Nigerian spam from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 25 Sep 2023 14:11:16 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from)
id 1qkruA-000P4D-27
for dave@doctor.nl2k.ab.ca;
Mon, 25 Sep 2023 14:10:06 -0600
Resent-From: The Doctor
Resent-Date: Mon, 25 Sep 2023 14:10:06 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ej1-f68.google.com ([209.85.218.68]:52566)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from)
id 1qkrjk-000Hsn-04
for doctor@doctor.nl2k.ab.ca;
Mon, 25 Sep 2023 13:59:25 -0600
Received: by mail-ej1-f68.google.com with SMTP id a640c23a62f3a-991c786369cso872601966b.1
for; Mon, 25 Sep 2023 12:57:21 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1695671835; x=1696276635; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=abFzG+D08OLN+Rl309H39Mzrb9Wl0Er16keEr1LjMMM=;
b=M7mMYm3EexiAeGFiv/qOfbuiBN76RDxkw85PA2WfnQQ07TcmafgzJolUHFtQ3/Fs7F
K6yyLE6nmEVLvBlH5HI2zkhESw0Jq6zbvR495vHvrpLSX8TXnNLM9F95aur7pbQYsfXA
+qjUhI6khrVRQB1kW1udX5QTC6S7W4hSVLNvdzQjgZU+3Q7KzRR6ySZnKS0Y/3/vOKg9
4oyuyKV2jDBzKz8w4lGkYmb5nQHVl+x/uEC4hFcAxiMVxNKkAZJL6Cxx8PfpS53mcTvv
xefNiQOXlRxxBLAg7iNmSpNvLK7xFEsNqIHn3jyePRHb2+dsFCHIkKxOPGeaIp19TNbc
VA0Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1695671835; x=1696276635;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=abFzG+D08OLN+Rl309H39Mzrb9Wl0Er16keEr1LjMMM=;
b=N5SVJ+hDip+1oVF0bwrHFhymaYJ3/zIHKRLh7Mb2FaQTR0h/iA1WXC5mIZJ/zgOMhA
vXjONzvUTsQup9EQSRnZkgJtmi0rsyYcAzydrQV6Vwe5IbsTjl3MSGkazSSTnXCr86GN
sb/V59xee0A2bXy78JU3/GDTm0DNdWq/RkEAXL+a0crNtAOXNSSY1kOVGJOzhPikAmc9
MmbIsDKhU++51uboi35FGCZ2e8zFXCD7+6R+Uvg/Kt3uyXH/uTxumjYGPwFV8fa4R3O2
0L0uyJVrZsE+7lOMmoLVWgW2jQHh7Tkn6IWdsn3zXYeXoGAta2QBE5y9CtxtyB5i8PL0
XK8w==
X-Gm-Message-State: AOJu0Yyf670AsriSFaTUZxqq6YoOaYKyoz3SVwCvPrILE34SO8GQoo1o
zoXJOZ6bv106We836z/ufzpbIzxDbqEJP/IL0ts=
X-Google-Smtp-Source: AGHT+IFAnIosU+U75vLgu3xskVQb1CX1eChJSBFxgk0Gd1+tav2azDQUKBa9WhPi1kJGVrjom5LCn1ncWb2ATV4nLbE=
X-Received: by 2002:a17:906:7954:b0:9ae:64b4:18b3 with SMTP id
l20-20020a170906795400b009ae64b418b3mr7738197ejo.37.1695671834869; Mon, 25
Sep 2023 12:57:14 -0700 (PDT)
MIME-Version: 1.0
From: Mensah Attoh
Date: Mon, 25 Sep 2023 21:56:54 +0200
Message-ID:
Subject: Attention Mr David
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000005f84400606345d06"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 9.6
X-Spam_score_int: 96
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attention I received a case file in my chamber concerning
someone from your country claiming to be your cousin to take over your $1.2million
usd and 5kg of gold bars in one of our banks here in Benin Republic. [...]
Content analysis details: (9.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.218.68 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[barr.mmmensahattoh(at)gmail.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.218.68 listed in wl.mailspike.net]
0.9 URG_BIZ BODY: Contains urgent matter
2.5 MILLION_USD BODY: Talks about millions of dollars
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Attention Mr David
X-Antivirus: AVG (VPS 230925-4, 9/25/2023), Inbound message
X-Antivirus-Status: Clean
--0000000000005f84400606345d06
Content-Type: text/plain; charset="UTF-8"
Attention
I received a case file in my chamber concerning someone from your country
claiming to be your cousin to take over your $1.2million usd and 5kg of
gold bars in one of our banks here in Benin Republic. We want you to
confirm for us if you have sent anyone to represent you or become the
beneficiary of your funds. Your urgent response will be appreciated
because your funds are about to be released to him. But our bank wants me
to investigate properly first, if it is true that you truly sent him. Note;
after 5 working days we did not hear from you, we shall release the funds
to him.
Be officially guided and respond accordingly
Best regards
Barr Mensah Attoh
--0000000000005f84400606345d06
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
mily:"Times New Roman","serif"">
e:14pt">Attention =C2=A0
New Roman","serif"">=C2=A0
pan>
New Roman","serif"">I receive=
d a case file in my chamber concerning someone from
your country claiming to be your cousin to take over your $1.2million usd a=
nd
5kg of gold bars in one of our banks here in Benin Republic. We want you to
confirm for us if you have sent anyone to represent you or become the
beneficiary of your funds.=C2=A0 Your urgent response will be appreciated
because your funds are about to be released to him. But our bank wants me t=
o
investigate properly first, if it is true that you truly sent him. Note; af=
ter
5 working days we did not hear from you, we shall release the funds to him.=
New Roman","serif"">Be offici=
ally guided and respond accordingly
New Roman","serif"">Best rega=
rds
New Roman","serif"">Barr Mens=
ah Attoh=C2=A0
--0000000000005f84400606345d06--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 25 Sep 2023 14:11:16 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from
id 1qkruA-000P4D-27
for dave@doctor.nl2k.ab.ca;
Mon, 25 Sep 2023 14:10:06 -0600
Resent-From: The Doctor
Resent-Date: Mon, 25 Sep 2023 14:10:06 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ej1-f68.google.com ([209.85.218.68]:52566)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from
id 1qkrjk-000Hsn-04
for doctor@doctor.nl2k.ab.ca;
Mon, 25 Sep 2023 13:59:25 -0600
Received: by mail-ej1-f68.google.com with SMTP id a640c23a62f3a-991c786369cso872601966b.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1695671835; x=1696276635; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=abFzG+D08OLN+Rl309H39Mzrb9Wl0Er16keEr1LjMMM=;
b=M7mMYm3EexiAeGFiv/qOfbuiBN76RDxkw85PA2WfnQQ07TcmafgzJolUHFtQ3/Fs7F
K6yyLE6nmEVLvBlH5HI2zkhESw0Jq6zbvR495vHvrpLSX8TXnNLM9F95aur7pbQYsfXA
+qjUhI6khrVRQB1kW1udX5QTC6S7W4hSVLNvdzQjgZU+3Q7KzRR6ySZnKS0Y/3/vOKg9
4oyuyKV2jDBzKz8w4lGkYmb5nQHVl+x/uEC4hFcAxiMVxNKkAZJL6Cxx8PfpS53mcTvv
xefNiQOXlRxxBLAg7iNmSpNvLK7xFEsNqIHn3jyePRHb2+dsFCHIkKxOPGeaIp19TNbc
VA0Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1695671835; x=1696276635;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=abFzG+D08OLN+Rl309H39Mzrb9Wl0Er16keEr1LjMMM=;
b=N5SVJ+hDip+1oVF0bwrHFhymaYJ3/zIHKRLh7Mb2FaQTR0h/iA1WXC5mIZJ/zgOMhA
vXjONzvUTsQup9EQSRnZkgJtmi0rsyYcAzydrQV6Vwe5IbsTjl3MSGkazSSTnXCr86GN
sb/V59xee0A2bXy78JU3/GDTm0DNdWq/RkEAXL+a0crNtAOXNSSY1kOVGJOzhPikAmc9
MmbIsDKhU++51uboi35FGCZ2e8zFXCD7+6R+Uvg/Kt3uyXH/uTxumjYGPwFV8fa4R3O2
0L0uyJVrZsE+7lOMmoLVWgW2jQHh7Tkn6IWdsn3zXYeXoGAta2QBE5y9CtxtyB5i8PL0
XK8w==
X-Gm-Message-State: AOJu0Yyf670AsriSFaTUZxqq6YoOaYKyoz3SVwCvPrILE34SO8GQoo1o
zoXJOZ6bv106We836z/ufzpbIzxDbqEJP/IL0ts=
X-Google-Smtp-Source: AGHT+IFAnIosU+U75vLgu3xskVQb1CX1eChJSBFxgk0Gd1+tav2azDQUKBa9WhPi1kJGVrjom5LCn1ncWb2ATV4nLbE=
X-Received: by 2002:a17:906:7954:b0:9ae:64b4:18b3 with SMTP id
l20-20020a170906795400b009ae64b418b3mr7738197ejo.37.1695671834869; Mon, 25
Sep 2023 12:57:14 -0700 (PDT)
MIME-Version: 1.0
From: Mensah Attoh
Date: Mon, 25 Sep 2023 21:56:54 +0200
Message-ID:
Subject: Attention Mr David
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000005f84400606345d06"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 9.6
X-Spam_score_int: 96
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attention I received a case file in my chamber concerning
someone from your country claiming to be your cousin to take over your $1.2million
usd and 5kg of gold bars in one of our banks here in Benin Republic. [...]
Content analysis details: (9.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.218.68 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[barr.mmmensahattoh(at)gmail.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.218.68 listed in wl.mailspike.net]
0.9 URG_BIZ BODY: Contains urgent matter
2.5 MILLION_USD BODY: Talks about millions of dollars
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Attention Mr David
X-Antivirus: AVG (VPS 230925-4, 9/25/2023), Inbound message
X-Antivirus-Status: Clean
--0000000000005f84400606345d06
Content-Type: text/plain; charset="UTF-8"
Attention
I received a case file in my chamber concerning someone from your country
claiming to be your cousin to take over your $1.2million usd and 5kg of
gold bars in one of our banks here in Benin Republic. We want you to
confirm for us if you have sent anyone to represent you or become the
beneficiary of your funds. Your urgent response will be appreciated
because your funds are about to be released to him. But our bank wants me
to investigate properly first, if it is true that you truly sent him. Note;
after 5 working days we did not hear from you, we shall release the funds
to him.
Be officially guided and respond accordingly
Best regards
Barr Mensah Attoh
--0000000000005f84400606345d06
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
mily:"Times New Roman","serif"">
e:14pt">Attention =C2=A0
New Roman","serif"">=C2=A0
pan>
New Roman","serif"">I receive=
d a case file in my chamber concerning someone from
your country claiming to be your cousin to take over your $1.2million usd a=
nd
5kg of gold bars in one of our banks here in Benin Republic. We want you to
confirm for us if you have sent anyone to represent you or become the
beneficiary of your funds.=C2=A0 Your urgent response will be appreciated
because your funds are about to be released to him. But our bank wants me t=
o
investigate properly first, if it is true that you truly sent him. Note; af=
ter
5 working days we did not hear from you, we shall release the funds to him.=
New Roman","serif"">Be offici=
ally guided and respond accordingly
New Roman","serif"">Best rega=
rds
New Roman","serif"">Barr Mens=
ah Attoh=C2=A0
--0000000000005f84400606345d06--
![](3D"https://images.drmerge.com/logo.png?63d6cc2b-130c-49ff-b339-d17=<br){kind=logo}
![](3D"https://lh6.googleusercontent.com/sx1sKZi2kZQa-zrOu=<br)
![](3D"https://lh4.googleusercontent.com/najFqv3VTuJsEkX--c5nH3=<br)