Western Union phish from Google

Posted by Dave Yadallee on Wednesday, January 18. 2023

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 17 Jan 2023 17:12:18 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pHw3E-000LFM-1I

for dave@doctor.nl2k.ab.ca;

Tue, 17 Jan 2023 17:11:36 -0700

Resent-From: The Doctor

Resent-Date: Tue, 17 Jan 2023 17:11:36 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f66.google.com ([209.85.218.66]:35797)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pHtFE-0002Ii-2R

for root@nk.ca;

Tue, 17 Jan 2023 14:11:54 -0700

Received: by mail-ej1-f66.google.com with SMTP id vm8so78402279ejc.2

for ; Tue, 17 Jan 2023 13:09:18 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=NEaGRgtzhLE3ZZqtzXyXnBe3N6OiWBTTu/s60GXkUcc=;

b=hiaQT3tSd8VJ8XOTZ7XOTVunCLthklhzm02Wds7/t7IELi5W3RIoU9u9fSf6RgcNhL

Wg7gqll4kyjc94O8ORTBrY2RzVIMsQFAVWXLysfLvW4HLmtKiyGZu2wuStRio6Qqi4jZ

8bcaGIAa8JS6w6PlEhwXT3A8PG3sCH4MILFmhSWaUB8u9RivT0CkABNERWWc00nJzK2Y

ebH0JjY1alxAftJQCiCtzY5J7lUrZ5PWQFddSsz1V4vekPMaYLhuGl6XlfCKzj6qv/pr

K9M/aULTQ4GYqz2ZfSKxsiLHxnVJJaYrWpTZjNx3TQeOuWIm7+EiNMC8qiG2QAmVicB7

ZiwA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=NEaGRgtzhLE3ZZqtzXyXnBe3N6OiWBTTu/s60GXkUcc=;

b=wao7kSAGccPOR81AXl1QhWbCl63Uat1qBai1LUP16MkxMFeLny3a7374GX3CBmFuUi

Dah8GzU5Sq2cX1fPAzNepVjru9BiiMKOIwRP/2q/RkDk86hx8cMnBpiN3p60kWQohdbe

Z1jIBYBEm0rBUsOnEm70Y+1bf8yhgWJa9zzj1ngbVvjs6J0gAEOB6RF+Tuzxu6RW+nlt

++S0ldzb1wMKWABDAWoQf0zgyHVXYrZCbIYQNVPdh8VXvoaTL5tyP5ENd9GrPTQuG7ie

ukZgeamJDpOOE84Mn1dwkUQIq02abpiMOVJVRjt+F+eqHWDDmpzl6eRbpCfFmUrNbVJ2

Sufw==

X-Gm-Message-State: AFqh2kpqmFR+AdCsDborAWdLTh4L6kWKAk7KErOXW98fdTZgU3Lkg04V

r7Z66fZg7K/GbxUvW8/4/AhmCrxoJkDUfdi0jB/hBOo7ZJ3Y3eHm

X-Google-Smtp-Source: AMrXdXugfFc0lsEZ3reMVo3W5e/lgwnviZ0aCRSMZhr9WCoGRnaiEfXgKbOFmUyQVTqiUvgulbmWEWZ3Q0cDt9gWmfU=

X-Received: by 2002:a05:6512:b0d:b0:4cc:941b:7cc0 with SMTP id

w13-20020a0565120b0d00b004cc941b7cc0mr277196lfu.365.1673987711680; Tue, 17

Jan 2023 12:35:11 -0800 (PST)

MIME-Version: 1.0

Reply-To: w.uofficer.hq251@gmail.com

From: WESTERN UNION

Date: Tue, 17 Jan 2023 21:34:39 +0100

Message-ID:

Subject: WESTERN UNION MONEY TRANSFER NOTIFICATION

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000e9c63705f27ba2a7"

Bcc: root@nk.ca

X-Spam_score: 20.9

X-Spam_score_int: 209

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Welcome to Western Union Worldwide Department of Western

Union United States of America. Address 1 Columbus Ave, Washington DC,

10006, United States of America

Content analysis details: (20.9 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.218.66 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.218.66 listed in wl.mailspike.net]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[w.uofficer.hq251(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[jibrinkwass40000(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[jibrinkwass40000(at)gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 LOTS_OF_MONEY Huge... sums of money

2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 LOTTO_DEPT Claims Department

1.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 FILL_THIS_FORM Fill in a form with personal information

0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases

1.0 XFER_LOTSA_MONEY Transfer a lot of money

2.2 FILL_THIS_FORM_LOAN Answer loan question(s)

0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)

0.0 MONEY_FORM Lots of money if you fill out a form

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.7 UNDISC_MONEY Undisclosed recipients + money/fraud signs

1.8 ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of money

Subject: {SPAM?} WESTERN UNION MONEY TRANSFER NOTIFICATION

--000000000000e9c63705f27ba2a7

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Welcome to Western Union Worldwide

Department of Western Union United States of America.

Address 1 Columbus Ave, Washington DC, 10006, United States of America

Our Ref: IMF/WB/UN/XWFD/0611/X012

Greetings from the Western Union Office Department.

Attention: Beneficiary, Our Ref: IMF/WB/UN/XWFD/0611/X012

We have sent this mail to you several times without getting any reply from

you.

This is to inform you that the United State Government under President Joe

Biden=E2=80=99s Administration has instructed Western Union Office Headquar=

ters

here in the United States to transfer 4.5 Million Dollars ($4,500,000.00)

compensating for all the CORONA-VIRUS (COVID-19) VICTIMS WORLDWIDE, SCAM

VICTIMS WORLDWIDE, Having reviewed thousands of extortion/delayed payment,

cases on all the UNPAID INHERITANCE, LOTTERY WINNERS and CONTRACT

BENEFICIARIES, CORONA-VIRUS PANDEMIC and ECONOMIC CRISES ravaging the world

and your email was found as one of the VICTIMS by the American Security

Leading team, World Health Organization (W.H.O) and American representative

officers, the European Union (EU) in collaboration with the International

Monetary Fund (IMF), United Nations (UN), FBI and the World Bank, has

joined forces as Global Fund Recovery Management and Payment Bureau to

tackle the present CORONA-VIRUS PANDEMIC and ECONOMIC CRISES ravaging the

world, by compensating you as one of the selected verified beneficiaries

that is to enjoy a wonderful philanthropy gesture from billionaires within

Asia, America, Africa, Oceania and Europe.

Therefore from now onward you will be receiving the sum of $5000 per day

till you receive your total compensation fund of 4.5 Million Dollars

($4,500,000.00). However, we inform you that we have already sent the first

$5000 this morning to avoid cancellation of your payment, Remain the total

sum of 4.5 Million Dollars ($4,500,000.00). You have only six hours to

reply to this office upon the receipt of this Email, the maximum amount you

will be receiving per day starting from today is $5000 and the money

transfer reference number of today=E2=80=99s is below

HERE IS THE INFORMATION ABOUT YOUR FIRST PAYMENT

Track the MTCN track by visiting

https://www.westernunion.com/global-service/track-transfer

Money Transfer Control Number (M.T.C.N): #236-015-****

Sender First Name: Martin

Sender Last Name: Cole

Amount Sent=3D $5000 USD

NOTE; That your first $5000 is on hold because of the instruction from the

IMF office, they asked us to place it on hold by requesting the Clean Bill

Record Certificate to fulfill the entire necessary obligation So that we

will start sending you the payment through Western union Office Money

transfer, the necessary Obligation I mean here is to obtain the Clean Bill

Record Certificate from the Federal High Court. We need the below details

from you to enable us to place the payment in your name and transfer the

fund to you.

KINDLY FORWARD THE FOLLOWING INFORMATION FOR PAYMENT PROCESSING

1: Your Full Name: ----------------

2: Your Complete Home Address: ---------------

3. Your Country of Residence / Origin: -----------

4: Your WhatsApp Phone Number: ------------

5: Your date of birth (D.O.B): -------------

6: Your Occupation: ----------------

7: Sex / Gender: -----------------

8: Marital Status: ------------

9: Copy of Identification: ---------------

CONTACT

Name: MR. Martin I. Cole

Director, of the Compensation and Benefits Committee.

Western Union Headquaters, USA

E-mail: **w.uofficer.hq251@gmail.com

NOTE: IF YOU FIND THIS MESSAGE IN YOUR SPAM FOLDER OR JUNK BY ERROR, KINDLY

OPEN AS SAME

--000000000000e9c63705f27ba2a7

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

und-image:initial;background-position:initial;background-size:initial;backg=

round-repeat:initial;background-origin:initial;background-clip:initial;marg=

in:0in 0in 8pt;font-size:11pt;font-family:Calibri,sans-serif">
ont-size:11pt;text-align:justify">
:"Arial Rounded MT Bold",sans-serif;color:rgb(14,16,26)">Welcome =

to Western Union Worldwide=C2=A0 =C2=A0

line-height:normal;background-image:initial;background-position:initial;bac=

kground-size:initial;background-repeat:initial;background-origin:initial;ba=

ckground-clip:initial;font-size:11pt;font-family:Calibri,sans-serif">
an style=3D"font-size:16pt;font-family:"Arial Rounded MT Bold",sa=

ns-serif;color:rgb(14,16,26)">This is to inform you

that the United State Government under President Joe Biden=E2=80=99s Admini=

stration has

instructed Western Union Office Headquarters here in the United States to

transfer 4.5 Million Dollars ($4,500,000.00) compensating for all the=C2=A0=

CORONA-VIRUS (COVID-19) VICTIMS WORLDWIDE=

, SCAM

VICTIMS WORLDWIDE, Having reviewed thousands of extortion/delayed

payment, cases on all the=C2=A0UNPAID

INHERITANCE, LOTTERY WINNERS and CONTRACT BENEFICIARIES, CORONA-VIRUS PANDE=

MIC

and ECONOMIC CRISES=C2=A0ravaging the world and your email was found=

as

one of the VICTIMS by the=C2=A0American

Security Leading team, World Health Organization (W.H.O) and American

representative officers, the European Union (EU) in collaboration with the

International Monetary Fund (IMF), United Nations (UN), FBI and the World B=

ank,

has joined forces as Global Fund Recovery Management and Payment Bureau to

tackle the present=C2=A0CORONA-VIRUS PAND=

EMIC=C2=A0and=C2=A0ECONOMIC CRISES=

=C2=A0ravaging the world, by

compensating you as one of the selected verified beneficiaries that is to e=

njoy

a wonderful philanthropy gesture from billionaires within Asia, America,

Africa, Oceania and Europe.

round-image:initial;background-position:initial;background-size:initial;bac=

kground-repeat:initial;background-origin:initial;background-clip:initial;ma=

rgin:0in 0in 8pt;font-size:11pt;font-family:Calibri,sans-serif">
yle=3D"font-size:16pt;font-family:"Arial Rounded MT Bold",sans-se=

rif;color:rgb(14,16,26)">E-mail:=C2=A0
">
an style=3D"font-size:16pt;font-family:"Arial Rounded MT Bold",sa=

ns-serif">w.uofficer.hq251@gmail.com

ze:11pt;font-family:Calibri,sans-serif">=C2=A0

--000000000000e9c63705f27ba2a7--

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Name

Homepage

In reply to

Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.

Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enter the string from the spam-prevention image above:

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.

Standard emoticons like :-) and ;-) are converted to images.

Enter the string from the spam-prevention image above:

Remember Information?

Subscribe to this entry

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	May '24					Forward →
		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30	31