[email protected] MR GARRY MARTI

Return-Path: <[email protected]>
Delivered-To:
Received: from
by with LMTP id mOboGgRHRVyvUwAAjbubUg
for <>; Sun, 20 Jan 2019 20:13:56 -0800
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sun, 20 Jan 2019 20:13:56 -0800
Received: from mail-it1-f196.google.com ([209.85.166.196]:37412)
by with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1glQy7-0005Yv-Q4
for ; Sun, 20 Jan 2019 20:13:56 -0800
Received: by mail-it1-f196.google.com with SMTP id b5so13468010iti.2
for <>; Sun, 20 Jan 2019 20:13:31 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:from:date:message-id:subject:to;
bh=ov4Q3GZmDRR9pAoyX5A3aN2HyLBjAizsHVJ5+mRzQMs=;
b=mPtEH5m0PYQ6t+CCqAQbrWT3rS3Wt5bU3QLBmsV1/9X86yfpCYY9rh6RLatT1Mp+OU
Fn50tOYXVeRCb53KVT05XPnSmoHyqXfkWgv3w1QEs0sXQLpNOOE27RS5twwUM0aiwjm7
vZpTibp51pHyFt6vhcbPwcAdXcJJPy4+Mmb3ev7QHZR09bC1ZCIOh+rEd5NIGDxhNRYm
/sHZ8ec29qzfV/hVMxGDKHRH4Y4qmwj2IEyg6jIlav6V3lF8/O2EMrVT89G1D4hMCEDt
eHTrUD4sIQonOWCSO7S/pV0Kgxk+aVkjCcMm+2V58Se268X5o08VMuq0JFoYDoIN4XsU
bLCQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
bh=ov4Q3GZmDRR9pAoyX5A3aN2HyLBjAizsHVJ5+mRzQMs=;
b=FBQsrVPvX3dZYh2xUhX8jMTcGtEHi0uQvYzBIhKeXQ1MlkhaRwgfFe6M38cmSxPaC6
cgCjomuEmLp9AOl3/tVy250F+K+kECWYfGGpQfglmJO8ZyBqN2ofAmRd7GMQDHPD9NAW
LuTY7DTtGm0pxMoADStYvy6eZQ/CUaw+0MFuoA5/XlYq1btRsvDEgJBCdW3Rikd18QyO
U/F6cIiQfHyre3/7Ht+fnXpN5tFLpDHnuFtWSzmAKXiqwJE9uLzX4L8T3F0qlnOX7O3c
+Hvq3pynsqi7XdpSSj77xYM50Qr46ydCUvt0ZuI2q6V6fiOjW8S3NtxJyWFfwshjxRWi
d8pw==
X-Gm-Message-State: AJcUukce8R2jjVmpBN+o9crSMEB7CzZQcuvOiCcmrwRUeSKBIfm+JWWt
bwPjRTmo43cFFk/1wrPgvfIpEPbOxV8xOcExg1c=
X-Google-Smtp-Source: ALg8bN4V+/ymRIe7V7OMH9+myQfq7udxpLB94vo90j1PL/0R6fVN5UHdCZxunXQwk7XXb2CognE3oMNDlbrFptSiG8k=
X-Received: by 2002:a24:80cc:: with SMTP id g195mr15116257itd.178.1548043990893;
Sun, 20 Jan 2019 20:13:10 -0800 (PST)
MIME-Version: 1.0
From: Moses Michael <[email protected]>
Date: Mon, 21 Jan 2019 05:12:59 +0100
Message-ID: <CAG36HQ37-=W1QPYA+ovw=M9uy6M3Rq7r1=cUwvzPaAFmXGqtKw@mail.gmail.com>
Subject: APPROVED
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000002c8c7a057ff014be"
Bcc:
X-Spam-Status: No, score=6.2
X-Spam-Score: 62
X-Spam-Bar: ++++++
X-Ham-Report: Spam detection software, running on the system "",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.

Content preview: [image: Image result for shore bank logo] SHORE BANK 540 East
105th Street Cleveland, Ohio 44108 330) 961-1671 DEAR CUSTOMER WE WRITE TO
INFORM YOU THAT YOUR ATM CARD WHICH WAS RETRIEVED FROM MR JOHNSON LOYD SINCE
LAST YEAR BY THE F B I IS STILL IN OUR BANK AND THE PRIMARY BANK THAT SEND
THE CARD (HSBC BANK) HAS ASKED US TO WIRE THE FUNDS DIRECT TO YOUR BANK ACCOUNT
VIA BANK TO BANK WIRE TRANSFER BASED ON THE NEW METHOD OF THIS FRAUDSTERS
TO ACCESS ATM CARD/DRAFTS WHILE ON TRANSIT. FOLLOWING TO THIS NEW DEVELOPMENT,
OUR BANK WILL IMMEDIATELY WIRE DIRECTLY YOUR FUNDS TO YOUR ACCOUNT WITHIN
24 BANKING HOURS FROM THE TIME YOUR ACCOUNT DETAILS IS RECEIVED BY OUR BANK.ALSO
ADD YOUR PERSONAL CELL PHONE NUMBER FOR CONFIDENTIAL PURPOSES. [...]

Content analysis details: (6.2 points, 7.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (mosesmike103[at]gmail.com)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.166.196 listed in list.dnswl.org]
-0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.166.196 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(mosesmike103[at]gmail.com)
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.0 UPPERCASE_75_100 message body is 75-100% uppercase
X-Spam-Flag: NO

[image: Image result for shore bank logo]
SHORE BANK
540 East 105th Street
Cleveland, Ohio 44108
330) 961-1671

DEAR CUSTOMER

WE WRITE TO INFORM YOU THAT YOUR ATM CARD WHICH WAS RETRIEVED FROM MR
JOHNSON LOYD SINCE LAST YEAR BY THE F B I IS STILL IN OUR BANK AND THE
PRIMARY BANK THAT SEND THE CARD (HSBC BANK) HAS ASKED US TO WIRE THE FUNDS
DIRECT TO YOUR BANK ACCOUNT VIA BANK TO BANK WIRE TRANSFER BASED ON THE NEW
METHOD OF THIS FRAUDSTERS TO ACCESS ATM CARD/DRAFTS WHILE ON TRANSIT.
FOLLOWING TO THIS NEW DEVELOPMENT, OUR BANK WILL IMMEDIATELY WIRE DIRECTLY
YOUR FUNDS TO YOUR ACCOUNT WITHIN 24 BANKING HOURS FROM THE TIME YOUR
ACCOUNT DETAILS IS RECEIVED BY OUR BANK.ALSO ADD YOUR PERSONAL CELL PHONE
NUMBER FOR CONFIDENTIAL PURPOSES.

CONGRATULATIONS
MR GARRY MARTI

[Troy Platt]

From: Moses Michael <[email protected]>
Date: Fri, 30 Aug 2019 07:21:41 +0100
Subject: CONFIRM

Image result for shore bank logo
SHORE BANK
540 East 105th Street
Cleveland, Ohio 44108
330) 961-1671

DEAR CUSTOMER

We received a letter from MR SMITH GOLLY to change your receiving bank account to
wells Fargo bank n,a
2605 sw 91st ,Gainesville ,Florida 32608
Account # 6001980421
For the transfer of your approved $4.500.000.00 from HSBC BANK , the reason was that you just passed on due to heart attack, please we need .confirmation before we proceed
Mrs Ann Wood