Nigerian Spam
Posted by Dave Yadallee on
        Return-path: 
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 03 Nov 2025 15:30:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vG33Q-00000000Dkj-47sm
for dave@doctor.nl2k.ab.ca;
Mon, 03 Nov 2025 15:29:36 -0700
Resent-From: The Doctor
Resent-Date: Mon, 3 Nov 2025 15:29:36 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [162.240.16.124] (port=48822 helo=6588504.thewdwguru.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vG0SR-00000000IYP-39AO
for mailer-daemon@doctor.nl2k.ab.ca;
Mon, 03 Nov 2025 12:43:24 -0700
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=thewdwguru.com; s=default; h=Content-Transfer-Encoding:Content-Type:
MIME-Version:Message-ID:Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=r9Sx96i7Ozp+b1xbDDjaJlOEGOFyruM5UPHcNdzUR2w=; b=nGzewA8JD6ECvme6DdB1XaL4Gb
917qn3xd47ADtfNMecFC6+U80YSdPd6iYS0fO9JuQFFaATo7fhRiTbMCpUOEXV+VOeGvp3NZv5+v+
uIuDQflqekRxnh7ViGspoCKej7IwHp9uIJiQ5aNpRN5vDtxy0gdEyVzZocmKSfFB/4Za7mA9KNcTx
LQ5ePSKpEovKQZCiJnz/Tu8Nwc64vMcQ6ZEWaNMm4OdIuieQxM2NmO6729sDTVZjIyoogWu3tZEF4
MFPl6oghgsEhBgQ5J1trOZ68JizujNMq4OexUY9uRFNVOHS9Nqt4U3bv/r32myKMb4q+/D2hBxsNx
34Zawkuw==;
Received: from [77.90.185.220] (port=10887)
by 6588504.thewdwguru.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.98.1)
(envelope-from)
id 1vG0Rf-000000007vu-1CDS
for mailer-daemon@doctor.nl2k.ab.ca;
Mon, 03 Nov 2025 13:42:27 -0600
Reply-To: francoisedmond000012345678@gmail.com
From: Francois Edmond
To: mailer-daemon@doctor.nl2k.ab.ca
Subject: Urgent''
Date: 3 Nov 2025 11:42:25 -0800
Message-ID: <20251103114225.327344381DAB4929@thewdwguru.com>
MIME-Version: 1.0
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - 6588504.thewdwguru.com
X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - thewdwguru.com
X-Get-Message-Sender-Via: 6588504.thewdwguru.com: authenticated_id: admin@thewdwguru.com
X-Authenticated-Sender: 6588504.thewdwguru.com: admin@thewdwguru.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 27.8
X-Spam_score_int: 278
X-Spam_bar: +++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
 
Content preview: Greetings, First and foremost, I extend my apologies for reaching
out to you in this unsolicited manner. I understand that initiating contact
in this way may seem unconventional for establishing trust, but I tru [...]
    
 
Content analysis details: (27.8 points, 5.0 required)
 
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[77.90.185.220 listed in will-spam-for-food.eu.org]
[77.90.185.220 listed in will-spam-for-food.eu.org]
[77.90.185.220 listed in will-spam-for-food.eu.org]
[77.90.185.220 listed in will-spam-for-food.eu.org]
[77.90.185.220 listed in will-spam-for-food.eu.org]
[77.90.185.220 listed in will-spam-for-food.eu.org]
[77.90.185.220 listed in will-spam-for-food.eu.org]
[77.90.185.220 listed in will-spam-for-food.eu.org]
[162.240.16.124 listed in will-spam-for-food.eu.org]
[162.240.16.124 listed in will-spam-for-food.eu.org]
[162.240.16.124 listed in will-spam-for-food.eu.org]
[162.240.16.124 listed in will-spam-for-food.eu.org]
[162.240.16.124 listed in will-spam-for-food.eu.org]
[162.240.16.124 listed in will-spam-for-food.eu.org]
[162.240.16.124 listed in will-spam-for-food.eu.org]
[162.240.16.124 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[77.90.185.220 listed in dnsbl.ahbl.org]
[77.90.185.220 listed in dnsbl.ahbl.org]
[77.90.185.220 listed in dnsbl.ahbl.org]
[77.90.185.220 listed in dnsbl.ahbl.org]
[162.240.16.124 listed in dnsbl.ahbl.org]
[162.240.16.124 listed in dnsbl.ahbl.org]
[162.240.16.124 listed in dnsbl.ahbl.org]
[162.240.16.124 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[77.90.185.220 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[77.90.185.220 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[77.90.185.220 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[77.90.185.220 listed in dnsbl.ahbl.org]
3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[77.90.185.220 listed in zen.spamhaus.org]
2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[77.90.185.220 listed in zen.spamhaus.org]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[77.90.185.220 listed in sbl-xbl.spamhaus.org]
[77.90.185.220 listed in sbl-xbl.spamhaus.org]
[77.90.185.220 listed in sbl-xbl.spamhaus.org]
[77.90.185.220 listed in sbl-xbl.spamhaus.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[francoisedmond000012345678(at)gmail.com]
2.5 HK_SCAM_N2 BODY: No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 HK_SCAM No description available.
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
1.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.2 MONEY_NOHTML Lots of money in plain text
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Urgent''
Greetings,
First and foremost, I extend my apologies for reaching out to you=20
in this unsolicited manner. I understand that initiating contact=20
in this way may seem unconventional for establishing trust, but I=20
trust you'll appreciate the necessity of my actions. My name is=20
Francois Edmond, and I represent Societe Generale Bank here in=20
Paris, France.
I am writing to inform you about an opportunity regarding the=20
estate of one of our late clients, a British-born individual=20
involved in diamond and gold mining. Unfortunately, the client=20
passed away without any designated next of kin. Subsequently,=20
there exists a fixed deposit account in my bank totaling $57.5=20
million dollars.
My proposal to you is to present you as the next of kin to the=20
deceased, thereby enabling you to claim the aforementioned funds.
I assure you that I will facilitate the acquisition of all=20
necessary legal documents to legitimate this claim. Upon=20
successful completion, I am prepared to share the funds with you=20
on a 60/40 basis, with the entire process expected to be=20
finalized within 72 hours. Once the legal formalities are
complete, the bank will recognize you as the rightful recipient=20
and disburse the funds to you within three working days.
I believe that it is in both our interests to ensure these funds=20
are put to good use, rather than risk their confiscation by the=20
bank.
If you are interested and can be relied upon to return my agreed=20
share once you have received the funds in your account, please=20
provide me with your full name, address, direct contact number,=20
and occupation for the processing of the necessary legal=20
documents. Further details will be provided upon your response.
I firmly believe that this opportunity could potentially be one=20
of the best decisions you will ever make. However, if you are not=20
inclined to pursue this offer, please disregard this message and
consider it as though we had never made contact. I will continue=20
my search for a reliable individual to assist me.
I eagerly await your prompt response.
Best Regards,
Francois Edmond.
francoisedmond000012345678@gmail.com    
                
        
        
    
    Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 03 Nov 2025 15:30:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vG33Q-00000000Dkj-47sm
for dave@doctor.nl2k.ab.ca;
Mon, 03 Nov 2025 15:29:36 -0700
Resent-From: The Doctor
Resent-Date: Mon, 3 Nov 2025 15:29:36 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [162.240.16.124] (port=48822 helo=6588504.thewdwguru.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vG0SR-00000000IYP-39AO
for mailer-daemon@doctor.nl2k.ab.ca;
Mon, 03 Nov 2025 12:43:24 -0700
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=thewdwguru.com; s=default; h=Content-Transfer-Encoding:Content-Type:
MIME-Version:Message-ID:Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=r9Sx96i7Ozp+b1xbDDjaJlOEGOFyruM5UPHcNdzUR2w=; b=nGzewA8JD6ECvme6DdB1XaL4Gb
917qn3xd47ADtfNMecFC6+U80YSdPd6iYS0fO9JuQFFaATo7fhRiTbMCpUOEXV+VOeGvp3NZv5+v+
uIuDQflqekRxnh7ViGspoCKej7IwHp9uIJiQ5aNpRN5vDtxy0gdEyVzZocmKSfFB/4Za7mA9KNcTx
LQ5ePSKpEovKQZCiJnz/Tu8Nwc64vMcQ6ZEWaNMm4OdIuieQxM2NmO6729sDTVZjIyoogWu3tZEF4
MFPl6oghgsEhBgQ5J1trOZ68JizujNMq4OexUY9uRFNVOHS9Nqt4U3bv/r32myKMb4q+/D2hBxsNx
34Zawkuw==;
Received: from [77.90.185.220] (port=10887)
by 6588504.thewdwguru.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.98.1)
(envelope-from
id 1vG0Rf-000000007vu-1CDS
for mailer-daemon@doctor.nl2k.ab.ca;
Mon, 03 Nov 2025 13:42:27 -0600
Reply-To: francoisedmond000012345678@gmail.com
From: Francois Edmond
To: mailer-daemon@doctor.nl2k.ab.ca
Subject: Urgent''
Date: 3 Nov 2025 11:42:25 -0800
Message-ID: <20251103114225.327344381DAB4929@thewdwguru.com>
MIME-Version: 1.0
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - 6588504.thewdwguru.com
X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - thewdwguru.com
X-Get-Message-Sender-Via: 6588504.thewdwguru.com: authenticated_id: admin@thewdwguru.com
X-Authenticated-Sender: 6588504.thewdwguru.com: admin@thewdwguru.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 27.8
X-Spam_score_int: 278
X-Spam_bar: +++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings, First and foremost, I extend my apologies for reaching
out to you in this unsolicited manner. I understand that initiating contact
in this way may seem unconventional for establishing trust, but I tru [...]
Content analysis details: (27.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[77.90.185.220 listed in will-spam-for-food.eu.org]
[77.90.185.220 listed in will-spam-for-food.eu.org]
[77.90.185.220 listed in will-spam-for-food.eu.org]
[77.90.185.220 listed in will-spam-for-food.eu.org]
[77.90.185.220 listed in will-spam-for-food.eu.org]
[77.90.185.220 listed in will-spam-for-food.eu.org]
[77.90.185.220 listed in will-spam-for-food.eu.org]
[77.90.185.220 listed in will-spam-for-food.eu.org]
[162.240.16.124 listed in will-spam-for-food.eu.org]
[162.240.16.124 listed in will-spam-for-food.eu.org]
[162.240.16.124 listed in will-spam-for-food.eu.org]
[162.240.16.124 listed in will-spam-for-food.eu.org]
[162.240.16.124 listed in will-spam-for-food.eu.org]
[162.240.16.124 listed in will-spam-for-food.eu.org]
[162.240.16.124 listed in will-spam-for-food.eu.org]
[162.240.16.124 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[77.90.185.220 listed in dnsbl.ahbl.org]
[77.90.185.220 listed in dnsbl.ahbl.org]
[77.90.185.220 listed in dnsbl.ahbl.org]
[77.90.185.220 listed in dnsbl.ahbl.org]
[162.240.16.124 listed in dnsbl.ahbl.org]
[162.240.16.124 listed in dnsbl.ahbl.org]
[162.240.16.124 listed in dnsbl.ahbl.org]
[162.240.16.124 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[77.90.185.220 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[77.90.185.220 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[77.90.185.220 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[77.90.185.220 listed in dnsbl.ahbl.org]
3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[77.90.185.220 listed in zen.spamhaus.org]
2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL
[77.90.185.220 listed in zen.spamhaus.org]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[77.90.185.220 listed in sbl-xbl.spamhaus.org]
[77.90.185.220 listed in sbl-xbl.spamhaus.org]
[77.90.185.220 listed in sbl-xbl.spamhaus.org]
[77.90.185.220 listed in sbl-xbl.spamhaus.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[francoisedmond000012345678(at)gmail.com]
2.5 HK_SCAM_N2 BODY: No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 HK_SCAM No description available.
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
1.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.2 MONEY_NOHTML Lots of money in plain text
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Urgent''
Greetings,
First and foremost, I extend my apologies for reaching out to you=20
in this unsolicited manner. I understand that initiating contact=20
in this way may seem unconventional for establishing trust, but I=20
trust you'll appreciate the necessity of my actions. My name is=20
Francois Edmond, and I represent Societe Generale Bank here in=20
Paris, France.
I am writing to inform you about an opportunity regarding the=20
estate of one of our late clients, a British-born individual=20
involved in diamond and gold mining. Unfortunately, the client=20
passed away without any designated next of kin. Subsequently,=20
there exists a fixed deposit account in my bank totaling $57.5=20
million dollars.
My proposal to you is to present you as the next of kin to the=20
deceased, thereby enabling you to claim the aforementioned funds.
I assure you that I will facilitate the acquisition of all=20
necessary legal documents to legitimate this claim. Upon=20
successful completion, I am prepared to share the funds with you=20
on a 60/40 basis, with the entire process expected to be=20
finalized within 72 hours. Once the legal formalities are
complete, the bank will recognize you as the rightful recipient=20
and disburse the funds to you within three working days.
I believe that it is in both our interests to ensure these funds=20
are put to good use, rather than risk their confiscation by the=20
bank.
If you are interested and can be relied upon to return my agreed=20
share once you have received the funds in your account, please=20
provide me with your full name, address, direct contact number,=20
and occupation for the processing of the necessary legal=20
documents. Further details will be provided upon your response.
I firmly believe that this opportunity could potentially be one=20
of the best decisions you will ever make. However, if you are not=20
inclined to pursue this offer, please disregard this message and
consider it as though we had never made contact. I will continue=20
my search for a reliable individual to assist me.
I eagerly await your prompt response.
Best Regards,
Francois Edmond.
francoisedmond000012345678@gmail.com