Nigerian spam from Microsoft outlook
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 09 Feb 2024 22:06:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rYdtu-00000000GhR-2p77
for dave@doctor.nl2k.ab.ca;
Fri, 09 Feb 2024 20:19:34 -0700
Resent-From: The Doctor
Resent-Date: Fri, 9 Feb 2024 20:19:34 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-dm3gcc02hn2248.outbound.protection.outlook.com ([52.100.154.248]:50528 helo=GCC02-DM3-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rYbub-00000000BJk-3D87
for doctor@doctor.nl2k.ab.ca;
Fri, 09 Feb 2024 18:12:12 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=I4xnybIyBOyrjmL7eUPmJXZw5BfyCUZ6O8HIwwFI1VjqUJ2rLhbOXFKWBdKt7RKLyvi8WYnoga4/l+1FROf2Q5dQ8sr1b/p0fzVka/gYVz/z+NyAE9LzgY8hr8Vxe3IwKDRUgsgi+EYuTtSb0JE49y5EQO4wiG1d0X0/8mCOI6S6NhsqwrJHYR7g12pkKgDpFCJwzqoMEPtJnzE/wf6OkOMCzcEK6NI0VUlIFePYs+ASwSkIh1xyziBG9cmXKTEJc5BmKhPZLCswP+h5NQuR0WUqz+GngtpJvE8x+H6NwjFaMo8D4wMPfGqydVKGELGGobadT5F6Rhm1/F4bmzbPXg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=XdlXRW71gGRCJvlJx6hv+0x0CSG8vaaFMkemSzmktUA=;
b=Bf4gXwxn/sQtE9/5uJksFu390/+JD5acawLDSAIw0kcaOTFyWQBw0u40RqROAO7tCWarTkBd+/XQ2F80PHm+o8NflTMioltKeOs29RJn0he27S21l5A94h79ykhnj4eRIHkuiqjoCjNAfjfPp5OMgOekkahRyj/oLMeaweR1NCJr6mVHOXoQEe8k6LbUaR80/wpBG99AONdhKoHXM2BtIC2T3TZVd2+J53lEFRE29LDgznTvG6mGHFVy4wTmEXHga0oQjk+ExTXw+xRraoT5z67LgG8TrKmr8LLbnv9fHNdMz9CEedXOjfIOkxfQMwEALbpbzu69oMTR9BxET0dAhA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is
204.235.229.20) smtp.rcpttodomain=doctor.nl2k.ab.ca smtp.mailfrom=uba.com;
dmarc=none action=none header.from=uba.com; dkim=none (message not signed);
arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=houstonpolice.onmicrosoft.com; s=selector2-houstonpolice-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=XdlXRW71gGRCJvlJx6hv+0x0CSG8vaaFMkemSzmktUA=;
b=g+WNDBh0KqoP18GUuw1+BvAehiCPREJWM3LNIBRKAJXsPeeyF0EL8FLCiJbCVG65yKSWZ5G728vBJ+PEBUHK2Kkgse25saW/mILVqgkXJUrfus4zPtYMtoWUDuCAdmgBYdDqb95kAtH/K0patFHEE3r2hDNrjL/D43+iQwY70oQ=
Received: from BL0PR0901CA0006.namprd09.prod.outlook.com
(2603:10b6:208:1c0::16) by SA1PR09MB9049.namprd09.prod.outlook.com
(2603:10b6:806:275::6) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7270.26; Sat, 10 Feb
2024 01:10:08 +0000
Received: from DS1PEPF00017E0A.namprd09.prod.outlook.com
(2603:10b6:208:1c0:cafe::14) by BL0PR0901CA0006.outlook.office365.com
(2603:10b6:208:1c0::16) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7270.24 via Frontend
Transport; Sat, 10 Feb 2024 01:10:08 +0000
X-MS-Exchange-Authentication-Results: spf=none (sender IP is 204.235.229.20)
smtp.mailfrom=uba.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=uba.com;
Received-SPF: None (protection.outlook.com: uba.com does not designate
permitted sender hosts)
Received: from mail.houstonpolice.org (204.235.229.20) by
DS1PEPF00017E0A.mail.protection.outlook.com (10.167.18.167) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id
15.20.7249.19 via Frontend Transport; Sat, 10 Feb 2024 01:10:08 +0000
Received: from PHSHPDCLSTR001B.HPDWINAD.HPD (10.10.132.104) by
PHSHPDCLSTR000B.HPDWINAD.HPD (10.10.132.103) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id
15.1.2507.35; Fri, 9 Feb 2024 19:09:54 -0600
Received: from [156.96.112.152] (10.10.132.248) by
PHSHPDCLSTR001B.HPDWINAD.HPD (10.10.132.104) with Microsoft SMTP Server id
15.1.2507.35 via Frontend Transport; Fri, 9 Feb 2024 19:09:53 -0600
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: UNITED BANK FOR AFRICA 204.235.229.134
To: Recipients
From: "Mr. Kent Williams"
Date: Fri, 9 Feb 2024 20:09:54 -0800
Reply-To:
Message-ID: <8d8644fc-4ed9-47c8-b0a7-35bfb87b0f5a@PHSHPDCLSTR001B.HPDWINAD.HPD>
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DS1PEPF00017E0A:EE_|SA1PR09MB9049:EE_
X-MS-Office365-Filtering-Correlation-Id: 438b8f73-3761-4515-2ba6-08dc29d505cd
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?iso-8859-1?Q?8kROO2jewFw2jExLzsbeS/4LvNBajN5TU3ZlCd4KfMqiV70YumtV8dYk6L?=
=?iso-8859-1?Q?rxvmOJgb4AfDtSZm80bUJyb1Y0UC03lTuj1WWSbzJgY6oyx5R1QQc1ZB1Y?=
=?iso-8859-1?Q?zJm5V7ZNLghYOXnAfmSr5EoRPmwmI9YLT11awNc8xBbChUfo0Q/gBL8aOX?=
=?iso-8859-1?Q?xHVfYxLJbEygUIVaQdI0MLG18zHKfmhAXh15H9AsRGB88rlKnqv3pKGLft?=
=?iso-8859-1?Q?/LPawMw1+2LREQPkBF0YFjMy3G05uP/7hoN58Ep4H/0yG1Opd+M1p2Gocz?=
=?iso-8859-1?Q?WKo3C0p/wtD4ZXmuC7b+5H93F4Ezt0BK2hr4OK0dj2VZUHLoDnSoDCFeM1?=
=?iso-8859-1?Q?v/pzDEqMd29OBbMatOiYFlegwUqtVq3DBJIyWnnLSLN5eFa+Lawmk9SO5P?=
=?iso-8859-1?Q?NKzKv58g4REejVW2Nku33y+sJa26hv7MlXbHddcxrbx/IFiw7IbtFhgtg6?=
=?iso-8859-1?Q?rWDyecTXvOW3gDArKpdIRoKpc63nJGgRWSi+1VPOqTaIK5d0hHWi273uZY?=
=?iso-8859-1?Q?nvklj5bRfxz1UHzgtNko6BUymX6TBsnOtJlxCCZc1QxnFvZAtQKnmrN7Jk?=
=?iso-8859-1?Q?/Ph1qlWyj+QOgq7mX0jsjiiLxwNk3F3hxf7wIS4ZaEbrhZNfbA+zIHyJPF?=
=?iso-8859-1?Q?sICAUSBE9MvUjQKfPRmwoANdB4JZ9MiZHJ0ohbxKiseOXZ/p4zUyq8iJhd?=
=?iso-8859-1?Q?isAEK2GV076WQqhlrr3+YCX6NhT4MMcZC5U2vl7DyJoNWiw7FFvqfQF9lN?=
=?iso-8859-1?Q?YGVOeBQ9yL6X4mMEd98WKvIBqyLdy/AEyVJaftg0xf8J18+48bPIb+DnMr?=
=?iso-8859-1?Q?FXTIcjzXS0wV7ZxvdfPHyDsguKaQyA5q0AetVuvew9qPE5uHjkFCg7z6og?=
=?iso-8859-1?Q?l9sq8NvxeyebPGSgv/9Vxi9WwWi3ReU4AAG06Z7eBh7sjtRGucYsIhVGyS?=
=?iso-8859-1?Q?GOs+KbESkYQEExn7Vk0CIGbw7gZEe2jCry7lUtBePl9yDOOcKgx9FRYfCq?=
=?iso-8859-1?Q?5MgE60sLupuhM+6U2r9BOnCytZkJBKjoziZYSl2vCBxKVAgYH9Oja9sqlm?=
=?iso-8859-1?Q?O8VY2JGu8ShEv38EvA+iuJM=3D?=
X-Forefront-Antispam-Report:
CIP:204.235.229.20;CTRY:US;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:mail.houstonpolice.org;PTR:InfoDomainNonexistent;CAT:OSPM;SFS:(13230031)(4636009)(396003)(39830400003)(136003)(230922051799003)(230473577357003)(64100799003)(451199024)(82310400011)(46966006)(40470700004)(356005)(81166007)(86362001)(31696002)(83380400001)(6706004)(316002)(508600001)(16576012)(70586007)(336012)(2860700004)(70206006)(956004)(26005)(9686003)(66899024)(7416002)(8676002)(6200100001)(8936002)(6862004)(5660300002)(41300700001)(15650500001)(2906002)(31686004)(62346018);DIR:OUT;SFP:1501;
X-OriginatorOrg: houstonpolice.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Feb 2024 01:10:08.1404
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 438b8f73-3761-4515-2ba6-08dc29d505cd
X-MS-Exchange-CrossTenant-Id: 64c753ca-2ec6-4981-81e7-5c7597f9e7d8
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=64c753ca-2ec6-4981-81e7-5c7597f9e7d8;Ip=[204.235.229.20];Helo=[mail.houstonpolice.org]
X-MS-Exchange-CrossTenant-AuthSource:
DS1PEPF00017E0A.namprd09.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR09MB9049
X-Spam_score: 23.6
X-Spam_score_int: 236
X-Spam_bar: +++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: [Message Came from Outside the Houston Police Department Mail
System] Dear Valued Beneficiary, I trust this message finds you in good health.
I am Mr. Kent Williams, the Director of Cash Processing at UNITED BANK FOR
AFRICA. In collaboration with the International Monetary Fund (I.M.F) and
the [...]
Content analysis details: (23.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[52.100.154.248 listed in list.dnswl.org]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.0 ARC_VALID Message has a valid ARC signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.0 ARC_SIGNED Message has a ARC signature
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[mrkentwilliams680(at)gmail.com]
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
1.5 HK_SCAM_N8 BODY: No description available.
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 HK_NAME_MR_MRS No description available.
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
2.5 MONEY_NOHTML Lots of money in plain text
2.0 HK_SCAM No description available.
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.9 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} UNITED BANK FOR AFRICA 204.235.229.134
[Message Came from Outside the Houston Police Department Mail System]
Dear Valued Beneficiary,
I trust this message finds you in good health. I am Mr. Kent Williams, the =
Director of Cash Processing at UNITED BANK FOR AFRICA. In collaboration wit=
h the International Monetary Fund (I.M.F) and the Organization of African U=
nity (O.A.U), we are pleased to inform you that you have been selected as a=
recipient of a compensation fund totaling $10,500,000.00USD.
We deeply regret any distress or inconvenience you may have experienced due=
to fraudulent activities. Your email address was regrettably among those f=
ound in the records of scam victims. To rectify this situation and offer yo=
u the compensation you deserve, we have been entrusted by the I.M.F to disb=
urse your compensation via a secure diplomatic courier service with a hand =
delivery to your specified location.
We understand that you may have concerns regarding associated expenses. Ple=
ase be assured that we have allocated an amount of Three, thousand United =
States dollars (USD$10,500,000.00) to cover all expenses, including taxes a=
nd the necessary documentation required for this transaction.
To expedite this process, kindly provide us with the following information:
Your complete home address.
Your direct phone number.
You may forward this information to our secure email address: mrkennedyozuo=
kapersonal@gmail.com
Please rest assured that your personal details will be handled with the utm=
ost confidentiality. Our dedicated team is committed to ensuring that you r=
eceive your compensation promptly and without any complications.
Should you have any questions or require further clarification, please do n=
ot hesitate to reach out to us via the provided email address. We are here =
to support you throughout this process and address any concerns you may hav=
e.
We appreciate your understanding and cooperation in this matter.
Warm regards,
Mr. Kent Williams
Managing Director
UNITED BANK FOR AFRICA
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 09 Feb 2024 22:06:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rYdtu-00000000GhR-2p77
for dave@doctor.nl2k.ab.ca;
Fri, 09 Feb 2024 20:19:34 -0700
Resent-From: The Doctor
Resent-Date: Fri, 9 Feb 2024 20:19:34 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-dm3gcc02hn2248.outbound.protection.outlook.com ([52.100.154.248]:50528 helo=GCC02-DM3-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rYbub-00000000BJk-3D87
for doctor@doctor.nl2k.ab.ca;
Fri, 09 Feb 2024 18:12:12 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=I4xnybIyBOyrjmL7eUPmJXZw5BfyCUZ6O8HIwwFI1VjqUJ2rLhbOXFKWBdKt7RKLyvi8WYnoga4/l+1FROf2Q5dQ8sr1b/p0fzVka/gYVz/z+NyAE9LzgY8hr8Vxe3IwKDRUgsgi+EYuTtSb0JE49y5EQO4wiG1d0X0/8mCOI6S6NhsqwrJHYR7g12pkKgDpFCJwzqoMEPtJnzE/wf6OkOMCzcEK6NI0VUlIFePYs+ASwSkIh1xyziBG9cmXKTEJc5BmKhPZLCswP+h5NQuR0WUqz+GngtpJvE8x+H6NwjFaMo8D4wMPfGqydVKGELGGobadT5F6Rhm1/F4bmzbPXg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=XdlXRW71gGRCJvlJx6hv+0x0CSG8vaaFMkemSzmktUA=;
b=Bf4gXwxn/sQtE9/5uJksFu390/+JD5acawLDSAIw0kcaOTFyWQBw0u40RqROAO7tCWarTkBd+/XQ2F80PHm+o8NflTMioltKeOs29RJn0he27S21l5A94h79ykhnj4eRIHkuiqjoCjNAfjfPp5OMgOekkahRyj/oLMeaweR1NCJr6mVHOXoQEe8k6LbUaR80/wpBG99AONdhKoHXM2BtIC2T3TZVd2+J53lEFRE29LDgznTvG6mGHFVy4wTmEXHga0oQjk+ExTXw+xRraoT5z67LgG8TrKmr8LLbnv9fHNdMz9CEedXOjfIOkxfQMwEALbpbzu69oMTR9BxET0dAhA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is
204.235.229.20) smtp.rcpttodomain=doctor.nl2k.ab.ca smtp.mailfrom=uba.com;
dmarc=none action=none header.from=uba.com; dkim=none (message not signed);
arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=houstonpolice.onmicrosoft.com; s=selector2-houstonpolice-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=XdlXRW71gGRCJvlJx6hv+0x0CSG8vaaFMkemSzmktUA=;
b=g+WNDBh0KqoP18GUuw1+BvAehiCPREJWM3LNIBRKAJXsPeeyF0EL8FLCiJbCVG65yKSWZ5G728vBJ+PEBUHK2Kkgse25saW/mILVqgkXJUrfus4zPtYMtoWUDuCAdmgBYdDqb95kAtH/K0patFHEE3r2hDNrjL/D43+iQwY70oQ=
Received: from BL0PR0901CA0006.namprd09.prod.outlook.com
(2603:10b6:208:1c0::16) by SA1PR09MB9049.namprd09.prod.outlook.com
(2603:10b6:806:275::6) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7270.26; Sat, 10 Feb
2024 01:10:08 +0000
Received: from DS1PEPF00017E0A.namprd09.prod.outlook.com
(2603:10b6:208:1c0:cafe::14) by BL0PR0901CA0006.outlook.office365.com
(2603:10b6:208:1c0::16) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7270.24 via Frontend
Transport; Sat, 10 Feb 2024 01:10:08 +0000
X-MS-Exchange-Authentication-Results: spf=none (sender IP is 204.235.229.20)
smtp.mailfrom=uba.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=uba.com;
Received-SPF: None (protection.outlook.com: uba.com does not designate
permitted sender hosts)
Received: from mail.houstonpolice.org (204.235.229.20) by
DS1PEPF00017E0A.mail.protection.outlook.com (10.167.18.167) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id
15.20.7249.19 via Frontend Transport; Sat, 10 Feb 2024 01:10:08 +0000
Received: from PHSHPDCLSTR001B.HPDWINAD.HPD (10.10.132.104) by
PHSHPDCLSTR000B.HPDWINAD.HPD (10.10.132.103) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id
15.1.2507.35; Fri, 9 Feb 2024 19:09:54 -0600
Received: from [156.96.112.152] (10.10.132.248) by
PHSHPDCLSTR001B.HPDWINAD.HPD (10.10.132.104) with Microsoft SMTP Server id
15.1.2507.35 via Frontend Transport; Fri, 9 Feb 2024 19:09:53 -0600
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: UNITED BANK FOR AFRICA 204.235.229.134
To: Recipients
From: "Mr. Kent Williams"
Date: Fri, 9 Feb 2024 20:09:54 -0800
Reply-To:
Message-ID: <8d8644fc-4ed9-47c8-b0a7-35bfb87b0f5a@PHSHPDCLSTR001B.HPDWINAD.HPD>
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DS1PEPF00017E0A:EE_|SA1PR09MB9049:EE_
X-MS-Office365-Filtering-Correlation-Id: 438b8f73-3761-4515-2ba6-08dc29d505cd
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?iso-8859-1?Q?8kROO2jewFw2jExLzsbeS/4LvNBajN5TU3ZlCd4KfMqiV70YumtV8dYk6L?=
=?iso-8859-1?Q?rxvmOJgb4AfDtSZm80bUJyb1Y0UC03lTuj1WWSbzJgY6oyx5R1QQc1ZB1Y?=
=?iso-8859-1?Q?zJm5V7ZNLghYOXnAfmSr5EoRPmwmI9YLT11awNc8xBbChUfo0Q/gBL8aOX?=
=?iso-8859-1?Q?xHVfYxLJbEygUIVaQdI0MLG18zHKfmhAXh15H9AsRGB88rlKnqv3pKGLft?=
=?iso-8859-1?Q?/LPawMw1+2LREQPkBF0YFjMy3G05uP/7hoN58Ep4H/0yG1Opd+M1p2Gocz?=
=?iso-8859-1?Q?WKo3C0p/wtD4ZXmuC7b+5H93F4Ezt0BK2hr4OK0dj2VZUHLoDnSoDCFeM1?=
=?iso-8859-1?Q?v/pzDEqMd29OBbMatOiYFlegwUqtVq3DBJIyWnnLSLN5eFa+Lawmk9SO5P?=
=?iso-8859-1?Q?NKzKv58g4REejVW2Nku33y+sJa26hv7MlXbHddcxrbx/IFiw7IbtFhgtg6?=
=?iso-8859-1?Q?rWDyecTXvOW3gDArKpdIRoKpc63nJGgRWSi+1VPOqTaIK5d0hHWi273uZY?=
=?iso-8859-1?Q?nvklj5bRfxz1UHzgtNko6BUymX6TBsnOtJlxCCZc1QxnFvZAtQKnmrN7Jk?=
=?iso-8859-1?Q?/Ph1qlWyj+QOgq7mX0jsjiiLxwNk3F3hxf7wIS4ZaEbrhZNfbA+zIHyJPF?=
=?iso-8859-1?Q?sICAUSBE9MvUjQKfPRmwoANdB4JZ9MiZHJ0ohbxKiseOXZ/p4zUyq8iJhd?=
=?iso-8859-1?Q?isAEK2GV076WQqhlrr3+YCX6NhT4MMcZC5U2vl7DyJoNWiw7FFvqfQF9lN?=
=?iso-8859-1?Q?YGVOeBQ9yL6X4mMEd98WKvIBqyLdy/AEyVJaftg0xf8J18+48bPIb+DnMr?=
=?iso-8859-1?Q?FXTIcjzXS0wV7ZxvdfPHyDsguKaQyA5q0AetVuvew9qPE5uHjkFCg7z6og?=
=?iso-8859-1?Q?l9sq8NvxeyebPGSgv/9Vxi9WwWi3ReU4AAG06Z7eBh7sjtRGucYsIhVGyS?=
=?iso-8859-1?Q?GOs+KbESkYQEExn7Vk0CIGbw7gZEe2jCry7lUtBePl9yDOOcKgx9FRYfCq?=
=?iso-8859-1?Q?5MgE60sLupuhM+6U2r9BOnCytZkJBKjoziZYSl2vCBxKVAgYH9Oja9sqlm?=
=?iso-8859-1?Q?O8VY2JGu8ShEv38EvA+iuJM=3D?=
X-Forefront-Antispam-Report:
CIP:204.235.229.20;CTRY:US;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:mail.houstonpolice.org;PTR:InfoDomainNonexistent;CAT:OSPM;SFS:(13230031)(4636009)(396003)(39830400003)(136003)(230922051799003)(230473577357003)(64100799003)(451199024)(82310400011)(46966006)(40470700004)(356005)(81166007)(86362001)(31696002)(83380400001)(6706004)(316002)(508600001)(16576012)(70586007)(336012)(2860700004)(70206006)(956004)(26005)(9686003)(66899024)(7416002)(8676002)(6200100001)(8936002)(6862004)(5660300002)(41300700001)(15650500001)(2906002)(31686004)(62346018);DIR:OUT;SFP:1501;
X-OriginatorOrg: houstonpolice.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Feb 2024 01:10:08.1404
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 438b8f73-3761-4515-2ba6-08dc29d505cd
X-MS-Exchange-CrossTenant-Id: 64c753ca-2ec6-4981-81e7-5c7597f9e7d8
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=64c753ca-2ec6-4981-81e7-5c7597f9e7d8;Ip=[204.235.229.20];Helo=[mail.houstonpolice.org]
X-MS-Exchange-CrossTenant-AuthSource:
DS1PEPF00017E0A.namprd09.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR09MB9049
X-Spam_score: 23.6
X-Spam_score_int: 236
X-Spam_bar: +++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: [Message Came from Outside the Houston Police Department Mail
System] Dear Valued Beneficiary, I trust this message finds you in good health.
I am Mr. Kent Williams, the Director of Cash Processing at UNITED BANK FOR
AFRICA. In collaboration with the International Monetary Fund (I.M.F) and
the [...]
Content analysis details: (23.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[52.100.154.248 listed in list.dnswl.org]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.0 ARC_VALID Message has a valid ARC signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.0 ARC_SIGNED Message has a ARC signature
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[mrkentwilliams680(at)gmail.com]
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
1.5 HK_SCAM_N8 BODY: No description available.
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 HK_NAME_MR_MRS No description available.
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
2.5 MONEY_NOHTML Lots of money in plain text
2.0 HK_SCAM No description available.
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.9 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} UNITED BANK FOR AFRICA 204.235.229.134
[Message Came from Outside the Houston Police Department Mail System]
Dear Valued Beneficiary,
I trust this message finds you in good health. I am Mr. Kent Williams, the =
Director of Cash Processing at UNITED BANK FOR AFRICA. In collaboration wit=
h the International Monetary Fund (I.M.F) and the Organization of African U=
nity (O.A.U), we are pleased to inform you that you have been selected as a=
recipient of a compensation fund totaling $10,500,000.00USD.
We deeply regret any distress or inconvenience you may have experienced due=
to fraudulent activities. Your email address was regrettably among those f=
ound in the records of scam victims. To rectify this situation and offer yo=
u the compensation you deserve, we have been entrusted by the I.M.F to disb=
urse your compensation via a secure diplomatic courier service with a hand =
delivery to your specified location.
We understand that you may have concerns regarding associated expenses. Ple=
ase be assured that we have allocated an amount of Three, thousand United =
States dollars (USD$10,500,000.00) to cover all expenses, including taxes a=
nd the necessary documentation required for this transaction.
To expedite this process, kindly provide us with the following information:
Your complete home address.
Your direct phone number.
You may forward this information to our secure email address: mrkennedyozuo=
kapersonal@gmail.com
Please rest assured that your personal details will be handled with the utm=
ost confidentiality. Our dedicated team is committed to ensuring that you r=
eceive your compensation promptly and without any complications.
Should you have any questions or require further clarification, please do n=
ot hesitate to reach out to us via the provided email address. We are here =
to support you throughout this process and address any concerns you may hav=
e.
We appreciate your understanding and cooperation in this matter.
Warm regards,
Mr. Kent Williams
Managing Director
UNITED BANK FOR AFRICA
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments