Beneficiary spam from Google
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 05 Aug 2022 17:22:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oK6dJ-000Bxy-9c
for dave@doctor.nl2k.ab.ca;
Fri, 05 Aug 2022 17:21:33 -0600
Resent-From: The Doctor
Resent-Date: Fri, 5 Aug 2022 17:21:33 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-wr1-f48.google.com ([209.85.221.48]:37417)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1oK6AO-0009te-HP
for root@nk.ca;
Fri, 05 Aug 2022 16:51:46 -0600
Received: by mail-wr1-f48.google.com with SMTP id z17so4701743wrq.4
for; Fri, 05 Aug 2022 15:51:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:reply-to:from:date:message-id:subject:to;
bh=oROvtpfjD9ceAZLRNaTLS6SjnHNJkAKjGkw6xTJdiDA=;
b=UyhKPU5QWtnubKM0zjcL7yttSP+6dflnmd0Qx7ZoRdw9as/mSpEQNn9zU6ICnxfZzZ
iLUfKPtGZ2SIP29CuY+xnRnleDYoH1nWtYLKRClnRi606szYfxgrX5hTqO6Hk8yJkyae
MO698qlJn4qXAXg0cXDnPJ9PbLKNCKuwYd2QYHhOHgEKc3cHRewt2zlFrcUV/CN6Amk4
UDEPouaKYozqy8VwKkpixbrXACICzcJT0xnRD5qkOAlJK4qULnj2z+ubRsbLnfLodvTk
fIPo9I4o2Ti0mzamHBkr0r0f9i8bdJgMNJBfv4xv6grhg2vqZG5685Bl7cZPgwiQDQ/I
l2zg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:reply-to:from:date:message-id
:subject:to;
bh=oROvtpfjD9ceAZLRNaTLS6SjnHNJkAKjGkw6xTJdiDA=;
b=fAU1s6KDwG8Dnk3r42WxYybi/e9R+jFufSJ8t6lmKHuiUo7ZR7XiH5aGWbpOfnLOHZ
bGNlKgKyx6E7l++d5fsq2ZesqlPBSovs1Oza89rv6TVIG16EWRB78OzWbjSNOyHwSUY+
r0TT5d2uiHfiz6M1INCAXSuvgSReQnWnuKVV6TrYUX5OqE/pIPgoKjZVxAd6VJ3J360t
k7IkIHqaEwbe172R8GcXtdbJP+mcWsTh/L5kPgp+phD8G7e9Lcg74MvVMDJnRzjAZohf
g1TpqThEfBgkvDeu9J/jNL9RB8NdoiFlXXXrxn130fFkYe67pQP5M7VVInZMRgg3UvOA
bcwg==
X-Gm-Message-State: ACgBeo30DCXmbjd+wMqXIz0CCWjZOEuLLE0JKOCoqP5JG5IuRUCU/bii
j6SJXvJtolfJju7aroBFIsMMQKzh7uvJticBrqA=
X-Google-Smtp-Source: AA6agR5lLXPb8Z2CBGAtydfY7bksvlpO5eyyHVkaDtR41dJ6b3gZM3A/S7WEPLLeFXf9/JSslkYS2uk/J5IhCZAVjRs=
X-Received: by 2002:a05:6000:1704:b0:220:69a7:ec2b with SMTP id
n4-20020a056000170400b0022069a7ec2bmr5695461wrc.436.1659739876362; Fri, 05
Aug 2022 15:51:16 -0700 (PDT)
MIME-Version: 1.0
Reply-To: stephen.acheampong@indamail.hu
From: Stephen Acheampong
Date: Fri, 5 Aug 2022 23:48:20 +0100
Message-ID:
Subject: Your Urgent Reply
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000c01d9305e5864d9f"
Bcc: root@nk.ca
X-Spam_score: 18.2
X-Spam_score_int: 182
X-Spam_bar: ++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attn: Beneficiary Are you alive or dead? We received several
emails from one Mr. Lionel Newman who informed us about the car accident
you were involved in 2 month ago. Mr. Lionel Newman made us understand that
you are [...]
Content analysis details: (18.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.221.48 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[johndagogo4040[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[johndagogo4040[at]gmail.com]
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
2.5 HK_SCAM_N2 BODY: No description available.
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.9 URG_BIZ BODY: Contains urgent matter
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 HK_SCAM No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 LOTTO_DEPT Claims Department
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Your Urgent Reply
--000000000000c01d9305e5864d9f
Content-Type: text/plain; charset="UTF-8"
Attn: Beneficiary
Are you alive or dead? We received several emails from one Mr. Lionel
Newman who informed us about the car accident you were involved in 2 month
ago. Mr. Lionel Newman made us understand that you are in hospital in a
critical situation in coma.
He stated that he is your only living relative and your next of kin who is
to inherit all your properties. He is contacting this office based on your
outstanding payment valid at USD$10,500,000.00 which is deposited with our
bank and requesting that the payment should now be transferred into his own
personal account as he stated below.
Bank Name : Citibank
Bank Address: 388 Greenwich St, New York, NY 10013, USA
Account Name :Lionel Newman
Routing Number: 021000089
Account Number: 5944130210
We request your confirmation before we can process this transfer to
Mr.Lionel Newman bank account so as to avoid releasing your money to the
wrong person because Mr. Lionel Newman is too eager and ready to follow
every instruction to have this money paid into his account.
Kindly reply to this message if you are alive so as to enable us process
the release of the $10.5 million dollars to you.
Waiting to hear from you
Mr. Stephen Acheampong
Foreign Remittance Department
Bank of Africa (Ghana) Ltd .
--000000000000c01d9305e5864d9f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
=3D"ltr" style=3D"box-sizing:border-box">Attn: Beneficiary
sizing:border-box">
ng:border-box">Are you alive or dead? We received several emails from one M=
r. Lionel Newman who informed us about the car accident you were involved i=
n 2 month ago. Mr. Lionel Newman made us understand that you are in hospita=
l in a critical situation in coma.
g:border-box">
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 05 Aug 2022 17:22:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oK6dJ-000Bxy-9c
for dave@doctor.nl2k.ab.ca;
Fri, 05 Aug 2022 17:21:33 -0600
Resent-From: The Doctor
Resent-Date: Fri, 5 Aug 2022 17:21:33 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-wr1-f48.google.com ([209.85.221.48]:37417)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1oK6AO-0009te-HP
for root@nk.ca;
Fri, 05 Aug 2022 16:51:46 -0600
Received: by mail-wr1-f48.google.com with SMTP id z17so4701743wrq.4
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:reply-to:from:date:message-id:subject:to;
bh=oROvtpfjD9ceAZLRNaTLS6SjnHNJkAKjGkw6xTJdiDA=;
b=UyhKPU5QWtnubKM0zjcL7yttSP+6dflnmd0Qx7ZoRdw9as/mSpEQNn9zU6ICnxfZzZ
iLUfKPtGZ2SIP29CuY+xnRnleDYoH1nWtYLKRClnRi606szYfxgrX5hTqO6Hk8yJkyae
MO698qlJn4qXAXg0cXDnPJ9PbLKNCKuwYd2QYHhOHgEKc3cHRewt2zlFrcUV/CN6Amk4
UDEPouaKYozqy8VwKkpixbrXACICzcJT0xnRD5qkOAlJK4qULnj2z+ubRsbLnfLodvTk
fIPo9I4o2Ti0mzamHBkr0r0f9i8bdJgMNJBfv4xv6grhg2vqZG5685Bl7cZPgwiQDQ/I
l2zg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:reply-to:from:date:message-id
:subject:to;
bh=oROvtpfjD9ceAZLRNaTLS6SjnHNJkAKjGkw6xTJdiDA=;
b=fAU1s6KDwG8Dnk3r42WxYybi/e9R+jFufSJ8t6lmKHuiUo7ZR7XiH5aGWbpOfnLOHZ
bGNlKgKyx6E7l++d5fsq2ZesqlPBSovs1Oza89rv6TVIG16EWRB78OzWbjSNOyHwSUY+
r0TT5d2uiHfiz6M1INCAXSuvgSReQnWnuKVV6TrYUX5OqE/pIPgoKjZVxAd6VJ3J360t
k7IkIHqaEwbe172R8GcXtdbJP+mcWsTh/L5kPgp+phD8G7e9Lcg74MvVMDJnRzjAZohf
g1TpqThEfBgkvDeu9J/jNL9RB8NdoiFlXXXrxn130fFkYe67pQP5M7VVInZMRgg3UvOA
bcwg==
X-Gm-Message-State: ACgBeo30DCXmbjd+wMqXIz0CCWjZOEuLLE0JKOCoqP5JG5IuRUCU/bii
j6SJXvJtolfJju7aroBFIsMMQKzh7uvJticBrqA=
X-Google-Smtp-Source: AA6agR5lLXPb8Z2CBGAtydfY7bksvlpO5eyyHVkaDtR41dJ6b3gZM3A/S7WEPLLeFXf9/JSslkYS2uk/J5IhCZAVjRs=
X-Received: by 2002:a05:6000:1704:b0:220:69a7:ec2b with SMTP id
n4-20020a056000170400b0022069a7ec2bmr5695461wrc.436.1659739876362; Fri, 05
Aug 2022 15:51:16 -0700 (PDT)
MIME-Version: 1.0
Reply-To: stephen.acheampong@indamail.hu
From: Stephen Acheampong
Date: Fri, 5 Aug 2022 23:48:20 +0100
Message-ID:
Subject: Your Urgent Reply
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000c01d9305e5864d9f"
Bcc: root@nk.ca
X-Spam_score: 18.2
X-Spam_score_int: 182
X-Spam_bar: ++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attn: Beneficiary Are you alive or dead? We received several
emails from one Mr. Lionel Newman who informed us about the car accident
you were involved in 2 month ago. Mr. Lionel Newman made us understand that
you are [...]
Content analysis details: (18.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.221.48 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[johndagogo4040[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[johndagogo4040[at]gmail.com]
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
2.5 HK_SCAM_N2 BODY: No description available.
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.9 URG_BIZ BODY: Contains urgent matter
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 HK_SCAM No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 LOTTO_DEPT Claims Department
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Your Urgent Reply
--000000000000c01d9305e5864d9f
Content-Type: text/plain; charset="UTF-8"
Attn: Beneficiary
Are you alive or dead? We received several emails from one Mr. Lionel
Newman who informed us about the car accident you were involved in 2 month
ago. Mr. Lionel Newman made us understand that you are in hospital in a
critical situation in coma.
He stated that he is your only living relative and your next of kin who is
to inherit all your properties. He is contacting this office based on your
outstanding payment valid at USD$10,500,000.00 which is deposited with our
bank and requesting that the payment should now be transferred into his own
personal account as he stated below.
Bank Name : Citibank
Bank Address: 388 Greenwich St, New York, NY 10013, USA
Account Name :Lionel Newman
Routing Number: 021000089
Account Number: 5944130210
We request your confirmation before we can process this transfer to
Mr.Lionel Newman bank account so as to avoid releasing your money to the
wrong person because Mr. Lionel Newman is too eager and ready to follow
every instruction to have this money paid into his account.
Kindly reply to this message if you are alive so as to enable us process
the release of the $10.5 million dollars to you.
Waiting to hear from you
Mr. Stephen Acheampong
Foreign Remittance Department
Bank of Africa (Ghana) Ltd .
--000000000000c01d9305e5864d9f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
=3D"ltr" style=3D"box-sizing:border-box">Attn: Beneficiary
sizing:border-box">
<=
br style=3D"box-sizing:border-box">
br style=3D"box-sizing:border-box">
ng:border-box">Are you alive or dead? We received several emails from one M=
r. Lionel Newman who informed us about the car accident you were involved i=
n 2 month ago. Mr. Lionel Newman made us understand that you are in hospita=
l in a critical situation in coma.
g:border-box">
yle=3D"box-sizing:border-box">He stated that he is your only living relativ=
e and your next of kin who is to inherit all your properties. He is contact=
ing this office based on your outstanding payment valid at=C2=A0 USD$10,500=
,000.00 which is deposited with our bank and requesting that the payment sh=
ould now be transferred into his own personal account as he stated below.
div>
g:border-box">
Bank N=
ame : Citibank
ame : Citibank
yle=3D"box-sizing:border-box">Bank Address: 388 Greenwich St, New York, NY =
10013, USA
=3D"box-sizing:border-box">Account Name :Lionel Newman
ng:border-box">
Routi=
ng Number: 021000089
ng Number: 021000089
tr" style=3D"box-sizing:border-box">Account Number: 5944130210
box-sizing:border-box">
x">
sizing:border-box">We request your confirmation before we can process this =
transfer to Mr.Lionel Newman bank account so as to avoid releasing your mon=
ey to the wrong person because Mr. Lionel Newman is too eager and ready to =
follow every instruction to have this money paid into his account.
v dir=3D"ltr" style=3D"box-sizing:border-box">
r-box">
Kindly reply =
to this message if you are alive so as to enable us=C2=A0 process the relea=
se of the $10.5 million dollars to you.
to this message if you are alive so as to enable us=C2=A0 process the relea=
se of the $10.5 million dollars to you.
sizing:border-box">
r" style=3D"box-sizing:border-box">Waiting to hear from you
-sizing:border-box">
=
ing:border-box">Mr. Stephen Acheampong
<=
/div>
Foreign Remittance De=
partment
partment
"box-sizing:border-box">Bank of Africa (Ghana) Ltd .
:border-box">
le=3D"box-sizing:border-box;color:rgb(85,85,85);font-family:Arial,Verdana,H=
elvetica,sans-serif;font-size:14.6667px">
--000000000000c01d9305e5864d9f--