Nigerian Google Gmail spam
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@nl2k.ab.ca
Delivery-date: Thu, 31 Aug 2023 19:43:02 -0600
Received: from mail-ed1-f42.google.com ([209.85.208.42]:47330)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from)
id 1qbsue-000NLn-0Z
for dave@nl2k.ab.ca;
Thu, 31 Aug 2023 19:25:31 -0600
Received: by mail-ed1-f42.google.com with SMTP id 4fb4d7f45d1cf-52a06f5f556so1900588a12.2
for; Thu, 31 Aug 2023 18:23:28 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1693531401; x=1694136201; darn=nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=HBK1StX140v3ErKiuVAxvxZFyumSd7WLR11K0wGMBxM=;
b=AJzioe+b9N7LcCpTMGRGxrYP/K3pFk/oRFIHy9i2m4DaKSanNyz1MX5oVDUdy3s+le
8/NHzpkcaHrYOJy7sI0xCpHP0OSQoteUjEBYm7dvTgdAQ7j5K6IN+xSn1A/D58142s24
dQi1UE3HbA28ovv6pfEmGtpWFJX5TbhwtXFuJ/FYZ7jYz9ZdDa+R4ZWUXUmhw+6MvuNG
pi/T0Kr1O9dQ2ChGS/U455rv1eIC9BRhmVWTXu/VEI+XolooJpKJw6UxUQOsgBfo/9Vp
ecwuVXKGQd1lRx0BcWD5N9ffJMOCzy/olmoS5zNja0hQA33uDOt406965T6v2zk82Po7
6Sbw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1693531401; x=1694136201;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=HBK1StX140v3ErKiuVAxvxZFyumSd7WLR11K0wGMBxM=;
b=MgbJW5+NgOjyvMhI6Q/TeGe8E7gVa5/Bq5gWShjHgf0bZHB4qarv3FCBPlhUmCCwX2
qfMM8HiV94/Swg4bS3xF12TNdXBrU/kwpR3zLbvSdcWaokvgrWeFdwn1VVSN0N8eQ7/3
t3aX+5dyLICk4nJ9bbOro9Lm3mMM1Hww3jL+hbF9RYbN0Sa3T+BEHtguEzJHWztisdno
ss5jPwOElv97eEFYFtjTJOu8exCgvw+ucskecYlTozlnbX0TlcoFO+1leJix6yoZTGr8
gGZfEuYnWIExBHXGt8dO2CYN0/CmeQUQFaNsufiXxERqNWF+17oqpdDI2CAnz7eNS4IQ
/HDQ==
X-Gm-Message-State: AOJu0YwUSp9U9BHlmG40PPzqnHxPFBRjcP4u/Vsw0K33t+J5fNOgro3o
AMFTDjxt6mbuFusv6cfNS2V/soiZdzUZdSZS5VU=
X-Google-Smtp-Source: AGHT+IEbnhFzEsnaRjahWT3EOa8fLUb5E1mPsgyxc2MBx+cJkkMkgmDeMkEWqz28s6DTBEkMdBoFOXhhpQ0OfnjTsZU=
X-Received: by 2002:aa7:c393:0:b0:525:570c:566b with SMTP id
k19-20020aa7c393000000b00525570c566bmr821166edq.22.1693531401095; Thu, 31 Aug
2023 18:23:21 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:ab4:aa46:0:b0:228:a51a:d3d7 with HTTP; Thu, 31 Aug 2023
18:23:20 -0700 (PDT)
Reply-To: westernunion1@secretary.net
From: "Mr. Devin McGranahan"
Date: Fri, 1 Sep 2023 02:23:20 +0100
Message-ID:
Subject: Your First Payment $5,000.00USD Has Be Paid Today.
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: dave@nl2k.ab.ca
X-Spam_score: 11.5
X-Spam_score_int: 115
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings To You This is to inform you that after the meeting
held in my office yesterday which consist between the Republic Of USA Embassy
and the United Nations, we have concluded that you will be compensated with
a [...]
Content analysis details: (11.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.208.42 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[westernunion1(at)secretary.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[samuelamechionyekwe(at)gmail.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.42 listed in wl.mailspike.net]
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
1.5 HK_NAME_FM_MR_MRS No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.6 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.2 FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 MONEY_FORM Lots of money if you fill out a form
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 ADVANCE_FEE_2_NEW_FRM_MNY Advance Fee fraud form and lots of money
Subject: {SPAM?} Your First Payment $5,000.00USD Has Be Paid Today.
Greetings To You
This is to inform you that after the meeting held in my office
yesterday which consist between the Republic Of USA Embassy and the
United Nations, we have concluded that you will be compensated with
all the money you have loosed in the hands of Africans.
We have deposited the BANK DRAFT of your fund ($5.500`000`00USD)
through Western Union department after our finally meeting regarding
your fund, All you will do is to contact Western Union director Mr.
Ben Adams, Via e-mail ( westernunion1@secretary.net) He will give you
direction on how you will be receiving the funds daily. Remember to
send him your Full information to avoid wrong transfer such as,
1. Your Full name....................
2. Your home Address.................
3. Your telephone number.............
4. A copy of your ID.................
5. Your age/sex......................
6. Your occupation...................
7. Your country......................
Mr. Devin McGranahan has sent $5000 in your name today so contact Mr.
Ben Adams as soon as you receive this email and tell him to give you
the Mtcn, sender name and question/answer to pick the $5000, Please
let us know as soon as you received all your fund.
Ilook foeward to your feedback
Yours sincerely
Mr. Devin McGranahan
WESTERN UNION OFFICE
Envelope-to: dave@nl2k.ab.ca
Delivery-date: Thu, 31 Aug 2023 19:43:02 -0600
Received: from mail-ed1-f42.google.com ([209.85.208.42]:47330)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from
id 1qbsue-000NLn-0Z
for dave@nl2k.ab.ca;
Thu, 31 Aug 2023 19:25:31 -0600
Received: by mail-ed1-f42.google.com with SMTP id 4fb4d7f45d1cf-52a06f5f556so1900588a12.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1693531401; x=1694136201; darn=nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=HBK1StX140v3ErKiuVAxvxZFyumSd7WLR11K0wGMBxM=;
b=AJzioe+b9N7LcCpTMGRGxrYP/K3pFk/oRFIHy9i2m4DaKSanNyz1MX5oVDUdy3s+le
8/NHzpkcaHrYOJy7sI0xCpHP0OSQoteUjEBYm7dvTgdAQ7j5K6IN+xSn1A/D58142s24
dQi1UE3HbA28ovv6pfEmGtpWFJX5TbhwtXFuJ/FYZ7jYz9ZdDa+R4ZWUXUmhw+6MvuNG
pi/T0Kr1O9dQ2ChGS/U455rv1eIC9BRhmVWTXu/VEI+XolooJpKJw6UxUQOsgBfo/9Vp
ecwuVXKGQd1lRx0BcWD5N9ffJMOCzy/olmoS5zNja0hQA33uDOt406965T6v2zk82Po7
6Sbw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1693531401; x=1694136201;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=HBK1StX140v3ErKiuVAxvxZFyumSd7WLR11K0wGMBxM=;
b=MgbJW5+NgOjyvMhI6Q/TeGe8E7gVa5/Bq5gWShjHgf0bZHB4qarv3FCBPlhUmCCwX2
qfMM8HiV94/Swg4bS3xF12TNdXBrU/kwpR3zLbvSdcWaokvgrWeFdwn1VVSN0N8eQ7/3
t3aX+5dyLICk4nJ9bbOro9Lm3mMM1Hww3jL+hbF9RYbN0Sa3T+BEHtguEzJHWztisdno
ss5jPwOElv97eEFYFtjTJOu8exCgvw+ucskecYlTozlnbX0TlcoFO+1leJix6yoZTGr8
gGZfEuYnWIExBHXGt8dO2CYN0/CmeQUQFaNsufiXxERqNWF+17oqpdDI2CAnz7eNS4IQ
/HDQ==
X-Gm-Message-State: AOJu0YwUSp9U9BHlmG40PPzqnHxPFBRjcP4u/Vsw0K33t+J5fNOgro3o
AMFTDjxt6mbuFusv6cfNS2V/soiZdzUZdSZS5VU=
X-Google-Smtp-Source: AGHT+IEbnhFzEsnaRjahWT3EOa8fLUb5E1mPsgyxc2MBx+cJkkMkgmDeMkEWqz28s6DTBEkMdBoFOXhhpQ0OfnjTsZU=
X-Received: by 2002:aa7:c393:0:b0:525:570c:566b with SMTP id
k19-20020aa7c393000000b00525570c566bmr821166edq.22.1693531401095; Thu, 31 Aug
2023 18:23:21 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:ab4:aa46:0:b0:228:a51a:d3d7 with HTTP; Thu, 31 Aug 2023
18:23:20 -0700 (PDT)
Reply-To: westernunion1@secretary.net
From: "Mr. Devin McGranahan"
Date: Fri, 1 Sep 2023 02:23:20 +0100
Message-ID:
Subject: Your First Payment $5,000.00USD Has Be Paid Today.
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: dave@nl2k.ab.ca
X-Spam_score: 11.5
X-Spam_score_int: 115
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings To You This is to inform you that after the meeting
held in my office yesterday which consist between the Republic Of USA Embassy
and the United Nations, we have concluded that you will be compensated with
a [...]
Content analysis details: (11.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.208.42 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[westernunion1(at)secretary.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[samuelamechionyekwe(at)gmail.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.42 listed in wl.mailspike.net]
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
1.5 HK_NAME_FM_MR_MRS No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.6 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.2 FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 MONEY_FORM Lots of money if you fill out a form
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 ADVANCE_FEE_2_NEW_FRM_MNY Advance Fee fraud form and lots of money
Subject: {SPAM?} Your First Payment $5,000.00USD Has Be Paid Today.
Greetings To You
This is to inform you that after the meeting held in my office
yesterday which consist between the Republic Of USA Embassy and the
United Nations, we have concluded that you will be compensated with
all the money you have loosed in the hands of Africans.
We have deposited the BANK DRAFT of your fund ($5.500`000`00USD)
through Western Union department after our finally meeting regarding
your fund, All you will do is to contact Western Union director Mr.
Ben Adams, Via e-mail ( westernunion1@secretary.net) He will give you
direction on how you will be receiving the funds daily. Remember to
send him your Full information to avoid wrong transfer such as,
1. Your Full name....................
2. Your home Address.................
3. Your telephone number.............
4. A copy of your ID.................
5. Your age/sex......................
6. Your occupation...................
7. Your country......................
Mr. Devin McGranahan has sent $5000 in your name today so contact Mr.
Ben Adams as soon as you receive this email and tell him to give you
the Mtcn, sender name and question/answer to pick the $5000, Please
let us know as soon as you received all your fund.
Ilook foeward to your feedback
Yours sincerely
Mr. Devin McGranahan
WESTERN UNION OFFICE
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments