Nigerian spam from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 28 Aug 2023 07:12:14 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from)
id 1qabsr-000KQP-1f
for dave@doctor.nl2k.ab.ca;
Mon, 28 Aug 2023 07:02:21 -0600
Resent-From: The Doctor
Resent-Date: Mon, 28 Aug 2023 07:02:21 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-lf1-f43.google.com ([209.85.167.43]:58537)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from)
id 1qaZ0w-0005a5-0T
for doctor@doctor.nl2k.ab.ca;
Mon, 28 Aug 2023 03:58:36 -0600
Received: by mail-lf1-f43.google.com with SMTP id 2adb3069b0e04-50078eba7afso4732174e87.0
for; Mon, 28 Aug 2023 02:56:31 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1693216585; x=1693821385;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=6Jdq1e2Qw7vjowTsBJqhUV1AoQQxTVCXAODljahIV3w=;
b=D129HMuG7tgnv1+MZyssELZiPifttfFhoW+ppKK+MkdoFZjQYTfzAzoSik/TKno7cu
cIvmfJzA1jIACRi1oD6/1A4iy8as6RErJZ1qNUeRKUQ/o7j0Y8yXZ8rRENwbOQGzw8hh
MJoAjtoewXyGf5kN27//27daty4hEvXD9zGhRYbyzfmj00+vEo+osyp8NFOd+rEumT9B
teOWhqxJOsMY9Moh7rpF0wz/Il8FgktcI4PKWpfocWX3ULAhA3WNU8pPfGqcrpBRn+I+
WuC6PDMSIn5Z59jtytWNbQdmDVqez3//Gtiryxjh1Ncf5Uv9uq+kvDHLSa0ww943ZPil
I3wA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1693216585; x=1693821385;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=6Jdq1e2Qw7vjowTsBJqhUV1AoQQxTVCXAODljahIV3w=;
b=by3Oyk0QJ8AAO7+vSig4x2hd8BSCSei4LcoasQtw5FphN9Fi6ELeZpR9NkRBratM2T
DtywJ6RZ3SqF0SiYjgZ36V42zg5c4oS2UWyYNsMhtuJYsLjEvyrKK2Emvj/ha3TbyIV7
3h9v1xYA0Ezy/gGkjngQa3U5wfMj7cy8uF7/tR+EEyoZacdoUhW75nQa8lATV5HDTZ/D
TdPafQcUl1Qeo0fJsIdCyP45Id6PUaBXTC2FieAAsio7s8kvIsRweMxtDvDO47Nwzk1f
yCjU0T21xdW9N/H+UGctQZQUiWrGlKOyps3tNXVp/gxCvwT1BN6miHitnNgjp25z5bax
hCaQ==
X-Gm-Message-State: AOJu0Ywuznxb3cdTqf9t+EkH2GZIixN4ufbXt5CnrA2C/hI7YavJlqPJ
gn6wdqrrU6CK+wA/JvQzjE7zOmSINP6bzq12uL8=
X-Google-Smtp-Source: AGHT+IE3vvWM49HtR+ZNvpb+l3gl6/+60bPgByPbxH0eJdCHtbskdDrViGf6v67MTQithjsHPP+IwBA302PNYoF4xCs=
X-Received: by 2002:a05:6512:130c:b0:500:9969:60bf with SMTP id
x12-20020a056512130c00b00500996960bfmr11995406lfu.68.1693216584775; Mon, 28
Aug 2023 02:56:24 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6504:5038:b0:23b:84b4:96a9 with HTTP; Mon, 28 Aug 2023
02:56:24 -0700 (PDT)
Reply-To: grantwatson684@gmail.com
From: "Mr. Grant Watson"
Date: Mon, 28 Aug 2023 10:56:24 +0100
Message-ID:
Subject: Attention Beneficiary.
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 17.3
X-Spam_score_int: 173
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: MR GRANT WATSON UNITED NATION INSPECTION AGENCY HARTS FIELD-JACKSON
INTERNATIONAL AIRPORT. ATLANTA, GEORGIA. I am GRANT WATSON Inspection Agency
in Harts field-Jackson International Airport Atlanta, Georgia. During our
investigation, I discovered an abandoned shipment through a Diplomat from
UNITED KINGDOM ( [...]
Content analysis details: (17.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.167.43 listed in list.dnswl.org]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[grantwatson684(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[garybowman243(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[garybowman243(at)gmail.com]
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.167.43 listed in wl.mailspike.net]
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_HK_NAME_FM_MR_MRS No description available.
1.5 HK_NAME_FM_MR_MRS No description available.
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.6 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Attention Beneficiary.
X-Antivirus: AVG (VPS 230827-4, 8/27/2023), Inbound message
X-Antivirus-Status: Clean
MR GRANT WATSON
UNITED NATION INSPECTION AGENCY
HARTS FIELD-JACKSON INTERNATIONAL AIRPORT.
ATLANTA, GEORGIA.
I am GRANT WATSON Inspection Agency in Harts field-Jackson International
Airport Atlanta, Georgia. During our investigation, I discovered an
abandoned shipment through a Diplomat from UNITED KINGDOM (UK)
which was transferred from Cardiff International Airport. To our facility
here in Atlanta, and when scanned it revealed an undisclosed sum of money
in 2 Metal Trunk Boxes. The consignment was abandoned because the Content
was not properly declared by the consignee as money rather it was declared
as personal Effect/classified document to either avoid diversion by the
Shipping Agent or confiscation by the relevant authorities.
The diplomat's inability to pay for Non Inspection fees among other things
are the reason why the consignment is delayed and abandoned. By my
assessment, each of the boxes contains about $4M or more. They are still
left in the airport storage facility till today. The Consignments like I
said are two metal trunk boxes, the details of the consignment including
your name and email on the official document from United Nations' office
in UNITED KINGDOM AND IRELAND where the shipment was tagged as personal
effects/classified document is still available with us. As it stands
now, you have to reconfirm your Full name, Phone Number, full address so
I can cross-check and see if it corresponds with the one on the official
documents.
It is now left to you to decide if you are the beneficiary and still need
the consignment or allow us repatriate it back to IRELAND (place of
origin) as we were instructed. Like I did say again, the shipper abandoned
it and ran away most importantly because he gave a false declaration, he
could not pay for the yellow tag, he could not secure a valid non
inspection document(s), etc. I am ready to assist you in any way I can for
you to get back this packages if only you are willing to work with me with
trust. You can either come in person, or you engage the services of a
secure shipping/delivery Company/agent that will provide the necessary
security. That is required to deliver the package to your doorstep or the
destination of your choice. I need the entire guarantee that I can get
from you before I can get involved in this project.
Best Regards,
MR GRANT WATSON
INSPECTION OFFICER.
Email :grantwatson684@gmail.com
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 28 Aug 2023 07:12:14 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from
id 1qabsr-000KQP-1f
for dave@doctor.nl2k.ab.ca;
Mon, 28 Aug 2023 07:02:21 -0600
Resent-From: The Doctor
Resent-Date: Mon, 28 Aug 2023 07:02:21 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-lf1-f43.google.com ([209.85.167.43]:58537)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from
id 1qaZ0w-0005a5-0T
for doctor@doctor.nl2k.ab.ca;
Mon, 28 Aug 2023 03:58:36 -0600
Received: by mail-lf1-f43.google.com with SMTP id 2adb3069b0e04-50078eba7afso4732174e87.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1693216585; x=1693821385;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=6Jdq1e2Qw7vjowTsBJqhUV1AoQQxTVCXAODljahIV3w=;
b=D129HMuG7tgnv1+MZyssELZiPifttfFhoW+ppKK+MkdoFZjQYTfzAzoSik/TKno7cu
cIvmfJzA1jIACRi1oD6/1A4iy8as6RErJZ1qNUeRKUQ/o7j0Y8yXZ8rRENwbOQGzw8hh
MJoAjtoewXyGf5kN27//27daty4hEvXD9zGhRYbyzfmj00+vEo+osyp8NFOd+rEumT9B
teOWhqxJOsMY9Moh7rpF0wz/Il8FgktcI4PKWpfocWX3ULAhA3WNU8pPfGqcrpBRn+I+
WuC6PDMSIn5Z59jtytWNbQdmDVqez3//Gtiryxjh1Ncf5Uv9uq+kvDHLSa0ww943ZPil
I3wA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1693216585; x=1693821385;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=6Jdq1e2Qw7vjowTsBJqhUV1AoQQxTVCXAODljahIV3w=;
b=by3Oyk0QJ8AAO7+vSig4x2hd8BSCSei4LcoasQtw5FphN9Fi6ELeZpR9NkRBratM2T
DtywJ6RZ3SqF0SiYjgZ36V42zg5c4oS2UWyYNsMhtuJYsLjEvyrKK2Emvj/ha3TbyIV7
3h9v1xYA0Ezy/gGkjngQa3U5wfMj7cy8uF7/tR+EEyoZacdoUhW75nQa8lATV5HDTZ/D
TdPafQcUl1Qeo0fJsIdCyP45Id6PUaBXTC2FieAAsio7s8kvIsRweMxtDvDO47Nwzk1f
yCjU0T21xdW9N/H+UGctQZQUiWrGlKOyps3tNXVp/gxCvwT1BN6miHitnNgjp25z5bax
hCaQ==
X-Gm-Message-State: AOJu0Ywuznxb3cdTqf9t+EkH2GZIixN4ufbXt5CnrA2C/hI7YavJlqPJ
gn6wdqrrU6CK+wA/JvQzjE7zOmSINP6bzq12uL8=
X-Google-Smtp-Source: AGHT+IE3vvWM49HtR+ZNvpb+l3gl6/+60bPgByPbxH0eJdCHtbskdDrViGf6v67MTQithjsHPP+IwBA302PNYoF4xCs=
X-Received: by 2002:a05:6512:130c:b0:500:9969:60bf with SMTP id
x12-20020a056512130c00b00500996960bfmr11995406lfu.68.1693216584775; Mon, 28
Aug 2023 02:56:24 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6504:5038:b0:23b:84b4:96a9 with HTTP; Mon, 28 Aug 2023
02:56:24 -0700 (PDT)
Reply-To: grantwatson684@gmail.com
From: "Mr. Grant Watson"
Date: Mon, 28 Aug 2023 10:56:24 +0100
Message-ID:
Subject: Attention Beneficiary.
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 17.3
X-Spam_score_int: 173
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: MR GRANT WATSON UNITED NATION INSPECTION AGENCY HARTS FIELD-JACKSON
INTERNATIONAL AIRPORT. ATLANTA, GEORGIA. I am GRANT WATSON Inspection Agency
in Harts field-Jackson International Airport Atlanta, Georgia. During our
investigation, I discovered an abandoned shipment through a Diplomat from
UNITED KINGDOM ( [...]
Content analysis details: (17.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.167.43 listed in list.dnswl.org]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[grantwatson684(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[garybowman243(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[garybowman243(at)gmail.com]
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.167.43 listed in wl.mailspike.net]
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_HK_NAME_FM_MR_MRS No description available.
1.5 HK_NAME_FM_MR_MRS No description available.
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.6 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Attention Beneficiary.
X-Antivirus: AVG (VPS 230827-4, 8/27/2023), Inbound message
X-Antivirus-Status: Clean
MR GRANT WATSON
UNITED NATION INSPECTION AGENCY
HARTS FIELD-JACKSON INTERNATIONAL AIRPORT.
ATLANTA, GEORGIA.
I am GRANT WATSON Inspection Agency in Harts field-Jackson International
Airport Atlanta, Georgia. During our investigation, I discovered an
abandoned shipment through a Diplomat from UNITED KINGDOM (UK)
which was transferred from Cardiff International Airport. To our facility
here in Atlanta, and when scanned it revealed an undisclosed sum of money
in 2 Metal Trunk Boxes. The consignment was abandoned because the Content
was not properly declared by the consignee as money rather it was declared
as personal Effect/classified document to either avoid diversion by the
Shipping Agent or confiscation by the relevant authorities.
The diplomat's inability to pay for Non Inspection fees among other things
are the reason why the consignment is delayed and abandoned. By my
assessment, each of the boxes contains about $4M or more. They are still
left in the airport storage facility till today. The Consignments like I
said are two metal trunk boxes, the details of the consignment including
your name and email on the official document from United Nations' office
in UNITED KINGDOM AND IRELAND where the shipment was tagged as personal
effects/classified document is still available with us. As it stands
now, you have to reconfirm your Full name, Phone Number, full address so
I can cross-check and see if it corresponds with the one on the official
documents.
It is now left to you to decide if you are the beneficiary and still need
the consignment or allow us repatriate it back to IRELAND (place of
origin) as we were instructed. Like I did say again, the shipper abandoned
it and ran away most importantly because he gave a false declaration, he
could not pay for the yellow tag, he could not secure a valid non
inspection document(s), etc. I am ready to assist you in any way I can for
you to get back this packages if only you are willing to work with me with
trust. You can either come in person, or you engage the services of a
secure shipping/delivery Company/agent that will provide the necessary
security. That is required to deliver the package to your doorstep or the
destination of your choice. I need the entire guarantee that I can get
from you before I can get involved in this project.
Best Regards,
MR GRANT WATSON
INSPECTION OFFICER.
Email :grantwatson684@gmail.com
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments