Nigerian spam from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 07 Feb 2024 10:39:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rXlsh-000000007EX-06dE
for dave@doctor.nl2k.ab.ca;
Wed, 07 Feb 2024 10:38:43 -0700
Resent-From: The Doctor
Resent-Date: Wed, 7 Feb 2024 10:38:43 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yw1-f172.google.com ([209.85.128.172]:59510)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rXkCA-00000000CwC-1hbz
for doctor@nk.ca;
Wed, 07 Feb 2024 08:50:45 -0700
Received: by mail-yw1-f172.google.com with SMTP id 00721157ae682-6049c6f79b1so3797647b3.2
for; Wed, 07 Feb 2024 07:48:47 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1707320922; x=1707925722; darn=nk.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=Ud7W4pwthtRSnjlwyfwOHXWb8gFJciIeFECbMRgV79A=;
b=J6L7Ljs2rbQyEnUe5XJhd+oI9Tx8CKFyEAaHh6Dfjn0s+7DhFxy3QxZzYsSEn1wniU
U46LQ0mBEUnB/d3+40ByzckDeUaUcOJZaulOib/G/lyLKgugMc3kBaM63ouEuYj11Lg5
5TIYVSHsgM8+qZwHdciirRWil+RVQ+j0gICGw8D0y/cdxXz2OQfXZjBpyM4NOVX1VmYN
rDGM0Iv1QWhwVVZSnQj9CNJXZ6sH4qIXMGO9wmUaVyIjftDNUU/U1OXY5JbLGOvMLv32
uVyqD5z+6F4e8/dl/jZzqC9K9NlaN+eAyLcu8evSp4jYDQ7KQSB6D9x4ojVjVKtMAM0J
vMXg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1707320922; x=1707925722;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=Ud7W4pwthtRSnjlwyfwOHXWb8gFJciIeFECbMRgV79A=;
b=nAoZ7Z7hEEzSvrnyHb1Mhvtjerg5Nqo2iRpNVxowDm1i1iV8USSo4V+mTBWo893r03
H/X/sr9m/WJBQu/8OsUgf9sxlsGAxD/HFnEXqhNE0TlF/BKrqCsOYeBY2gjm+cJsj8q0
CENT5zmqx2++6NoSkarPkRq1KGYY2M4RpfNF0lc7kYEK3Xn5LKmt8GQSY9gCBhPhQxaB
J3DCtQIVUvFWT7gPvyrsP36W5PBP3bOy67ubiq32xXqpQ2HuecuxAM2HuCPOpftXMC+o
RqIJJwmK7au+z3z35nFdLhFsnqbGn5OsMPg0EG0bFb+0aXMc8gBZ5fr5lqvisMQgXjAS
cWLg==
X-Gm-Message-State: AOJu0Yz6dzpk7mCK9e98jgCpW2ncH4BQxXmfLtLThlyycmRm8EiWYCtd
qyXIXQ/5djcxwj2D/NkDhK4h05z7J9bWAghnk+n6HjUYWzckKqFPIbeXWQsCMtIhpepRCvw7mus
ETe9GVzkS45r9ZN1aSyAxtZV9YZU=
X-Google-Smtp-Source: AGHT+IGqKWW3iKV1Fux1UR6ATOxI7I/xNkjI3TqWP6niZ1guTRcxkrc20PJtXLPC3TPeR2dkob3VGRY/2Maqy4A0Wp8=
X-Received: by 2002:a05:6902:2293:b0:dbe:9cee:7d11 with SMTP id
dn19-20020a056902229300b00dbe9cee7d11mr5359711ybb.59.1707320921284; Wed, 07
Feb 2024 07:48:41 -0800 (PST)
MIME-Version: 1.0
Received: by 2002:a05:7000:ba08:b0:555:7255:daa0 with HTTP; Wed, 7 Feb 2024
07:48:40 -0800 (PST)
Reply-To: dongood910@gmail.com
From: Jerome Powell
Date: Wed, 7 Feb 2024 07:48:40 -0800
Message-ID:
Subject: Central Bank of USA
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@nk.ca
X-Spam_score: 11.3
X-Spam_score_int: 113
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- I am now in charge of your fund payment in my department
here in Central Bank of USA (CBN) and like i stated in my mail that your
name appear in our Central Computer here as a beneficiary who have not [...]
Content analysis details: (11.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.128.172 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.128.172 listed in wl.mailspike.net]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[homelandsamuel48(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[homelandsamuel48(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[dongood910(at)gmail.com]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
1.5 MONEY_ATM_CARD Lots of money on an ATM card
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 MONEY_NOHTML Lots of money in plain text
1.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Central Bank of USA
X-Antivirus: AVG (VPS 240207-4, 2/7/2024), Inbound message
X-Antivirus-Status: Clean
--
I am now in charge of your fund payment in my department here in
Central Bank of USA (CBN) and like i stated in my mail that your
name appear in our Central Computer here as a beneficiary who have not
receive his contract payment for long, Be informed that your fund
of USD $5000,Million Dollars has been approved by the (IMF) and the federal
government for payment and we have decided to convert your fund into
an (ATM CARD) which we will send to you in your country for the
withdrawal of your fund in any ATM machine in your country.
To make it easy for your payment in order to avoid many expenses in
receiving your funds, we have made every arrangement regarding your
payment through (ATM CARD) since last week Due to the instruction
given to us for your immediate payment.
I have to inform you again, That we are not playing over this, I know
my reason for the continuous sending of this notification to you, The
fact is that you can't seem to trust any one again over this payment
for what you have been in cantered in many Year/months ago, But i want
you to trust me, I cannot scam you for $50 It is for bank processing
of your ATM CARD, The fees of $50 is clearly written to you before, I
did not invent the bill to defraud you of $50 It is an official bank
ATM CARD processing fee, And the good part of this, Is that you will
never, Ever be disturbed again over any kind of payment, This is
final, And the forms from there becomes effective once we submit your
ATM CARD application processing fee and pay the form fee of $50 don't
want you to loose this ATM CARD this time,
Thank you and God bless you.
Name/ Jerome Powell
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 07 Feb 2024 10:39:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rXlsh-000000007EX-06dE
for dave@doctor.nl2k.ab.ca;
Wed, 07 Feb 2024 10:38:43 -0700
Resent-From: The Doctor
Resent-Date: Wed, 7 Feb 2024 10:38:43 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yw1-f172.google.com ([209.85.128.172]:59510)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rXkCA-00000000CwC-1hbz
for doctor@nk.ca;
Wed, 07 Feb 2024 08:50:45 -0700
Received: by mail-yw1-f172.google.com with SMTP id 00721157ae682-6049c6f79b1so3797647b3.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1707320922; x=1707925722; darn=nk.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=Ud7W4pwthtRSnjlwyfwOHXWb8gFJciIeFECbMRgV79A=;
b=J6L7Ljs2rbQyEnUe5XJhd+oI9Tx8CKFyEAaHh6Dfjn0s+7DhFxy3QxZzYsSEn1wniU
U46LQ0mBEUnB/d3+40ByzckDeUaUcOJZaulOib/G/lyLKgugMc3kBaM63ouEuYj11Lg5
5TIYVSHsgM8+qZwHdciirRWil+RVQ+j0gICGw8D0y/cdxXz2OQfXZjBpyM4NOVX1VmYN
rDGM0Iv1QWhwVVZSnQj9CNJXZ6sH4qIXMGO9wmUaVyIjftDNUU/U1OXY5JbLGOvMLv32
uVyqD5z+6F4e8/dl/jZzqC9K9NlaN+eAyLcu8evSp4jYDQ7KQSB6D9x4ojVjVKtMAM0J
vMXg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1707320922; x=1707925722;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=Ud7W4pwthtRSnjlwyfwOHXWb8gFJciIeFECbMRgV79A=;
b=nAoZ7Z7hEEzSvrnyHb1Mhvtjerg5Nqo2iRpNVxowDm1i1iV8USSo4V+mTBWo893r03
H/X/sr9m/WJBQu/8OsUgf9sxlsGAxD/HFnEXqhNE0TlF/BKrqCsOYeBY2gjm+cJsj8q0
CENT5zmqx2++6NoSkarPkRq1KGYY2M4RpfNF0lc7kYEK3Xn5LKmt8GQSY9gCBhPhQxaB
J3DCtQIVUvFWT7gPvyrsP36W5PBP3bOy67ubiq32xXqpQ2HuecuxAM2HuCPOpftXMC+o
RqIJJwmK7au+z3z35nFdLhFsnqbGn5OsMPg0EG0bFb+0aXMc8gBZ5fr5lqvisMQgXjAS
cWLg==
X-Gm-Message-State: AOJu0Yz6dzpk7mCK9e98jgCpW2ncH4BQxXmfLtLThlyycmRm8EiWYCtd
qyXIXQ/5djcxwj2D/NkDhK4h05z7J9bWAghnk+n6HjUYWzckKqFPIbeXWQsCMtIhpepRCvw7mus
ETe9GVzkS45r9ZN1aSyAxtZV9YZU=
X-Google-Smtp-Source: AGHT+IGqKWW3iKV1Fux1UR6ATOxI7I/xNkjI3TqWP6niZ1guTRcxkrc20PJtXLPC3TPeR2dkob3VGRY/2Maqy4A0Wp8=
X-Received: by 2002:a05:6902:2293:b0:dbe:9cee:7d11 with SMTP id
dn19-20020a056902229300b00dbe9cee7d11mr5359711ybb.59.1707320921284; Wed, 07
Feb 2024 07:48:41 -0800 (PST)
MIME-Version: 1.0
Received: by 2002:a05:7000:ba08:b0:555:7255:daa0 with HTTP; Wed, 7 Feb 2024
07:48:40 -0800 (PST)
Reply-To: dongood910@gmail.com
From: Jerome Powell
Date: Wed, 7 Feb 2024 07:48:40 -0800
Message-ID:
Subject: Central Bank of USA
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@nk.ca
X-Spam_score: 11.3
X-Spam_score_int: 113
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- I am now in charge of your fund payment in my department
here in Central Bank of USA (CBN) and like i stated in my mail that your
name appear in our Central Computer here as a beneficiary who have not [...]
Content analysis details: (11.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.128.172 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.128.172 listed in wl.mailspike.net]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[homelandsamuel48(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[homelandsamuel48(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[dongood910(at)gmail.com]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
1.5 MONEY_ATM_CARD Lots of money on an ATM card
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 MONEY_NOHTML Lots of money in plain text
1.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Central Bank of USA
X-Antivirus: AVG (VPS 240207-4, 2/7/2024), Inbound message
X-Antivirus-Status: Clean
--
I am now in charge of your fund payment in my department here in
Central Bank of USA (CBN) and like i stated in my mail that your
name appear in our Central Computer here as a beneficiary who have not
receive his contract payment for long, Be informed that your fund
of USD $5000,Million Dollars has been approved by the (IMF) and the federal
government for payment and we have decided to convert your fund into
an (ATM CARD) which we will send to you in your country for the
withdrawal of your fund in any ATM machine in your country.
To make it easy for your payment in order to avoid many expenses in
receiving your funds, we have made every arrangement regarding your
payment through (ATM CARD) since last week Due to the instruction
given to us for your immediate payment.
I have to inform you again, That we are not playing over this, I know
my reason for the continuous sending of this notification to you, The
fact is that you can't seem to trust any one again over this payment
for what you have been in cantered in many Year/months ago, But i want
you to trust me, I cannot scam you for $50 It is for bank processing
of your ATM CARD, The fees of $50 is clearly written to you before, I
did not invent the bill to defraud you of $50 It is an official bank
ATM CARD processing fee, And the good part of this, Is that you will
never, Ever be disturbed again over any kind of payment, This is
final, And the forms from there becomes effective once we submit your
ATM CARD application processing fee and pay the form fee of $50 don't
want you to loose this ATM CARD this time,
Thank you and God bless you.
Name/ Jerome Powell
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments