Barclay's Bank Phish from Western Somoa
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 29 Aug 2023 14:39:45 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from)
id 1qb5RU-000Ckb-1T
for dave@doctor.nl2k.ab.ca;
Tue, 29 Aug 2023 14:36:04 -0600
Resent-From: The Doctor
Resent-Date: Tue, 29 Aug 2023 14:36:04 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from meli.mnre.gov.ws ([202.4.37.25]:33334)
by doctor.nl2k.ab.ca with esmtp (Exim 4.96 (FreeBSD))
(envelope-from)
id 1qb2cU-000GS8-2o
for doctor@nl2k.ab.ca;
Tue, 29 Aug 2023 11:35:20 -0600
Received: from localhost (localhost [127.0.0.1])
by meli.mnre.gov.ws (Postfix) with ESMTP id 9B832C186DC08;
Wed, 30 Aug 2023 06:33:10 +1300 (+13)
DKIM-Filter: OpenDKIM Filter v2.11.0 meli.mnre.gov.ws 9B832C186DC08
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnre.gov.ws;
s=default; t=1693330390;
bh=STquSPApllz0aVmC0W9KvoQWZCLlpruzZV3zgcqMYhg=;
h=Date:From:To:Subject:Reply-To:From;
b=O7DHxgJB+nmyq+5ozueSINnzRp2fNxDwfpwQ+aNKeqdyM68Fu/YEGRHBe7CAEEGnJ
CmEXn5bHDaIstBwq4PgsnPJrS5ahjsqJSCWNOuw4pEePd5iE+tMpOAYRn9rQBMINfB
59JtzeoTaTWzcI8K9JhtGiYUiajSMTgqgIYQySMvroztpEmZ4E8uFHXIVE5Qro3DKv
0aiM1R4JeHW2EI46WB2lK9yuQivn3bbpXquIQwaVKcXi4tMoyFQlJRk81eB285fv2Y
nMZU98QGm+UliwDA8b9d066QRNZgQHZpBr8Jmsm9gSqKgW+LfA1o4H79eVe6n9nbqt
+4ugTLfBzW3eQ==
X-Virus-Scanned: amavisd-new at mnre.gov.ws
Received: from meli.mnre.gov.ws ([127.0.0.1])
by localhost (meli.mnre.gov.ws [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id X0sK4aV1uIdB; Wed, 30 Aug 2023 06:33:08 +1300 (+13)
Received: from webmail.mnre.gov.ws (meli.mnre.gov.ws [202.4.37.25])
by meli.mnre.gov.ws (Postfix) with ESMTPSA id 84B1AC17FBCA1;
Wed, 30 Aug 2023 06:33:06 +1300 (+13)
DKIM-Filter: OpenDKIM Filter v2.11.0 meli.mnre.gov.ws 84B1AC17FBCA1
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnre.gov.ws;
s=default; t=1693330387;
bh=STquSPApllz0aVmC0W9KvoQWZCLlpruzZV3zgcqMYhg=;
h=Date:From:To:Subject:Reply-To:From;
b=tGsQfqwbgXtDhbUtKbJzMt606NQezSV34bgqwVptWuG3HA3pj3JZdk/DdIcEsdTUU
wtJQQXK4iegcbKLNBjef96uvcTk4N5Syg34VVvt4XuahsiIOUc6xyJXtc1I0yOn8L7
F6aAfYanFQ2Ma6IyP2uGfugJFMhNM8Wi5x2USrSNJQnCG18Lj+8ULvXPdl5vLMbEJn
EKbbTiAcO4Sq2CZGEVun0h7dw0IoXWDTnxusRvCkFUhpVoXNMs76aig/F7xUl1SoEh
iA7bVZLvFfCGwhD/y0PNvYTo9Ysrt8AtAhLpjiFVzr6LLT4G55rlgL5pK/ooSdkT7I
MGmBFhy4zCPDQ==
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_b652b1d218c5d4355905768145e46bae"
Date: Tue, 29 Aug 2023 18:33:06 +0100
From: Barclay's Bank Plc UK
To: undisclosed-recipients:;
Subject: Remittance Notification
Reply-To: mrshelenkeelan@mail2finance.com
Mail-Reply-To: mrshelenkeelan@mail2finance.com
Message-ID: <6054a2b1080a15c82aa502dfca766c59@mnre.gov.ws>
X-Sender: noreply@mnre.gov.ws
User-Agent: Roundcube Webmail/1.1.12
X-Spam_score: 22.3
X-Spam_score_int: 223
X-Spam_bar: ++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Barclay's Bank PLC, UK 1 Churchill Place London, E14 5HP,
United Kingdom http://www.barclays.co.uk Dear Esteemed Customer, We at this
bank wish to congratulate and inform you that after a thorough review of
your Inheritance/Contract funds transfer release documents in conjunction
with the World Bank and the IMF assessment [...]
Content analysis details: (22.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[202.4.37.25 listed in bl.score.senderscore.com]
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
[202.4.37.25 listed in bl.score.senderscore.com]
0.0 T_SPF_HELO_PERMERROR SPF: test of HELO record failed (permerror)
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
1.0 HK_SCAM_N15 BODY: No description available.
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 T_SCC_BODY_TEXT_LINE No description available.
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.9 YOU_INHERIT Discussing your inheritance
2.0 HK_SCAM No description available.
2.5 ODD_FREEM_REPTO Has unusual reply-to header
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
1.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
0.0 FILL_THIS_FORM Fill in a form with personal information
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 MONEY_FORM Lots of money if you fill out a form
2.3 ADVANCE_FEE_3_NEW_FRM_MNY Advance Fee fraud form and lots of money
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
Subject: {SPAM?} Remittance Notification
--=_b652b1d218c5d4355905768145e46bae
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII
--
Barclay's Bank PLC, UK
1 Churchill Place
London, E14 5HP, United Kingdom
http://www.barclays.co.uk
Dear Esteemed Customer,
We at this bank wish to congratulate and inform you that after a
thorough review of your Inheritance/Contract funds transfer release
documents in conjunction with the World Bank and the IMF assessment
report, your payment file was forwarded to us for immediate transfer of
a part-payment of US$800,000.00 to your designated bank account from
their offshore account with us
The audit reports given to us show that you have been going through hard
times by paying a lot of money to see to the release of your funds,
which has been delayed by some dubious officials.
We, therefore, advise that you stop further communication with any
correspondence outside this office since you do not have to pay any
money or fee to receive your funds as you have met up with the whole
fund's transfer requirements.
The only thing required from you is to obtain the Non-Residential
Clearance to enable us to credit your account directly by telegraphic
transfer or through any of our corresponding banks and send copies of
the fund's transfer release documents to you and your bankers for
confirmation.
Should you follow our directives, your funds will be credited and
reflected in your bank account within five (5) bank working days from
the day you obtain this Non-Residential Clearance.
For further details and assistance on this Remittance Notification,
kindly forward your
FULL NAME:
FULL CONTACT ADDRESS:
TELEPHONE and FAX NUMBERS:
Directly to my private; E-mail:
mrs.helenkeelan@hotmail.com/mrs.helenkeelan@tutanota.com
Yours sincerely,
Mrs. Helen Keelan
Head, International Banking Division.
Barclay's Bank PLC, UK.
--=_b652b1d218c5d4355905768145e46bae
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset=UTF-8
=3DUTF-8" />
eva,sans-serif'>
--=_b652b1d218c5d4355905768145e46bae--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 29 Aug 2023 14:39:45 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from
id 1qb5RU-000Ckb-1T
for dave@doctor.nl2k.ab.ca;
Tue, 29 Aug 2023 14:36:04 -0600
Resent-From: The Doctor
Resent-Date: Tue, 29 Aug 2023 14:36:04 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from meli.mnre.gov.ws ([202.4.37.25]:33334)
by doctor.nl2k.ab.ca with esmtp (Exim 4.96 (FreeBSD))
(envelope-from
id 1qb2cU-000GS8-2o
for doctor@nl2k.ab.ca;
Tue, 29 Aug 2023 11:35:20 -0600
Received: from localhost (localhost [127.0.0.1])
by meli.mnre.gov.ws (Postfix) with ESMTP id 9B832C186DC08;
Wed, 30 Aug 2023 06:33:10 +1300 (+13)
DKIM-Filter: OpenDKIM Filter v2.11.0 meli.mnre.gov.ws 9B832C186DC08
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnre.gov.ws;
s=default; t=1693330390;
bh=STquSPApllz0aVmC0W9KvoQWZCLlpruzZV3zgcqMYhg=;
h=Date:From:To:Subject:Reply-To:From;
b=O7DHxgJB+nmyq+5ozueSINnzRp2fNxDwfpwQ+aNKeqdyM68Fu/YEGRHBe7CAEEGnJ
CmEXn5bHDaIstBwq4PgsnPJrS5ahjsqJSCWNOuw4pEePd5iE+tMpOAYRn9rQBMINfB
59JtzeoTaTWzcI8K9JhtGiYUiajSMTgqgIYQySMvroztpEmZ4E8uFHXIVE5Qro3DKv
0aiM1R4JeHW2EI46WB2lK9yuQivn3bbpXquIQwaVKcXi4tMoyFQlJRk81eB285fv2Y
nMZU98QGm+UliwDA8b9d066QRNZgQHZpBr8Jmsm9gSqKgW+LfA1o4H79eVe6n9nbqt
+4ugTLfBzW3eQ==
X-Virus-Scanned: amavisd-new at mnre.gov.ws
Received: from meli.mnre.gov.ws ([127.0.0.1])
by localhost (meli.mnre.gov.ws [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id X0sK4aV1uIdB; Wed, 30 Aug 2023 06:33:08 +1300 (+13)
Received: from webmail.mnre.gov.ws (meli.mnre.gov.ws [202.4.37.25])
by meli.mnre.gov.ws (Postfix) with ESMTPSA id 84B1AC17FBCA1;
Wed, 30 Aug 2023 06:33:06 +1300 (+13)
DKIM-Filter: OpenDKIM Filter v2.11.0 meli.mnre.gov.ws 84B1AC17FBCA1
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnre.gov.ws;
s=default; t=1693330387;
bh=STquSPApllz0aVmC0W9KvoQWZCLlpruzZV3zgcqMYhg=;
h=Date:From:To:Subject:Reply-To:From;
b=tGsQfqwbgXtDhbUtKbJzMt606NQezSV34bgqwVptWuG3HA3pj3JZdk/DdIcEsdTUU
wtJQQXK4iegcbKLNBjef96uvcTk4N5Syg34VVvt4XuahsiIOUc6xyJXtc1I0yOn8L7
F6aAfYanFQ2Ma6IyP2uGfugJFMhNM8Wi5x2USrSNJQnCG18Lj+8ULvXPdl5vLMbEJn
EKbbTiAcO4Sq2CZGEVun0h7dw0IoXWDTnxusRvCkFUhpVoXNMs76aig/F7xUl1SoEh
iA7bVZLvFfCGwhD/y0PNvYTo9Ysrt8AtAhLpjiFVzr6LLT4G55rlgL5pK/ooSdkT7I
MGmBFhy4zCPDQ==
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_b652b1d218c5d4355905768145e46bae"
Date: Tue, 29 Aug 2023 18:33:06 +0100
From: Barclay's Bank Plc UK
To: undisclosed-recipients:;
Subject: Remittance Notification
Reply-To: mrshelenkeelan@mail2finance.com
Mail-Reply-To: mrshelenkeelan@mail2finance.com
Message-ID: <6054a2b1080a15c82aa502dfca766c59@mnre.gov.ws>
X-Sender: noreply@mnre.gov.ws
User-Agent: Roundcube Webmail/1.1.12
X-Spam_score: 22.3
X-Spam_score_int: 223
X-Spam_bar: ++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Barclay's Bank PLC, UK 1 Churchill Place London, E14 5HP,
United Kingdom http://www.barclays.co.uk Dear Esteemed Customer, We at this
bank wish to congratulate and inform you that after a thorough review of
your Inheritance/Contract funds transfer release documents in conjunction
with the World Bank and the IMF assessment [...]
Content analysis details: (22.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[202.4.37.25 listed in bl.score.senderscore.com]
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
[202.4.37.25 listed in bl.score.senderscore.com]
0.0 T_SPF_HELO_PERMERROR SPF: test of HELO record failed (permerror)
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
1.0 HK_SCAM_N15 BODY: No description available.
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 T_SCC_BODY_TEXT_LINE No description available.
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.9 YOU_INHERIT Discussing your inheritance
2.0 HK_SCAM No description available.
2.5 ODD_FREEM_REPTO Has unusual reply-to header
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
1.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
0.0 FILL_THIS_FORM Fill in a form with personal information
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 MONEY_FORM Lots of money if you fill out a form
2.3 ADVANCE_FEE_3_NEW_FRM_MNY Advance Fee fraud form and lots of money
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
Subject: {SPAM?} Remittance Notification
--=_b652b1d218c5d4355905768145e46bae
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII
--
Barclay's Bank PLC, UK
1 Churchill Place
London, E14 5HP, United Kingdom
http://www.barclays.co.uk
Dear Esteemed Customer,
We at this bank wish to congratulate and inform you that after a
thorough review of your Inheritance/Contract funds transfer release
documents in conjunction with the World Bank and the IMF assessment
report, your payment file was forwarded to us for immediate transfer of
a part-payment of US$800,000.00 to your designated bank account from
their offshore account with us
The audit reports given to us show that you have been going through hard
times by paying a lot of money to see to the release of your funds,
which has been delayed by some dubious officials.
We, therefore, advise that you stop further communication with any
correspondence outside this office since you do not have to pay any
money or fee to receive your funds as you have met up with the whole
fund's transfer requirements.
The only thing required from you is to obtain the Non-Residential
Clearance to enable us to credit your account directly by telegraphic
transfer or through any of our corresponding banks and send copies of
the fund's transfer release documents to you and your bankers for
confirmation.
Should you follow our directives, your funds will be credited and
reflected in your bank account within five (5) bank working days from
the day you obtain this Non-Residential Clearance.
For further details and assistance on this Remittance Notification,
kindly forward your
FULL NAME:
FULL CONTACT ADDRESS:
TELEPHONE and FAX NUMBERS:
Directly to my private; E-mail:
mrs.helenkeelan@hotmail.com/mrs.helenkeelan@tutanota.com
Yours sincerely,
Mrs. Helen Keelan
Head, International Banking Division.
Barclay's Bank PLC, UK.
--=_b652b1d218c5d4355905768145e46bae
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset=UTF-8
=3DUTF-8" />
eva,sans-serif'>
--
=
Barclay's Bank PLC, UK
1 Churchill Place
London, E14 5HP, Unite=
d Kingdom
=3D"noreferrer">http://www.barclays.co.uk
Dear Esteemed Cu=
stomer,
We at this bank wish to congratulate and inform you th=
at after a thorough review of your Inheritance/Contract funds transfer rele=
ase documents in conjunction with the World Bank and the IMF assessment rep=
ort, your payment file was forwarded to us for immediate transfer of a part=
-payment of US$800,000.00 to your designated bank account from their offsho=
re account with us
The audit reports given to us show that you=
have been going through hard times by paying a lot of money to see to the =
release of your funds, which has been delayed by some dubious officials.
/>
We, therefore, advise that you stop further communication with a=
ny correspondence outside this office since you do not have to pay any mone=
y or fee to receive your funds as you have met up with the whole fund's tra=
nsfer requirements.
The only thing required from you is to obt=
ain the Non-Residential Clearance to enable us to credit your account direc=
tly by telegraphic transfer or through any of our corresponding banks and s=
end copies of the fund's transfer release documents to you and your bankers=
for confirmation.
Should you follow our directives, your fund=
s will be credited and reflected in your bank account within five (5) bank =
working days from the day you obtain this Non-Residential Clearance.
=
For further details and assistance on this Remittance Notification, =
kindly forward your
FULL NAME:
FULL CONTACT ADDRESS:
/> TELEPHONE and FAX NUMBERS:
Directly to my private; E-mail: =
mrs.helenkeelan@hotmail.com<=
/a>/mrs.helenkeelan@tutano=
ta.com
Yours sincerely,
Mrs. Helen Keelan
Head=
, International Banking Division.
Barclay's Bank PLC, UK.
Barclay's Bank PLC, UK
1 Churchill Place
London, E14 5HP, Unite=
d Kingdom
=3D"noreferrer">http://www.barclays.co.uk
Dear Esteemed Cu=
stomer,
We at this bank wish to congratulate and inform you th=
at after a thorough review of your Inheritance/Contract funds transfer rele=
ase documents in conjunction with the World Bank and the IMF assessment rep=
ort, your payment file was forwarded to us for immediate transfer of a part=
-payment of US$800,000.00 to your designated bank account from their offsho=
re account with us
The audit reports given to us show that you=
have been going through hard times by paying a lot of money to see to the =
release of your funds, which has been delayed by some dubious officials.
/>
We, therefore, advise that you stop further communication with a=
ny correspondence outside this office since you do not have to pay any mone=
y or fee to receive your funds as you have met up with the whole fund's tra=
nsfer requirements.
The only thing required from you is to obt=
ain the Non-Residential Clearance to enable us to credit your account direc=
tly by telegraphic transfer or through any of our corresponding banks and s=
end copies of the fund's transfer release documents to you and your bankers=
for confirmation.
Should you follow our directives, your fund=
s will be credited and reflected in your bank account within five (5) bank =
working days from the day you obtain this Non-Residential Clearance.
=
For further details and assistance on this Remittance Notification, =
kindly forward your
FULL NAME:
FULL CONTACT ADDRESS:
/> TELEPHONE and FAX NUMBERS:
Directly to my private; E-mail: =
mrs.helenkeelan@hotmail.com<=
/a>/mrs.helenkeelan@tutano=
ta.com
Yours sincerely,
Mrs. Helen Keelan
Head=
, International Banking Division.
Barclay's Bank PLC, UK.
--=_b652b1d218c5d4355905768145e46bae--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments