Payment spam from Google
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 08 Jul 2022 07:29:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1o9o21-000JNi-Eh
for dave@doctor.nl2k.ab.ca;
Fri, 08 Jul 2022 07:28:29 -0600
Resent-From: The Doctor
Resent-Date: Fri, 8 Jul 2022 07:28:29 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yw1-f194.google.com ([209.85.128.194]:36602)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1o9n0b-000CIv-4f
for www@doctor.nl2k.ab.ca;
Fri, 08 Jul 2022 06:23:01 -0600
Received: by mail-yw1-f194.google.com with SMTP id 00721157ae682-31caffa4a45so124800947b3.3
for; Fri, 08 Jul 2022 05:22:39 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:reply-to:from:date:message-id:subject:to;
bh=6TvO6ltEPc55hdd51dO8QieztisDj+/DK5rZti30QmA=;
b=fkn3KAyRBcHyJ7Gkup5FHX+G/WoQhQ4tb2tN2oKaMXnHTU6EcrtbW5NhEBOmG5A5ie
TAF9sQrqJjmI7W1oWZSRvN7Hb3McchA4ANvglwjsomMjtoZT40rntyXn/HfJFgpHqZMz
fgMg//fJn6eHY2pWIXKapA4/jqCaevy91Slr4oi8VwnYzhFJ/wNfHATwFKlNkseZatX6
6ZneJ8jc/31UCJHEPp4fCYozs60hnCFX3BYSntkNlSzYpSXEk46D0Wxhk77MeD0XpzOf
LvioCWAyo1w0BaWC6mPzW8kaUqwM4TcE1tBdFd8rIpCG2F2ihjoztj5NMVffRiqD8PkG
WL/g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:reply-to:from:date:message-id
:subject:to;
bh=6TvO6ltEPc55hdd51dO8QieztisDj+/DK5rZti30QmA=;
b=dd1YIAoXWlsTPoekLOB4i5ZOEeY/c+mqifmn2pGfYJczHzYLViyMMwblMP3U43vDuc
BwAgHGJElmqoXLnB72WdHYGBaLZ5DUP6pyPCpMg5A+uFSO+jYWVJrBKJGIA5aylebdAv
3ULFknS5/R9k+4YU1Zu4FfHQuf5Tj+DgMUdlnti5jEBBlJdnBt7zaESx3zRiq3PJiUVs
ey08VO/1qFqPR08pCcz8p7vju0oWihB/9Y6xRtNXSO2QJ8UQTNaEC5BkStj1ZJ4bcYTm
ArOobN5EAflvFTktDEqY1SKLefzMaLBKRp5GP2YZKsuv9Eh1gSU8tmmZHEQelwFdUV0I
EduQ==
X-Gm-Message-State: AJIora+s1gbmxXbQbDxM0HyKcMxPjJMEIgZtd/7dIQQpC8ZhPFc6CbYs
4Io1sLFX80YBtwy9wPIVVw+ZJTlN6q1kZ+iI8cQ=
X-Google-Smtp-Source: AGRyM1tmYnAQ57zQ0XvdLo499SXDSlZW/7rD16WbjO3+njLF91/B6zfZ7Jdm2nYlHWzH4uFIYYoA+4nwe6knjNL0+mk=
X-Received: by 2002:a81:1d13:0:b0:31c:f77b:9d27 with SMTP id
d19-20020a811d13000000b0031cf77b9d27mr3690602ywd.514.1657282953647; Fri, 08
Jul 2022 05:22:33 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:7000:4907:0:0:0:0 with HTTP; Fri, 8 Jul 2022 05:22:33
-0700 (PDT)
Reply-To: Westernunionrespond@gmx.com
From: Faso Liza619
Date: Fri, 8 Jul 2022 12:22:33 +0000
Message-ID:
Subject: PAYMENT THROUGH WESTEN UNION
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: www@doctor.nl2k.ab.ca
X-Spam_score: 15.4
X-Spam_score_int: 154
X-Spam_bar: +++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: GREETING:BENEFICIARY You are welcome to Western Union Money
Transfer head office Burkina Faso. Am Barr Liza Faso by name, The new director
of Western Union Foreign Operation.
Content analysis details: (15.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.128.194 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[sawadogobassirou101[at]gmail.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[sawadogobassirou101[at]gmail.com]
2.5 MILLION_USD BODY: Talks about millions of dollars
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.0 MONEY_BARRISTER Lots of money from a UK lawyer
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
Subject: {SPAM?} PAYMENT THROUGH WESTEN UNION
GREETING:BENEFICIARY
You are welcome to Western Union Money Transfer head office Burkina Faso.
Am Barr Liza Faso by name, The new director of Western Union Foreign Operation.
I resumed work today 30th of March 2022 and your daily transfer file
was submitted as pending payment in our western union office and after
my verification, I called the formal Accountant Officer in-charge of
your payment to find out the reason why they are delaying your daily
transfer and he explained that you was unable to activate your daily
installment account fully.
However, I don't know your financial capability at this moment and it
was the reason why I decided to help in this matter just to make it
easy for you to start receiving your daily transfer because I know
that when you receive the total sum $1.5 million usd that you will
definitely compensate me.
I don't want you to lose this fund at this stage after all your
efforts. Most wise people prefer to use this medium western union
money transfer now as the best and reliable means of transfer,Kindly
take control of yourself and leave everything to God because I know
that from now on, you will be the one to say that our lord is good, so
I will advice you to send me your direct phone number because I will
text you the MTCN through SMS and attach other information and send
through your email box, including all documents involve in the
transaction.
For this moment I will be very glad for your quick response by sending
sum of $35.00 so that I will quickly do the needful and finalize
everything within 2:43pm our local time here, I am giving you every
assurance that as soon as I receive the $35.00 that I will activate
your daily installment account and proceed with your first transfer of
$5,000.00 before 2:43pm our local time because I will close once its
5:30pm.
Be aware that all verification's and arrangement involve in this
transfer has being made in your favour. So I need your maximum
co-operation to ensure that strictest confidence is maintained to
avoid any further delay.
Send the $35.00 through Western Union Money Transfer to below
following information and get back to me with copy of the Western
Union slip OK?
Receiver's Name...............
Country.... Burkina Faso
Amount .......$35 USD
I felt pains after going through your payment file and found the
reason why you have not start receiving your fund from this department
and ready to do my utmost to make sure you receive it all OK?
Be rest assured that I will activate your daily installment account
and post your first $5,000 USD for you to pick-up today as soon as we
receive the fee from you today.
email respound. Westernunionrespond@gmx.com
Yours
faithfully,
Barrister Liza Faso
New Managing Director
Western Union Foreign Operation
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 08 Jul 2022 07:29:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1o9o21-000JNi-Eh
for dave@doctor.nl2k.ab.ca;
Fri, 08 Jul 2022 07:28:29 -0600
Resent-From: The Doctor
Resent-Date: Fri, 8 Jul 2022 07:28:29 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yw1-f194.google.com ([209.85.128.194]:36602)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1o9n0b-000CIv-4f
for www@doctor.nl2k.ab.ca;
Fri, 08 Jul 2022 06:23:01 -0600
Received: by mail-yw1-f194.google.com with SMTP id 00721157ae682-31caffa4a45so124800947b3.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:reply-to:from:date:message-id:subject:to;
bh=6TvO6ltEPc55hdd51dO8QieztisDj+/DK5rZti30QmA=;
b=fkn3KAyRBcHyJ7Gkup5FHX+G/WoQhQ4tb2tN2oKaMXnHTU6EcrtbW5NhEBOmG5A5ie
TAF9sQrqJjmI7W1oWZSRvN7Hb3McchA4ANvglwjsomMjtoZT40rntyXn/HfJFgpHqZMz
fgMg//fJn6eHY2pWIXKapA4/jqCaevy91Slr4oi8VwnYzhFJ/wNfHATwFKlNkseZatX6
6ZneJ8jc/31UCJHEPp4fCYozs60hnCFX3BYSntkNlSzYpSXEk46D0Wxhk77MeD0XpzOf
LvioCWAyo1w0BaWC6mPzW8kaUqwM4TcE1tBdFd8rIpCG2F2ihjoztj5NMVffRiqD8PkG
WL/g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:reply-to:from:date:message-id
:subject:to;
bh=6TvO6ltEPc55hdd51dO8QieztisDj+/DK5rZti30QmA=;
b=dd1YIAoXWlsTPoekLOB4i5ZOEeY/c+mqifmn2pGfYJczHzYLViyMMwblMP3U43vDuc
BwAgHGJElmqoXLnB72WdHYGBaLZ5DUP6pyPCpMg5A+uFSO+jYWVJrBKJGIA5aylebdAv
3ULFknS5/R9k+4YU1Zu4FfHQuf5Tj+DgMUdlnti5jEBBlJdnBt7zaESx3zRiq3PJiUVs
ey08VO/1qFqPR08pCcz8p7vju0oWihB/9Y6xRtNXSO2QJ8UQTNaEC5BkStj1ZJ4bcYTm
ArOobN5EAflvFTktDEqY1SKLefzMaLBKRp5GP2YZKsuv9Eh1gSU8tmmZHEQelwFdUV0I
EduQ==
X-Gm-Message-State: AJIora+s1gbmxXbQbDxM0HyKcMxPjJMEIgZtd/7dIQQpC8ZhPFc6CbYs
4Io1sLFX80YBtwy9wPIVVw+ZJTlN6q1kZ+iI8cQ=
X-Google-Smtp-Source: AGRyM1tmYnAQ57zQ0XvdLo499SXDSlZW/7rD16WbjO3+njLF91/B6zfZ7Jdm2nYlHWzH4uFIYYoA+4nwe6knjNL0+mk=
X-Received: by 2002:a81:1d13:0:b0:31c:f77b:9d27 with SMTP id
d19-20020a811d13000000b0031cf77b9d27mr3690602ywd.514.1657282953647; Fri, 08
Jul 2022 05:22:33 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:7000:4907:0:0:0:0 with HTTP; Fri, 8 Jul 2022 05:22:33
-0700 (PDT)
Reply-To: Westernunionrespond@gmx.com
From: Faso Liza619
Date: Fri, 8 Jul 2022 12:22:33 +0000
Message-ID:
Subject: PAYMENT THROUGH WESTEN UNION
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: www@doctor.nl2k.ab.ca
X-Spam_score: 15.4
X-Spam_score_int: 154
X-Spam_bar: +++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: GREETING:BENEFICIARY You are welcome to Western Union Money
Transfer head office Burkina Faso. Am Barr Liza Faso by name, The new director
of Western Union Foreign Operation.
Content analysis details: (15.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.128.194 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[sawadogobassirou101[at]gmail.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[sawadogobassirou101[at]gmail.com]
2.5 MILLION_USD BODY: Talks about millions of dollars
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.0 MONEY_BARRISTER Lots of money from a UK lawyer
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
Subject: {SPAM?} PAYMENT THROUGH WESTEN UNION
GREETING:BENEFICIARY
You are welcome to Western Union Money Transfer head office Burkina Faso.
Am Barr Liza Faso by name, The new director of Western Union Foreign Operation.
I resumed work today 30th of March 2022 and your daily transfer file
was submitted as pending payment in our western union office and after
my verification, I called the formal Accountant Officer in-charge of
your payment to find out the reason why they are delaying your daily
transfer and he explained that you was unable to activate your daily
installment account fully.
However, I don't know your financial capability at this moment and it
was the reason why I decided to help in this matter just to make it
easy for you to start receiving your daily transfer because I know
that when you receive the total sum $1.5 million usd that you will
definitely compensate me.
I don't want you to lose this fund at this stage after all your
efforts. Most wise people prefer to use this medium western union
money transfer now as the best and reliable means of transfer,Kindly
take control of yourself and leave everything to God because I know
that from now on, you will be the one to say that our lord is good, so
I will advice you to send me your direct phone number because I will
text you the MTCN through SMS and attach other information and send
through your email box, including all documents involve in the
transaction.
For this moment I will be very glad for your quick response by sending
sum of $35.00 so that I will quickly do the needful and finalize
everything within 2:43pm our local time here, I am giving you every
assurance that as soon as I receive the $35.00 that I will activate
your daily installment account and proceed with your first transfer of
$5,000.00 before 2:43pm our local time because I will close once its
5:30pm.
Be aware that all verification's and arrangement involve in this
transfer has being made in your favour. So I need your maximum
co-operation to ensure that strictest confidence is maintained to
avoid any further delay.
Send the $35.00 through Western Union Money Transfer to below
following information and get back to me with copy of the Western
Union slip OK?
Receiver's Name...............
Country.... Burkina Faso
Amount .......$35 USD
I felt pains after going through your payment file and found the
reason why you have not start receiving your fund from this department
and ready to do my utmost to make sure you receive it all OK?
Be rest assured that I will activate your daily installment account
and post your first $5,000 USD for you to pick-up today as soon as we
receive the fee from you today.
email respound. Westernunionrespond@gmx.com
Yours
faithfully,
Barrister Liza Faso
New Managing Director
Western Union Foreign Operation