4th of July, FBI, Phishing, Robert Mueller III, and John Stefanidis III

Posted • July 11, 2010 • 1 Comment

The Federal Bureau of Investigation is now using Gmail for their Mail Server! Well Maybe Not…

Do you ever get an Phishing email that just makes you laugh until you realize a percentage of the people receiving it will actually reply to it?

I received just such an email the day before the 4th of July. It is supposed to be from the FBI so I guess the date is appropriate.

The 4th of July Phishing Expedition

From:	FEDERAL BUREAU OF INVESTIGATION <info@fbi.gov>
Subject:	[spam?] RE:MESSAGE FROM (FEDERAL BUREAU OF INVESTIGATION)
Date:	July 3, 2010 6:42:46 AM PDT
To:	golivemod-owner@yahoogroups.com
Reply-To:	govffbi.fff@gmail.com

---

ROBERT MUELLER III
EXECUTIVE DIRECTOR FBI
FEDERAL BUREAU OF INVESTIGATION FBI.WASHINGTON D.C
FEDERAL BUREAU OF INVESTIGATION SEEKING TO WIRETAP
INTERNET

ATTENTION: FUND BENEFICIARY,

IT HAS COME TO OUR NOTICE THAT YOU HAVE BEEN DEALING WITH AN IMPOSTER WHICH WE HAVE BEEN WARNING YOU TO TERMINATE ANY CONTACT WITH.

THIS IS ALSO TO NOTIFY YOU THAT YOUR FUND WILL BE TRANSFER TO YOU THROUGH A NOTABLE BANK IN UNITED STATES (HSBC).

WE ALSO DISCOVERED THAT THE PEOPLE YOU ARE DEALING WITH ARE TRYING EVERY POSSIBLE MEANS FOR YOU TO PAY AN UPFRONT FEE WHICH YOU ARE NOT SUPPOSE TO PAY. THE ONLY FEE WHICH YOU HAVE TO PAY FOR THE CONCLUSION OF YOUR TRANSFER IS THE SUM OF US$100 WHICH THE ACTIVATION FEE AND IT IS MANDATORY. AS SOON AS THE FEE OF US$100 IS BEEN PAID, YOU WILL BE ISSUED A TRANSFER CODE THAT YOU WILL TENDER TO ANY HSBC BRANCH IN UNITED STATES. MAKE SURE YOU CONTACT THE INTERNATIONAL FOREIGN REMITTANCE OF THE CENTRAL BANK OF NIGERIA ON HOW YOU WILL MAKE THE PAYMENT OF US$100 AND THE POSSIBLE DAY TO RECEIVE THE CODE.

CONTACT NAME: MR. HENRY BILL
CONTACT E-MAIL: HWFINANCE@CIUDAD.COM.AR
CONTACT NUMBER: +234-8139461605
OFFICE ADDRESS: 15 AWOLOWO ROAD, IKOYI, LAGOS, NIGERIA

THE FEDERAL BUREAU OF INVESTIGATION (FBI) WASHINGTON, D.C, VEHEMENTLY ADVISE YOU COMPLY WITH THE MANAGEMENT COMPANY IN CHARGE OF YOUR FUND AND ADHERE TO EVERY INSTRUCTION GIVEN TO YOU, FOR SMOOTH AND EASY TRANSACTIONS, YOU’RE HEREBY AUTHORIZE TO CONTACT HENRY COLE VIA THE ABOVE INFORMATION ON HOW YOU’RE TO OBTAIN THE TRANSFER CODE WHICH WILL COST YOU APPROXIMATELY US$100 AND IF YOU’RE ASK TO SEND ANY MORE MONEY ASIDE THE ACTIVATION OF THE TRANSFER CODE, DO NOT HESITATE TO NOTIFY THIS OFFICE FOR SECURITY REASONS..

BEST REGARDS,

JOHN STEFANIDIS III
FEDERAL BUREAU OF INVESTIGATION
J. EDGAR HOOVER BUILDING
935 PENNSYLVANIA AVENUE,
NW WASHINGTON, D.C

More Indications of email Fraud and/or Phishing
Other than the FBI using gmail for their email server there other indications that this email is fake.

Did you pick up on the [spam?] RE:MESSAGE FROM (FEDERAL BUREAU OF INVESTIGATION) in the email title? This means that the message triggered server level spam detection.

To investigate this further you can view the long or full header. There is plenty of information here to let you know why the server tagged this as spam.

Here is just a some of the information available there.

X-Spam-Flag:	YES
X-Spam-Level:	*************
X-Spam-Status:	Yes, score=13.7 required=5.0 tests=ADVANCE_FEE_4_NEW, ADVANCE_FEE_5_NEW,DEAR_BENEFICIARY, DKIM_SIGNED, RAZOR2_CF_RANGE_51_100, RAZOR2_CF_RANGE_E4_51_100, RAZOR2_ CHECK,RCVD_IN_DNSWL_NONE,SUBJ_ALL_CAPS, T_DKIM_INVALID, T_RP_MATCHES_RCVD,UPPERCASE_75_100 autolearn=spam version=3.3.1
X-Spam-Report:	* -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, low * trust * [66.163.168.155 listed in list.dnswl.org] * -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay * domain * 1.6 SUBJ_ALL_CAPS Subject is all capitals * 2.8 DEAR_BENEFICIARY BODY: Dear Beneficiary: * 0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 100] * 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily * valid * 0.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level * above 50% * [cf: 100] * 1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) * 1.2 UPPERCASE_75_100 message body is 75-100% uppercase * 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid * 2.1 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419) * 3.3 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419)

(Post from Search Engine Optimizician.)
I post these phishing emails as a service to my readers.
I also post the entire email just in case someone is using search as a way to check the validity this particular email.

Late,
Gary Pool SEO

Terms related to this post:

Comments