IMF spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 28 Jun 2022 07:55:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1o6BfV-000Nyz-7J

for dave@doctor.nl2k.ab.ca;

Tue, 28 Jun 2022 07:54:17 -0600

Resent-From: The Doctor

Resent-Date: Tue, 28 Jun 2022 07:54:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wr1-f66.google.com ([209.85.221.66]:41831)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1o6BJx-000HCg-9l

for www@doctor.nl2k.ab.ca;

Tue, 28 Jun 2022 07:32:05 -0600

Received: by mail-wr1-f66.google.com with SMTP id q9so17722823wrd.8

for ; Tue, 28 Jun 2022 06:31:41 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to

:content-transfer-encoding;

bh=SBgtwvWkIYwrI4NNUchOadkQP815ewxm/3gr0Bmy3PM=;

b=kazCH5QR+bMBtSH5cPJYfsQt1N3wjCA4zVpcMs77Aggv9/EzWNu+fQG0jN6Q7b1q+Q

kx5L6YE0SCED2A9z9shUHHxkVK7S71eqGUvftYoIRiszmNvbIqa2Eaby+YUaIvd+LmuA

CWZmewJpODnJr4BDGE0E5gKAWN+1SV6+M1aV8Tptm2X64DDwTRut3aUTW8sA5KWghJGT

txHySfBSWSIdWeS00Ax+Pv7NowtwRq3qKaaBSZ8Pwwrh/rGYYFdR4rckbhQiADU0s92u

yktV3XkMxMPAnufZgXxRNaVtmp4ClDdkPFDRPIFjPz17SwThvnhrxnRVLej93DdJMbbC

z0gw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to:content-transfer-encoding;

bh=SBgtwvWkIYwrI4NNUchOadkQP815ewxm/3gr0Bmy3PM=;

b=6lPSJwzEw9Vi5jponcjOjBKZ09pQYf/5U/DiQTOKGq5mB81rckZ63jwWmVaGlymlwr

3hg1BFRUVjguldEc/JGt6lEsGPv9PvbYkeps9FsA29vMvwEUUuiTPunakso7QBiq/CUW

uAuBWHQfubXNOBJO7VHe+/bTTP8d4dGJYoom6MmHK+2BFOiWugTa7sJpJJUVjffOl9pb

lvQxdW2zYYqlaUvanu4p8A+J/Rg0Km7k9BuTCic+CcN1AoKRqLKteyE2SBNk9Ee66gIa

46+ZiWNdPLk8KGvHfCj6H8KHNrzsrusLET2sHfqAeAIMDpK+kI/C1eQ+GVmU7Zk4Apic

pG+w==

X-Gm-Message-State: AJIora8jcxtvZbpxnDWrj5u6ueBPUcyx0stTOdZMDXmSftyMw1Q73Ob2

qZJBzr/RGkovNSw7bXSBjRkmP/xlui2iQQIKa5c=

X-Google-Smtp-Source: AGRyM1vyJFYu8PRjxoX0wOf43kSoDUw60FryKtZDwZdJVPEwAYJNt3E93DKxl1Hv463zt+1G/PGKFlpb+QfDZCCDF9E=

X-Received: by 2002:a5d:4302:0:b0:21b:a641:9a36 with SMTP id

h2-20020a5d4302000000b0021ba6419a36mr16852043wrq.87.1656423094670; Tue, 28

Jun 2022 06:31:34 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:6000:1d9c:0:0:0:0 with HTTP; Tue, 28 Jun 2022 06:31:33

-0700 (PDT)

Reply-To: kristalinageorgieva17@yahoo.com

From: IMF OFFICE

Date: Tue, 28 Jun 2022 06:31:33 -0700

Message-ID:

Subject: Greetings

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Bcc: www@doctor.nl2k.ab.ca

X-Spam_score: 21.9

X-Spam_score_int: 219

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: -- Greeting from IMF office INTERNATIONAL MONETARY FUND (IMF)

OFFICE OF REGISTER 700 19th STREET, NW, SUITE HQ1_3_544 WASHINGTON, DC 20431,

USA Are you alive or dead? We received several emails from one Mr. David

Trent Mallory who narrated to us about the auto car accident you had 2 weeks

ago. Mr. David Trent Mallory made us to understand tha [...]



Content analysis details: (21.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.66 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[robertumar001[at]gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[kristalinageorgieva17[at]yahoo.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[robertumar001[at]gmail.com]

2.5 HK_SCAM_N2 BODY: No description available.

3.6 NA_DOLLARS BODY: Talks about a million North American dollars

1.1 HK_SCAM_N3 BODY: No description available.

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 HK_SCAM No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

2.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to

2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.0 FILL_THIS_FORM Fill in a form with personal information

2.0 FILL_THIS_FORM_LONG Fill in a form with personal information

0.0 MONEY_FORM Lots of money if you fill out a form

2.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.3 ADVANCE_FEE_3_NEW_FRM_MNY Advance Fee fraud form and lots of

money

3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: reply.so]

Subject: {SPAM?} Greetings



--=20

Greeting from IMF office

INTERNATIONAL MONETARY FUND (IMF)

OFFICE OF REGISTER

700 19th STREET, NW, SUITE HQ1_3_544

WASHINGTON, DC 20431, USA



Are you alive or dead? We received several emails from one Mr. David

Trent Mallory

who narrated to us about the auto car accident you had 2 weeks ago.

Mr. David Trent Mallory

made us to understand that you are in hospital for treatment but there is n=

o

hope of your recovery. He stated that he is your business associates and

your next of kin who you have chosen and permitted to inherit all your

properties, he is contacting this office base on your contract

/Inheritance payment fund

valid $8.5 Million US Dollars,so we request your confirmation before

we can process this transfer to Mr. David Trent Mallory

Bank Account. This is to avoid releasing your money to wrong person because



Mr. David Trent Mallory is too eager and ready to follow every

instruction to have this

money into his account. If you did not have auto accident and you did not p=

ermit

Mr. David Trent Mallory to claim your money, kindly reply this message

with your full contact information so we can process the release of

the $8.5 Million US Dollars dollars to you, and please if anyone

emails with my name without this very code (006955). Please that email

is a scam and do not reply.so here is the information we need now to

start processing your release of your funds.



Full Name:=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=

=E2=80=A6. =E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=

=E2=80=A6=E2=80=A6=E2=80=A6 =E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=

=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6

Full Address:=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=

=A6. =E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=

=A6=E2=80=A6=E2=80=A6 =E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=

=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6

Direct Telephone Number:=E2=80=A6=E2=80=A6. =E2=80=A6=E2=80=A6=E2=80=A6=E2=

=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6 =E2=80=A6=E2=

=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6

IDENTITY CARD OR PASSPORT COPY...........

Please, reconfirm your direct cell phone number to enable voice communicati=

on

Here to contact my office with the information.



Mrs. Georgieva Kristalina

Managing Director

Contact Email:

kristalinageorgieva17@yahoo.com

Text number:+1 (315) 238-4879

WhatsApp: number +1 (972) 848-7050

Waiting to here from you.

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA