Nigerian spam from Google Gmail
Posted by Dave Yadallee onEnvelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 29 Aug 2025 08:14:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1urzrG-00000000Hwp-3yNm
for dave@doctor.nl2k.ab.ca;
Fri, 29 Aug 2025 08:13:38 -0600
Resent-From: The Doctor
Resent-Date: Fri, 29 Aug 2025 08:13:38 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-lj1-f227.google.com ([209.85.208.227]:52458)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1uryxO-000000009Jg-3ZfP
for sales@nk.ca;
Fri, 29 Aug 2025 07:16:05 -0600
Received: by mail-lj1-f227.google.com with SMTP id 38308e7fff4ca-3367f35d11aso17347901fa.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=usal-es.20230601.gappssmtp.com; s=20230601; t=1756473289; x=1757078089; darn=nk.ca;
h=message-id:reply-to:date:from:to:subject:content-description
:content-transfer-encoding:mime-version:from:to:cc:subject:date
:message-id:reply-to;
bh=ezpJZwOqP69Nd5GIR6sQWBfOiS55lzRb+AJastPDwlk=;
b=HbzWvJe3k9UYnYkb/ADx1x96UyJP4/2kZAyvNqZbEr8JDj5pLqXjz7nFEEtcEH954F
BoZzoXvwmdkTriwhHmLNMHhmAVgiR907i1ZR+jvC4riM/Op4QGjFPLiOlAJLenA7Nb5T
VoIzW62d28zwKRJwnngFjoMiKz+cvUcw5azY9UtMmFCcA1JaSs5zbm4ujaxOzzZTLMzx
SU/Z/EP8BDyJ2SD4RbvbHNj/tLKwqeGSyRHZK9FciLrQaqHSObt4rd0QdT6q8odFq29b
J/jzOLQ/gUqMn/dqOybqEdfzHDch/dblE0DAyvefZ9v19NWiOlwa5UCczmSeoG9AWGPA
xesw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1756473289; x=1757078089;
h=message-id:reply-to:date:from:to:subject:content-description
:content-transfer-encoding:mime-version:x-gm-message-state:from:to
:cc:subject:date:message-id:reply-to;
bh=ezpJZwOqP69Nd5GIR6sQWBfOiS55lzRb+AJastPDwlk=;
b=WebiE8gBm4GPPdz4K17kQfuVk7oq1N+lVLE0pJSv/dJJwze/Ooq8c8z89Zth7Widro
auFlLHQMha23vDigG1Lyt9SU4B3qSnXstM0Nr91xozackj/dpPVXioc6r/K5lPYzwmBk
R3sXt5D+KRuDHtOfl+/ojlAYrbZOThe4WAN6IIDPgMR5O2Deecx2A7Nt/UERqvx2+EVz
uMqpbOJqGtqlc/x3hfqp2JBsjtB+o+FGa2zCpaXGLNqWSFNqGRbYBimfHZW4BNBsRB2W
O3sp+b8TXHoSNEi8x0I5qe9vZArz8bNeVMcBqeRHYpHGkF3AAAxTMgbjmyq5h6CVTIwj
+UtQ==
X-Forwarded-Encrypted: i=1; AJvYcCUaMgUmoIhKkp05ei3xUA7ryoZGpwlASwipI/cGM2/0HgB+KR8enceNZ9TnIcABmZhVdwKAlg==@nk.ca
X-Gm-Message-State: AOJu0Yw3M4R+Yht+xXd12vL2khGHv7W1WV55co2OLxSZx4DCpwrN3/ly
ge/VE3bqN12vUSbr/ZYLfM4YxYrD50vzf3TrSoLVceBY8kxMFgxmU5QDN2j/vHAlrfyG6jT2dIy
6NiDZdoG4iNA+FXwMZo4N1Gn3EidqIcxSzIyk
X-Gm-Gg: ASbGnctN8ionoWNgFxEQGS45f2wJy1fqp7eJKofNBQQc7R4YAyTnUjRkexCV/QmpHi5
ia9I7/BlYc1yWYFdFCAllh1nUCOUeHNFkvWxjidjXxhBFjDw/SqLMC7vg1TIzQ0JeE3AvRj5ZfH
jL0N6EUYFIJWGh8AYBJT6dyDRGaU6cxDjJIL6POCJJfaq18mA8Pmqqjiv60wwvADEfUARaB3P8k
Ex6gtr16ZtLJx71m1nV8SLl/dpvaJFfd2ZCtc6zspBOXczEnKCcj3CRr9xzbLb4vdK8l1XdizLC
juplUhtXJL0Btb2fxYaBeNxirgxt/g==
X-Google-Smtp-Source: AGHT+IHw/cUq9T92gTm8ryTdpA0ot1rc0NpNzVc/JI26PXakAoMWLd4PT7kzei97/a+HtUM9VP0y52R4yLIj
X-Received: by 2002:a05:651c:41ca:b0:336:8fa8:e034 with SMTP id 38308e7fff4ca-3368fa8e643mr27827961fa.4.1756473289088;
Fri, 29 Aug 2025 06:14:49 -0700 (PDT)
Received: from aida.usal.es (aida.usal.es. [212.128.130.103])
by smtp-relay.gmail.com with ESMTP id 2adb3069b0e04-55f6770c66bsm350456e87.28.2025.08.29.06.14.48;
Fri, 29 Aug 2025 06:14:49 -0700 (PDT)
X-Relaying-Domain: usal.es
Received: from instance-20250829-081602.us-central1-a.c.new-vps-tst.internal. (244.97.29.34.bc.googleusercontent.com [34.29.97.244])
by aida.usal.es (Postfix) with ESMTPSA id 8EFF2C0574;
Fri, 29 Aug 2025 15:14:46 +0200 (CEST)
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Re: Change Of Ownership Notification
To: Recipients
From: "Mr. Robert Moore"
Date: Fri, 29 Aug 2025 13:14:43 +0000
Reply-To: mrsifdsss@gmail.com
Message-Id: <20250829131446.8EFF2C0574@aida.usal.es>
X-Spam_score: 17.1
X-Spam_score_int: 171
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attn; I'm Mr. Robert Moore, the Chief Executive Officer of
the Minister of Finance. We wish to urgently confirm from you if actually
you know one Mr. Gene Duncan who claims to be your business associate/par
[...]
Content analysis details: (17.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[34.29.97.244 listed in will-spam-for-food.eu.org]
[34.29.97.244 listed in will-spam-for-food.eu.org]
[34.29.97.244 listed in will-spam-for-food.eu.org]
[34.29.97.244 listed in will-spam-for-food.eu.org]
[34.29.97.244 listed in will-spam-for-food.eu.org]
[34.29.97.244 listed in will-spam-for-food.eu.org]
[34.29.97.244 listed in will-spam-for-food.eu.org]
[34.29.97.244 listed in will-spam-for-food.eu.org]
[212.128.130.103 listed in will-spam-for-food.eu.org]
[212.128.130.103 listed in will-spam-for-food.eu.org]
[212.128.130.103 listed in will-spam-for-food.eu.org]
[212.128.130.103 listed in will-spam-for-food.eu.org]
[212.128.130.103 listed in will-spam-for-food.eu.org]
[212.128.130.103 listed in will-spam-for-food.eu.org]
[212.128.130.103 listed in will-spam-for-food.eu.org]
[212.128.130.103 listed in will-spam-for-food.eu.org]
[209.85.208.227 listed in will-spam-for-food.eu.org]
[209.85.208.227 listed in will-spam-for-food.eu.org]
[209.85.208.227 listed in will-spam-for-food.eu.org]
[209.85.208.227 listed in will-spam-for-food.eu.org]
[209.85.208.227 listed in will-spam-for-food.eu.org]
[209.85.208.227 listed in will-spam-for-food.eu.org]
[209.85.208.227 listed in will-spam-for-food.eu.org]
[209.85.208.227 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.208.227 listed in dnsbl.ahbl.org]
[209.85.208.227 listed in dnsbl.ahbl.org]
[209.85.208.227 listed in dnsbl.ahbl.org]
[209.85.208.227 listed in dnsbl.ahbl.org]
[34.29.97.244 listed in dnsbl.ahbl.org]
[34.29.97.244 listed in dnsbl.ahbl.org]
[34.29.97.244 listed in dnsbl.ahbl.org]
[34.29.97.244 listed in dnsbl.ahbl.org]
[212.128.130.103 listed in dnsbl.ahbl.org]
[212.128.130.103 listed in dnsbl.ahbl.org]
[212.128.130.103 listed in dnsbl.ahbl.org]
[212.128.130.103 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.208.227 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.208.227 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.208.227 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.208.227 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.208.227 listed in list.dnswl.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.208.227 listed in sa-accredit.habeas.com]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.208.227 listed in sa-trusted.bondedsender.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.227 listed in wl.mailspike.net]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.208.227 listed in bl.score.senderscore.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.208.227 listed in bl.score.senderscore.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
3.0 RECEIVED_MULTICAST A multicast IP adress appears in Received header
2.5 MILLION_USD BODY: Talks about millions of dollars
1.1 HK_SCAM_N3 BODY: No description available.
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
0.0 HK_NAME_MR_MRS No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_HK_NAME_MR_MRS No description available.
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 HK_SCAM No description available.
1.5 MONEY_NOHTML Lots of money in plain text
0.0 T_FILL_THIS_FORM_LONG Fill in a form with personal information
0.0 FILL_THIS_FORM Fill in a form with personal information
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
0.0 MONEY_FORM Lots of money if you fill out a form
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases
0.0 ADVANCE_FEE_2_NEW_FRM_MNY Advance Fee fraud form and lots of money
Subject: {SPAM?} Re: Change Of Ownership Notification
Attn;
I'm Mr. Robert Moore, the Chief Executive Officer of the Minister of Financ=
e. We wish to urgently confirm from you if actually you know one Mr. Gene D=
uncan who claims to be your business associate/partner.
Kindly reconfirm this application put in by Mr. Gene Duncan - he submitted =
the under-listed bank account information supposedly sent by you to receive=
the funds on your behalf.
The bank information he applied with are stated thus:
Account Name: Mr. Gene A. Duncan
Bank name: Global Federal Credit Union
Bank address: 1520 West Third Avenue Spokane, WA 99220
Account Number: 789170461820
Routing Number: 325180595
The said Mr. Gene Duncan is claiming to this office that you are dead and h=
ave Instructed that all relevant
documentation/Information regarding your Payment/Transfer, be changed to hi=
m as the beneficiary of the payment short-listed among the beneficiaries en=
titled to receive their payment.
For your Information, this Government has approved the total amount of EIGH=
T MILLION, FIVE HUNDRED THOUSAND UNITED STATES
DOLLARS ONLY, in your favor, prior to the Federal Government instructions/m=
andate to offset all outstanding payments to the various legal beneficiarie=
s around the world and your payment file was affected. We need to confirm f=
rom you if it's really true that you are dead as mentioned by your Associat=
e.
You should note that, if we do not hear from you, we automatically assume t=
hat you are actually dead and the
information passed to us by Mr. Gene Duncan is correct. Hence, you are here=
by requested to reply to this Email immediately for confirmation, before we=
proceed with this payment and for us to know the true position of things w=
ith you so that we won't make any mistakes/errors in remitting your out-sta=
nding payment to a wrong person/account.
Lastly, you are advised to reply back to this email and reconfirm the detai=
ls of this message if truly you're alive.
Full name
Direct telephone number
Address
Age
Occupation
Country
Bank name
Bank address
Bank account
Account type
Your quick response will help us a lot.
Yours, Sincerely,
Mr. Robert Moore.