Nigerian ATM Spam from Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 14 Jun 2022 08:12:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1o17GH-000Nwv-J1
for dave@doctor.nl2k.ab.ca;
Tue, 14 Jun 2022 08:11:17 -0600
Resent-From: The Doctor
Resent-Date: Tue, 14 Jun 2022 08:11:17 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pj1-f48.google.com ([209.85.216.48]:52774)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1o13oX-000ERf-Uf
for root@doctor.nl2k.ab.ca;
Tue, 14 Jun 2022 04:30:29 -0600
Received: by mail-pj1-f48.google.com with SMTP id gd1so8123534pjb.2
for; Tue, 14 Jun 2022 03:30:08 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:reply-to:from:date:message-id:subject:to;
bh=NEEJbfXxn0TjJn5vw0dPGRoxGSJmfr3kYirYCa/E8ag=;
b=fkRpAJcc00/XIFNd0TPArBes5jh63BRklnpeRwlnCCSr4DjzSseaaW8A4rteaoSYsk
1/wwTqXaqL8Viw3ZU8zBvHhLpgjgyoTEotlPV8KJxYXvcD6iTc7Dkf3I17hQo499Ddg8
PEvznYOma0Vsh+jYI/Pc1XtN1u+9yqEFTodTNSEbqIW/E46fVzdAnr2zvJ8Az5m+FVSq
Z4gkP4MV7xW8187bqUWz0PucXAXNOZEd+T4fxEHE3O7sy4qG4CHiuySgviilgVHcPLnH
QcloB1px39ZYmity5sqmTMpicXgaP9DQvlvraJ5S49JtBVztWgs+TKLJFSHs7FYpNXrQ
+MPg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:reply-to:from:date:message-id
:subject:to;
bh=NEEJbfXxn0TjJn5vw0dPGRoxGSJmfr3kYirYCa/E8ag=;
b=usqs72bSymw7TPfUIj+9Fj54Nayc9HDmdDzRKLMGwFmRYyRYNKkdF/1AJkIA5hWYIo
aysPP/jNV3lzo2GWSVs34T458P3e/5ieaWydPgA8Patp2h6PWFxk7IcqNngnzutxBu7v
tiCWnRWusm0cYcHoUjpwzNsExdiNSjqky2rNWd4cO7+yytzwcqyN1XnyaXYUNhQ3bBFi
gQLHxvlZwXwJ/KAf4WsrLpw93wsgYAO6qsG93Oui4VBMz2CEsvnDoaWOxZLxYPLYOndW
d9pi1ZN4g0AyT/vOkTVJ3jvUaOV++3yLgYSmsPCrHM7GWzJLjtZ9yMXPKle2F25CEf4G
QLxA==
X-Gm-Message-State: AJIora+0CFIl/PCuwylxZwCqwT5UE3gAf6LHOqqnVXeR0XQmAH8zkETm
QGy7TDKLzzy7sjWXch1o1WPKuGaoy+hDAw3f+ww=
X-Google-Smtp-Source: AGRyM1v3R/pCTtmRH6NzjjSTPMx4/ow2ArMjQiqo++n/UzTRtelzAs+dMQnkQlgDcVWKnYhCS/T2JSnu5p76RGGzIMM=
X-Received: by 2002:a17:902:6b05:b0:168:ee36:1928 with SMTP id
o5-20020a1709026b0500b00168ee361928mr2232615plk.114.1655202602977; Tue, 14
Jun 2022 03:30:02 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:7022:725:b0:40:cd38:e6b7 with HTTP; Tue, 14 Jun 2022
03:30:02 -0700 (PDT)
Reply-To: officefile_0112@yahoo.co.jp
From: OFFICIAL MESSAGE
Date: Tue, 14 Jun 2022 11:30:02 +0100
Message-ID:
Subject: We officially want to inform you that an ATM Visa Card Valued at $120 Million
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: root@doctor.nl2k.ab.ca
X-Spam_score: 14.1
X-Spam_score_int: 141
X-Spam_bar: ++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Your ATM card is ready now,your contact delivery details
as stated below so that they will proceed with the necessary arrangement
for the delivery your ATM VISA/MASTER CARD. You're Full Name=== Cell Phone
Number=== Whats-app Number=== Your Company names=== Current Home Address===
OCCUPATION=== Country=,City=== Nearest Airport=== Next Of Kin Name=== Next
Email Address=== A [...]
Content analysis details: (14.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.216.48 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[barr.williamsdavis[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[officefile_0112[at]yahoo.co.jp]
2.5 HK_SCAM_N2 BODY: No description available.
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
0.0 HK_SCAM No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
1.5 MONEY_ATM_CARD Lots of money on an ATM card
0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
0.0 FILL_THIS_FORM Fill in a form with personal information
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
2.2 FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 MONEY_FORM Lots of money if you fill out a form
1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 ADVANCE_FEE_2_NEW_FRM_MNY Advance Fee fraud form and lots of
money
Subject: {SPAM?} We officially want to inform you that an ATM Visa Card Valued at $120 Million
X-Antivirus: AVG (VPS 220614-2, 6/14/2022), Inbound message
X-Antivirus-Status: Clean
--
Your ATM card is ready now,your contact delivery details as stated
below so that they will proceed with the necessary arrangement for the
delivery your ATM VISA/MASTER CARD.
You're Full Name===
Cell Phone Number===
Whats-app Number===
Your Company names===
Current Home Address===
OCCUPATION===
Country=,City===
Nearest Airport===
Next Of Kin Name===
Next Email Address===
ANNUAL INCOME===
contact Tony Elumelu, Chairman Email:
tonyelumeluchairman@accountant.com or tonyelumeluchairman@gmail.com,
you shall receive your ATM Card package as soon as possible.
Best regards
Mrs. Chantal Sevo.
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 14 Jun 2022 08:12:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1o17GH-000Nwv-J1
for dave@doctor.nl2k.ab.ca;
Tue, 14 Jun 2022 08:11:17 -0600
Resent-From: The Doctor
Resent-Date: Tue, 14 Jun 2022 08:11:17 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pj1-f48.google.com ([209.85.216.48]:52774)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1o13oX-000ERf-Uf
for root@doctor.nl2k.ab.ca;
Tue, 14 Jun 2022 04:30:29 -0600
Received: by mail-pj1-f48.google.com with SMTP id gd1so8123534pjb.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:reply-to:from:date:message-id:subject:to;
bh=NEEJbfXxn0TjJn5vw0dPGRoxGSJmfr3kYirYCa/E8ag=;
b=fkRpAJcc00/XIFNd0TPArBes5jh63BRklnpeRwlnCCSr4DjzSseaaW8A4rteaoSYsk
1/wwTqXaqL8Viw3ZU8zBvHhLpgjgyoTEotlPV8KJxYXvcD6iTc7Dkf3I17hQo499Ddg8
PEvznYOma0Vsh+jYI/Pc1XtN1u+9yqEFTodTNSEbqIW/E46fVzdAnr2zvJ8Az5m+FVSq
Z4gkP4MV7xW8187bqUWz0PucXAXNOZEd+T4fxEHE3O7sy4qG4CHiuySgviilgVHcPLnH
QcloB1px39ZYmity5sqmTMpicXgaP9DQvlvraJ5S49JtBVztWgs+TKLJFSHs7FYpNXrQ
+MPg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:reply-to:from:date:message-id
:subject:to;
bh=NEEJbfXxn0TjJn5vw0dPGRoxGSJmfr3kYirYCa/E8ag=;
b=usqs72bSymw7TPfUIj+9Fj54Nayc9HDmdDzRKLMGwFmRYyRYNKkdF/1AJkIA5hWYIo
aysPP/jNV3lzo2GWSVs34T458P3e/5ieaWydPgA8Patp2h6PWFxk7IcqNngnzutxBu7v
tiCWnRWusm0cYcHoUjpwzNsExdiNSjqky2rNWd4cO7+yytzwcqyN1XnyaXYUNhQ3bBFi
gQLHxvlZwXwJ/KAf4WsrLpw93wsgYAO6qsG93Oui4VBMz2CEsvnDoaWOxZLxYPLYOndW
d9pi1ZN4g0AyT/vOkTVJ3jvUaOV++3yLgYSmsPCrHM7GWzJLjtZ9yMXPKle2F25CEf4G
QLxA==
X-Gm-Message-State: AJIora+0CFIl/PCuwylxZwCqwT5UE3gAf6LHOqqnVXeR0XQmAH8zkETm
QGy7TDKLzzy7sjWXch1o1WPKuGaoy+hDAw3f+ww=
X-Google-Smtp-Source: AGRyM1v3R/pCTtmRH6NzjjSTPMx4/ow2ArMjQiqo++n/UzTRtelzAs+dMQnkQlgDcVWKnYhCS/T2JSnu5p76RGGzIMM=
X-Received: by 2002:a17:902:6b05:b0:168:ee36:1928 with SMTP id
o5-20020a1709026b0500b00168ee361928mr2232615plk.114.1655202602977; Tue, 14
Jun 2022 03:30:02 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:7022:725:b0:40:cd38:e6b7 with HTTP; Tue, 14 Jun 2022
03:30:02 -0700 (PDT)
Reply-To: officefile_0112@yahoo.co.jp
From: OFFICIAL MESSAGE
Date: Tue, 14 Jun 2022 11:30:02 +0100
Message-ID:
Subject: We officially want to inform you that an ATM Visa Card Valued at $120 Million
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: root@doctor.nl2k.ab.ca
X-Spam_score: 14.1
X-Spam_score_int: 141
X-Spam_bar: ++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Your ATM card is ready now,your contact delivery details
as stated below so that they will proceed with the necessary arrangement
for the delivery your ATM VISA/MASTER CARD. You're Full Name=== Cell Phone
Number=== Whats-app Number=== Your Company names=== Current Home Address===
OCCUPATION=== Country=,City=== Nearest Airport=== Next Of Kin Name=== Next
Email Address=== A [...]
Content analysis details: (14.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.216.48 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[barr.williamsdavis[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[officefile_0112[at]yahoo.co.jp]
2.5 HK_SCAM_N2 BODY: No description available.
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
0.0 HK_SCAM No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
1.5 MONEY_ATM_CARD Lots of money on an ATM card
0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
0.0 FILL_THIS_FORM Fill in a form with personal information
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
2.2 FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 MONEY_FORM Lots of money if you fill out a form
1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 ADVANCE_FEE_2_NEW_FRM_MNY Advance Fee fraud form and lots of
money
Subject: {SPAM?} We officially want to inform you that an ATM Visa Card Valued at $120 Million
X-Antivirus: AVG (VPS 220614-2, 6/14/2022), Inbound message
X-Antivirus-Status: Clean
--
Your ATM card is ready now,your contact delivery details as stated
below so that they will proceed with the necessary arrangement for the
delivery your ATM VISA/MASTER CARD.
You're Full Name===
Cell Phone Number===
Whats-app Number===
Your Company names===
Current Home Address===
OCCUPATION===
Country=,City===
Nearest Airport===
Next Of Kin Name===
Next Email Address===
ANNUAL INCOME===
contact Tony Elumelu, Chairman Email:
tonyelumeluchairman@accountant.com or tonyelumeluchairman@gmail.com,
you shall receive your ATM Card package as soon as possible.
Best regards
Mrs. Chantal Sevo.
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments