Urgency spam from Google
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 01 Jun 2022 07:47:08 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1nwOgD-000Lvl-4l
for dave@doctor.nl2k.ab.ca;
Wed, 01 Jun 2022 07:46:33 -0600
Resent-From: The Doctor
Resent-Date: Wed, 1 Jun 2022 07:46:33 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ed1-f68.google.com ([209.85.208.68]:42766)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1nwHpf-000K6D-6m
for doctor@nl2k.ab.ca;
Wed, 01 Jun 2022 00:27:55 -0600
Received: by mail-ed1-f68.google.com with SMTP id n28so763181edb.9
for; Tue, 31 May 2022 23:27:34 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:reply-to:from:date:message-id:subject:to
:content-transfer-encoding;
bh=AVqfvoo8fmViyKV5x3F3wkS15GcpCe80nz6urVIk770=;
b=kNL6oRI9idw6ayNSjPDhx4cjya31+t9ApJHWNnV8qsEVN9uDjysYXBoG0QGmJc53St
y9AV843T8/YFoA89iBKiE8rqkMH3o7gdFHbJbdYbuiZGMECH2T8lnd2py2EUkMtQbMDp
5uE5IJkkOikE/ffwrYWL+rNyRqz96SbCTe0qwpCHg3Gzqlszx6lNu0ciyx0Ei0dTFvnu
An68hsWwXzDSdMB42PpAEsSv/yYR1vPIHOQ3nzHcmotFFWnencG2irC4XLloiKJvVc4t
/myooCAHgGf4gXdIuBAUd/d6i8MRctLWWXqr4kAsaY3dDuSX7Du/u8xqPgrtstFTHWjv
OY1g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:reply-to:from:date:message-id
:subject:to:content-transfer-encoding;
bh=AVqfvoo8fmViyKV5x3F3wkS15GcpCe80nz6urVIk770=;
b=5fMgO1/1GGiTAmGWUGuU3SaHT/YT7ketWtCePWWyS+V3C5y1AuMmfeoz17roNt2hy1
z/jo+GPejR8aN58PwP20ZaQE0dAXyixvA9LUbMR6uR4bvPhqbsvpVvIQt1w4hrLr07UM
g40FYdEDmxheSbgFIaRRQMSEh+QEaQTcc0po1ITpiV+BNMLXIO0Ie/B0qgqFoKe4+7+o
cAA5IxgIz2T8AHZcDr3pQHbXOt05Kyy7zTM3zu0KaD/dkWHCVvMkyV1cR2x6JjOBGi/L
KXSCM85p910yA81o5cL2cthdg9iqfk63jzk4OkpQ4WPg0dszj74FP9fKbFiHaKGEfHeb
dx+g==
X-Gm-Message-State: AOAM531efVtMIus7dqfZ4CoW1qlZt3c4Bpbtl2MkHa0PJR3vvqr1Yc+D
HNt+318mjLmY/mFVz2UB55Vvz8hoWhjak9jAa0Q=
X-Google-Smtp-Source: ABdhPJxZSTcZDFomU4kRvrSAMLqfMMDgVJlVOpGiJSkEwcfgzyfrPpaQr15RleS5cv73UlqwV5ahh7bUb99/4L9FdZE=
X-Received: by 2002:a05:6402:500a:b0:42d:d109:b7da with SMTP id
p10-20020a056402500a00b0042dd109b7damr15801564eda.289.1654064847338; Tue, 31
May 2022 23:27:27 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:ab4:a650:0:0:0:0:0 with HTTP; Tue, 31 May 2022 23:27:26
-0700 (PDT)
Reply-To: jamesdidiza@gmail.com
From: "MOW&H"
Date: Wed, 1 Jun 2022 08:27:26 +0200
Message-ID:
Subject: CONTRACT SUM
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Bcc: doctor@nl2k.ab.ca
X-Spam_score: 16.6
X-Spam_score_int: 166
X-Spam_bar: ++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Sir/Ma. My name is Mr. James Didiza" a senior government
official in department of Public Works & Infrastructure here in South Africa,
I am the Chief of Staff in charge for contract awards / execution. also t
[...]
Content analysis details: (16.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[infomo0007[at]gmail.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.68 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[infomo0007[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
2.5 MILLION_USD BODY: Talks about millions of dollars
0.9 URG_BIZ BODY: Contains urgent matter
1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} CONTRACT SUM
Dear Sir/Ma.
My name is Mr. James Didiza" a senior government official in
department of Public Works & Infrastructure here in South Africa, I am
the Chief of Staff in charge for contract awards / execution. also the
supervisor of all contracts in Department Of Public Works &
Infrastructure. In 2019 before the (Pandemic), I personally monitored
and supervised the awarded contracts for supplies of building
materials and constructions of ultra modern shopping malls, low cost
housing units, airports maintenance and Stadiums to Improve the
standard of living in this country, In the Eastern Cape, Western Cape,
Natal and Gauteng provinces here in South Africa.
My colleague and I serving in the board deliberately inflated and over
invoiced the contract sum, leaving an excess of US$30, 000,000.00
(Thirty Million United States Dollars Only). At the completion of the
contracts, the real contract sum was paid to the original contractors,
leaving the excess, which we reported to the Government that it
belonged to the sub-contractor that handled part of the original
contract. But the company we submitted as the beneficiary was
non-existing foreign company, which was a purported attempt by us to
divert the money for our private use. I do not intend to mince words
with you, I have to tell you the truth; this is a deal but completely
risk-free and genuine because the contract has been perfectly and
genuinely executed and completed. It depends on whether you are
interested or not.
Right now this amount is due for payment and is floating in the
treasury not attached to anyone/company. We are only two people who
know the origin of this fund. But we cannot claim it by ourselves
because we are civil servants therefore we are looking for a
trustworthy foreign company / individual whose name can be used to
claim this money for our mutual benefit.
This is strictly a business deal, but it=E2=80=99s completely risk-free and
secure because we will use our official positions to source all the
necessary approvals, official documents and certificates that will
back up the fund to reflect that you/your company genuinely executed
and completed the contract. All necessary arrangements have been put
in place in all the relevant departments for immediate approval of
this payment.
For your co-operation, we have agreed to offer you 2.5% of the entire
amount on conclusion of the transaction while 75% will be for us.
Please if you are interested in this proposal, I want you to respond
immediately through my personal e-mail account stated below for
further information and directives.
This transaction is expected to be completed within 5 or 8 work days
and is highly confidential and discreet. Thank you for your
co-operation. Your urgent reply is awaited through my private email
accounts below.
Best Regards,
Mr. James Didiza.
Private Email: didizasa@gmail.com
(Department Of Public Works)
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 01 Jun 2022 07:47:08 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1nwOgD-000Lvl-4l
for dave@doctor.nl2k.ab.ca;
Wed, 01 Jun 2022 07:46:33 -0600
Resent-From: The Doctor
Resent-Date: Wed, 1 Jun 2022 07:46:33 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ed1-f68.google.com ([209.85.208.68]:42766)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1nwHpf-000K6D-6m
for doctor@nl2k.ab.ca;
Wed, 01 Jun 2022 00:27:55 -0600
Received: by mail-ed1-f68.google.com with SMTP id n28so763181edb.9
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:reply-to:from:date:message-id:subject:to
:content-transfer-encoding;
bh=AVqfvoo8fmViyKV5x3F3wkS15GcpCe80nz6urVIk770=;
b=kNL6oRI9idw6ayNSjPDhx4cjya31+t9ApJHWNnV8qsEVN9uDjysYXBoG0QGmJc53St
y9AV843T8/YFoA89iBKiE8rqkMH3o7gdFHbJbdYbuiZGMECH2T8lnd2py2EUkMtQbMDp
5uE5IJkkOikE/ffwrYWL+rNyRqz96SbCTe0qwpCHg3Gzqlszx6lNu0ciyx0Ei0dTFvnu
An68hsWwXzDSdMB42PpAEsSv/yYR1vPIHOQ3nzHcmotFFWnencG2irC4XLloiKJvVc4t
/myooCAHgGf4gXdIuBAUd/d6i8MRctLWWXqr4kAsaY3dDuSX7Du/u8xqPgrtstFTHWjv
OY1g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:reply-to:from:date:message-id
:subject:to:content-transfer-encoding;
bh=AVqfvoo8fmViyKV5x3F3wkS15GcpCe80nz6urVIk770=;
b=5fMgO1/1GGiTAmGWUGuU3SaHT/YT7ketWtCePWWyS+V3C5y1AuMmfeoz17roNt2hy1
z/jo+GPejR8aN58PwP20ZaQE0dAXyixvA9LUbMR6uR4bvPhqbsvpVvIQt1w4hrLr07UM
g40FYdEDmxheSbgFIaRRQMSEh+QEaQTcc0po1ITpiV+BNMLXIO0Ie/B0qgqFoKe4+7+o
cAA5IxgIz2T8AHZcDr3pQHbXOt05Kyy7zTM3zu0KaD/dkWHCVvMkyV1cR2x6JjOBGi/L
KXSCM85p910yA81o5cL2cthdg9iqfk63jzk4OkpQ4WPg0dszj74FP9fKbFiHaKGEfHeb
dx+g==
X-Gm-Message-State: AOAM531efVtMIus7dqfZ4CoW1qlZt3c4Bpbtl2MkHa0PJR3vvqr1Yc+D
HNt+318mjLmY/mFVz2UB55Vvz8hoWhjak9jAa0Q=
X-Google-Smtp-Source: ABdhPJxZSTcZDFomU4kRvrSAMLqfMMDgVJlVOpGiJSkEwcfgzyfrPpaQr15RleS5cv73UlqwV5ahh7bUb99/4L9FdZE=
X-Received: by 2002:a05:6402:500a:b0:42d:d109:b7da with SMTP id
p10-20020a056402500a00b0042dd109b7damr15801564eda.289.1654064847338; Tue, 31
May 2022 23:27:27 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:ab4:a650:0:0:0:0:0 with HTTP; Tue, 31 May 2022 23:27:26
-0700 (PDT)
Reply-To: jamesdidiza@gmail.com
From: "MOW&H"
Date: Wed, 1 Jun 2022 08:27:26 +0200
Message-ID:
Subject: CONTRACT SUM
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Bcc: doctor@nl2k.ab.ca
X-Spam_score: 16.6
X-Spam_score_int: 166
X-Spam_bar: ++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Sir/Ma. My name is Mr. James Didiza" a senior government
official in department of Public Works & Infrastructure here in South Africa,
I am the Chief of Staff in charge for contract awards / execution. also t
[...]
Content analysis details: (16.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[infomo0007[at]gmail.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.68 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[infomo0007[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
2.5 MILLION_USD BODY: Talks about millions of dollars
0.9 URG_BIZ BODY: Contains urgent matter
1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} CONTRACT SUM
Dear Sir/Ma.
My name is Mr. James Didiza" a senior government official in
department of Public Works & Infrastructure here in South Africa, I am
the Chief of Staff in charge for contract awards / execution. also the
supervisor of all contracts in Department Of Public Works &
Infrastructure. In 2019 before the (Pandemic), I personally monitored
and supervised the awarded contracts for supplies of building
materials and constructions of ultra modern shopping malls, low cost
housing units, airports maintenance and Stadiums to Improve the
standard of living in this country, In the Eastern Cape, Western Cape,
Natal and Gauteng provinces here in South Africa.
My colleague and I serving in the board deliberately inflated and over
invoiced the contract sum, leaving an excess of US$30, 000,000.00
(Thirty Million United States Dollars Only). At the completion of the
contracts, the real contract sum was paid to the original contractors,
leaving the excess, which we reported to the Government that it
belonged to the sub-contractor that handled part of the original
contract. But the company we submitted as the beneficiary was
non-existing foreign company, which was a purported attempt by us to
divert the money for our private use. I do not intend to mince words
with you, I have to tell you the truth; this is a deal but completely
risk-free and genuine because the contract has been perfectly and
genuinely executed and completed. It depends on whether you are
interested or not.
Right now this amount is due for payment and is floating in the
treasury not attached to anyone/company. We are only two people who
know the origin of this fund. But we cannot claim it by ourselves
because we are civil servants therefore we are looking for a
trustworthy foreign company / individual whose name can be used to
claim this money for our mutual benefit.
This is strictly a business deal, but it=E2=80=99s completely risk-free and
secure because we will use our official positions to source all the
necessary approvals, official documents and certificates that will
back up the fund to reflect that you/your company genuinely executed
and completed the contract. All necessary arrangements have been put
in place in all the relevant departments for immediate approval of
this payment.
For your co-operation, we have agreed to offer you 2.5% of the entire
amount on conclusion of the transaction while 75% will be for us.
Please if you are interested in this proposal, I want you to respond
immediately through my personal e-mail account stated below for
further information and directives.
This transaction is expected to be completed within 5 or 8 work days
and is highly confidential and discreet. Thank you for your
co-operation. Your urgent reply is awaited through my private email
accounts below.
Best Regards,
Mr. James Didiza.
Private Email: didizasa@gmail.com
(Department Of Public Works)
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments