Nigerian Google Gmail spam
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 03 Sep 2023 15:30:06 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from)
id 1qcuXW-0005pj-14
for dave@doctor.nl2k.ab.ca;
Sun, 03 Sep 2023 15:21:50 -0600
Resent-From: The Doctor
Resent-Date: Sun, 3 Sep 2023 15:21:50 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-wr1-f44.google.com ([209.85.221.44]:60900)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from)
id 1qcozG-000MEs-0W
for doctor@doctor.nl2k.ab.ca;
Sun, 03 Sep 2023 09:26:10 -0600
Received: by mail-wr1-f44.google.com with SMTP id ffacd0b85a97d-31c7912416bso653683f8f.1
for; Sun, 03 Sep 2023 08:24:06 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1693754640; x=1694359440; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=6Jdq1e2Qw7vjowTsBJqhUV1AoQQxTVCXAODljahIV3w=;
b=b8ajCyMUM/pabrmdRdIvdYdfJaSOZo0gkk02q8WFQg1wLpa7zbWTbw+jaQHjAIPQff
tefapvUPhdqq8kzKtgrBpjYn7qW5iHXduOlcYlIkqohM8vmFOoLb4mt5S9hIqwzRWqDS
B2Xmx++F/4QYwKQdTvsn9lNm/Q8xMdMtUPwLp82MBeFhHkXkFvFJlnlDytP13EOVbsiC
rPiG7JnE0wB+OUmEYtXpJ7FuAuj0jqSUJ4aCpe5t4sN+BdE8XY1KDcCJvxnD49IRush2
LsQHYYfu5zuQ9VpUayHe8c41FlFWLypreBIynpMpEiz/yxvYUvfTHhPsIoLeoWChJUBh
w5zg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1693754640; x=1694359440;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=6Jdq1e2Qw7vjowTsBJqhUV1AoQQxTVCXAODljahIV3w=;
b=ABsrAckb6NLTTlMhfNgIbkAzFo6jNizSTWtgu/INwPZ+6mQM2b5lGxYT50FAP3dOi0
q/XzdBbLixPZco/zRSoPS0VlflS3dhTV1F0rXCqo5V5W3egf0w45OqfJISFnpzSFLHbl
0vvnTxB4MlF/oCpkEWYDyeOb/CRZj+uUNElcPDhBQSentZwB6IVhlBY+braQHB9ilKCQ
bx2thCzfx9HVlHWWaC4zMA3ZUD3k5g+EyU9ZoYNEVsl6KgjSOWxPa8FOH44j4HLzRcGd
x4047iBJDh2WQRYEp16NTjsdH7n2Sgi7y9evyd2iFqJiwsw1WhWZwLi48TB+WZJevkGp
/jvQ==
X-Gm-Message-State: AOJu0YzUVYWSlHX62ztwj6uWAKUWmFp21sMBJwGQFrCpBbLct1h234s/
j/+nCkAcjORlvoNgyvRilaLiC+HDjmSS9J6jGQo=
X-Google-Smtp-Source: AGHT+IFX/5S8W3DiuY+F9dl/hQBq0uzVaQocLGFBpDwp5g6dUdUvW8V7xOAKmr6zLjBMTk8Ps5h9ZzSNN1gnlB72JsI=
X-Received: by 2002:a5d:4ec1:0:b0:314:3740:7f69 with SMTP id
s1-20020a5d4ec1000000b0031437407f69mr5381876wrv.37.1693754639958; Sun, 03 Sep
2023 08:23:59 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:adf:fc8b:0:b0:314:2eaf:3cdc with HTTP; Sun, 3 Sep 2023
08:23:59 -0700 (PDT)
Reply-To: grantwatson684@gmail.com
From: Mr Grant Watson
Date: Sun, 3 Sep 2023 16:23:59 +0100
Message-ID:
Subject: Attention Beneficiary.
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 17.1
X-Spam_score_int: 171
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: MR GRANT WATSON UNITED NATION INSPECTION AGENCY HARTS FIELD-JACKSON
INTERNATIONAL AIRPORT. ATLANTA, GEORGIA. I am GRANT WATSON Inspection Agency
in Harts field-Jackson International Airport Atlanta, Georgia. During our
investigation, I discovered an abandoned shipment through a Diplomat from
UNITED KINGDOM ( [...]
Content analysis details: (17.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.221.44 listed in list.dnswl.org]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[grantwatson684(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[jungkookprivatefanemail(at)gmail.com]
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.221.44 listed in wl.mailspike.net]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
1.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.6 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases
Subject: {SPAM?} Attention Beneficiary.
MR GRANT WATSON
UNITED NATION INSPECTION AGENCY
HARTS FIELD-JACKSON INTERNATIONAL AIRPORT.
ATLANTA, GEORGIA.
I am GRANT WATSON Inspection Agency in Harts field-Jackson International
Airport Atlanta, Georgia. During our investigation, I discovered an
abandoned shipment through a Diplomat from UNITED KINGDOM (UK)
which was transferred from Cardiff International Airport. To our facility
here in Atlanta, and when scanned it revealed an undisclosed sum of money
in 2 Metal Trunk Boxes. The consignment was abandoned because the Content
was not properly declared by the consignee as money rather it was declared
as personal Effect/classified document to either avoid diversion by the
Shipping Agent or confiscation by the relevant authorities.
The diplomat's inability to pay for Non Inspection fees among other things
are the reason why the consignment is delayed and abandoned. By my
assessment, each of the boxes contains about $4M or more. They are still
left in the airport storage facility till today. The Consignments like I
said are two metal trunk boxes, the details of the consignment including
your name and email on the official document from United Nations' office
in UNITED KINGDOM AND IRELAND where the shipment was tagged as personal
effects/classified document is still available with us. As it stands
now, you have to reconfirm your Full name, Phone Number, full address so
I can cross-check and see if it corresponds with the one on the official
documents.
It is now left to you to decide if you are the beneficiary and still need
the consignment or allow us repatriate it back to IRELAND (place of
origin) as we were instructed. Like I did say again, the shipper abandoned
it and ran away most importantly because he gave a false declaration, he
could not pay for the yellow tag, he could not secure a valid non
inspection document(s), etc. I am ready to assist you in any way I can for
you to get back this packages if only you are willing to work with me with
trust. You can either come in person, or you engage the services of a
secure shipping/delivery Company/agent that will provide the necessary
security. That is required to deliver the package to your doorstep or the
destination of your choice. I need the entire guarantee that I can get
from you before I can get involved in this project.
Best Regards,
MR GRANT WATSON
INSPECTION OFFICER.
Email :grantwatson684@gmail.com
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 03 Sep 2023 15:30:06 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from
id 1qcuXW-0005pj-14
for dave@doctor.nl2k.ab.ca;
Sun, 03 Sep 2023 15:21:50 -0600
Resent-From: The Doctor
Resent-Date: Sun, 3 Sep 2023 15:21:50 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-wr1-f44.google.com ([209.85.221.44]:60900)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from
id 1qcozG-000MEs-0W
for doctor@doctor.nl2k.ab.ca;
Sun, 03 Sep 2023 09:26:10 -0600
Received: by mail-wr1-f44.google.com with SMTP id ffacd0b85a97d-31c7912416bso653683f8f.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1693754640; x=1694359440; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=6Jdq1e2Qw7vjowTsBJqhUV1AoQQxTVCXAODljahIV3w=;
b=b8ajCyMUM/pabrmdRdIvdYdfJaSOZo0gkk02q8WFQg1wLpa7zbWTbw+jaQHjAIPQff
tefapvUPhdqq8kzKtgrBpjYn7qW5iHXduOlcYlIkqohM8vmFOoLb4mt5S9hIqwzRWqDS
B2Xmx++F/4QYwKQdTvsn9lNm/Q8xMdMtUPwLp82MBeFhHkXkFvFJlnlDytP13EOVbsiC
rPiG7JnE0wB+OUmEYtXpJ7FuAuj0jqSUJ4aCpe5t4sN+BdE8XY1KDcCJvxnD49IRush2
LsQHYYfu5zuQ9VpUayHe8c41FlFWLypreBIynpMpEiz/yxvYUvfTHhPsIoLeoWChJUBh
w5zg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1693754640; x=1694359440;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=6Jdq1e2Qw7vjowTsBJqhUV1AoQQxTVCXAODljahIV3w=;
b=ABsrAckb6NLTTlMhfNgIbkAzFo6jNizSTWtgu/INwPZ+6mQM2b5lGxYT50FAP3dOi0
q/XzdBbLixPZco/zRSoPS0VlflS3dhTV1F0rXCqo5V5W3egf0w45OqfJISFnpzSFLHbl
0vvnTxB4MlF/oCpkEWYDyeOb/CRZj+uUNElcPDhBQSentZwB6IVhlBY+braQHB9ilKCQ
bx2thCzfx9HVlHWWaC4zMA3ZUD3k5g+EyU9ZoYNEVsl6KgjSOWxPa8FOH44j4HLzRcGd
x4047iBJDh2WQRYEp16NTjsdH7n2Sgi7y9evyd2iFqJiwsw1WhWZwLi48TB+WZJevkGp
/jvQ==
X-Gm-Message-State: AOJu0YzUVYWSlHX62ztwj6uWAKUWmFp21sMBJwGQFrCpBbLct1h234s/
j/+nCkAcjORlvoNgyvRilaLiC+HDjmSS9J6jGQo=
X-Google-Smtp-Source: AGHT+IFX/5S8W3DiuY+F9dl/hQBq0uzVaQocLGFBpDwp5g6dUdUvW8V7xOAKmr6zLjBMTk8Ps5h9ZzSNN1gnlB72JsI=
X-Received: by 2002:a5d:4ec1:0:b0:314:3740:7f69 with SMTP id
s1-20020a5d4ec1000000b0031437407f69mr5381876wrv.37.1693754639958; Sun, 03 Sep
2023 08:23:59 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:adf:fc8b:0:b0:314:2eaf:3cdc with HTTP; Sun, 3 Sep 2023
08:23:59 -0700 (PDT)
Reply-To: grantwatson684@gmail.com
From: Mr Grant Watson
Date: Sun, 3 Sep 2023 16:23:59 +0100
Message-ID:
Subject: Attention Beneficiary.
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 17.1
X-Spam_score_int: 171
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: MR GRANT WATSON UNITED NATION INSPECTION AGENCY HARTS FIELD-JACKSON
INTERNATIONAL AIRPORT. ATLANTA, GEORGIA. I am GRANT WATSON Inspection Agency
in Harts field-Jackson International Airport Atlanta, Georgia. During our
investigation, I discovered an abandoned shipment through a Diplomat from
UNITED KINGDOM ( [...]
Content analysis details: (17.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.221.44 listed in list.dnswl.org]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[grantwatson684(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[jungkookprivatefanemail(at)gmail.com]
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.221.44 listed in wl.mailspike.net]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
1.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.6 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases
Subject: {SPAM?} Attention Beneficiary.
MR GRANT WATSON
UNITED NATION INSPECTION AGENCY
HARTS FIELD-JACKSON INTERNATIONAL AIRPORT.
ATLANTA, GEORGIA.
I am GRANT WATSON Inspection Agency in Harts field-Jackson International
Airport Atlanta, Georgia. During our investigation, I discovered an
abandoned shipment through a Diplomat from UNITED KINGDOM (UK)
which was transferred from Cardiff International Airport. To our facility
here in Atlanta, and when scanned it revealed an undisclosed sum of money
in 2 Metal Trunk Boxes. The consignment was abandoned because the Content
was not properly declared by the consignee as money rather it was declared
as personal Effect/classified document to either avoid diversion by the
Shipping Agent or confiscation by the relevant authorities.
The diplomat's inability to pay for Non Inspection fees among other things
are the reason why the consignment is delayed and abandoned. By my
assessment, each of the boxes contains about $4M or more. They are still
left in the airport storage facility till today. The Consignments like I
said are two metal trunk boxes, the details of the consignment including
your name and email on the official document from United Nations' office
in UNITED KINGDOM AND IRELAND where the shipment was tagged as personal
effects/classified document is still available with us. As it stands
now, you have to reconfirm your Full name, Phone Number, full address so
I can cross-check and see if it corresponds with the one on the official
documents.
It is now left to you to decide if you are the beneficiary and still need
the consignment or allow us repatriate it back to IRELAND (place of
origin) as we were instructed. Like I did say again, the shipper abandoned
it and ran away most importantly because he gave a false declaration, he
could not pay for the yellow tag, he could not secure a valid non
inspection document(s), etc. I am ready to assist you in any way I can for
you to get back this packages if only you are willing to work with me with
trust. You can either come in person, or you engage the services of a
secure shipping/delivery Company/agent that will provide the necessary
security. That is required to deliver the package to your doorstep or the
destination of your choice. I need the entire guarantee that I can get
from you before I can get involved in this project.
Best Regards,
MR GRANT WATSON
INSPECTION OFFICER.
Email :grantwatson684@gmail.com
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments