Nigerian Gmail spam
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 06 Jun 2022 16:23:01 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1nyL7f-000O0z-EC
for dave@doctor.nl2k.ab.ca;
Mon, 06 Jun 2022 16:22:55 -0600
Resent-From: The Doctor
Resent-Date: Mon, 6 Jun 2022 16:22:55 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pj1-f65.google.com ([209.85.216.65]:33008)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1nyFOE-00086p-1q
for doctor@doctor.nl2k.ab.ca;
Mon, 06 Jun 2022 10:15:42 -0600
Received: by mail-pj1-f65.google.com with SMTP id hv24-20020a17090ae41800b001e33eebdb5dso12043181pjb.0
for; Mon, 06 Jun 2022 09:15:21 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:reply-to:from:date:message-id:subject:to;
bh=OB/0jZdMI5FxsV8Xr78uDS2oc7EGSVOcgylMowijHkM=;
b=aW4M813WvHTE7jqPIs9zCpzHkRvwTFjc6L9m/OdQx3iXj3QZ5DybyBDfWI7qX221ej
hfWAaprmBykLMPRA26dN1ojCspSgiyItaVJiJVssQ0I8k+n/rcgaNYuXNM2piWfMEpLj
oA0CZIjiQirCRqvUF56u8GiDauVvV240/9cADhzCHOBI8OcOGiUhA8a+3w597sIjtOgt
Hw4gfAyCPeS+g15008QQgReoWfFJkBEoF1tZajcNFFoY8CWN4p45SbzkJqF2ZXdsuTyu
9X2uXM43JOhZw+ijPQC49DBbIVvBz9FdE7W/w6WvtBkQlrB7qxCJ/asHw6og8iSPGTdU
hPfQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:reply-to:from:date:message-id
:subject:to;
bh=OB/0jZdMI5FxsV8Xr78uDS2oc7EGSVOcgylMowijHkM=;
b=KbLwzcA5m+Z1/53XoUwtN8X0biqSzeFr1yMj73HlAECJd+UpUhaL6hTpXKIdhs/yjL
jXvZhJtULgw4KQTniZ3MAzXCGENrF6/UpC/ICDskmTVelR/gnNCXN1IoXbk8msTC3nOR
AkO0iHRkw1dmqtzFV+9v9ao0K7ATC6GIb9ojndUOR3TSxsRAOUOnPVWLWKoz8/cp/0Vc
G9JnD9h18qyFe0oMzRTh0c4QGna5BhyU0Dy0J3n9AoNFalSE7DYl0rDcmYTBSc7a9v4U
JUPTqj8MuwZ0hl2mX5oEWLqOBLHM4xpmEEEpLPscybCWb9TnXXJtKpU+3c0e6vIG6Hjf
BrYg==
X-Gm-Message-State: AOAM530j2xxzBqC63f/OwpYrg67bRHxIpUQBe7ySOfsZg35jt4sHthoh
HFp2eWiCm0S/6xUsvIT/rcJZa6u2360evGgRHac=
X-Google-Smtp-Source: ABdhPJxIRnxWYaDswr317oDNTz1TQvsBIduYa288RXs7c3VCKcTRLft75nmtH72O309CW0EvVshsGJcxqQ6iQrUw6t8=
X-Received: by 2002:a17:902:a9c4:b0:15f:90c:12f6 with SMTP id
b4-20020a170902a9c400b0015f090c12f6mr24704185plr.115.1654532115376; Mon, 06
Jun 2022 09:15:15 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6a10:6b05:0:0:0:0 with HTTP; Mon, 6 Jun 2022 09:15:15
-0700 (PDT)
Reply-To: waudbyneil@protonmail.com
From: NEIL WAUDBY
Date: Mon, 6 Jun 2022 17:15:15 +0100
Message-ID:
Subject: FROM ATTORNEY NEIL WAUDBY
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 21.6
X-Spam_score_int: 216
X-Spam_bar: +++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear friend, My name is Barrister N.Waudby of Holloway Chambers.
law firm Nigeria. I have a client (a contractor) who executed a contract
for Nigerian National Petroleum Corporation, NNPC. This corporation control
[...]
Content analysis details: (21.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[hassanbello1961[at]gmail.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.216.65 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[hassanbello1961[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
2.5 HK_SCAM_N2 BODY: No description available.
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
0.0 HK_SCAM No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 MONEY_BARRISTER Lots of money from a UK lawyer
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
0.0 T_MONEY_PERCENT X% of a lot of money for you
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal
information
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: naijagists.com]
Subject: {SPAM?} FROM ATTORNEY NEIL WAUDBY
Dear friend,
My name is Barrister N.Waudby of Holloway Chambers. law firm Nigeria.
I have a client (a contractor) who executed a contract for Nigerian
National Petroleum Corporation, NNPC. This corporation control and
manages the petroleum industry in the country. This my client, Mr. Yu
Wang, an Asian and two of his colleagues died through air crash on
June 6, 2012 in Lagos Nigeria which claimed the lives of all
passengers and crew, 153 in all perished.
The crashed Dana air line had reg. Mark. 5N-RAM. His contract number
is NNPC/FGN/0431/PH/REF/2011 and the amount is USD35.5M. This contract
is turn around maintenance of Port Harcourt refinery Nigeria. He had
received his fund after commissioning of the project and securely
parked USD20,500,000.00 in Access Bank, PLC., with all documents
firmly kept in my chamber hoping to travel back from Abuja to pick
up the funds before his tragic death.
I have searched for his next of kin to hand him over the documents but
to no avail. I therefore seek your permission to use you as the next
of kin to Mr. Yu Wang, and I will legally transfer the next of kinship
to you, with all documents changed to your name as the rightful
beneficiary of this fund.
I will give you more detail information about the fund in Access bank
and direct
you how to apply and claim the fund. If you are interested, I need your full
name, address and telephone numbers. Sharing shall be 70% for us here,
30% for you. We also intend to reinvest our share in your country on
your advice on a better venture. This transaction will cost some money
to procure the requisite documents. I hope you are willing to help
even though I have some money to start off, so we can get it done
quicker.
Please reply as quickly as you can if you are interested.
Kindly view the site of the plane crash,
http://naijagists.com/dana-plane-crash-victims-ncaa-releases-names-pictures-of-recovered-bodies/
Yours truly,
Barrister Neil Waudby
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 06 Jun 2022 16:23:01 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1nyL7f-000O0z-EC
for dave@doctor.nl2k.ab.ca;
Mon, 06 Jun 2022 16:22:55 -0600
Resent-From: The Doctor
Resent-Date: Mon, 6 Jun 2022 16:22:55 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pj1-f65.google.com ([209.85.216.65]:33008)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1nyFOE-00086p-1q
for doctor@doctor.nl2k.ab.ca;
Mon, 06 Jun 2022 10:15:42 -0600
Received: by mail-pj1-f65.google.com with SMTP id hv24-20020a17090ae41800b001e33eebdb5dso12043181pjb.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:reply-to:from:date:message-id:subject:to;
bh=OB/0jZdMI5FxsV8Xr78uDS2oc7EGSVOcgylMowijHkM=;
b=aW4M813WvHTE7jqPIs9zCpzHkRvwTFjc6L9m/OdQx3iXj3QZ5DybyBDfWI7qX221ej
hfWAaprmBykLMPRA26dN1ojCspSgiyItaVJiJVssQ0I8k+n/rcgaNYuXNM2piWfMEpLj
oA0CZIjiQirCRqvUF56u8GiDauVvV240/9cADhzCHOBI8OcOGiUhA8a+3w597sIjtOgt
Hw4gfAyCPeS+g15008QQgReoWfFJkBEoF1tZajcNFFoY8CWN4p45SbzkJqF2ZXdsuTyu
9X2uXM43JOhZw+ijPQC49DBbIVvBz9FdE7W/w6WvtBkQlrB7qxCJ/asHw6og8iSPGTdU
hPfQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:reply-to:from:date:message-id
:subject:to;
bh=OB/0jZdMI5FxsV8Xr78uDS2oc7EGSVOcgylMowijHkM=;
b=KbLwzcA5m+Z1/53XoUwtN8X0biqSzeFr1yMj73HlAECJd+UpUhaL6hTpXKIdhs/yjL
jXvZhJtULgw4KQTniZ3MAzXCGENrF6/UpC/ICDskmTVelR/gnNCXN1IoXbk8msTC3nOR
AkO0iHRkw1dmqtzFV+9v9ao0K7ATC6GIb9ojndUOR3TSxsRAOUOnPVWLWKoz8/cp/0Vc
G9JnD9h18qyFe0oMzRTh0c4QGna5BhyU0Dy0J3n9AoNFalSE7DYl0rDcmYTBSc7a9v4U
JUPTqj8MuwZ0hl2mX5oEWLqOBLHM4xpmEEEpLPscybCWb9TnXXJtKpU+3c0e6vIG6Hjf
BrYg==
X-Gm-Message-State: AOAM530j2xxzBqC63f/OwpYrg67bRHxIpUQBe7ySOfsZg35jt4sHthoh
HFp2eWiCm0S/6xUsvIT/rcJZa6u2360evGgRHac=
X-Google-Smtp-Source: ABdhPJxIRnxWYaDswr317oDNTz1TQvsBIduYa288RXs7c3VCKcTRLft75nmtH72O309CW0EvVshsGJcxqQ6iQrUw6t8=
X-Received: by 2002:a17:902:a9c4:b0:15f:90c:12f6 with SMTP id
b4-20020a170902a9c400b0015f090c12f6mr24704185plr.115.1654532115376; Mon, 06
Jun 2022 09:15:15 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6a10:6b05:0:0:0:0 with HTTP; Mon, 6 Jun 2022 09:15:15
-0700 (PDT)
Reply-To: waudbyneil@protonmail.com
From: NEIL WAUDBY
Date: Mon, 6 Jun 2022 17:15:15 +0100
Message-ID:
Subject: FROM ATTORNEY NEIL WAUDBY
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 21.6
X-Spam_score_int: 216
X-Spam_bar: +++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear friend, My name is Barrister N.Waudby of Holloway Chambers.
law firm Nigeria. I have a client (a contractor) who executed a contract
for Nigerian National Petroleum Corporation, NNPC. This corporation control
[...]
Content analysis details: (21.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[hassanbello1961[at]gmail.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.216.65 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[hassanbello1961[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
2.5 HK_SCAM_N2 BODY: No description available.
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
0.0 HK_SCAM No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 MONEY_BARRISTER Lots of money from a UK lawyer
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
0.0 T_MONEY_PERCENT X% of a lot of money for you
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal
information
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: naijagists.com]
Subject: {SPAM?} FROM ATTORNEY NEIL WAUDBY
Dear friend,
My name is Barrister N.Waudby of Holloway Chambers. law firm Nigeria.
I have a client (a contractor) who executed a contract for Nigerian
National Petroleum Corporation, NNPC. This corporation control and
manages the petroleum industry in the country. This my client, Mr. Yu
Wang, an Asian and two of his colleagues died through air crash on
June 6, 2012 in Lagos Nigeria which claimed the lives of all
passengers and crew, 153 in all perished.
The crashed Dana air line had reg. Mark. 5N-RAM. His contract number
is NNPC/FGN/0431/PH/REF/2011 and the amount is USD35.5M. This contract
is turn around maintenance of Port Harcourt refinery Nigeria. He had
received his fund after commissioning of the project and securely
parked USD20,500,000.00 in Access Bank, PLC., with all documents
firmly kept in my chamber hoping to travel back from Abuja to pick
up the funds before his tragic death.
I have searched for his next of kin to hand him over the documents but
to no avail. I therefore seek your permission to use you as the next
of kin to Mr. Yu Wang, and I will legally transfer the next of kinship
to you, with all documents changed to your name as the rightful
beneficiary of this fund.
I will give you more detail information about the fund in Access bank
and direct
you how to apply and claim the fund. If you are interested, I need your full
name, address and telephone numbers. Sharing shall be 70% for us here,
30% for you. We also intend to reinvest our share in your country on
your advice on a better venture. This transaction will cost some money
to procure the requisite documents. I hope you are willing to help
even though I have some money to start off, so we can get it done
quicker.
Please reply as quickly as you can if you are interested.
Kindly view the site of the plane crash,
http://naijagists.com/dana-plane-crash-victims-ncaa-releases-names-pictures-of-recovered-bodies/
Yours truly,
Barrister Neil Waudby
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments