Nigerian spam from Google Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jul 2024 10:50:00 -0600

Received: from mail-ed1-f51.google.com ([209.85.208.51]:46086)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1sVDGa-000000009ez-1WgV

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jul 2024 10:49:08 -0600

Received: by mail-ed1-f51.google.com with SMTP id 4fb4d7f45d1cf-5a10bb7b237so2119266a12.0

for ; Sat, 20 Jul 2024 09:47:09 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1721494023; x=1722098823; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:in-reply-to:references

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=ZEgpHqie6U1sGpAclZpzBQxoImQkUb7xbRzzbn1gez4=;

b=GXyMrxFE1kg1FBPtz8XVmAldClc4bN3/Ulsh/+JmP6YaiCOQPZ4K6HQnkxejRW2ekW

/afpkjUZ5vi9O0E4lYbPTq1lkmTe6H8TIJcNtPDub7rkpYCLtfxqvzQyZVOqimGKqfHY

5qmIuX0tI9BXDQZAQg8ochyqfR0MhtQV2JgspqD0xVb2JoPXuASv6Uh95feylYLucLq5

aKtA5HfSJj5HXrpuLxVV03DAS365tRHIjTsOPB3mXA0rjNM9vurDorgtFJQbDf7mwY2K

tu7f00y+1+131/VbQOs7O8ZZY2H7l5yL8iK8viSGFUfnZSnoCsuk1WCHXxWfFTIdszSf

O0Og==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1721494023; x=1722098823;

h=to:subject:message-id:date:from:reply-to:in-reply-to:references

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=ZEgpHqie6U1sGpAclZpzBQxoImQkUb7xbRzzbn1gez4=;

b=Yddyy1OJs8D2o9bt1HBCO8QYslnlKAey6QT9gDGbZWmZNSKR6WHEohYAVi0tpGpxvV

axsrE/kCW1lgBHfFavcDF31x3dUC9Cqi/UJl0LXCGSbylDQOjK7qIovlNv9DNT8KMlV3

0A5/jphnJCIC4wwTJNwcwC3r+A3zVtt68Lp0JSCuhClVWE0j429PIKzryASkU2bmC8q4

8MRIjD7ID8QgoNOStTO+lTS2gKisNQT7/KocmtWhWKsRrINkjMAuJnLoH9HO50YYE7e0

g3OK3yxROObnR2utLh8TN0GfqffyDAxiCz9vr63G4pZQ/4G26+/i0eHZ6EaLCLuW4307

hDNQ==

X-Forwarded-Encrypted: i=1; AJvYcCVBCigEhcK4XxsJo0ejNm05RRiJviPbDNf94uWBSjfjSFcSoZ4Vm5ILA+Y5j1kWt0WcI1ih8O3JPvbhxQRc/JKbBAOBeofi

X-Gm-Message-State: AOJu0YyLO+6uaE0JlRW8PChSgQzrhJVcaEQLYCtn/uYHGr0MOij6WCN8

/BNXPPUWMjmYR80dfCLGWTQF17IxQllNJbInIFCqfSSDu99/eOQ3KP12fyNuEzCmaztQFME0jNQ

wymD8bvvnlDNvA0xwFWpoZ3bYumA=

X-Google-Smtp-Source: AGHT+IEqIbiU6vNlo/v+FHQxOo9QnJDL/E5HMLZUwxUYFvhAJ7TylaAz0tU64fvQCmic749YA+9byNCeH/QXCuvXpWY=

X-Received: by 2002:a50:bb6c:0:b0:5a2:c750:f47d with SMTP id

4fb4d7f45d1cf-5a479f562c6mr1110720a12.12.1721494022742; Sat, 20 Jul 2024

09:47:02 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

Reply-To: cfc.ubagroup02@gmail.com

From: kristalina georgieva

Date: Sat, 20 Jul 2024 17:44:03 +0100

Message-ID:

Subject: Attention please

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000b569ed061db08f30"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 16.0

X-Spam_score_int: 160

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Beneficiary, I sent this letter to you a month ago, but

I did not hear from you, I'm not sure if you got it, And that is why I sent

it again, Firstly, I'm Mrs. Kristalina Georgieva, Managing Dire [...]



Content analysis details: (16.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.51 listed in dnsbl.ahbl.org]

[209.85.208.51 listed in dnsbl.ahbl.org]

[209.85.208.51 listed in dnsbl.ahbl.org]

[209.85.208.51 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.51 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.51 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.51 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.51 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.51 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.51 listed in list.dnswl.org]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[carlsmith3241(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[carlsmith3241(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[cfc.ubagroup02(at)gmail.com]

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 LOTS_OF_MONEY Huge... sums of money

3.1 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

0.7 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Attention please



--000000000000b569ed061db08f30

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Dear Beneficiary,

I sent this letter to you a month ago, but I did not hear from you, I'm not

sure if you got it, And that is why I sent it again, Firstly, I'm Mrs.

Kristalina Georgieva, Managing Director and Chairwoman of the International

Monetary Fund.



Indeed We have reviewed all the obstacles and problems surrounded your

uncompleted transaction and your inability to meet up with transfer charges

levied, against you, for the past transfer options, view our site for your

confirmation 38=C2=B053=E2=80=B256=E2=80=B3N 77=C2=B02=E2=80=B239=E2=80=B3W



We are the Board of Directors, World Bank and International Monetary Fund

(IMF) Washington, D.C. in conjunction with The U.S. Department of the

Treasury and some other relevant Investigation Agencies here in the United

States of America. has ordered our Foreign Payment Remittance Unit, United

Bank of Africa Lome Togo to issue you a VISA Card, where your fund $1.5

million will be uploaded, for further withdrawal of your fund.



During the course of our investigation, we discovered with dismay that your

payment has been delayed by corrupt officials of the Bank who are Trying to

divert your funds into their private accounts.



And today we notify you that your fund has been credited into a VISA Card

by UBA Bank and also ready to be delivered. Now contact UBA Bank director

his name is Mr. Tony Elumelu, email: (cfc.ubagroup02@gmail.com) to direct

you on how to receive your ATM VISA card.



Sincerely,



Mrs. Kristalina Georgieva



--000000000000b569ed061db08f30

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Dear Beneficiary, =C2=A0

v dir=3D"ltr">I sent this letter to you a month ago, but I did not hear fro=

m you, I'm not sure if you got it, And that is why I sent it again, Fir=

stly, I'm Mrs. Kristalina Georgieva, Managing Director and Chairwoman o=

f the International Monetary Fund.

Indeed We have reviewed all the o=

bstacles and problems surrounded your uncompleted transaction and your inab=

ility to meet up with transfer charges levied, against you, for the past tr=

ansfer options, view our site for your confirmation 38=C2=B053=E2=80=B256=

=E2=80=B3N 77=C2=B02=E2=80=B239=E2=80=B3W

We are the Board of Direct=

ors, World Bank and International Monetary Fund (IMF) Washington, D.C. in c=

onjunction with The U.S. Department of the Treasury and some other relevant=

Investigation Agencies here in the United States of America. has ordered o=

ur Foreign Payment Remittance Unit, United Bank of Africa Lome Togo to issu=

e you a VISA Card, where your fund $1.5 million will be uploaded, for furth=

er withdrawal of your fund.

During the course of our investigation, =

we discovered with dismay that your payment has been delayed by corrupt off=

icials of the Bank who are Trying to divert your funds into their private a=

ccounts.

And today we notify you that your fund has been credited in=

to a VISA Card by UBA Bank and also ready to be delivered. Now contact UBA =

Bank director his name is Mr. Tony Elumelu, email: (
bagroup02@gmail.com" target=3D"_blank">cfc.ubagroup02@gmail.com
) to dir=

ect you on how to receive your ATM VISA card.

Sincerely,

Mrs.=

Kristalina Georgieva






--000000000000b569ed061db08f30--

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA 1CAPTCHA 2CAPTCHA 3CAPTCHA 4CAPTCHA 5


Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA 1CAPTCHA 2CAPTCHA 3CAPTCHA 4CAPTCHA 5