Payment notification phish from Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 13 Sep 2022 16:17:03 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oYECw-000II7-Qf
for dave@doctor.nl2k.ab.ca;
Tue, 13 Sep 2022 16:16:42 -0600
Resent-From: The Doctor
Resent-Date: Tue, 13 Sep 2022 16:16:42 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-lj1-f173.google.com ([209.85.208.173]:39835)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1oY72F-000Fwa-KP
for doctor@doctor.nl2k.ab.ca;
Tue, 13 Sep 2022 08:37:15 -0600
Received: by mail-lj1-f173.google.com with SMTP id bn9so14614658ljb.6
for; Tue, 13 Sep 2022 07:36:54 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date;
bh=vKviBlZv651C2CBIglhJWRvpj0ix94yf4EcyIqcdlf8=;
b=Yx57GIyh9ZROGLI0wLAWhLFttHJ/LNUrBDDrFgonryKUE/KZsVr2jJmwdhai0bpQpR
V4WortqgqGDCxmcGmLCIVmEFOK6LFH2mncUfMxcKxxVhSFiE708OoZLao4nRHSUZ/tYR
PByVZHSTteOaHws39r8r+GUe+SiXbHXrWnztJmlPskYFI38KxcJt895YiikIyZ+Lriqe
qWATHecejIs9l32shU7akaolgjeHzRGpbbGu6MHndXwW0jQnJovdaReinoOTmGNPcwvl
bGsOq/gg4PieHpa+p01F+yC74oy57SwbKDor7le7J/MhbUzk6R03zME7dY2AQdDmvuut
iTRg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date;
bh=vKviBlZv651C2CBIglhJWRvpj0ix94yf4EcyIqcdlf8=;
b=nSW0gP7vPBH6crceIT+tOFI0Gz3CeLQwR0uT58nlSd7xejBVBnf/qMazFXU3vT6Lfz
0i8zb4Iib0bMWL0jWbdnXPNrLMsYphKZ+iq4to/f+hTH6ScJBWBMzc8xiwZ6wtoM4gbL
UBEpQ5n+HNebcNAwbJlJpkziEAuBrgfozcOb+6h3oL4x7RLb9ukVaPMzt1S7v2W8gIXS
9q4mXaRAysWLG6hfUDnxbJEZT+87uF8nr5MpWbM5jZep+dBOiUzl6K/eYvS7QxlowaDk
PktZDw5Ts6ehSTFC7JBUHnSIsEMGWD/yChq/iHkWkJ10KandN9vkWFUBSkIOtQb/IiwW
4zQw==
X-Gm-Message-State: ACgBeo0BGnKmt9V2FVZZm9WxruPX2WTGn/khgQLF6nP09rOrDEFLwG23
23kf3lEWAF9b04u+D7raqfmknz/U7id8VYvPCis=
X-Google-Smtp-Source: AA6agR7Lh19m3DC8ovfsFfMAwm0yPWdDABJykz2al/sgvodQx6C68MbLoV3GRM/lAq9dPv33pIKSBv+den+DTcBITs8=
X-Received: by 2002:a2e:a887:0:b0:25e:3174:fb67 with SMTP id
m7-20020a2ea887000000b0025e3174fb67mr8855615ljq.337.1663079807389; Tue, 13
Sep 2022 07:36:47 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6504:644:b0:1db:dc8f:5313 with HTTP; Tue, 13 Sep 2022
07:36:46 -0700 (PDT)
Reply-To: emefiele.centrabankofnig@gmail.com
From: "Pro.Godwin Emefiele"
Date: Tue, 13 Sep 2022 15:36:46 +0100
Message-ID:
Subject: 2022 SECOND QUARTER PAYMENT NOTIFICATION
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 19.0
X-Spam_score_int: 190
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Central International Bank PLC ATM Visa/Swift Card Unit, Attn.
Fund Beneficiary, This note is a reminder that the President through the
office of Federal Ministry Of Finance and the Central Bank of Nigeria has
approved the Release of your fund (10M) Million United States Dollars o [...]
Content analysis details: (19.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.173 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[paulmonti.miami[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
1.6 SUBJ_ALL_CAPS Subject is all capitals
2.5 MILLION_USD BODY: Talks about millions of dollars
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
1.5 MONEY_ATM_CARD Lots of money on an ATM card
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal
information
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
1.5 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
Subject: {SPAM?} 2022 SECOND QUARTER PAYMENT NOTIFICATION
Central International Bank PLC
ATM Visa/Swift Card Unit,
Attn. Fund Beneficiary,
This note is a reminder that the President through the office of
Federal Ministry Of Finance and the Central Bank of Nigeria has
approved the Release of your fund (10M) Million United States Dollars
only, through ATM CARD. This method is necessary to avoid
suppression,You are Required to send to us your details information
for process
1) Your: Full Name===================
2) Your: Full Address================
3) Your: contact telephone and fax number;=====
4) Your: Age and Profession;=========
5) Your:Copy of any valid form of your Identification;===
6) Your:Marital status===========
This information will enable our IT unit and customer service to
Process your ATM VISA OR MATER CARD which will be deliver to you.We
shall Proceed on receipt of this information requested from you .
Private E-mail:pro.godwinemefiele@yahoo.com
Thank you for your anticipated co-operation.
TREAT AS URGENT.
Pro.Godwin Emefiele.Governor Central Bank of Nigeria (CBN)
Head,e-Payment Division
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 13 Sep 2022 16:17:03 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oYECw-000II7-Qf
for dave@doctor.nl2k.ab.ca;
Tue, 13 Sep 2022 16:16:42 -0600
Resent-From: The Doctor
Resent-Date: Tue, 13 Sep 2022 16:16:42 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-lj1-f173.google.com ([209.85.208.173]:39835)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1oY72F-000Fwa-KP
for doctor@doctor.nl2k.ab.ca;
Tue, 13 Sep 2022 08:37:15 -0600
Received: by mail-lj1-f173.google.com with SMTP id bn9so14614658ljb.6
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date;
bh=vKviBlZv651C2CBIglhJWRvpj0ix94yf4EcyIqcdlf8=;
b=Yx57GIyh9ZROGLI0wLAWhLFttHJ/LNUrBDDrFgonryKUE/KZsVr2jJmwdhai0bpQpR
V4WortqgqGDCxmcGmLCIVmEFOK6LFH2mncUfMxcKxxVhSFiE708OoZLao4nRHSUZ/tYR
PByVZHSTteOaHws39r8r+GUe+SiXbHXrWnztJmlPskYFI38KxcJt895YiikIyZ+Lriqe
qWATHecejIs9l32shU7akaolgjeHzRGpbbGu6MHndXwW0jQnJovdaReinoOTmGNPcwvl
bGsOq/gg4PieHpa+p01F+yC74oy57SwbKDor7le7J/MhbUzk6R03zME7dY2AQdDmvuut
iTRg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date;
bh=vKviBlZv651C2CBIglhJWRvpj0ix94yf4EcyIqcdlf8=;
b=nSW0gP7vPBH6crceIT+tOFI0Gz3CeLQwR0uT58nlSd7xejBVBnf/qMazFXU3vT6Lfz
0i8zb4Iib0bMWL0jWbdnXPNrLMsYphKZ+iq4to/f+hTH6ScJBWBMzc8xiwZ6wtoM4gbL
UBEpQ5n+HNebcNAwbJlJpkziEAuBrgfozcOb+6h3oL4x7RLb9ukVaPMzt1S7v2W8gIXS
9q4mXaRAysWLG6hfUDnxbJEZT+87uF8nr5MpWbM5jZep+dBOiUzl6K/eYvS7QxlowaDk
PktZDw5Ts6ehSTFC7JBUHnSIsEMGWD/yChq/iHkWkJ10KandN9vkWFUBSkIOtQb/IiwW
4zQw==
X-Gm-Message-State: ACgBeo0BGnKmt9V2FVZZm9WxruPX2WTGn/khgQLF6nP09rOrDEFLwG23
23kf3lEWAF9b04u+D7raqfmknz/U7id8VYvPCis=
X-Google-Smtp-Source: AA6agR7Lh19m3DC8ovfsFfMAwm0yPWdDABJykz2al/sgvodQx6C68MbLoV3GRM/lAq9dPv33pIKSBv+den+DTcBITs8=
X-Received: by 2002:a2e:a887:0:b0:25e:3174:fb67 with SMTP id
m7-20020a2ea887000000b0025e3174fb67mr8855615ljq.337.1663079807389; Tue, 13
Sep 2022 07:36:47 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6504:644:b0:1db:dc8f:5313 with HTTP; Tue, 13 Sep 2022
07:36:46 -0700 (PDT)
Reply-To: emefiele.centrabankofnig@gmail.com
From: "Pro.Godwin Emefiele"
Date: Tue, 13 Sep 2022 15:36:46 +0100
Message-ID:
Subject: 2022 SECOND QUARTER PAYMENT NOTIFICATION
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 19.0
X-Spam_score_int: 190
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Central International Bank PLC ATM Visa/Swift Card Unit, Attn.
Fund Beneficiary, This note is a reminder that the President through the
office of Federal Ministry Of Finance and the Central Bank of Nigeria has
approved the Release of your fund (10M) Million United States Dollars o [...]
Content analysis details: (19.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.173 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[paulmonti.miami[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
1.6 SUBJ_ALL_CAPS Subject is all capitals
2.5 MILLION_USD BODY: Talks about millions of dollars
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
1.5 MONEY_ATM_CARD Lots of money on an ATM card
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal
information
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
1.5 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
Subject: {SPAM?} 2022 SECOND QUARTER PAYMENT NOTIFICATION
Central International Bank PLC
ATM Visa/Swift Card Unit,
Attn. Fund Beneficiary,
This note is a reminder that the President through the office of
Federal Ministry Of Finance and the Central Bank of Nigeria has
approved the Release of your fund (10M) Million United States Dollars
only, through ATM CARD. This method is necessary to avoid
suppression,You are Required to send to us your details information
for process
1) Your: Full Name===================
2) Your: Full Address================
3) Your: contact telephone and fax number;=====
4) Your: Age and Profession;=========
5) Your:Copy of any valid form of your Identification;===
6) Your:Marital status===========
This information will enable our IT unit and customer service to
Process your ATM VISA OR MATER CARD which will be deliver to you.We
shall Proceed on receipt of this information requested from you .
Private E-mail:pro.godwinemefiele@yahoo.com
Thank you for your anticipated co-operation.
TREAT AS URGENT.
Pro.Godwin Emefiele.Governor Central Bank of Nigeria (CBN)
Head,e-Payment Division
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments