
I'm the longest-serving heir apparent and the oldest person to accede to th=
e British throne, at the age of 73, following the death of my mother, Eliza=
beth II, on 8 September 2022.
Based on the meeting held today 28th October, 2022. We have concluded it to=
compensate all Covid-19 victims with Economic Devastation Relief Package. =
As of mid-October, the Federal Trade Commission (FTC) had logged nearly 754=
,000 consumer complaints related to COVID-19 and stimulus payments since th=
e start of the pandemic.
After the meeting we have decided to pay out sum of =A3500,000.00 each as p=
art of unprecedented time in modern history that will require the best of m=
y humanity to overcome. =
The funds has been delivered down to the distribution points and currently =
secured by the International Committee of Red Cross (ICRC) Vault Operations=
, Centurion, United Kingdom, as you can see on the following Web-video page=
below:
https://drive.google.com/file/d/1P1TUPuxFnusug3Da8MpyaFoHUbS7GVEm/view?usp=
=3Dsharing
Remember you will be asked to pay them sum of =A3150 only to secure your sw=
orn affidavit of funds claim and insurance coverage.
Therefore, you can forward your details as stated below for your claim.
1. Your full names.
2. Your address.
3. Your telephone.
4. Your age.
5. Your occupation.
This is your Reference Code: GBP/DDCS0011001300-ICRC
Best Regards,
His Majesty Charles III
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments