Nigerian spam from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 16 Oct 2023 07:05:03 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96.1 (FreeBSD))
(envelope-from)
id 1qsNGc-0009hf-0w
for dave@doctor.nl2k.ab.ca;
Mon, 16 Oct 2023 07:04:18 -0600
Resent-From: The Doctor
Resent-Date: Mon, 16 Oct 2023 07:04:18 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ua1-f44.google.com ([209.85.222.44]:55802)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96.1 (FreeBSD))
(envelope-from)
id 1qsLyI-000AXr-2T
for doctor@doctor.nl2k.ab.ca;
Mon, 16 Oct 2023 05:41:22 -0600
Received: by mail-ua1-f44.google.com with SMTP id a1e0cc1a2514c-7ae1a075fc5so1798110241.3
for; Mon, 16 Oct 2023 04:39:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1697456354; x=1698061154; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=z7KgdhX73Px/XAUY/6FM43CHhCIi+36rzKdERme09LY=;
b=GadNjz1FlHjXXuGFbCe4TF0kLFIMgu5+3hkXscskU+qF4L+WUXQlkOCncMjBQBeMyI
cRM5W03vKrRQT+t0FBphyaUb9UXb4GKY1Ja+gd5Q7kEf/ssiy/DT++m9CxI5/+XcvAMm
djAKU9PfveQMwanOqGJ44w9xuMJjiDlBlfu1qznOSHgDfvyn72d6x1JBJq8qT1Ahln5d
g/RHYN/kwPa/wxBh/4U42id/zQhKpwHPTS5YOlnmYID5EOZNKiuACHi0D8lmMQxUQfBJ
xK6a+JhkcFndCvTS3abndHhOFsf03V4Gt85ZTcwUTVstcWrKff2loIN8DxFFCsUXdmVX
WiSA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1697456354; x=1698061154;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=z7KgdhX73Px/XAUY/6FM43CHhCIi+36rzKdERme09LY=;
b=oHm0l9eoe8NgjuqugiwmFoJg0od+IfSe/aLv1mAWKYZUoqTINn4SSpMZbPJPWiUR5A
fbMIWFmSsZiKsehksgN2utGDdCpBPKdZsg7sm0IgFGJM4WGtbt447c27eJtRTh7jXq46
dsfaQ+TnHLoII+Q6uU4CVusg/4KNynWmAMu/+2jfleIQrHahRnweDmTDvC6DMk1CW6cj
fULsVgp0NDU60aqWieSB2Yjis8/msgLy8EEqpROTvZrtztWX3BBfAgZaKvZ4/qscRvXo
64sNMBG2CpiegnuKAou+Qy/4MwrsCw7az4MTMBBDepJ0dit8whkMrhZ0vtCPURBgLsaq
FCPw==
X-Gm-Message-State: AOJu0YxUGyU7OzBHglCDnqY3n279pEtING7EBN0ZTA4oixQkULuWfoTn
RnvAAbryOd/Vnm9B1zXZZvtMKtL41OXqQl8wha0=
X-Google-Smtp-Source: AGHT+IEkKgr98ctiX8WQy/nWm3VkWZE1bS9cEQPA894W1pwGTWYR1eJP4oTYv0BvRUPvHl7LblciEYrUuQo8ny/nEak=
X-Received: by 2002:a1f:db84:0:b0:495:be1c:5be9 with SMTP id
s126-20020a1fdb84000000b00495be1c5be9mr26468933vkg.1.1697456353964; Mon, 16
Oct 2023 04:39:13 -0700 (PDT)
MIME-Version: 1.0
Reply-To: Office.office454@email.com
From: Office of Department
Date: Mon, 16 Oct 2023 04:39:00 -0700
Message-ID:
Subject: Hey Dear
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000ffff7b0607d3da99"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 19.5
X-Spam_score_int: 195
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attention: Dear Beneficiary, Kindly, be informed that your
Inheritance payment of Us$6.500.000.00 Million Dollars has been re-scheduled
by (boards) to be transfer to you through a credit Online Bank t [...]
Content analysis details: (19.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.222.44 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ojojbj9(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[ojojbj9(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[office.office454(at)email.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.222.44 listed in wl.mailspike.net]
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.0 HTML_MESSAGE BODY: HTML included in message
2.9 YOU_INHERIT Discussing your inheritance
0.0 LOTS_OF_MONEY Huge... sums of money
2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.7 UNDISC_MONEY Undisclosed recipients + money/fraud signs
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
2.3 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
Subject: {SPAM?} Hey Dear
X-Antivirus: AVG (VPS 231016-0, 10/15/2023), Inbound message
X-Antivirus-Status: Clean
--000000000000ffff7b0607d3da99
Content-Type: text/plain; charset="UTF-8"
Attention: Dear Beneficiary,
Kindly, be informed that your Inheritance payment of Us$6.500.000.00
Million Dollars has been re-scheduled by (boards) to be transfer to you
through a credit Online Bank to Bank Wire transfer or Atm Visa Card, into
your nominated account of your choice OR delivery.
This is t avoid any form of delay in the transfer.
Contact Bank Group with your payment details for the immediate
transfer.( FOREIGN BANK ) Foreign Operation Manager: Mr. Anthony Whean.
Have it in mind that your information is highly protected by this great
Bank.
We look forward to serving you with the best of our service.
Yours in Service,
Mr. Philip White.
Consular,
Payment Coordinator.
--000000000000ffff7b0607d3da99
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--000000000000ffff7b0607d3da99--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 16 Oct 2023 07:05:03 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96.1 (FreeBSD))
(envelope-from
id 1qsNGc-0009hf-0w
for dave@doctor.nl2k.ab.ca;
Mon, 16 Oct 2023 07:04:18 -0600
Resent-From: The Doctor
Resent-Date: Mon, 16 Oct 2023 07:04:18 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ua1-f44.google.com ([209.85.222.44]:55802)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96.1 (FreeBSD))
(envelope-from
id 1qsLyI-000AXr-2T
for doctor@doctor.nl2k.ab.ca;
Mon, 16 Oct 2023 05:41:22 -0600
Received: by mail-ua1-f44.google.com with SMTP id a1e0cc1a2514c-7ae1a075fc5so1798110241.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1697456354; x=1698061154; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=z7KgdhX73Px/XAUY/6FM43CHhCIi+36rzKdERme09LY=;
b=GadNjz1FlHjXXuGFbCe4TF0kLFIMgu5+3hkXscskU+qF4L+WUXQlkOCncMjBQBeMyI
cRM5W03vKrRQT+t0FBphyaUb9UXb4GKY1Ja+gd5Q7kEf/ssiy/DT++m9CxI5/+XcvAMm
djAKU9PfveQMwanOqGJ44w9xuMJjiDlBlfu1qznOSHgDfvyn72d6x1JBJq8qT1Ahln5d
g/RHYN/kwPa/wxBh/4U42id/zQhKpwHPTS5YOlnmYID5EOZNKiuACHi0D8lmMQxUQfBJ
xK6a+JhkcFndCvTS3abndHhOFsf03V4Gt85ZTcwUTVstcWrKff2loIN8DxFFCsUXdmVX
WiSA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1697456354; x=1698061154;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=z7KgdhX73Px/XAUY/6FM43CHhCIi+36rzKdERme09LY=;
b=oHm0l9eoe8NgjuqugiwmFoJg0od+IfSe/aLv1mAWKYZUoqTINn4SSpMZbPJPWiUR5A
fbMIWFmSsZiKsehksgN2utGDdCpBPKdZsg7sm0IgFGJM4WGtbt447c27eJtRTh7jXq46
dsfaQ+TnHLoII+Q6uU4CVusg/4KNynWmAMu/+2jfleIQrHahRnweDmTDvC6DMk1CW6cj
fULsVgp0NDU60aqWieSB2Yjis8/msgLy8EEqpROTvZrtztWX3BBfAgZaKvZ4/qscRvXo
64sNMBG2CpiegnuKAou+Qy/4MwrsCw7az4MTMBBDepJ0dit8whkMrhZ0vtCPURBgLsaq
FCPw==
X-Gm-Message-State: AOJu0YxUGyU7OzBHglCDnqY3n279pEtING7EBN0ZTA4oixQkULuWfoTn
RnvAAbryOd/Vnm9B1zXZZvtMKtL41OXqQl8wha0=
X-Google-Smtp-Source: AGHT+IEkKgr98ctiX8WQy/nWm3VkWZE1bS9cEQPA894W1pwGTWYR1eJP4oTYv0BvRUPvHl7LblciEYrUuQo8ny/nEak=
X-Received: by 2002:a1f:db84:0:b0:495:be1c:5be9 with SMTP id
s126-20020a1fdb84000000b00495be1c5be9mr26468933vkg.1.1697456353964; Mon, 16
Oct 2023 04:39:13 -0700 (PDT)
MIME-Version: 1.0
Reply-To: Office.office454@email.com
From: Office of Department
Date: Mon, 16 Oct 2023 04:39:00 -0700
Message-ID:
Subject: Hey Dear
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000ffff7b0607d3da99"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 19.5
X-Spam_score_int: 195
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attention: Dear Beneficiary, Kindly, be informed that your
Inheritance payment of Us$6.500.000.00 Million Dollars has been re-scheduled
by (boards) to be transfer to you through a credit Online Bank t [...]
Content analysis details: (19.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.222.44 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ojojbj9(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[ojojbj9(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[office.office454(at)email.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.222.44 listed in wl.mailspike.net]
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.0 HTML_MESSAGE BODY: HTML included in message
2.9 YOU_INHERIT Discussing your inheritance
0.0 LOTS_OF_MONEY Huge... sums of money
2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.7 UNDISC_MONEY Undisclosed recipients + money/fraud signs
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
2.3 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
Subject: {SPAM?} Hey Dear
X-Antivirus: AVG (VPS 231016-0, 10/15/2023), Inbound message
X-Antivirus-Status: Clean
--000000000000ffff7b0607d3da99
Content-Type: text/plain; charset="UTF-8"
Attention: Dear Beneficiary,
Kindly, be informed that your Inheritance payment of Us$6.500.000.00
Million Dollars has been re-scheduled by (boards) to be transfer to you
through a credit Online Bank to Bank Wire transfer or Atm Visa Card, into
your nominated account of your choice OR delivery.
This is t avoid any form of delay in the transfer.
Contact Bank Group with your payment details for the immediate
transfer.( FOREIGN BANK ) Foreign Operation Manager: Mr. Anthony Whean.
Have it in mind that your information is highly protected by this great
Bank.
We look forward to serving you with the best of our service.
Yours in Service,
Mr. Philip White.
Consular,
Payment Coordinator.
--000000000000ffff7b0607d3da99
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Attention: Dear Beneficiary,
Kindly, be informed that y=
our Inheritance payment of Us$6.500.000.00 Million Dollars has been re-sche=
duled by (boards) to be transfer =C2=A0to you through a credit Online Bank =
to Bank Wire transfer or Atm Visa Card, into your nominated account of your=
choice OR delivery.
This is t avoid any form of delay in the transfer.=
Contact Bank Group with your payment details for the immediate
tran=
sfer.( FOREIGN BANK ) Foreign Operation Manager: Mr. Anthony Whean.
Hav=
e it in mind that your information is highly protected by this great Bank. =
We look forward to serving you with the best of our service.
Yours i=
n Service,
Mr. Philip White.
Consular,
Payment =C2=A0Coordinator.<=
br>
Kindly, be informed that y=
our Inheritance payment of Us$6.500.000.00 Million Dollars has been re-sche=
duled by (boards) to be transfer =C2=A0to you through a credit Online Bank =
to Bank Wire transfer or Atm Visa Card, into your nominated account of your=
choice OR delivery.
This is t avoid any form of delay in the transfer.=
Contact Bank Group with your payment details for the immediate
tran=
sfer.( FOREIGN BANK ) Foreign Operation Manager: Mr. Anthony Whean.
Hav=
e it in mind that your information is highly protected by this great Bank. =
We look forward to serving you with the best of our service.
Yours i=
n Service,
Mr. Philip White.
Consular,
Payment =C2=A0Coordinator.<=
br>
--000000000000ffff7b0607d3da99--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments