Nigerian Beneficiary spam from Hotmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 27 Feb 2023 09:20:02 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pWgDb-000DCD-2x
for dave@doctor.nl2k.ab.ca;
Mon, 27 Feb 2023 09:19:15 -0700
Resent-From: The Doctor
Resent-Date: Mon, 27 Feb 2023 09:19:15 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-cy1usg02hn0248.outbound.protection.office365.us ([23.103.209.248]:51168 helo=USG02-CY1-obe.outbound.protection.office365.us)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from)
id 1pWgBW-0008Ir-1T
for root@nl2k.ab.ca;
Mon, 27 Feb 2023 09:17:11 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector5401; d=microsoft.com; cv=none;
b=imc5WEqPHNcCbiXRKxNn8oxd9G1GJB+M3WGtlwvZ+Xshmg+AAtN444/abXBhE9xVYmobBJHo1s3moGQoP7gRMNB2hqQXL7USW9/wkeABbCMgLkjVpoUIHi+pw70Wb+T9BtSbaqmGgcck1abuxSdPbCXxQpmW5LQ3dEgocyjnFjeunAbfJE96Dqf2GYUHdpGUgWzy/lHI4NmeMuU6phzCJX61ENS7bTPm7wMqeZ+6HpC+zVDl4GG+B5Zj4BILD+0aAnDK+cvvPiwAGR1bzTDF0bcwp2UkeazLpZ5MncDrBD8xhN8VFOKusPJpKuIbIZ5nemgrbgIj4TlcdeAx1eeQ8g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector5401;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=JSjle7R6cJxT18N9KpQlohNRthtu7PPRB26aot7OS5E=;
b=Gop0+mX6Mv4/EULZJCINj5A6nk2OLCWGMZDcU5i4JfaQe3dLLdY0OM0fJg4FRFtmgCAnKsQyobumPy1Qug0U6EtWCyEiAliuOyq/PZd4F/MW4aNrrrHm9ycEuVUouIlVS0HzLCqYrYIghmRhtbs8d+X9AqT8SDMk7D4B1Ei97Rh5whpnBTI08mafLxypVbll9e+0bA3zcR5jrVgX/zcl0JFQPPzXsmGOCp1E2VzYDtQTOLhiFQjufOIsNN98MkgAK/3RH4KbtUGMLo9Xi7cHQegRO+UkzVpYqiKn819hhgIf71qEz51vIww/5+qUQRyzHkaB6PLVR80HB7hHYGZWcg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
208.118.171.250) smtp.rcpttodomain=ropeja.wanadoo.co.uk smtp.mailfrom=un.org;
dmarc=fail (p=none sp=none pct=100) action=none header.from=un.org; dkim=none
(message not signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=saincair.onmicrosoft.com; s=selector1-saincair-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=JSjle7R6cJxT18N9KpQlohNRthtu7PPRB26aot7OS5E=;
b=LE2G95uKc6y2HLAoeYiZBKZYrAlbWeqYC7p9G20oM+EEFPkpx2bmOaqDvf99kyLOA/rLcvIulzZpYyMp5CsI3uuH3FUIUS0j4u8AcJF9iVNMaBrB9AlA0ZIp7IBjuApfZaHWX2QxpYfoNAZvc4N8Niog00W69kqInnIIOqeEbE8=
Received: from PH2P110CA0015.NAMP110.PROD.OUTLOOK.COM (2001:489a:200:127::28)
by SA1P110MB1647.NAMP110.PROD.OUTLOOK.COM (2001:489a:200:191::20) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6134.25; Mon, 27 Feb
2023 16:14:57 +0000
Received: from BN3USG02FT013.eop-usg02.itar.protection.office365.us
(2001:489a:2202:4::207) by PH2P110CA0015.office365.us (2001:489a:200:127::28)
with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6134.28 via Frontend
Transport; Mon, 27 Feb 2023 16:14:56 +0000
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 208.118.171.250)
smtp.mailfrom=UN.ORG; dkim=none (message not signed) header.d=none;dmarc=fail
action=none header.from=UN.ORG;
Received-SPF: Fail (protection.outlook.com: domain of UN.ORG does not
designate 208.118.171.250 as permitted sender)
receiver=protection.outlook.com; client-ip=208.118.171.250; helo=sainc.com;
Received: from sainc.com (208.118.171.250) by
BN3USG02FT013.mail.protection.office365.us (10.97.24.73) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id
15.20.6134.21 via Frontend Transport; Mon, 27 Feb 2023 16:14:54 +0000
Received: from Phoenix.sainc.com (172.18.0.138) by Phoenix.sainc.com
(172.18.0.138) with Microsoft SMTP Server (TLS) id 15.0.1497.47; Mon, 27 Feb
2023 02:34:28 -0500
Received: from User (192.168.200.4) by Phoenix.sainc.com (172.18.0.138) with
Microsoft SMTP Server id 15.0.1497.47 via Frontend Transport; Mon, 27 Feb
2023 02:34:23 -0500
Reply-To:
From: James Fia.
Subject: United Nations Fund Donations
Date: Mon, 27 Feb 2023 07:35:35 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID:
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: BN3USG02FT013:EE_|SA1P110MB1647:EE_
X-MS-Office365-Filtering-Correlation-Id: 0c5629bd-01b9-4537-69d5-08db18ddc383
X-MS-Exchange-SenderADCheck: 2
X-Forefront-Antispam-Report:
CIP:208.118.171.250;CTRY:US;LANG:en;SCL:5;SRV:;IPV:CAL;SFV:SPM;H:sainc.com;PTR:208-118-171-250.i95.net;CAT:OSPM;SFS:(13230025)(4636009)(136003)(39830400003)(396003)(451199018)(109986016)(40470700004)(4000180100002)(66899018)(40460700003)(26005)(9686003)(40480700001)(108616005)(32650700002)(41300700001)(8936002)(4744005)(5660300002)(336012)(7416002)(81166007)(35950700001)(7406005)(8676002)(70206006)(70586007)(82310400005)(7366002)(2860700004)(83380400001)(3480700007)(508600001)(24736004)(41320700001)(6666004)(86362001)(2906002)(2700400008);DIR:OUT;SFP:1501;
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?FZ6tx+koFT95ct1bwBgERXGxTC3HZBMbBQAH7OJNE5wiTuAJq0qYAblY?=
=?windows-1251?Q?dyEQTt+3XU6ObgH2TCb0ROR6ZknCS/KLDIzR2zNPQ9bYD3fnasfsIbHf?=
=?windows-1251?Q?e9ZGCPnS0B+WH2+pXhrM9ZXEVuCVJ1D/AcBcBcXv9BD+YHU38fYCvNff?=
=?windows-1251?Q?i3/xnoHdF2dPVqDd634LSnF7KybeUUtMej0NgsdE//U9Ct3fI8x48+f6?=
=?windows-1251?Q?jnnDX4lY5X1e1lOoqzfHt3rK4ELVYy0y9SEUMJmj2aJrLpaCtb52yy/7?=
=?windows-1251?Q?cGv+8ZXmm6BoJm+f6Loaw0IVVM/1P7YMlFMvkw4zCTktjFg6PUoiUV0q?=
=?windows-1251?Q?pZPTQyCI/dhTCWZTk6ZaKkbVgqGCEHz5DOCQuSmx+e5r3Ay7h6LUwaIm?=
=?windows-1251?Q?hDERW1zpm7PztrhpC5sFihSz1jhTUCbAtCXAu4ev9HK5HSTlEHsm+B/i?=
=?windows-1251?Q?IrGdczHA45tC4dz0Qxbk8koDb0TsE53tzkYS/EOxYCLqJTSC1mU3Tcn0?=
=?windows-1251?Q?qIPvic5wKQ0CMmzMMZqPZLICYyXotBPzOp4BOQQruX8gw8JUrFUCN532?=
=?windows-1251?Q?r1h1B667WCeF8KRxwNloFVYomqB1fNbDsSwytXttRJD1JcowUaXZPd4R?=
=?windows-1251?Q?+4wgFyhQ+8tT5pw3JRsRYOZlL++O1gNW5C9g9hYDwjKz787cFYyEWymZ?=
=?windows-1251?Q?nkxQwiopyajKxsWEH1id09UitWuQd8ns3gHwnb8HHzykrZFAVdAh4tci?=
=?windows-1251?Q?6q8w+dVliYE71ysiB4Lw0ui0/NDrBq5RUj587pApIlGZ1xi/Yhtk2Ng8?=
=?windows-1251?Q?G7ttmNnAwdNs+6ZVg6FDc6VA+yWXgLvL7nrt+l/q6lUWa3/O0kvbFKxg?=
=?windows-1251?Q?IvP55jgzAbN36sofbp4S0llDknuREGl1ps6nBLOucVPZdcmTpukeT2SI?=
=?windows-1251?Q?PmhQNG/hILxrpI7o+C/LsK1FE8u129JsQbngW3vuSo5gISntBnm4W2TY?=
=?windows-1251?Q?YUa43POCtyeFZfT5i79fDarxN5ab9OMPZolLmJC8v99jtYfLpbaiSdrP?=
=?windows-1251?Q?8JZxKyOnY6Hr+meFoM/hvEjjIL6m0dT20TJjRl5VESsC1PGDCVcxEyYd?=
=?windows-1251?Q?WQcf/FhAq2wuWWN4OTGXL50vIIuVeGWkfo/6cBBkpjOCDc7rDluEWVvz?=
=?windows-1251?Q?77C3MOTwvHTxyXmrmGPvo4GTwIK+Z35t?=
X-OriginatorOrg: saincair.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Feb 2023 16:14:54.8971
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 0c5629bd-01b9-4537-69d5-08db18ddc383
X-MS-Exchange-CrossTenant-Id: 819abd3a-9a7e-4ac3-97fe-8f9e558d64d7
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=819abd3a-9a7e-4ac3-97fe-8f9e558d64d7;Ip=[208.118.171.250];Helo=[sainc.com]
X-MS-Exchange-CrossTenant-AuthSource:
BN3USG02FT013.eop-usg02.itar.protection.office365.us
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1P110MB1647
X-Spam_score: 19.3
X-Spam_score_int: 193
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: DHL International (Nigeria) Ltd. Isolo Expressway New Airport
Rd Junction Isolo Lagos Nigeria. Dear Beneficiary, This mail is to inform
you of your registered package.CONTENT: ATM card of $950,000.00 USD registered
by an Official of the United Nation. The Fund is a donation to you from the
U.N through e-mails ba [...]
Content analysis details: (19.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[23.103.209.248 listed in list.dnswl.org]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.0 XPRIO Has X-Priority header
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
0.0 FILL_THIS_FORM Fill in a form with personal information
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases
0.0 MONEY_FORM Lots of money if you fill out a form
0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
0.0 ADVANCE_FEE_2_NEW_FRM_MNY Advance Fee fraud form and lots of money
Subject: {SPAM?} United Nations Fund Donations
DHL International (Nigeria) Ltd.
Isolo Expressway
New Airport Rd Junction
Isolo Lagos Nigeria.
Dear Beneficiary,
This mail is to inform you of your registered package.CONTENT: ATM card of $950,000.00 USD registered by an Official of the United Nation. The Fund is a donation
to you from the U.N through e-mails balloting in affiliation with worldbank poverty eradication program.
For your information the VAT and COD have been paid and the only money you will have to pay is the security keeping fee which is US$160.00 must be paid before shipment.
Do contact DHL Delivery Department with this Email address (courierdhlagents@yahoo.co.jp)
First name:
Last name:
Age:
Sex:
ID Card:
Country:
Full Address:
Postal code:
Occupation:
Phone Number:
A copy of passport:
Contact DHL Delivery Department (Ms.Judith Williams) for shipment.
Regards,
Mr. James Fia.
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 27 Feb 2023 09:20:02 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pWgDb-000DCD-2x
for dave@doctor.nl2k.ab.ca;
Mon, 27 Feb 2023 09:19:15 -0700
Resent-From: The Doctor
Resent-Date: Mon, 27 Feb 2023 09:19:15 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-cy1usg02hn0248.outbound.protection.office365.us ([23.103.209.248]:51168 helo=USG02-CY1-obe.outbound.protection.office365.us)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from
id 1pWgBW-0008Ir-1T
for root@nl2k.ab.ca;
Mon, 27 Feb 2023 09:17:11 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector5401; d=microsoft.com; cv=none;
b=imc5WEqPHNcCbiXRKxNn8oxd9G1GJB+M3WGtlwvZ+Xshmg+AAtN444/abXBhE9xVYmobBJHo1s3moGQoP7gRMNB2hqQXL7USW9/wkeABbCMgLkjVpoUIHi+pw70Wb+T9BtSbaqmGgcck1abuxSdPbCXxQpmW5LQ3dEgocyjnFjeunAbfJE96Dqf2GYUHdpGUgWzy/lHI4NmeMuU6phzCJX61ENS7bTPm7wMqeZ+6HpC+zVDl4GG+B5Zj4BILD+0aAnDK+cvvPiwAGR1bzTDF0bcwp2UkeazLpZ5MncDrBD8xhN8VFOKusPJpKuIbIZ5nemgrbgIj4TlcdeAx1eeQ8g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector5401;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=JSjle7R6cJxT18N9KpQlohNRthtu7PPRB26aot7OS5E=;
b=Gop0+mX6Mv4/EULZJCINj5A6nk2OLCWGMZDcU5i4JfaQe3dLLdY0OM0fJg4FRFtmgCAnKsQyobumPy1Qug0U6EtWCyEiAliuOyq/PZd4F/MW4aNrrrHm9ycEuVUouIlVS0HzLCqYrYIghmRhtbs8d+X9AqT8SDMk7D4B1Ei97Rh5whpnBTI08mafLxypVbll9e+0bA3zcR5jrVgX/zcl0JFQPPzXsmGOCp1E2VzYDtQTOLhiFQjufOIsNN98MkgAK/3RH4KbtUGMLo9Xi7cHQegRO+UkzVpYqiKn819hhgIf71qEz51vIww/5+qUQRyzHkaB6PLVR80HB7hHYGZWcg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
208.118.171.250) smtp.rcpttodomain=ropeja.wanadoo.co.uk smtp.mailfrom=un.org;
dmarc=fail (p=none sp=none pct=100) action=none header.from=un.org; dkim=none
(message not signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=saincair.onmicrosoft.com; s=selector1-saincair-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=JSjle7R6cJxT18N9KpQlohNRthtu7PPRB26aot7OS5E=;
b=LE2G95uKc6y2HLAoeYiZBKZYrAlbWeqYC7p9G20oM+EEFPkpx2bmOaqDvf99kyLOA/rLcvIulzZpYyMp5CsI3uuH3FUIUS0j4u8AcJF9iVNMaBrB9AlA0ZIp7IBjuApfZaHWX2QxpYfoNAZvc4N8Niog00W69kqInnIIOqeEbE8=
Received: from PH2P110CA0015.NAMP110.PROD.OUTLOOK.COM (2001:489a:200:127::28)
by SA1P110MB1647.NAMP110.PROD.OUTLOOK.COM (2001:489a:200:191::20) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6134.25; Mon, 27 Feb
2023 16:14:57 +0000
Received: from BN3USG02FT013.eop-usg02.itar.protection.office365.us
(2001:489a:2202:4::207) by PH2P110CA0015.office365.us (2001:489a:200:127::28)
with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6134.28 via Frontend
Transport; Mon, 27 Feb 2023 16:14:56 +0000
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 208.118.171.250)
smtp.mailfrom=UN.ORG; dkim=none (message not signed) header.d=none;dmarc=fail
action=none header.from=UN.ORG;
Received-SPF: Fail (protection.outlook.com: domain of UN.ORG does not
designate 208.118.171.250 as permitted sender)
receiver=protection.outlook.com; client-ip=208.118.171.250; helo=sainc.com;
Received: from sainc.com (208.118.171.250) by
BN3USG02FT013.mail.protection.office365.us (10.97.24.73) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id
15.20.6134.21 via Frontend Transport; Mon, 27 Feb 2023 16:14:54 +0000
Received: from Phoenix.sainc.com (172.18.0.138) by Phoenix.sainc.com
(172.18.0.138) with Microsoft SMTP Server (TLS) id 15.0.1497.47; Mon, 27 Feb
2023 02:34:28 -0500
Received: from User (192.168.200.4) by Phoenix.sainc.com (172.18.0.138) with
Microsoft SMTP Server id 15.0.1497.47 via Frontend Transport; Mon, 27 Feb
2023 02:34:23 -0500
Reply-To:
From: James Fia.
Subject: United Nations Fund Donations
Date: Mon, 27 Feb 2023 07:35:35 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID:
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: BN3USG02FT013:EE_|SA1P110MB1647:EE_
X-MS-Office365-Filtering-Correlation-Id: 0c5629bd-01b9-4537-69d5-08db18ddc383
X-MS-Exchange-SenderADCheck: 2
X-Forefront-Antispam-Report:
CIP:208.118.171.250;CTRY:US;LANG:en;SCL:5;SRV:;IPV:CAL;SFV:SPM;H:sainc.com;PTR:208-118-171-250.i95.net;CAT:OSPM;SFS:(13230025)(4636009)(136003)(39830400003)(396003)(451199018)(109986016)(40470700004)(4000180100002)(66899018)(40460700003)(26005)(9686003)(40480700001)(108616005)(32650700002)(41300700001)(8936002)(4744005)(5660300002)(336012)(7416002)(81166007)(35950700001)(7406005)(8676002)(70206006)(70586007)(82310400005)(7366002)(2860700004)(83380400001)(3480700007)(508600001)(24736004)(41320700001)(6666004)(86362001)(2906002)(2700400008);DIR:OUT;SFP:1501;
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?FZ6tx+koFT95ct1bwBgERXGxTC3HZBMbBQAH7OJNE5wiTuAJq0qYAblY?=
=?windows-1251?Q?dyEQTt+3XU6ObgH2TCb0ROR6ZknCS/KLDIzR2zNPQ9bYD3fnasfsIbHf?=
=?windows-1251?Q?e9ZGCPnS0B+WH2+pXhrM9ZXEVuCVJ1D/AcBcBcXv9BD+YHU38fYCvNff?=
=?windows-1251?Q?i3/xnoHdF2dPVqDd634LSnF7KybeUUtMej0NgsdE//U9Ct3fI8x48+f6?=
=?windows-1251?Q?jnnDX4lY5X1e1lOoqzfHt3rK4ELVYy0y9SEUMJmj2aJrLpaCtb52yy/7?=
=?windows-1251?Q?cGv+8ZXmm6BoJm+f6Loaw0IVVM/1P7YMlFMvkw4zCTktjFg6PUoiUV0q?=
=?windows-1251?Q?pZPTQyCI/dhTCWZTk6ZaKkbVgqGCEHz5DOCQuSmx+e5r3Ay7h6LUwaIm?=
=?windows-1251?Q?hDERW1zpm7PztrhpC5sFihSz1jhTUCbAtCXAu4ev9HK5HSTlEHsm+B/i?=
=?windows-1251?Q?IrGdczHA45tC4dz0Qxbk8koDb0TsE53tzkYS/EOxYCLqJTSC1mU3Tcn0?=
=?windows-1251?Q?qIPvic5wKQ0CMmzMMZqPZLICYyXotBPzOp4BOQQruX8gw8JUrFUCN532?=
=?windows-1251?Q?r1h1B667WCeF8KRxwNloFVYomqB1fNbDsSwytXttRJD1JcowUaXZPd4R?=
=?windows-1251?Q?+4wgFyhQ+8tT5pw3JRsRYOZlL++O1gNW5C9g9hYDwjKz787cFYyEWymZ?=
=?windows-1251?Q?nkxQwiopyajKxsWEH1id09UitWuQd8ns3gHwnb8HHzykrZFAVdAh4tci?=
=?windows-1251?Q?6q8w+dVliYE71ysiB4Lw0ui0/NDrBq5RUj587pApIlGZ1xi/Yhtk2Ng8?=
=?windows-1251?Q?G7ttmNnAwdNs+6ZVg6FDc6VA+yWXgLvL7nrt+l/q6lUWa3/O0kvbFKxg?=
=?windows-1251?Q?IvP55jgzAbN36sofbp4S0llDknuREGl1ps6nBLOucVPZdcmTpukeT2SI?=
=?windows-1251?Q?PmhQNG/hILxrpI7o+C/LsK1FE8u129JsQbngW3vuSo5gISntBnm4W2TY?=
=?windows-1251?Q?YUa43POCtyeFZfT5i79fDarxN5ab9OMPZolLmJC8v99jtYfLpbaiSdrP?=
=?windows-1251?Q?8JZxKyOnY6Hr+meFoM/hvEjjIL6m0dT20TJjRl5VESsC1PGDCVcxEyYd?=
=?windows-1251?Q?WQcf/FhAq2wuWWN4OTGXL50vIIuVeGWkfo/6cBBkpjOCDc7rDluEWVvz?=
=?windows-1251?Q?77C3MOTwvHTxyXmrmGPvo4GTwIK+Z35t?=
X-OriginatorOrg: saincair.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Feb 2023 16:14:54.8971
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 0c5629bd-01b9-4537-69d5-08db18ddc383
X-MS-Exchange-CrossTenant-Id: 819abd3a-9a7e-4ac3-97fe-8f9e558d64d7
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=819abd3a-9a7e-4ac3-97fe-8f9e558d64d7;Ip=[208.118.171.250];Helo=[sainc.com]
X-MS-Exchange-CrossTenant-AuthSource:
BN3USG02FT013.eop-usg02.itar.protection.office365.us
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1P110MB1647
X-Spam_score: 19.3
X-Spam_score_int: 193
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: DHL International (Nigeria) Ltd. Isolo Expressway New Airport
Rd Junction Isolo Lagos Nigeria. Dear Beneficiary, This mail is to inform
you of your registered package.CONTENT: ATM card of $950,000.00 USD registered
by an Official of the United Nation. The Fund is a donation to you from the
U.N through e-mails ba [...]
Content analysis details: (19.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[23.103.209.248 listed in list.dnswl.org]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.0 XPRIO Has X-Priority header
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
0.0 FILL_THIS_FORM Fill in a form with personal information
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases
0.0 MONEY_FORM Lots of money if you fill out a form
0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
0.0 ADVANCE_FEE_2_NEW_FRM_MNY Advance Fee fraud form and lots of money
Subject: {SPAM?} United Nations Fund Donations
DHL International (Nigeria) Ltd.
Isolo Expressway
New Airport Rd Junction
Isolo Lagos Nigeria.
Dear Beneficiary,
This mail is to inform you of your registered package.CONTENT: ATM card of $950,000.00 USD registered by an Official of the United Nation. The Fund is a donation
to you from the U.N through e-mails balloting in affiliation with worldbank poverty eradication program.
For your information the VAT and COD have been paid and the only money you will have to pay is the security keeping fee which is US$160.00 must be paid before shipment.
Do contact DHL Delivery Department with this Email address (courierdhlagents@yahoo.co.jp)
First name:
Last name:
Age:
Sex:
ID Card:
Country:
Full Address:
Postal code:
Occupation:
Phone Number:
A copy of passport:
Contact DHL Delivery Department (Ms.Judith Williams) for shipment.
Regards,
Mr. James Fia.
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments