Subject: INTERNATIONAL MONETARY FUND (IMF)

From: [email-masked]
Date: Wed, 6 Jan 2021 21:35:59 -0800 (PST)

Spam detection software, running on the system "mx2.eskimo.com",
has identified this incoming email as possible spam.  The original
message has been attached to this so you can view it or label
similar future email.  If you have any questions, see
the administrator of that system for details.

Content preview:  I've invited you to fill out the following form: Untitled
  form To fill it out, visit: https://docs.google.com/forms/d/e/1FAIpQLSd-P7z9x0SmcarM7aq2Y4PFfbwxQQUwANRN3BC37wWHtGYr2Q/viewform?vc=0&amp;c=0&amp;w=1&amp;flr=0&amp;usp=mail_form_link

Content analysis details:   (8.3 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                            blocked.  See
                            http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                             for more information.
                            [URIs: 4.direct]
-0.0 RCVD_IN_DNSWL_NONE     RBL: Sender listed at https://www.dnswl.org/,
                             no trust
                            [209.85.219.199 listed in list.dnswl.org]
 0.8 BAYES_50               BODY: Bayes spam probability is 40 to 60%
                            [score: 0.5000]
 0.1 NA_DOLLARS             BODY: Talks about a million North American dollars
-0.0 SPF_PASS               SPF: sender matches SPF record
 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
                            digit
                            [barr.annapaula30[at]gmail.com]
 0.0 DKIM_ADSP_CUSTOM_MED   No valid author signature, adsp_override is
                             CUSTOM_MED
 0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail
                            provider
                            [barr.annapaula30[at]gmail.com]
 0.5 SUBJ_ALL_CAPS          Subject is all capitals
 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                            mail domains are different
 0.0 HTML_MESSAGE           BODY: HTML included in message
 0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                            valid
 1.1 DCC_CHECK              Detected as bulk mail by DCC (dcc-servers.net)
 0.1 DKIM_INVALID           DKIM or DK signature exists, but is not valid
 0.6 URG_BIZ                Contains urgent matter
 0.0 LOTS_OF_MONEY          Huge... sums of money
 0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and
                            EnvelopeFrom freemail headers are
                            different
 0.3 MONEY_FREEMAIL_REPTO   Lots of money from someone using free
                            email?
 0.0 MONEY_BARRISTER        Lots of money from a UK lawyer
 0.9 NML_ADSP_CUSTOM_MED    ADSP custom_med hit, and not from a mailing
                            list
 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal
                            information
 0.0 MONEY_FORM_SHORT       Lots of money if you fill out a short form
 0.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
 3.0 GOOGLE_DOC_SUSP        Suspicious use of Google Docs
 0.0 FORM_FRAUD_5           Fill a form and many fraud phrases

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam.  If you wish to view
it, it may be safer to save it to a file and open it with an editor.

Subject: INTERNATIONAL MONETARY FUND (IMF)
From: [email-masked]
To: [email-masked]
Date: Wed, 6 Jan 2021 21:35:59 -0800 (PST)

I've invited you to fill out the following form:
Untitled form

To fill it out, visit:
https://docs.google.com/forms/d/e/1FAIpQLSd-P7z9x0SmcarM7aq2Y4PFfbwxQQUwANRN3BC37wWHtGYr2Q/viewform?vc=0&amp;c=0&amp;w=1&amp;flr=0&amp;usp=mail_form_link

INTERNATIONAL MONETARY FUND (IMF)
DEPT: WORLD DEBT RECONCILIATION AGENCIES.
ADVISE: YOUR OUTSTANDING PAYMENT NOTIFICATION

Good Day

Happy New Year, We wish you all the best this 2021;

I&#39;m directed to contact you by the (WORLD BANK AND INTERNATIONAL
MONETARY FUND )to urgently confirm from you if you actually know one
Mrs Shelly Gligor and COLLEAGUES who claim to be your business
associate/ partner in your country.Mrs Shelly Gligor is claiming to us
that you are dead and she will like to change all the Information that
you gave to us as our bonafide beneficiary. Below is the new banking
information were she wish to have this funds transferred to:-

Bank of America
4000 Garth Road Baytown TX 77521
ABA: 026009500 (International)
ACCT. #:003042656666
ACCT: Name: NEO Investments Inc.
Signatory: Shelly Gligor

This development is coming up now that the Ministry want to offset all
your outstanding payments to all our legal foreign beneficiaries
around the world in which your payment file was also approved for
release. As you may know, the total amount in your favor is a total
sum of $5.8 Million U.S Dollars. We need to confirm from you if it&#39;s
really true that you are dead and If we did not hear from you it
automatically means that you are actually dead and the information
passed to us by Mrs Shelly Gligor and Paul Harris are correct.You are
to contact me as soon as you receive this message so as to know the
true position of things with you so that we would not make any mistake
in remitting your out-standing payment to a wrong person/account.

Please contact us immediately if you know you did not authorize anyone
to claim your Fund

Your urgent response will help our management a lot. Do email me with
your

1.Full names
2.Your age
3.occupation
4.Direct Cell Number for an easy communication to this effect.

Regards
Barr. Anna Paula

Google Forms: Create and analyze surveys.