Nigerian spam from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 01 Feb 2024 14:56:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rVf2D-000000006SQ-2URt
for dave@doctor.nl2k.ab.ca;
Thu, 01 Feb 2024 14:55:49 -0700
Resent-From: The Doctor
Resent-Date: Thu, 1 Feb 2024 14:55:49 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from omgroup.ge ([80.241.252.99]:38838 helo=mail.omgroup.ge)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rVexn-000000006Ff-497F
for sales@nk.ca;
Thu, 01 Feb 2024 14:51:20 -0700
Received: from omgroup.ge (omgroup.ge [80.241.252.99])
by mail.omgroup.ge (Postfix) with ESMTP id 80A7810E0D01;
Fri, 2 Feb 2024 01:49:11 +0400 (+04)
DKIM-Filter: OpenDKIM Filter v2.11.0 mail.omgroup.ge 80A7810E0D01
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII;
format=flowed
Content-Transfer-Encoding: 7bit
Date: Fri, 02 Feb 2024 01:49:11 +0400
From: "Mr James Oha,"
To: undisclosed-recipients:;
Subject: $12.5Million, ATM Master card Payment
Reply-To: obaj741@gmail.com
Mail-Reply-To: obaj741@gmail.com
Message-ID: <8f05524047651e631ee6df301a81551e@omgroup.ge>
X-Sender: onlylauram134@gmail.com
User-Agent: Roundcube Webmail/1.0.12
X-Spam_score: 28.4
X-Spam_score_int: 284
X-Spam_bar: ++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Mr James Oha, ATM Head of Operation ECO Bank Nigeria PLC
(ECO) $12.5Million, ATM Master card Payment Attention Beneficiary:
Content analysis details: (28.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is
CUSTOM_MED
0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.0 SUBJ_DOLLARS Subject starts with dollar amount
1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[onlylauram134(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[onlylauram134(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[obaj741(at)gmail.com]
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
1.1 HK_SCAM_N3 BODY: No description available.
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 ODD_FREEM_REPTO Has unusual reply-to header
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.0 MONEY_NOHTML Lots of money in plain text
2.0 HK_SCAM No description available.
1.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list
1.5 MONEY_ATM_CARD Lots of money on an ATM card
2.5 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 SPOOFED_FREEMAIL No description available.
1.0 SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} $12.5Million, ATM Master card Payment
X-Antivirus: AVG (VPS 240201-4, 2/1/2024), Inbound message
X-Antivirus-Status: Clean
--
Mr James Oha,
ATM Head of Operation
ECO Bank Nigeria PLC (ECO)
$12.5Million, ATM Master card Payment
Attention Beneficiary:
I am Mr James Oha, ATM Head of Operation Department ECO
Bank Nigeria PLC, I resumed to this office on the 5th of last Month
and during my official research last week I discovered an abandoned
ATM Master card valued sum of $12.5Million with card number
5321452123400355 belonging to you as the rightfully intimate
beneficiary.
I tried to know why this card have not been released to you but I was
told that the formal ATM head of operation who left this office two
months ago with-held your card for his own personal use without
knowing that I will not approve or support him to take your card.
Now that your ATM Master card is still available for you to pick it up
here in our bank, I want to know how you wish to receive your ATM card
along with your four digits pin code number.
You can come down here in our bank to pick up your card direct from my
office or alternatively it can be send to your address through any
registered reliable courier service company that you will take care of
the courier charge, I don't know the cost of shipping the card to you
but if you permit me I will go to the courier shipment company to find
out the cost, but in that case you will be required to forward to me
your shipment address to enable find out the shipment cost to your
location.
Your direct telephone number and address will be needed and more
details of your ATM card payment will be made known to you as soon as
I receive your swift positive response, to enable you know the amount
programmed for your ATM daily withdrawal. Do call me on:
as soon as you receive this message.
please email us here (obaj741@gmail.com)
Thanks For your anticipated co-operation and understanding. We will
serve You better.
Yours Faithfully,
Mr James Oha,
ECO Bank Management
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 01 Feb 2024 14:56:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rVf2D-000000006SQ-2URt
for dave@doctor.nl2k.ab.ca;
Thu, 01 Feb 2024 14:55:49 -0700
Resent-From: The Doctor
Resent-Date: Thu, 1 Feb 2024 14:55:49 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from omgroup.ge ([80.241.252.99]:38838 helo=mail.omgroup.ge)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rVexn-000000006Ff-497F
for sales@nk.ca;
Thu, 01 Feb 2024 14:51:20 -0700
Received: from omgroup.ge (omgroup.ge [80.241.252.99])
by mail.omgroup.ge (Postfix) with ESMTP id 80A7810E0D01;
Fri, 2 Feb 2024 01:49:11 +0400 (+04)
DKIM-Filter: OpenDKIM Filter v2.11.0 mail.omgroup.ge 80A7810E0D01
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII;
format=flowed
Content-Transfer-Encoding: 7bit
Date: Fri, 02 Feb 2024 01:49:11 +0400
From: "Mr James Oha,"
To: undisclosed-recipients:;
Subject: $12.5Million, ATM Master card Payment
Reply-To: obaj741@gmail.com
Mail-Reply-To: obaj741@gmail.com
Message-ID: <8f05524047651e631ee6df301a81551e@omgroup.ge>
X-Sender: onlylauram134@gmail.com
User-Agent: Roundcube Webmail/1.0.12
X-Spam_score: 28.4
X-Spam_score_int: 284
X-Spam_bar: ++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Mr James Oha, ATM Head of Operation ECO Bank Nigeria PLC
(ECO) $12.5Million, ATM Master card Payment Attention Beneficiary:
Content analysis details: (28.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is
CUSTOM_MED
0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.0 SUBJ_DOLLARS Subject starts with dollar amount
1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[onlylauram134(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[onlylauram134(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[obaj741(at)gmail.com]
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
1.1 HK_SCAM_N3 BODY: No description available.
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 ODD_FREEM_REPTO Has unusual reply-to header
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.0 MONEY_NOHTML Lots of money in plain text
2.0 HK_SCAM No description available.
1.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list
1.5 MONEY_ATM_CARD Lots of money on an ATM card
2.5 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 SPOOFED_FREEMAIL No description available.
1.0 SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} $12.5Million, ATM Master card Payment
X-Antivirus: AVG (VPS 240201-4, 2/1/2024), Inbound message
X-Antivirus-Status: Clean
--
Mr James Oha,
ATM Head of Operation
ECO Bank Nigeria PLC (ECO)
$12.5Million, ATM Master card Payment
Attention Beneficiary:
I am Mr James Oha, ATM Head of Operation Department ECO
Bank Nigeria PLC, I resumed to this office on the 5th of last Month
and during my official research last week I discovered an abandoned
ATM Master card valued sum of $12.5Million with card number
5321452123400355 belonging to you as the rightfully intimate
beneficiary.
I tried to know why this card have not been released to you but I was
told that the formal ATM head of operation who left this office two
months ago with-held your card for his own personal use without
knowing that I will not approve or support him to take your card.
Now that your ATM Master card is still available for you to pick it up
here in our bank, I want to know how you wish to receive your ATM card
along with your four digits pin code number.
You can come down here in our bank to pick up your card direct from my
office or alternatively it can be send to your address through any
registered reliable courier service company that you will take care of
the courier charge, I don't know the cost of shipping the card to you
but if you permit me I will go to the courier shipment company to find
out the cost, but in that case you will be required to forward to me
your shipment address to enable find out the shipment cost to your
location.
Your direct telephone number and address will be needed and more
details of your ATM card payment will be made known to you as soon as
I receive your swift positive response, to enable you know the amount
programmed for your ATM daily withdrawal. Do call me on:
as soon as you receive this message.
please email us here (obaj741@gmail.com)
Thanks For your anticipated co-operation and understanding. We will
serve You better.
Yours Faithfully,
Mr James Oha,
ECO Bank Management
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments