Nigerian spam from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 18 Feb 2024 14:27:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rbogX-00000000Eq1-3SzJ
for dave@doctor.nl2k.ab.ca;
Sun, 18 Feb 2024 14:26:53 -0700
Resent-From: The Doctor
Resent-Date: Sun, 18 Feb 2024 14:26:53 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ed1-f66.google.com ([209.85.208.66]:56512)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rboJi-00000000Drg-0rvo
for bin@nl2k.ab.ca;
Sun, 18 Feb 2024 14:03:21 -0700
Received: by mail-ed1-f66.google.com with SMTP id 4fb4d7f45d1cf-55a179f5fa1so4946258a12.0
for; Sun, 18 Feb 2024 13:01:23 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1708290077; x=1708894877; darn=nl2k.ab.ca;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=039ibGIjvRGdrKOWEMinUEwaXneZ3vc+KcfmhIPheoQ=;
b=GMvfLgeiJxDLzuI/thBHA0TO+waJc5AtzBwaoowFtthOEXSzXn9H6Wf1cxeNAsQes1
Fy9MxB4hA5PuW0us0omdnU1EVSBvkcOl3G18XLrtymir0hI/7WjncFsbQDd+OeTWTQn/
PviWNjkiudgU5c/V3V4zEKfP/cUNmV289LZxaugaPW1h2I2y8hcAEIK2UMMxVjhMKOv1
aE5RUPSNNLIrbYZCo8L3PvHXhPzxg6LzVsiYu73J6w50IBxC/fDOKbJluER0h6mSpgVF
/N7gfdQJGJJ80xG78wu3pBhwSQYd8rXKJCIkPzNRcn13NrIHlrVdoFOxcZQAOuCu8zBT
u0+g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1708290077; x=1708894877;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=039ibGIjvRGdrKOWEMinUEwaXneZ3vc+KcfmhIPheoQ=;
b=GwoBlXMuMBoNY8aN2RKIwES30/BmwxtPepQh2Apv61eGPdZG0ZdPzkNGcEVotPimpF
ddn/cm9PAESnhFizUtY+bqyATzckCtoh7CL+2a+igaK0atDDPjKxm/OLHyspf91ajrXD
ugox6FVczsVR1+mvOTEZV/U62vL/BmDQiyPnej9kYdACGTmauisT+yRLQVVBBZrL1h6o
a8joCfzfKiOtwu2vzWe4wjJuqYMwUKmafIbfos5NIvDQv2wwzGJioAQtlPrWyCe2lYtS
bzi1DHUW7Ft/4vz5zgItBN3ui8dlnTntXDzsx70jCh/ckyBgkWKbyV6GIe3Z6yle4qdc
J3hQ==
X-Forwarded-Encrypted: i=1; AJvYcCWzZT/loByamhL6b0RT3uHTypeMKfYhRFptvWN4lPuVJ+5qgjhKM0mUfNoSv90yLr7yMvczzaKYshq4UQcwWQ==
X-Gm-Message-State: AOJu0YymqCpl+f9QAwrE7orQRU812YPmHYD7pfJRmNYAzUwV9KzzKB2p
nAdJl3RphkS9YcDwQfrozzQipfh/+LDxxjMswhtddAgZetJwJYnahmiSK/zj1bXBa+gCrj0jHAI
Xfz//hMqet/6ptSPmxvpZYYSjEME=
X-Google-Smtp-Source: AGHT+IEZQAVYk2ypP0Z5GWzlrWs4YzquJZuLw1cQWyT2nJ5m/INKdiOSgfrLOJNdaP7rac2yTl1Awi0QV1UFPh16rhg=
X-Received: by 2002:aa7:d595:0:b0:564:405c:dfa with SMTP id
r21-20020aa7d595000000b00564405c0dfamr2061012edq.17.1708290076893; Sun, 18
Feb 2024 13:01:16 -0800 (PST)
MIME-Version: 1.0
Received: by 2002:a05:7208:6496:b0:7e:544c:b0b8 with HTTP; Sun, 18 Feb 2024
13:01:16 -0800 (PST)
From: Desmond Peter
Date: Sun, 18 Feb 2024 22:01:16 +0100
Message-ID:
Subject: Attention:
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: bin@nl2k.ab.ca
X-Spam_score: 12.3
X-Spam_score_int: 123
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attention: Dear Beneficiary This is to bring to your notice
that we have credited your total sum of $5.500.000.00 USD into an ATM VISA
card and we have deposited it with DHL Express Company to deliver it to you.
We paid all the [...]
Content analysis details: (12.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.208.66 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[dp575496(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[dp575496(at)gmail.com]
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.66 listed in wl.mailspike.net]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLY From and body contain different freemails
2.5 MONEY_NOHTML Lots of money in plain text
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 MONEY_FORM Lots of money if you fill out a form
3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Attention:
Attention: Dear Beneficiary
This is to bring to your notice that we have credited your total sum of
$5.500.000.00 USD into an ATM VISA card and we have deposited it with DHL
Express Company to deliver it to you. We paid all the necessary charges
such as Company registration and delivery fee.
The only money you will send to them is the security keeping charges of your
ATM VISA card $35.00 dollars. We tried to pay that but they complained that
they don't know when you will contact them for the delivery and the demurrage
might have increased by then. I deposited it on 18/02/2024. Therefore, contact
them now with Your:
Your Full Name........
Your Country............
Your City Airport........
Your Home Address........
Telephone Number.........
Gender...................
DHL Express
Email address: deploymentagent711@gmail.com
Tel/+22964083699
I880L0LD35.6KI2.16KwhoissourceRank13.5MPIN0Summary reportDiagnosisDensity00n/a
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 18 Feb 2024 14:27:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rbogX-00000000Eq1-3SzJ
for dave@doctor.nl2k.ab.ca;
Sun, 18 Feb 2024 14:26:53 -0700
Resent-From: The Doctor
Resent-Date: Sun, 18 Feb 2024 14:26:53 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ed1-f66.google.com ([209.85.208.66]:56512)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rboJi-00000000Drg-0rvo
for bin@nl2k.ab.ca;
Sun, 18 Feb 2024 14:03:21 -0700
Received: by mail-ed1-f66.google.com with SMTP id 4fb4d7f45d1cf-55a179f5fa1so4946258a12.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1708290077; x=1708894877; darn=nl2k.ab.ca;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=039ibGIjvRGdrKOWEMinUEwaXneZ3vc+KcfmhIPheoQ=;
b=GMvfLgeiJxDLzuI/thBHA0TO+waJc5AtzBwaoowFtthOEXSzXn9H6Wf1cxeNAsQes1
Fy9MxB4hA5PuW0us0omdnU1EVSBvkcOl3G18XLrtymir0hI/7WjncFsbQDd+OeTWTQn/
PviWNjkiudgU5c/V3V4zEKfP/cUNmV289LZxaugaPW1h2I2y8hcAEIK2UMMxVjhMKOv1
aE5RUPSNNLIrbYZCo8L3PvHXhPzxg6LzVsiYu73J6w50IBxC/fDOKbJluER0h6mSpgVF
/N7gfdQJGJJ80xG78wu3pBhwSQYd8rXKJCIkPzNRcn13NrIHlrVdoFOxcZQAOuCu8zBT
u0+g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1708290077; x=1708894877;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=039ibGIjvRGdrKOWEMinUEwaXneZ3vc+KcfmhIPheoQ=;
b=GwoBlXMuMBoNY8aN2RKIwES30/BmwxtPepQh2Apv61eGPdZG0ZdPzkNGcEVotPimpF
ddn/cm9PAESnhFizUtY+bqyATzckCtoh7CL+2a+igaK0atDDPjKxm/OLHyspf91ajrXD
ugox6FVczsVR1+mvOTEZV/U62vL/BmDQiyPnej9kYdACGTmauisT+yRLQVVBBZrL1h6o
a8joCfzfKiOtwu2vzWe4wjJuqYMwUKmafIbfos5NIvDQv2wwzGJioAQtlPrWyCe2lYtS
bzi1DHUW7Ft/4vz5zgItBN3ui8dlnTntXDzsx70jCh/ckyBgkWKbyV6GIe3Z6yle4qdc
J3hQ==
X-Forwarded-Encrypted: i=1; AJvYcCWzZT/loByamhL6b0RT3uHTypeMKfYhRFptvWN4lPuVJ+5qgjhKM0mUfNoSv90yLr7yMvczzaKYshq4UQcwWQ==
X-Gm-Message-State: AOJu0YymqCpl+f9QAwrE7orQRU812YPmHYD7pfJRmNYAzUwV9KzzKB2p
nAdJl3RphkS9YcDwQfrozzQipfh/+LDxxjMswhtddAgZetJwJYnahmiSK/zj1bXBa+gCrj0jHAI
Xfz//hMqet/6ptSPmxvpZYYSjEME=
X-Google-Smtp-Source: AGHT+IEZQAVYk2ypP0Z5GWzlrWs4YzquJZuLw1cQWyT2nJ5m/INKdiOSgfrLOJNdaP7rac2yTl1Awi0QV1UFPh16rhg=
X-Received: by 2002:aa7:d595:0:b0:564:405c:dfa with SMTP id
r21-20020aa7d595000000b00564405c0dfamr2061012edq.17.1708290076893; Sun, 18
Feb 2024 13:01:16 -0800 (PST)
MIME-Version: 1.0
Received: by 2002:a05:7208:6496:b0:7e:544c:b0b8 with HTTP; Sun, 18 Feb 2024
13:01:16 -0800 (PST)
From: Desmond Peter
Date: Sun, 18 Feb 2024 22:01:16 +0100
Message-ID:
Subject: Attention:
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: bin@nl2k.ab.ca
X-Spam_score: 12.3
X-Spam_score_int: 123
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attention: Dear Beneficiary This is to bring to your notice
that we have credited your total sum of $5.500.000.00 USD into an ATM VISA
card and we have deposited it with DHL Express Company to deliver it to you.
We paid all the [...]
Content analysis details: (12.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.208.66 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[dp575496(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[dp575496(at)gmail.com]
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.66 listed in wl.mailspike.net]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLY From and body contain different freemails
2.5 MONEY_NOHTML Lots of money in plain text
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 MONEY_FORM Lots of money if you fill out a form
3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Attention:
Attention: Dear Beneficiary
This is to bring to your notice that we have credited your total sum of
$5.500.000.00 USD into an ATM VISA card and we have deposited it with DHL
Express Company to deliver it to you. We paid all the necessary charges
such as Company registration and delivery fee.
The only money you will send to them is the security keeping charges of your
ATM VISA card $35.00 dollars. We tried to pay that but they complained that
they don't know when you will contact them for the delivery and the demurrage
might have increased by then. I deposited it on 18/02/2024. Therefore, contact
them now with Your:
Your Full Name........
Your Country............
Your City Airport........
Your Home Address........
Telephone Number.........
Gender...................
DHL Express
Email address: deploymentagent711@gmail.com
Tel/+22964083699
I880L0LD35.6KI2.16KwhoissourceRank13.5MPIN0Summary reportDiagnosisDensity00n/a