An
Email with the Subject "Important - Secure Bank Documents" was
received in one of Scamdex's honeypot email accounts on Mon, 20 Feb 2017 07:30:46 -0500
and has been classified as a Generic Scam Email.
The sender shows as "Lloyds Bank" <no-reply@lloydsbanksecuredocs.com>.
The email address was probably spoofed. Do not reply to or contact any persons or organizations referenced in
this email, or follow any URLs as you may expose yourself to scammers and, at the very least, you will be
added to their email address lists for spam purposes.
Scam TagCloud
845 600 7143banklloydscheckcontactservicebacsjordansecuresentbank secure bank lloyds bank sincerelyboaachfinancial
NO CHART DATA - EMAIL HAS NOT YET BEEN ANALYSED
Scam Email Headers
This a (redacted) view of the raw email headers of this scam email.
Personally Identifiable Information (PII) has been suppressed, but can be
supplied as received to appropriate investigating or law enforcement agencies on request.
EEEEEstdClass Object
(
[return-path:] => Array
(
[0] =>
[1] =>
)
[delivered-to:] => o7enet@edie.newsblaze.com
[received:] => Array
(
[0] => from edie.newsblaze.comby edie.newsblaze.com (Dovecot) with LMTP id EUWPEXbhqljyKQAApOa+twfor ; Mon, 20 Feb 2017 07:30:46 -0500
[1] => from lloydsbanksecuredocs.com ([159.203.115.143]:38879)by edie.newsblaze.com with esmtp (Exim 4.88)(envelope-from )id 1cfn6w-0002kO-Hofor cell@o7e.net; Mon, 20 Feb 2017 07:30:46 -0500
[2] => by lloydsbanksecuredocs.com id hlbh71amgbo7 for ; Mon, 20 Feb 2017 12:30:22 +0000 (envelope-from )
)
[envelope-to:] => cell@o7e.net
[delivery-date:] => Mon, 20 Feb 2017 07:30:46 -0500
[dkim-signature:] => v=1; a=rsa-sha1; c=relaxed/relaxed; s=key; d=lloydsbanksecuredocs.com;h=Mime-Version:Date:To:Subject:From:Content-Type:Message-ID;bh=2A5QCSDvBthB/Ezkco8AgQ0BY2s=;b=aW9vB5O9/218D63SSBH9h6HBnefl8lxrZCgoKLAX0nwTMRlLzm6COIw8afbfAOtFFA+yC+yLqxaB wZdKu7IPX1PczP5vP3sUodVCAn8FqfAWMXM1DM3fsG+olcIyXloz5qocKAyNJxVuYHmptvua/TfM HNVkJkxo+aqMKNUFByeWb1IQsKRL5RmPazopeCLC+QTZrE6zPT+SsqzA/4WG7Uzed7MYyQMGZ4E/ gVjzBbGJz8J+MNFNPsWPstYykqq0z5leN+qOgZVFpoBYe/d0w1IzhxTMqPuTNeM85K2WBtkrdIaL f8V/X34mvkyj6Pc0l6WSRAhYzF3Fzsl5nIKuvg==
[mime-version:] => 1.0
[date:] => Mon, 20 Feb 2017 12:30:22 +0000
[to:] => cell@o7e.net
[subject:] => Important - Secure Bank Documents
[from:] => "Lloyds Bank"
[content-type:] => multipart/mixed;boundary=861c9ff2bb6b3b000c053e8fe569b779
[message-id:] => <0.0.0.0.1D28B751AEE0A04.3086CCFD@lloydsbanksecuredocs.com>
[x-spam-status:] => No, score=-0.1
[x-spam-score:] => 0
[x-spam-bar:] => /
[x-ham-report:] => Spam detection software, running on the system "edie.newsblaze.com",has NOT identified this incoming email as spam. The originalmessage has been attached to this so you can view it or labelsimilar future email. If you have any questions, seeroot\@localhost for details.Content preview: This message was sent to: cell@o7e.net Lloyds Bank Logo FW: Important BACs documents Please review attached BACs documents and fax it to +44 (0) 845 600 7143. Please note that the Terms and Conditions available below are the Bank's most recently issued versions. Please bear in mind that earlier versions of these Terms and Conditions may apply to your products, depending on when you signed up to the relevant product or when you were last advised of any changes to your Terms and Conditions. If you have any questions regarding which version of the Terms and Conditions apply to your products, please contact your Relationship Manager. [...] Content analysis details: (-0.1 points, 4.5 required) pts rule name description---- ---------------------- ---------------------------------------------------0.0 SPF_HELO_PASS SPF: HELO matches SPF record-0.0 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain 0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror) 0.0 HTML_MESSAGE BODY: HTML included in message 0.0 T_OBFU_DOC_ATTACH BODY: MS Document attachment with generic MIME type-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
[x-spam-flag:] => NO
)
Domain Names used for collecting scam email ("Honeypot email accounts") have been obscured and replaced with the token 'HUN1P0T'
Community Action - SPAM/non-Scam Report
Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this
email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.
Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not
be in our database. Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or
SPAM, via unpublished 'Honeypot' email addresses.
This message was sent to: cell@o7e.net
FW: Important BACs documents
Please review attached BACs documents and fax it to +44 (0) 845 600 7143.
Please note that the Terms and Conditions available below are the Bank's most recently issued versions. Please bear in mind that earlier versions of these Terms and Conditions may apply to your products, depending on when you signed up to the relevant product or when you were last advised of any changes to your Terms and Conditions. If you have any questions regarding which version of the Terms and Conditions apply to your products, please contact your Relationship Manager.
Your sincerely,
Simon Jordan
Senior Manager, Lloyds Bank Cardnet
Calls may be monitored or recorded in case we need to check we have carried out your instructions correctly and to help improve our quality of service.
Lloyds Bank plc. Registered Office: 25 Gresham Street, London EC2V 7HN. Registered in England and Wales no. 2065 Lloyds Bank plc is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority under registration number 119278. We also subscribe to the lending code. Details can be obtained from www.lendingstandardsboard.orguk.
Lloyds Bank plc registered office:
25 Gresham Street,
London EC2V 7HN.
Registered in England and Wales No. 2065.
id: 3cd2fc78-8022d6a8-319d8d7b-e302857d
We may monitor or record telephone calls to check out your instructions correctly and to help us improve the quality of our service. Calls from abroad are charged according to the telephone service provider's published tariff. Not all Telephone Banking services are available 24 hours a day, 7 days a week. Please speak to an adviser for more information.
