#296256 by buried under 419s
Thu May 26, 2016 11:51 am
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 26 May 2016 03:11:25 -0700
Received: from mail-oi0-f66.google.com ([209.85.218.66]:35664)
by with esmtps (TLSv1:AES128-SHA:128)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1b5sGC-0002uJ-Ap
for ; Thu, 26 May 2016 03:11:24 -0700
Received: by mail-oi0-f66.google.com with SMTP id h125so2797922oib.2
for <>; Thu, 26 May 2016 03:34:45 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20120113;
h=mime-version:date:message-id:subject:from:to;
bh=LJJeDFwD7OQJarpNfPiPy5v0L2T4mOvrgAlcNHQn5sk=;
b=OR7dTp2DMqlYIN/W5RvwKuI5rVqhoZDNBGI4fqnGs3V60U89fY9oD/9nMZlMWTWDJ/
Nag483MGYkdcmoIXbLeznU8g2nwf6ncqGHYBAHnwsgZq3gD8vFizpg14XagaauMFet0C
9uBaasDIxSw3b/j1OArhOiEZZ18Ab9LlJs9NdCIsaUgCK20wS44Rv6OWt2rnzH4l/D6w
tYIeUXFVFzjuNro483mPu7cGlLzinlFXoJv5aO9xv9t0KKpFU9wSCVCS1ytEO9wLDdpZ
OSJj6cqWBsDluoWQGR+pMKq/c47VkBeP6cnOQ5lL1TzZ5WDQ+Ra+SljF5b3tQibRriXJ
yOBw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20130820;
h=x-gm-message-state:mime-version:date:message-id:subject:from:to;
bh=LJJeDFwD7OQJarpNfPiPy5v0L2T4mOvrgAlcNHQn5sk=;
b=PCfRCMLJY+zqFz5Gewfgx3uL1C9lxkiusC+FJeQfmmekTlvff2W715MRV3SbOHSf4j
GsqIHAUsmrmi0LszWG5Z04Twygd3UC1q6lAbPuIYUTCaLsHTU9s3VHsFPcK6IvALMCZJ
onin23z7LKatTj9q1q/myTxV+bpkhc4Zhb2qknAi/B3w7UF8jXfnnWPoXzgN4aL9FRH6
mfc3QgM6gUcwteYFU0znQedd9Zt0vNIwr89cgwgNgAlyQXu1ic3hU7dVSY16bRdrFE3P
CfIrIIngv4DJEUGLy2oOb2uxfapaBBFIcIhxpWE107p9nR+eRdZ4OOfw0wDcUqzcCHpG
6b3Q==
X-Gm-Message-State: ALyK8tJxmlk4SdZ7jRa059sI2uO2skijEA2rkDc2Dq8h63lYNWNy1Y5FZB1uc1P3Xsug3E5el75xbysrnmoqyQ==
MIME-Version: 1.0
X-Received: by 10.157.0.68 with SMTP id 62mr5842419ota.189.1464258882425; Thu,
26 May 2016 03:34:42 -0700 (PDT)
Received: by 10.202.181.135 with HTTP; Thu, 26 May 2016 03:34:42 -0700 (PDT)
Date: Thu, 26 May 2016 03:34:42 -0700
Message-ID: <CAOqjWy60wDmybjgea1hqUyhGL6K-EeaNPBzizf=o-6CCqrYQOw@mail.gmail.com>
From: STANBIC BANK <[email protected]>
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary=94eb2c0441f48be98c0533bc5673
Bcc:
X-Spam-Status: Yes, score=7.3
X-Spam-Score: 73
X-Spam-Bar: +++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: SHORE BANK 540 East 105th Street Cleveland, Ohio 44108 330)
961-1671 DEAR CUSTOMER WE WRITE TO INFORM YOU THAT YOUR ATM CARD WHICH WAS
RETRIEVED FROM MR JOHNSON LOYD SINCE LAST YEAR BY THE F B I IS STILL IN OUR
BANK AND THE PRIMARY BANK THAT SEND THE CARD (HSBC BANK) HAS ASKED US TO
WIRE THE FUNDS DIRECT TO YOUR BANK ACCOUNT VIA BANK TO BANK WIRE TRANSFER
BASED ON THE NEW METHOD OF THIS FRAUDSTERS TO ACCESS ATM CARD/DRAFTS WHILE
ON TRANSIT. FOLLOWING TO THIS NEW DEVELOPMENT, OUR BANK WILL IMMEDIATELY
WIRE DIRECTLY YOUR FUNDS TO YOUR ACCOUNT WITHIN 24 BANKING HOURS FROM THE
TIME YOUR ACCOUNT DETAILS IS RECEIVED BY OUR BANK.ALSO ADD YOUR PERSONAL CELL
PHONE NUMBER FOR CONFIDENTIAL PURPOSES. [...]
Content analysis details: (7.3 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(stanbicbank.bank[at]gmail.com)
-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low
trust
[209.85.218.66 listed in list.dnswl.org]
1.5 SUBJ_ALL_CAPS Subject is all capitals
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 HTML_IMAGE_RATIO_08 BODY: HTML has a low ratio of text to image area
2.1 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words
1.5 BAYES_60 BODY: Bayes spam probability is 60 to 80%
[score: 0.7864]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 UPPERCASE_75_100 message body is 75-100% uppercase
3.0 TVD_PH_BODY_META TVD_PH_BODY_META
0.0 T_REMOTE_IMAGE Message contains an external image
X-Spam-Flag: YES
Subject: ***SPAM*** PAYMENT VIA SHORE BANK USA
--94eb2c0441f48be98c0533bc5673
Content-Type: text/plain; charset=UTF-8
SHORE BANK
540 East 105th Street
Cleveland, Ohio 44108
330) 961-1671
DEAR CUSTOMER
WE WRITE TO INFORM YOU THAT YOUR ATM CARD WHICH WAS RETRIEVED FROM MR
JOHNSON LOYD SINCE LAST YEAR BY THE F B I IS STILL IN OUR BANK AND THE
PRIMARY BANK THAT SEND THE CARD (HSBC BANK) HAS ASKED US TO WIRE THE FUNDS
DIRECT TO YOUR BANK ACCOUNT VIA BANK TO BANK WIRE TRANSFER BASED ON THE NEW
METHOD OF THIS FRAUDSTERS TO ACCESS ATM CARD/DRAFTS WHILE ON TRANSIT.
FOLLOWING TO THIS NEW DEVELOPMENT, OUR BANK WILL IMMEDIATELY WIRE DIRECTLY
YOUR FUNDS TO YOUR ACCOUNT WITHIN 24 BANKING HOURS FROM THE TIME YOUR
ACCOUNT DETAILS IS RECEIVED BY OUR BANK.ALSO ADD YOUR PERSONAL CELL PHONE
NUMBER FOR CONFIDENTIAL PURPOSES.
CONGRATULATIONS
Envelope-to:
Delivery-date: Thu, 26 May 2016 03:11:25 -0700
Received: from mail-oi0-f66.google.com ([209.85.218.66]:35664)
by with esmtps (TLSv1:AES128-SHA:128)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1b5sGC-0002uJ-Ap
for ; Thu, 26 May 2016 03:11:24 -0700
Received: by mail-oi0-f66.google.com with SMTP id h125so2797922oib.2
for <>; Thu, 26 May 2016 03:34:45 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20120113;
h=mime-version:date:message-id:subject:from:to;
bh=LJJeDFwD7OQJarpNfPiPy5v0L2T4mOvrgAlcNHQn5sk=;
b=OR7dTp2DMqlYIN/W5RvwKuI5rVqhoZDNBGI4fqnGs3V60U89fY9oD/9nMZlMWTWDJ/
Nag483MGYkdcmoIXbLeznU8g2nwf6ncqGHYBAHnwsgZq3gD8vFizpg14XagaauMFet0C
9uBaasDIxSw3b/j1OArhOiEZZ18Ab9LlJs9NdCIsaUgCK20wS44Rv6OWt2rnzH4l/D6w
tYIeUXFVFzjuNro483mPu7cGlLzinlFXoJv5aO9xv9t0KKpFU9wSCVCS1ytEO9wLDdpZ
OSJj6cqWBsDluoWQGR+pMKq/c47VkBeP6cnOQ5lL1TzZ5WDQ+Ra+SljF5b3tQibRriXJ
yOBw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20130820;
h=x-gm-message-state:mime-version:date:message-id:subject:from:to;
bh=LJJeDFwD7OQJarpNfPiPy5v0L2T4mOvrgAlcNHQn5sk=;
b=PCfRCMLJY+zqFz5Gewfgx3uL1C9lxkiusC+FJeQfmmekTlvff2W715MRV3SbOHSf4j
GsqIHAUsmrmi0LszWG5Z04Twygd3UC1q6lAbPuIYUTCaLsHTU9s3VHsFPcK6IvALMCZJ
onin23z7LKatTj9q1q/myTxV+bpkhc4Zhb2qknAi/B3w7UF8jXfnnWPoXzgN4aL9FRH6
mfc3QgM6gUcwteYFU0znQedd9Zt0vNIwr89cgwgNgAlyQXu1ic3hU7dVSY16bRdrFE3P
CfIrIIngv4DJEUGLy2oOb2uxfapaBBFIcIhxpWE107p9nR+eRdZ4OOfw0wDcUqzcCHpG
6b3Q==
X-Gm-Message-State: ALyK8tJxmlk4SdZ7jRa059sI2uO2skijEA2rkDc2Dq8h63lYNWNy1Y5FZB1uc1P3Xsug3E5el75xbysrnmoqyQ==
MIME-Version: 1.0
X-Received: by 10.157.0.68 with SMTP id 62mr5842419ota.189.1464258882425; Thu,
26 May 2016 03:34:42 -0700 (PDT)
Received: by 10.202.181.135 with HTTP; Thu, 26 May 2016 03:34:42 -0700 (PDT)
Date: Thu, 26 May 2016 03:34:42 -0700
Message-ID: <CAOqjWy60wDmybjgea1hqUyhGL6K-EeaNPBzizf=o-6CCqrYQOw@mail.gmail.com>
From: STANBIC BANK <[email protected]>
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary=94eb2c0441f48be98c0533bc5673
Bcc:
X-Spam-Status: Yes, score=7.3
X-Spam-Score: 73
X-Spam-Bar: +++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: SHORE BANK 540 East 105th Street Cleveland, Ohio 44108 330)
961-1671 DEAR CUSTOMER WE WRITE TO INFORM YOU THAT YOUR ATM CARD WHICH WAS
RETRIEVED FROM MR JOHNSON LOYD SINCE LAST YEAR BY THE F B I IS STILL IN OUR
BANK AND THE PRIMARY BANK THAT SEND THE CARD (HSBC BANK) HAS ASKED US TO
WIRE THE FUNDS DIRECT TO YOUR BANK ACCOUNT VIA BANK TO BANK WIRE TRANSFER
BASED ON THE NEW METHOD OF THIS FRAUDSTERS TO ACCESS ATM CARD/DRAFTS WHILE
ON TRANSIT. FOLLOWING TO THIS NEW DEVELOPMENT, OUR BANK WILL IMMEDIATELY
WIRE DIRECTLY YOUR FUNDS TO YOUR ACCOUNT WITHIN 24 BANKING HOURS FROM THE
TIME YOUR ACCOUNT DETAILS IS RECEIVED BY OUR BANK.ALSO ADD YOUR PERSONAL CELL
PHONE NUMBER FOR CONFIDENTIAL PURPOSES. [...]
Content analysis details: (7.3 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(stanbicbank.bank[at]gmail.com)
-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low
trust
[209.85.218.66 listed in list.dnswl.org]
1.5 SUBJ_ALL_CAPS Subject is all capitals
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 HTML_IMAGE_RATIO_08 BODY: HTML has a low ratio of text to image area
2.1 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words
1.5 BAYES_60 BODY: Bayes spam probability is 60 to 80%
[score: 0.7864]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 UPPERCASE_75_100 message body is 75-100% uppercase
3.0 TVD_PH_BODY_META TVD_PH_BODY_META
0.0 T_REMOTE_IMAGE Message contains an external image
X-Spam-Flag: YES
Subject: ***SPAM*** PAYMENT VIA SHORE BANK USA
--94eb2c0441f48be98c0533bc5673
Content-Type: text/plain; charset=UTF-8
SHORE BANK
540 East 105th Street
Cleveland, Ohio 44108
330) 961-1671
DEAR CUSTOMER
WE WRITE TO INFORM YOU THAT YOUR ATM CARD WHICH WAS RETRIEVED FROM MR
JOHNSON LOYD SINCE LAST YEAR BY THE F B I IS STILL IN OUR BANK AND THE
PRIMARY BANK THAT SEND THE CARD (HSBC BANK) HAS ASKED US TO WIRE THE FUNDS
DIRECT TO YOUR BANK ACCOUNT VIA BANK TO BANK WIRE TRANSFER BASED ON THE NEW
METHOD OF THIS FRAUDSTERS TO ACCESS ATM CARD/DRAFTS WHILE ON TRANSIT.
FOLLOWING TO THIS NEW DEVELOPMENT, OUR BANK WILL IMMEDIATELY WIRE DIRECTLY
YOUR FUNDS TO YOUR ACCOUNT WITHIN 24 BANKING HOURS FROM THE TIME YOUR
ACCOUNT DETAILS IS RECEIVED BY OUR BANK.ALSO ADD YOUR PERSONAL CELL PHONE
NUMBER FOR CONFIDENTIAL PURPOSES.
CONGRATULATIONS
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces