by andyve
Sun Apr 04, 2021 2:03 pm
"Thomas Morris" scam strikes again, using the same YouTube video in their email
The email asks to send further questions to [email protected]
The domain thomasrep.com seems to be owned by the scammer themselves, judging by the "info" username in the email
Also, WHOIS service shows that the domain owner email is @withheldforprivacy.com for anonymity
I sent a question to [email protected], but the scammer replied from a third email - [email protected], asking me to provide personal information to receive the prize
First "invitation" email
From: Thomas Morris Family <[email protected]>
Date: Mon 29 Mar 2021 at 03:18
Subject: My Donation Gift of 7-million dollars
To:
Second email, asking for personal info
Original email server messages
First email
Second email
The email asks to send further questions to [email protected]
The domain thomasrep.com seems to be owned by the scammer themselves, judging by the "info" username in the email
Also, WHOIS service shows that the domain owner email is @withheldforprivacy.com for anonymity
I sent a question to [email protected], but the scammer replied from a third email - [email protected], asking me to provide personal information to receive the prize
First "invitation" email
From: Thomas Morris Family <[email protected]>
Date: Mon 29 Mar 2021 at 03:18
Subject: My Donation Gift of 7-million dollars
To:
We have a donation gift of 7 million dollars for you to support the COVID-19
pandemic, from our Power Ball Lottery Winning. If you are interested, reply
back for more details. Email; [email protected]
WATCH US ON YOU-TUBE CHANNEL:
https://www.youtube.com/watch?v=2sZs7YZ ... e=youtu.be
We hope to hear from you soon.
Best Regards
Thomas & Kathleen Morris.
Second email, asking for personal info
From: Thomas Morris Family <[email protected]>
Date: Wed, 31 Mar 2021 at 03:19
Subject: Thank you for your correspondence
To: <redacted>
My Dear Beloved,
Thank you for your correspondence, please do not be bothered as to why you have been contacted for these charitable gestures, both I and my wife has done this from a pure motive, our purpose regarding this gesture is to be of immense blessing to people most especially the less privilege and the sick ones in the society and to also support the COVID-19 pandemic and to also help fight against other deadly diseases. We cannot continue to amass wealth without giving out or doing charity work because both I and my wife do not know how long we have to live on earth, we are both diagnosed with cancer.
Thank you for your commitment to accept our gift, it's 100% risk-free. My lawyer will take care of the necessary documentation required to perfect the Seven Million dollars to you, and you don't have anything to worry about. My family would love to know more about you, a little about your family background, your financial status, type of work experience that you enjoy doing. PLEASE NOTE, To facilitate the APPROVAL/CLAIM process of the $7,000,000.00 USD by my lawyer to you, the following information about yourself is needed.
1.FULL NAME: 2.CURRENT ADDRESS: 3.OCCUPATION: 4.TELEPHONE NUMBER: 5.PRESENT COUNTRY:
The above information enables my lawyer to proceed with the fund transfer authorization letter, Legally appointing you as the sole beneficiary to the sum of $7,000,000.00 USD approved by Mr.Thomas Morris Family. We will be waiting for your urgent response to proceed with the next step to pay you the $7,000,000.00 USD via bank transfer. The main purpose we are donating these funds is to ensure that our memories live on even after we are long gone due to the lives that will be affected positively through your help as the sole beneficiary of these donation funds.
Thank you in advance for accepting the offer, we are indeed grateful. God bless you and your entire household. Please extend our greetings to your loved ones and family, till we hear back from you again.
Best regardsThomas & Kathleen Morris.
Original email server messages
First email
Code: Select all
Delivered-To: <redacted, just in case>
Received: by 2002:a6b:5017:0:0:0:0:0 with SMTP id e23csp3074630iob;
Sun, 28 Mar 2021 16:18:22 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJxHiFefgCmRuYCW+LgMWjE0zMGDzzr24LYnmpeGIE9m5N7UsbLwVGNyecguG0GmF3KS+nGQ
X-Received: by 2002:a17:90a:7e8b:: with SMTP id j11mr24017419pjl.11.1616973502248;
Sun, 28 Mar 2021 16:18:22 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1616973502; cv=none;
d=google.com; s=arc-20160816;
b=PkC4W5M6dwUj2Ud9jRE4gneQw5A4NLXp52E+Rhf6zqBsF/i+8BSbrqN7HKFS7Nyc4g
jXw8FcQpdTo7SZKRt124OhvzWU/W2crGByitIynjNi3u+MIYHZ9N3WuVZFKBl4oJiPjV
gvVEN6G6faqk+0knnv4+2zF2KzP8eeL3OkAkN/tzUkDfOuRXaO0tLQBQ6Bhb+0Xr/kfR
xQ6FZafxieJx9053Mnv8wJ+1bNj7iF40KRurFyf67X860bfbdLQF9rJGN2/sRLL9JAJ3
SrYziuXGiSnJotO5xjMMkpWRneabCbjUdl2I0w2SnGGR+wsuslwnHy1tRLi7JDxIiK0y
jpnw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=mime-version:message-id:date:subject:reply-to:from;
bh=WpWkSLCBP/82ZpCLRXd0N6f6nmu77U3yJqnbZJxVyIo=;
b=cWbbgmxQAZ2rGOnL2Dsn8/baK0ZVkyJrZCfNdkWL5Vs76GsCtXsbO1s2lD0NNynFEe
vjf0wTlrAiN+JTyA3Ev8E9q3GCNJFkTJTu7lnUVEB40DuUgPrYzuE3asT2GnMFKQWDoX
OkaeFdZXrTwNvbN2gVfrkJwz8p6qZInWORg++7DT/avZewaGJXwVX6XUMwzDaInUWOj4
fP3xyKvqbhVVB0lIctsD/7pFF91rEoIoH07tHpu6OW08FD2atsg5BGqfexMk4TAyl5jd
rEYEoqZ3TOlSke0i2NJ7RPYN8C1fHwohcFoEJ2qe23CRekcxewoMyggY8+LfTJi2Zse6
zcGQ==
ARC-Authentication-Results: i=1; mx.google.com;
spf=neutral (google.com: 140.137.16.43 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Return-Path: <[email protected]>
Received: from relay3.pccu.edu.tw (relay3.pccu.edu.tw. [140.137.16.43])
by mx.google.com with ESMTP id u17si1714632pgf.325.2021.03.28.16.18.09;
Sun, 28 Mar 2021 16:18:22 -0700 (PDT)
Received-SPF: neutral (google.com: 140.137.16.43 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=140.137.16.43;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 140.137.16.43 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Received: from faculty.pccu.edu.tw (staff.pccu.edu.tw [140.137.16.1]) by relay3.pccu.edu.tw (Postfix) with ESMTP id 16E5942949; Mon, 29 Mar 2021 07:14:08 +0800 (CST)
From: Thomas Morris Family <[email protected]>
Reply-To: [email protected]
Subject: My Donation Gift of 7-million dollars
Date: Mon, 29 Mar 2021 07:18:00 +0800
Message-Id: <[email protected]>
X-Mailer: OpenWebMail 2.53
X-OriginatingIP: 102.134.115.193 (ldf2)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
We have a donation gift of 7 million dollars for you to support the COVID-19
pandemic, from our Power Ball Lottery Winning. If you are interested, reply
back for more details. Email; [email protected]
WATCH US ON YOU-TUBE CHANNEL:
https://www.youtube.com/watch?v=2sZs7YZSH1c&feature=youtu.be
We hope to hear from you soon.
Best Regards
Thomas & Kathleen Morris.Second email
Code: Select all
Delivered-To: <redacted>
Received: by 2002:ac2:495e:0:0:0:0:0 with SMTP id o30csp4863449lfi;
Tue, 30 Mar 2021 16:19:18 -0700 (PDT)
X-Received: by 2002:a17:906:6703:: with SMTP id a3mr569096ejp.240.1617146358092;
Tue, 30 Mar 2021 16:19:18 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1617146358; cv=none;
d=google.com; s=arc-20160816;
b=SuLrqKG3vEL+Tz49r4xnLaGfyLjxZ8601psBXAVKqGJHnSGYvUpCD2fTvfLJUsZuRT
NYqNryskZYwG8GpMbkmDjWLePyZIrhsKHM3KPycEV7/DHmnP67+XZflfr04Hzed9oGIT
Uaeq7DUti1rQ5X4EanUk02Y0aXDY+8cTUhmE63ret66YpK3zRm8TJj0UJdJq9NVi8kKD
PQF/HZpVKxZ3oyKryC/WZLGT2fpbeneCpPLix+lGo0xTICsld5QfrbMqbEusX3Ck18GI
VUAZfxYfVKI5YP2z0OvQi0u9hy/oYzcUUdTmXDtbzHtN8elDCy8DrtHr1dhC9zkvmEec
sNwg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=to:subject:message-id:date:from:in-reply-to:references:mime-version
:dkim-signature;
bh=1kHZhN2S6kNhWlBwtIavseWsZLV/cN2cCQQTTDXqh/Y=;
b=Y4PPkn6gJbwZ15qQ2n68BUHeX/fnraELer01ycH9LV/6i+CsUIwHGhAmKStoTXWKPq
nprm99Q2TMlwcPL2KAN9DunPDtchIxcjdIDRtYCmBzUFpcNfnnMPiEM0gcg34hQEg830
fxK31f+aqbbNqYURhKf8Hng9ho6t+jsYrlFoYU9MJdCTSHEtaFTH+d3XRiuQVOuL4Bv4
OawGy1se3esaMqxMj9naubWyH60YfMR+jJlUvvmu7wUe2dc31UKbENa2FegtnH5JbTMd
n1T8AxN+N4AqrVce+QhbM9yhq5uTzEWLjK8GNOOcnkkhIHX/EkBHXQe1eTk32r12YnoR
1sxg==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass [email protected] header.s=20161025 header.b=a3BE0WcF;
spf=pass (google.com: domain of [email protected] designates 209.85.220.41 as permitted sender) [email protected];
dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
Return-Path: <[email protected]>
Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])
by mx.google.com with SMTPS id ho12sor175020ejc.88.2021.03.30.16.19.18
for <redacted>
(Google Transport Security);
Tue, 30 Mar 2021 16:19:18 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;
Authentication-Results: mx.google.com;
dkim=pass [email protected] header.s=20161025 header.b=a3BE0WcF;
spf=pass (google.com: domain of [email protected] designates 209.85.220.41 as permitted sender) [email protected];
dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:references:in-reply-to:from:date:message-id:subject:to;
bh=1kHZhN2S6kNhWlBwtIavseWsZLV/cN2cCQQTTDXqh/Y=;
b=a3BE0WcFjdBVWRudR/XfSid9k7xb53AmUrIzs35TIok9jlCU8iruqGJwOjlshg1+Ew
cPQZvuJbykf9tM8/CcIKExaF9KzxF1wSpyvHbmyx4eqY8fMBCrBYRg5WfpCQAps5MS/d
jJ6cxDO8GiU6r8Lv+cNM12ygToQ3+CSgABeIcjkl0BAVjuX4MtPapoEBIk+ByJPE8rGI
N21FpwGTw1AO5Ze2Em5VZFBFgHBm8MYT45wCeTEDdFnM0TB+DGetC+16YQWxGCId+h7m
R7OpEcsaI/vdp4y2C9P8rcVKoVB0sgyQ5bx17kFyapdPmKQsx3BBdj5GagWay1UYTERD
/MqQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:references:in-reply-to:from:date
:message-id:subject:to;
bh=1kHZhN2S6kNhWlBwtIavseWsZLV/cN2cCQQTTDXqh/Y=;
b=R+iMTCUcQSMYBdFiHdONgrPbjbexamp4EHS/GifvjfFwOkSwa9ELE2CC57gts1MMG0
kEnnZoe69FzjbTB0CS+WqEga2RWuS6eEjvo+NaRuVjySOc0FqXLsiKsudkmPXesewjTu
GDua5TL8HA5RX4GrdYHgcZhkk4z6b6WdAummkLu6okc0VxoP6jgl+G7/PcQtzghnHTSp
y5QczMzZH8quaKMHldxhTFiVhwTxwoJyiJ5PyNiS6M0uC8ruF/CUQnQWEbHFAF3zjd74
eJFoxocXduPvVBjdAtaVwC0LfnMwDf+nF0rqTMo5DjcySytUneHzJB1Hrl6wxyjBAV7R
oEeQ==
X-Gm-Message-State: AOAM531k2G2gZuKksFL1xWh76qAXVY+GwjgtXaJGdoG2y/rhKXgpQjLW pNMzPTIYZcARFQNNyI6+GFF3aGR0ifO/ZGf2cihdcHjbs5/S
X-Google-Smtp-Source: ABdhPJzyMlFiPWcd43K/ln6NQqEsCLgmPiCv6uZN3xh+3TcFUEks4fs3VMp00WGzz+z7HK/hii0F8g7VEEcVQ6KKsdQ=
X-Received: by 2002:a17:906:9501:: with SMTP id u1mr584713ejx.324.1617146357622; Tue, 30 Mar 2021 16:19:17 -0700 (PDT)
MIME-Version: 1.0
References: <CAJvKYKvW9358Tuyxwpbr5E5YYoeoX2mRGg6js49O9WCZJzZf6Q@mail.gmail.com>
In-Reply-To: <CAJvKYKvW9358Tuyxwpbr5E5YYoeoX2mRGg6js49O9WCZJzZf6Q@mail.gmail.com>
From: Thomas Morris Family <[email protected]>
Date: Wed, 31 Mar 2021 00:18:42 +0100
Message-ID: <CAHWckZfKtCLvC83s3aPKozgyow2xP65GgWN71N2ekaCsXSnEKw@mail.gmail.com>
Subject: Thank you for your correspondence
To: <redacted>
Content-Type: multipart/alternative; boundary="000000000000322c2105bec93a5c"
--000000000000322c2105bec93a5c
Content-Type: text/plain; charset="UTF-8"
My Dear Beloved,
Thank you for your correspondence, please do not be bothered as to why you
have been contacted for these charitable gestures, both I and my wife has
done this from a pure motive, our purpose regarding this gesture is to be
of immense blessing to people most especially the less privilege and the
sick ones in the society and to also support the COVID-19 pandemic and to
also help fight against other deadly diseases. We cannot continue to amass
wealth without giving out or doing charity work because both I and my wife
do not know how long we have to live on earth, we are both diagnosed with
cancer.
Thank you for your commitment to accept our gift, it's 100% risk-free. My
lawyer will take care of the necessary documentation required to perfect
the Seven Million dollars to you, and you don't have anything to worry
about. My family would love to know more about you, a little about your
family background, your financial status, type of work experience that you
enjoy doing. PLEASE NOTE, To facilitate the APPROVAL/CLAIM process of the
$7,000,000.00 USD by my lawyer to you, the following information about
yourself is needed.
1.FULL NAME: 2.CURRENT ADDRESS: 3.OCCUPATION: 4.TELEPHONE
NUMBER: 5.PRESENT COUNTRY:
The above information enables my lawyer to proceed with the fund transfer
authorization letter, Legally appointing you as the sole beneficiary to the
sum of $7,000,000.00 USD approved by Mr.Thomas Morris Family. We will be
waiting for your urgent response to proceed with the next step to pay you
the $7,000,000.00 USD via bank transfer. The main purpose we are donating
these funds is to ensure that our memories live on even after we are long
gone due to the lives that will be affected positively through your help as
the sole beneficiary of these donation funds.
Thank you in advance for accepting the offer, we are indeed grateful. God
bless you and your entire household. Please extend our greetings to your
loved ones and family, till we hear back from you again.
Best regards
Thomas & Kathleen Morris.
--000000000000322c2105bec93a5c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div dir=3D"ltr"><div class=3D"gmail-adn gmail-ads" style=
=3D"border-left:none;padding:0px;display:flex;font-family:Roboto,RobotoDraf=
t,Helvetica,Arial,sans-serif;font-size:medium"><div class=3D"gmail-gs" styl=
e=3D"margin:0px;padding:0px 0px 20px;width:950px"><div class=3D"gmail-"><di=
v id=3D"gmail-:341" class=3D"gmail-ii gmail-gt" style=3D"font-size:0.875rem=
;direction:ltr;margin:8px 0px 0px;padding:0px"><div id=3D"gmail-:340" class=
=3D"gmail-a3s gmail-aiL" style=3D"overflow:hidden;font-variant-numeric:norm=
al;font-variant-east-asian:normal;font-stretch:normal;font-size:small;line-=
height:1.5;font-family:Arial,Helvetica,sans-serif"><div dir=3D"ltr"><font f=
ace=3D"verdana, sans-serif"><font style=3D"vertical-align:inherit"><font st=
yle=3D"vertical-align:inherit">My Dear Beloved,=C2=A0</font></font><br><br>=
<font style=3D"vertical-align:inherit"><font style=3D"vertical-align:inheri=
t">=C2=A0Thank you for your correspondence, please do not be bothered as to=
why you have been contacted for these charitable gestures, both I and my w=
ife has done this from a pure motive, our purpose regarding this gesture is=
to be of immense blessing to people most especially the less privilege and=
the sick ones in the society and to also support the=C2=A0COVID-19 pandemi=
c=C2=A0and to also help fight against other=C2=A0deadly diseases.=C2=A0We c=
annot continue to amass wealth without giving out or doing charity work bec=
ause both I and my wife do not know how long we have to live on earth, we a=
re both=C2=A0diagnosed=C2=A0with cancer.</font></font></font><div><font fac=
e=3D"verdana, sans-serif"><br><font style=3D"vertical-align:inherit"><font =
style=3D"vertical-align:inherit">Thank you for your commitment to accept ou=
r gift, it's 100% risk-free. My lawyer will take care of the necessary =
documentation required to perfect the Seven Million dollars to you, and you=
don't have anything to worry about.=C2=A0My family would love to know =
more about=C2=A0you, a=C2=A0little about your family background, your finan=
cial status, type of work experience that you enjoy doing.=C2=A0PLEASE NOTE=
, To facilitate the APPROVAL/CLAIM process of the $7,000,000.00 USD by my l=
awyer to you, the following information about yourself is needed.</font></f=
ont></font></div><div><font face=3D"verdana, sans-serif"><br><font style=3D=
"vertical-align:inherit"><font style=3D"vertical-align:inherit">1.FULL NAME=
:=C2=A0=C2=A02.CURRENT ADDRESS:=C2=A0=C2=A03.OCCUPATION:=C2=A0=C2=A04.</fon=
t></font><font style=3D"vertical-align:inherit"><font style=3D"vertical-ali=
gn:inherit">TELEPHONE NUMBER:=C2=A0=C2=A05.PRESENT COUNTRY:</font></font><b=
r><br><font style=3D"vertical-align:inherit"><font style=3D"vertical-align:=
inherit">=C2=A0The above information enables my lawyer to proceed with the =
fund transfer authorization letter, Legally appointing you as the sole bene=
ficiary to the sum of $7,000,000.00 USD approved by Mr.Thomas Morris Family=
. We will be waiting for your urgent response to proceed with the next step=
=C2=A0to pay you the $7,000,000.00 USD via bank transfer.=C2=A0The main pur=
pose we are donating these funds is to ensure that our memories live on eve=
n after we are long gone due to the lives that will be affected positively =
through your help as the sole beneficiary of these donation funds.=C2=A0</f=
ont></font></font></div><div><font face=3D"verdana, sans-serif"><br><font s=
tyle=3D"vertical-align:inherit"><font style=3D"vertical-align:inherit">Than=
k you in advance for accepting the offer, we are indeed grateful. God bless=
you and your entire household. Please extend our greetings to your loved o=
nes and family, till we hear back from you again.=C2=A0</font></font></font=
></div><div><font face=3D"verdana, sans-serif"><br><font style=3D"vertical-=
align:inherit"><font style=3D"vertical-align:inherit">Best regards</font></=
font></font></div><div><font face=3D"verdana, sans-serif"><font style=3D"ve=
rtical-align:inherit"><font style=3D"vertical-align:inherit">Thomas & K=
athleen Morris.</font></font></font></div></div><div class=3D"gmail-yj6qo">=
</div><div class=3D"gmail-adL"></div></div></div><div class=3D"gmail-hi" st=
yle=3D"border-bottom-left-radius:1px;border-bottom-right-radius:1px;padding=
:0px;width:auto;background:rgb(242,242,242);margin:0px"></div></div></div><=
div class=3D"gmail-ajx" style=3D"clear:both"></div></div><div class=3D"gmai=
l-gA gmail-gt gmail-acV" style=3D"font-size:0.875rem;padding:0px;width:auto=
;border-bottom-left-radius:0px;border-bottom-right-radius:0px;border-top:no=
ne;margin:0px;background-image:initial;background-position:initial;backgrou=
nd-size:initial;background-repeat:initial;background-origin:initial;backgro=
und-clip:initial;font-family:Roboto,RobotoDraft,Helvetica,Arial,sans-serif"=
><div class=3D"gmail-gB gmail-xu" style=3D"border-top:0px;padding:0px"><div=
class=3D"gmail-ip gmail-iq" style=3D"clear:both;margin:0px;padding:16px 0p=
x;border-top:none"><br class=3D"gmail-Apple-interchange-newline"></div></di=
v></div></div><div class=3D"gmail_quote"><blockquote class=3D"gmail_quote" =
style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);pa=
dding-left:1ex">
</blockquote></div></div>
--000000000000322c2105bec93a5c--
Also thomasrep.com seems to be the scammer's server