Return-Path: <dailyclaims_noreply@discovery.co.za>
Delivered-To: govancoz+spam@zacp120.webway.host
Received: from zacp120.webway.host
	by zacp120.webway.host with LMTP
	id AK9PKUmccmjfCAMA8rC0kQ
	(envelope-from <dailyclaims_noreply@discovery.co.za>)
	for <govancoz+spam@zacp120.webway.host>; Sat, 12 Jul 2025 19:32:57 +0200
Return-path: <dailyclaims_noreply@discovery.co.za>
Envelope-to: helen@govan.co.za
Delivery-date: Sat, 12 Jul 2025 19:32:57 +0200
Received: from [147.124.214.198] (port=62509 helo=discovery.co.za)
	by zacp120.webway.host with esmtp (Exim 4.98.2)
	(envelope-from <dailyclaims_noreply@discovery.co.za>)
	id 1uae5p-00000000sWE-2Fdr
	for helen@govan.co.za;
	Sat, 12 Jul 2025 19:32:57 +0200
From: Financial Intelligence Unit <paulreilly.payments@accountant.com>
To: helen@govan.co.za
Date: 12 Jul 2025 10:32:12 -0700
Message-ID: <20250712103211.459EDBB6EBF8004A@accountant.com>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
X-Spam-Status: Yes, score=20.4
X-Spam-Score: 204
X-Spam-Bar: ++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "zacp120.webway.host",
 has identified this incoming email as possible spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 root\@localhost for details.
 Content preview:  Dear helen@govan.co.za We hope this message finds you well.
    
 Content analysis details:   (20.4 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
             [Blocked - see <https://www.spamcop.net/bl.shtml?147.124.214.198>]
  2.7 RCVD_IN_PSBL           RBL: Received via a relay in PSBL
                             [147.124.214.198 listed in psbl.surriel.com]
  4.7 RCVD_IN_XBL            RBL: Received via a relay in Spamhaus XBL
                             [147.124.214.198 listed in zen.spamhaus.org]
  0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
                              Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                           [147.124.214.198 listed in bl.score.senderscore.com]
  0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
                             query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                        [147.124.214.198 listed in sa-trusted.bondedsender.org]
  0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
                              Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [147.124.214.198 listed in sa-accredit.habeas.com]
  4.0 SPF_HELO_FAIL          SPF: HELO does not match SPF record (fail)
 [SPF failed: Please see http://www.openspf.org/Why?s=helo;id=discovery.co.za;ip=147.124.214.198;r=zacp120.webway.host]
  4.0 SPF_FAIL               SPF: sender does not match SPF record (fail)
 [SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=dailyclaims_noreply%40discovery.co.za;ip=147.124.214.198;r=zacp120.webway.host]
  0.0 KAM_DMARC_STATUS       Test Rule for DKIM or SPF Failure with Strict
                             Alignment
  1.5 KAM_DMARC_QUARANTINE   DKIM has Failed or SPF has failed on the message
                              and the domain has a DMARC quarantine policy
  0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail provider
                             [paulreilly.payments(at)accountant.com]
  0.1 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
                             domains are different
  0.0 HTML_MESSAGE           BODY: HTML included in message
  0.1 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
  2.0 RDNS_NONE              Delivered to internal network by a host with no rDNS
  0.0 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom
                              freemail headers are different
  0.0 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS
  0.0 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML only
  0.0 SPOOFED_FREEMAIL       No description available.
X-Spam-Flag: YES
Subject:  ***SPAM***  =?UTF-8?B?Tm90aWZpY2F0aW9uIG9mIFJlZnVuZCBhbmQgQ29tcGVuc2F0aW9uIOKAkyBGcmF1ZCBWaWN0aW0gU3VwcG9ydA==?=

<!DOCTYPE HTML>

<html><head><title></title>
<meta http-equiv=3D"X-UA-Compatible" content=3D"IE=3Dedge">
</head>
<body style=3D"margin: 0.4em;">
<p style=3D"color: rgb(34, 34, 34); text-transform: none; text-indent: 0px;=
 letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=
ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=
pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =
font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=
oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =
initial; text-decoration-color: initial;">
Dear helen@govan.co.za</p><p style=3D"color: rgb(34, 34, 34); text-transfor=
m: none; text-indent: 0px; letter-spacing: normal; font-family: Arial, Helv=
etica, sans-serif; font-size: small; font-style: normal; font-weight: 400; =
word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; font-variant=
-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0=
px; text-decoration-thickness: initial; text-decoration-style: initial; tex=
t-decoration-color: initial;">
We hope this message finds you well.</p><p style=3D"color: rgb(34, 34, 34);=
 text-transform: none; text-indent: 0px; letter-spacing: normal; font-famil=
y: Arial, Helvetica, sans-serif; font-size: small; font-style: normal; font=
-weight: 400; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2=
; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-s=
troke-width: 0px; text-decoration-thickness: initial; text-decoration-style=
: initial; text-decoration-color: initial;">
Following a thorough investigation conducted by the Financial Intelligence =
Unit, it has been conclusively determined that you were a victim of fraud o=
r attempted fraud. We recognize the emotional and financial hardship this m=
ay have caused and extend our sincere support during this time.</p>
<p style=3D"color: rgb(34, 34, 34); text-transform: none; text-indent: 0px;=
 letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=
ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=
pace: normal; orphans: 2; widows: 2; font-variant-ligatures: normal; font-v=
ariant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickn=
ess: initial; text-decoration-style: initial; text-decoration-color: initia=
l;">
As part of our commitment to assist affected individuals, we are pleased to=
 inform you that a compensation award in the amount of<span>&nbsp;</span><s=
trong>R980,000</strong><span>&nbsp;</span>has been approved in your favor. =
This compensation is intended to aid your financial recovery and provide re=
lief from the distressing circumstances you have endured.</p>
<p style=3D"color: rgb(34, 34, 34); text-transform: none; text-indent: 0px;=
 letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=
ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=
pace: normal; orphans: 2; widows: 2; font-variant-ligatures: normal; font-v=
ariant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickn=
ess: initial; text-decoration-style: initial; text-decoration-color: initia=
l;">The full amount will be disbursed as a<span>
&nbsp;</span><strong>lump sum within 14 business days</strong>, delivered v=
ia a MasterCard issued in your name for your convenience and security.</p>
<p style=3D"color: rgb(34, 34, 34); text-transform: none; text-indent: 0px;=
 letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=
ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=
pace: normal; orphans: 2; widows: 2; font-variant-ligatures: normal; font-v=
ariant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickn=
ess: initial; text-decoration-style: initial; text-decoration-color: initia=
l;">
To proceed with your claim and receive further details, please reply to thi=
s email immediately.</p>
<p style=3D"color: rgb(34, 34, 34); text-transform: none; text-indent: 0px;=
 letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=
ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=
pace: normal; orphans: 2; widows: 2; font-variant-ligatures: normal; font-v=
ariant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickn=
ess: initial; text-decoration-style: initial; text-decoration-color: initia=
l;"><b>PAUL REILLY</b><br>
Client Relationship Officer<br>Financial Crimes Enforcement Network<br>1003=
 Chain Bridge Road, Vienna, VA 22182, USA</p>
<p style=3D"color: rgb(34, 34, 34); text-transform: none; text-indent: 0px;=
 letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=
ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=
pace: normal; orphans: 2; widows: 2; font-variant-ligatures: normal; font-v=
ariant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickn=
ess: initial; text-decoration-style: initial; text-decoration-color: initia=
l;">Sincerely,<br><strong>
Financial Crimes Enforcement Network (FinCEN)</strong></p><p>
</p>


</body></html>