Nigerian spam from Microsoft Outlook servers
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 11 Jan 2023 21:00:46 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pFokx-000Co2-2y
for dave@doctor.nl2k.ab.ca;
Wed, 11 Jan 2023 20:59:59 -0700
Resent-From: The Doctor
Resent-Date: Wed, 11 Jan 2023 20:59:59 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-he1eur04hn2240.outbound.protection.outlook.com ([52.100.18.240]:56198 helo=EUR04-HE1-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from)
id 1pFnfE-000FaN-06
for doctor@nl2k.ab.ca;
Wed, 11 Jan 2023 19:50:09 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=dAAasj99BtnTrx9MMAiF7fpZzSdjMsSVnJwktFsfoYB/VL71fudml108KZXC7gB+k+Kq5mEuYnw3rauU5e1f5aFLWEa6w54sw64znXxJRSLTz5upJ1bafim11b6tMDeRIdzvp+4ZVG/hSJzypYEDekeqSdJi+VyHUehKQc08gDydknvuDdhwt9KT4B1AuVhjkYLu5p4XkHzJW0g5M7t7Qhcj5UH154Bhdh/W/ozJPg+LBR+MEevgxYz4eYkgQGS2Zl418RXZ+t41P6dLA9h4OseDKyKrIEHE4CZnz4DmyPy6zb/cQDkLvov+S6LWouzQ7dDqfE180paPBcBWQQ9jSw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=L90LSiEJfreLGRg2DfgjUIVRc608YwinpiPk9ZZjNxg=;
b=E3FrYGLXuafiNyPbMbLZHKnCgJrciUqTQvVbI3wAkmtMJbL7LG7ke/7Osjm4MkfcQbzQ2muaF9id1DXJ5qSzauKr4IRj4m3PeriMJUx07EgP7PXT8mLTcyVjGt1XZbOMNISf95fn7HAhYQ4encmQhDHYxBpcbcKgUAXVhGTcBo9u+nL0d2qpOLoRM0mvura/p1RWYUu13cEhqyTDu8fvIrQMWVSDuRWRMmKHHd1+ixXflxeFepuOmcjqIElwH/jJzV4TSXVaBv4I496YbLVZ28fn5LMbRNmPGhDu2K/L2Dwuqa4vsnDZkyHgr8uPMp+QFmQgX5eWoU1WlVWBXDOu8A==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
52.157.248.72) smtp.rcpttodomain=earthlink.net smtp.mailfrom=europe.com;
dmarc=none action=none header.from=europe.com; dkim=none (message not
signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=generali.onmicrosoft.com; s=selector2-generali-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=L90LSiEJfreLGRg2DfgjUIVRc608YwinpiPk9ZZjNxg=;
b=v0kCDsfcj4Q7wzUCYVsH+qnD1GzjbrdMG2cuXUPOGCKGtP+YXiKg4zCeVIwdU+Ea3hdtBN3NqHm3he3LZWZCBkk6hYYf7m/giZQnPCJ3tACSRoqxVP8ucwMj+8JnYStm/EKH5oxVIHcBZNNwRD24y48D9CyA7/ikAw/KZ6+Ril0=
Received: from DB9PR02CA0014.eurprd02.prod.outlook.com (2603:10a6:10:1d9::19)
by PAWP189MB2375.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:337::16) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5986.18; Thu, 12 Jan
2023 02:47:22 +0000
Received: from DB5EUR01FT064.eop-EUR01.prod.protection.outlook.com
(2603:10a6:10:1d9:cafe::58) by DB9PR02CA0014.outlook.office365.com
(2603:10a6:10:1d9::19) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6002.13 via Frontend
Transport; Thu, 12 Jan 2023 02:47:22 +0000
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 52.157.248.72)
smtp.mailfrom=europe.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=europe.com;
Received-SPF: Fail (protection.outlook.com: domain of europe.com does not
designate 52.157.248.72 as permitted sender) receiver=protection.outlook.com;
client-ip=52.157.248.72; helo=mail.generali.es;
Received: from mail.generali.es (52.157.248.72) by
DB5EUR01FT064.mail.protection.outlook.com (10.152.5.83) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.5986.18 via Frontend Transport; Thu, 12 Jan 2023 02:47:21 +0000
Received: from C20ACX0001.generali.priv (10.200.66.62) by
C20ACX0002.generali.priv (10.200.66.63) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id
15.1.2375.31; Thu, 12 Jan 2023 03:47:18 +0100
Received: from User (10.200.70.80) by C20ACX0001.generali.priv (10.200.66.62)
with Microsoft SMTP Server id 15.1.2375.32 via Frontend Transport; Thu, 12
Jan 2023 03:46:59 +0100
Reply-To:,
From: Bradley
Subject: I Need Your Cooperation.
Date: Thu, 12 Jan 2023 02:47:17 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <5a9a4a35-e415-4f3b-91d5-b4d6efd6d3bd@C20ACX0001.generali.priv>
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DB5EUR01FT064:EE_|PAWP189MB2375:EE_
X-MS-Office365-Filtering-Correlation-Id: b62437d2-6bef-44d2-d978-08daf447545a
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?0edc6mU7th8HvAbfwmilv3r9IDz8BHkoQlt2dU64Mazs+7EEmTUD6Z3q?=
=?windows-1251?Q?CVg0SZqrT1TAGUDo2ZB1c5UPZsXknZ8c8jgjJabFSiQD7GUCiaHCMsG+?=
=?windows-1251?Q?toGAWXmSrL6dkAPBdFaIO28tKxcpjYQYxS5Dr3gI6OWfD350+qvISfhw?=
=?windows-1251?Q?W20XBNuc9X4NV8bcU1056F8iXr4+SIu/LOoYDabut9E/T0ewRSV/DaF0?=
=?windows-1251?Q?R9YZ9tzWI/k/UHnHypuuXvrWjmgKFkw1FdIXesbFmDCxufV/kSTpbM8x?=
=?windows-1251?Q?wg99xTq/DYASRnrSw/wglAsO0ZKRE2fcQjuWJYpqWfJnXcem98Uk94sr?=
=?windows-1251?Q?yaqwMXHHCc0Y629LAvoQKnP+M2NIUb/VTYPzMKZUXZa4nd1MmA/fHEUd?=
=?windows-1251?Q?6ZRK91VUDxefyPYY+49DBoKONhaKilDhCRB18jls8AU8gPtgDiKnV0bm?=
=?windows-1251?Q?INxxKWzwM6mLfv9QVx+qg7UL9wp9PwrdT6t6k8UurRwasPkl7F/Zn8I4?=
=?windows-1251?Q?+eC5QGOMbSxk3Uw91IbJF/t45/phQkwJGV+QCux5nNmXEo+H8H3BL7Ax?=
=?windows-1251?Q?ZdJFCpFIfEubzWmiX8DtDKtwpu94ZcrcBncqLTt0cNb34vKpTZTvIEcG?=
=?windows-1251?Q?0rZn8R5k0NBkyd7f8SyaMYO3rgbpB1q2OjmHBJw0192m+rcRokLbJ9o+?=
=?windows-1251?Q?zGQe6n4YJ6aq+Y31reAgdjJ0KbmF3vjewhUhkcE44XhRFbsbSEKueAdb?=
=?windows-1251?Q?mESwx7t2Ua2rgHxVS0ECdYrHSCdGxw1vum3voSS0NDoV0h2au/78+u6z?=
=?windows-1251?Q?YyDbC/xLfgCLZKzt2p48cxfHkU7zGVROPgh+7Gwo98Eq+7NuXNeAKwmB?=
=?windows-1251?Q?8YzzYUr85otbd1XvgHifFY8RN646xUoGv472z0rzDPj1sgsbF8MQuGU0?=
=?windows-1251?Q?Zp2kZLnK+Fu52fObWWkQrSDokwc3vrxeofrWJRYS5sq+jAH4npHkdG1t?=
=?windows-1251?Q?ylM0djK5HA/96ClsJ02wCTLJvTz/U9nzKW5dd5MHRb/btaVNjrb3v3Ck?=
=?windows-1251?Q?H2UQFTJrW7WxcAJ+tB1eHQlxW6wtNqtV7MUuK/0K2Z/S3alxcpNZic7S?=
=?windows-1251?Q?QS3uaSHNxj9BZz+6KRNibgqBHSAPokJDPViffKEAhYiJbavTaLiDb8s5?=
=?windows-1251?Q?JD17O4cEj3Hp2uCPDaqWI7Jv4lkmKh/7?=
X-Forefront-Antispam-Report:
CIP:52.157.248.72;CTRY:NL;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:mail.generali.es;PTR:InfoDomainNonexistent;CAT:OSPM;SFS:(13230022)(4636009)(346002)(136003)(39860400002)(376002)(396003)(84050400002)(109986013)(451199015)(40470700004)(40480700001)(2860700004)(316002)(32650700002)(86362001)(31696002)(7366002)(7336002)(7416002)(7406005)(2906002)(6666004)(7276002)(8676002)(41300700001)(508600001)(70586007)(70206006)(8936002)(3480700007)(82740400003)(5660300002)(356005)(81166007)(35950700001)(40460700003)(26005)(336012)(82960400001)(9686003)(31686004)(83380400001)(82310400005)(66899015)(2700400008);DIR:OUT;SFP:1501;
X-OriginatorOrg: generali.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Jan 2023 02:47:21.8942
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: b62437d2-6bef-44d2-d978-08daf447545a
X-MS-Exchange-CrossTenant-Id: cbeb3ecc-6f45-4183-b5a8-088140deae5d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=cbeb3ecc-6f45-4183-b5a8-088140deae5d;Ip=[52.157.248.72];Helo=[mail.generali.es]
X-MS-Exchange-CrossTenant-AuthSource:
DB5EUR01FT064.eop-EUR01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAWP189MB2375
X-Spam_score: 15.8
X-Spam_score_int: 158
X-Spam_bar: +++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: How are you and your family? I believe you received my letter
in your best mood today; my name is Bradley Rodgers, a branch manager with
NatWest Bank Plc. I decided to seek a confidential co-operation [...]
Content analysis details: (15.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[52.100.18.240 listed in list.dnswl.org]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[bradleyrodgersuk(at)europe.com]
0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
2.7 UNCLAIMED_MONEY BODY: People just leave money laying around
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom
freemail headers are different
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 CTE_8BIT_MISMATCH Header says 7bits but body disagrees
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
3.1 RISK_FREE No risk!
1.0 XPRIO Has X-Priority header
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.7 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} I Need Your Cooperation.
How are you and your family? I believe you received my letter in your best mood today; my name is Bradley Rodgers, a branch manager with NatWest Bank Plc. I decided to seek a confidential co-operation with you in the execution of the deal described here-under for both of us mutual benefit and hope you will keep it a top secret because of the nature of the transaction.
The transaction pertains to an unclaimed Funds savings monetary deposit in the sum of Twelve Million, Three Hundred Thousand British Pounds (12,300,000) with NatWest Bank Plc. The policy holder was one of our clients who died on March 29th of pneumonia after contracting COVID-19. Since his death no one has come forward for the claim and all our efforts to locate his relatives have proved unsuccessful. The Finance company policy stipulates that “Funds" not claimed must be turned over to the abandoned property division of the state treasury after the deadline.
Therefore, I ask for your consent to be in partnership with me for the claim of these Funds, If you permit me to add your name to the policy Funds, all proceeds will be processed on your behalf. I wish to point out that I want 10% of this money to be shared among charity organizations while the remaining 90% will be shared between us.
This is 100% risk free and 100% legal. I do have all necessary documentation to expedite the process in a highly professional and confidential manner. I will provide all the relevant documents to substantiate your claim as the beneficiary. This claim requires a high level of confidentiality and it may take up to Ten (10) business days, from the date of receipt of your consent.
Your earliest response to this matter would be highly appreciated,
Regards,
Bradley Rodgers,
NatWest Bank Plc.
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 11 Jan 2023 21:00:46 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pFokx-000Co2-2y
for dave@doctor.nl2k.ab.ca;
Wed, 11 Jan 2023 20:59:59 -0700
Resent-From: The Doctor
Resent-Date: Wed, 11 Jan 2023 20:59:59 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-he1eur04hn2240.outbound.protection.outlook.com ([52.100.18.240]:56198 helo=EUR04-HE1-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from
id 1pFnfE-000FaN-06
for doctor@nl2k.ab.ca;
Wed, 11 Jan 2023 19:50:09 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=dAAasj99BtnTrx9MMAiF7fpZzSdjMsSVnJwktFsfoYB/VL71fudml108KZXC7gB+k+Kq5mEuYnw3rauU5e1f5aFLWEa6w54sw64znXxJRSLTz5upJ1bafim11b6tMDeRIdzvp+4ZVG/hSJzypYEDekeqSdJi+VyHUehKQc08gDydknvuDdhwt9KT4B1AuVhjkYLu5p4XkHzJW0g5M7t7Qhcj5UH154Bhdh/W/ozJPg+LBR+MEevgxYz4eYkgQGS2Zl418RXZ+t41P6dLA9h4OseDKyKrIEHE4CZnz4DmyPy6zb/cQDkLvov+S6LWouzQ7dDqfE180paPBcBWQQ9jSw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=L90LSiEJfreLGRg2DfgjUIVRc608YwinpiPk9ZZjNxg=;
b=E3FrYGLXuafiNyPbMbLZHKnCgJrciUqTQvVbI3wAkmtMJbL7LG7ke/7Osjm4MkfcQbzQ2muaF9id1DXJ5qSzauKr4IRj4m3PeriMJUx07EgP7PXT8mLTcyVjGt1XZbOMNISf95fn7HAhYQ4encmQhDHYxBpcbcKgUAXVhGTcBo9u+nL0d2qpOLoRM0mvura/p1RWYUu13cEhqyTDu8fvIrQMWVSDuRWRMmKHHd1+ixXflxeFepuOmcjqIElwH/jJzV4TSXVaBv4I496YbLVZ28fn5LMbRNmPGhDu2K/L2Dwuqa4vsnDZkyHgr8uPMp+QFmQgX5eWoU1WlVWBXDOu8A==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
52.157.248.72) smtp.rcpttodomain=earthlink.net smtp.mailfrom=europe.com;
dmarc=none action=none header.from=europe.com; dkim=none (message not
signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=generali.onmicrosoft.com; s=selector2-generali-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=L90LSiEJfreLGRg2DfgjUIVRc608YwinpiPk9ZZjNxg=;
b=v0kCDsfcj4Q7wzUCYVsH+qnD1GzjbrdMG2cuXUPOGCKGtP+YXiKg4zCeVIwdU+Ea3hdtBN3NqHm3he3LZWZCBkk6hYYf7m/giZQnPCJ3tACSRoqxVP8ucwMj+8JnYStm/EKH5oxVIHcBZNNwRD24y48D9CyA7/ikAw/KZ6+Ril0=
Received: from DB9PR02CA0014.eurprd02.prod.outlook.com (2603:10a6:10:1d9::19)
by PAWP189MB2375.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:337::16) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5986.18; Thu, 12 Jan
2023 02:47:22 +0000
Received: from DB5EUR01FT064.eop-EUR01.prod.protection.outlook.com
(2603:10a6:10:1d9:cafe::58) by DB9PR02CA0014.outlook.office365.com
(2603:10a6:10:1d9::19) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6002.13 via Frontend
Transport; Thu, 12 Jan 2023 02:47:22 +0000
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 52.157.248.72)
smtp.mailfrom=europe.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=europe.com;
Received-SPF: Fail (protection.outlook.com: domain of europe.com does not
designate 52.157.248.72 as permitted sender) receiver=protection.outlook.com;
client-ip=52.157.248.72; helo=mail.generali.es;
Received: from mail.generali.es (52.157.248.72) by
DB5EUR01FT064.mail.protection.outlook.com (10.152.5.83) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.5986.18 via Frontend Transport; Thu, 12 Jan 2023 02:47:21 +0000
Received: from C20ACX0001.generali.priv (10.200.66.62) by
C20ACX0002.generali.priv (10.200.66.63) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id
15.1.2375.31; Thu, 12 Jan 2023 03:47:18 +0100
Received: from User (10.200.70.80) by C20ACX0001.generali.priv (10.200.66.62)
with Microsoft SMTP Server id 15.1.2375.32 via Frontend Transport; Thu, 12
Jan 2023 03:46:59 +0100
Reply-To:
From: Bradley
Subject: I Need Your Cooperation.
Date: Thu, 12 Jan 2023 02:47:17 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <5a9a4a35-e415-4f3b-91d5-b4d6efd6d3bd@C20ACX0001.generali.priv>
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DB5EUR01FT064:EE_|PAWP189MB2375:EE_
X-MS-Office365-Filtering-Correlation-Id: b62437d2-6bef-44d2-d978-08daf447545a
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?0edc6mU7th8HvAbfwmilv3r9IDz8BHkoQlt2dU64Mazs+7EEmTUD6Z3q?=
=?windows-1251?Q?CVg0SZqrT1TAGUDo2ZB1c5UPZsXknZ8c8jgjJabFSiQD7GUCiaHCMsG+?=
=?windows-1251?Q?toGAWXmSrL6dkAPBdFaIO28tKxcpjYQYxS5Dr3gI6OWfD350+qvISfhw?=
=?windows-1251?Q?W20XBNuc9X4NV8bcU1056F8iXr4+SIu/LOoYDabut9E/T0ewRSV/DaF0?=
=?windows-1251?Q?R9YZ9tzWI/k/UHnHypuuXvrWjmgKFkw1FdIXesbFmDCxufV/kSTpbM8x?=
=?windows-1251?Q?wg99xTq/DYASRnrSw/wglAsO0ZKRE2fcQjuWJYpqWfJnXcem98Uk94sr?=
=?windows-1251?Q?yaqwMXHHCc0Y629LAvoQKnP+M2NIUb/VTYPzMKZUXZa4nd1MmA/fHEUd?=
=?windows-1251?Q?6ZRK91VUDxefyPYY+49DBoKONhaKilDhCRB18jls8AU8gPtgDiKnV0bm?=
=?windows-1251?Q?INxxKWzwM6mLfv9QVx+qg7UL9wp9PwrdT6t6k8UurRwasPkl7F/Zn8I4?=
=?windows-1251?Q?+eC5QGOMbSxk3Uw91IbJF/t45/phQkwJGV+QCux5nNmXEo+H8H3BL7Ax?=
=?windows-1251?Q?ZdJFCpFIfEubzWmiX8DtDKtwpu94ZcrcBncqLTt0cNb34vKpTZTvIEcG?=
=?windows-1251?Q?0rZn8R5k0NBkyd7f8SyaMYO3rgbpB1q2OjmHBJw0192m+rcRokLbJ9o+?=
=?windows-1251?Q?zGQe6n4YJ6aq+Y31reAgdjJ0KbmF3vjewhUhkcE44XhRFbsbSEKueAdb?=
=?windows-1251?Q?mESwx7t2Ua2rgHxVS0ECdYrHSCdGxw1vum3voSS0NDoV0h2au/78+u6z?=
=?windows-1251?Q?YyDbC/xLfgCLZKzt2p48cxfHkU7zGVROPgh+7Gwo98Eq+7NuXNeAKwmB?=
=?windows-1251?Q?8YzzYUr85otbd1XvgHifFY8RN646xUoGv472z0rzDPj1sgsbF8MQuGU0?=
=?windows-1251?Q?Zp2kZLnK+Fu52fObWWkQrSDokwc3vrxeofrWJRYS5sq+jAH4npHkdG1t?=
=?windows-1251?Q?ylM0djK5HA/96ClsJ02wCTLJvTz/U9nzKW5dd5MHRb/btaVNjrb3v3Ck?=
=?windows-1251?Q?H2UQFTJrW7WxcAJ+tB1eHQlxW6wtNqtV7MUuK/0K2Z/S3alxcpNZic7S?=
=?windows-1251?Q?QS3uaSHNxj9BZz+6KRNibgqBHSAPokJDPViffKEAhYiJbavTaLiDb8s5?=
=?windows-1251?Q?JD17O4cEj3Hp2uCPDaqWI7Jv4lkmKh/7?=
X-Forefront-Antispam-Report:
CIP:52.157.248.72;CTRY:NL;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:mail.generali.es;PTR:InfoDomainNonexistent;CAT:OSPM;SFS:(13230022)(4636009)(346002)(136003)(39860400002)(376002)(396003)(84050400002)(109986013)(451199015)(40470700004)(40480700001)(2860700004)(316002)(32650700002)(86362001)(31696002)(7366002)(7336002)(7416002)(7406005)(2906002)(6666004)(7276002)(8676002)(41300700001)(508600001)(70586007)(70206006)(8936002)(3480700007)(82740400003)(5660300002)(356005)(81166007)(35950700001)(40460700003)(26005)(336012)(82960400001)(9686003)(31686004)(83380400001)(82310400005)(66899015)(2700400008);DIR:OUT;SFP:1501;
X-OriginatorOrg: generali.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Jan 2023 02:47:21.8942
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: b62437d2-6bef-44d2-d978-08daf447545a
X-MS-Exchange-CrossTenant-Id: cbeb3ecc-6f45-4183-b5a8-088140deae5d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=cbeb3ecc-6f45-4183-b5a8-088140deae5d;Ip=[52.157.248.72];Helo=[mail.generali.es]
X-MS-Exchange-CrossTenant-AuthSource:
DB5EUR01FT064.eop-EUR01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAWP189MB2375
X-Spam_score: 15.8
X-Spam_score_int: 158
X-Spam_bar: +++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: How are you and your family? I believe you received my letter
in your best mood today; my name is Bradley Rodgers, a branch manager with
NatWest Bank Plc. I decided to seek a confidential co-operation [...]
Content analysis details: (15.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[52.100.18.240 listed in list.dnswl.org]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[bradleyrodgersuk(at)europe.com]
0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
2.7 UNCLAIMED_MONEY BODY: People just leave money laying around
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom
freemail headers are different
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
1.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 CTE_8BIT_MISMATCH Header says 7bits but body disagrees
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
3.1 RISK_FREE No risk!
1.0 XPRIO Has X-Priority header
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.7 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} I Need Your Cooperation.
How are you and your family? I believe you received my letter in your best mood today; my name is Bradley Rodgers, a branch manager with NatWest Bank Plc. I decided to seek a confidential co-operation with you in the execution of the deal described here-under for both of us mutual benefit and hope you will keep it a top secret because of the nature of the transaction.
The transaction pertains to an unclaimed Funds savings monetary deposit in the sum of Twelve Million, Three Hundred Thousand British Pounds (12,300,000) with NatWest Bank Plc. The policy holder was one of our clients who died on March 29th of pneumonia after contracting COVID-19. Since his death no one has come forward for the claim and all our efforts to locate his relatives have proved unsuccessful. The Finance company policy stipulates that “Funds" not claimed must be turned over to the abandoned property division of the state treasury after the deadline.
Therefore, I ask for your consent to be in partnership with me for the claim of these Funds, If you permit me to add your name to the policy Funds, all proceeds will be processed on your behalf. I wish to point out that I want 10% of this money to be shared among charity organizations while the remaining 90% will be shared between us.
This is 100% risk free and 100% legal. I do have all necessary documentation to expedite the process in a highly professional and confidential manner. I will provide all the relevant documents to substantiate your claim as the beneficiary. This claim requires a high level of confidentiality and it may take up to Ten (10) business days, from the date of receipt of your consent.
Your earliest response to this matter would be highly appreciated,
Regards,
Bradley Rodgers,
NatWest Bank Plc.
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments