by buried under 419s
Wed Dec 16, 2020 10:08 am
Return-Path: <3WOfZXxcJAJMB225z19x58F1EI5z1UOOUNO39x58.zB9@trix.bounces.google.com>
Delivered-To:
Received: from
by = with LMTP
id OGFyF4Ln2V9PIAAAibB4EA
(envelope-from <3WOfZXxcJAJMB225z19x58F1EI5z1UOOUNO39x58.zB9@trix.bounces.google.com>)
for <>; Wed, 16 Dec 2020 10:54:58 +0000
Return-path: <3WOfZXxcJAJMB225z19x58F1EI5z1UOOUNO39x58.zB9@trix.bounces.google.com>
Envelope-to:
Delivery-date: Wed, 16 Dec 2020 10:54:58 +0000
Received: from mail-yb1-f198.google.com ([209.85.219.198]:40376)
by with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.93)
(envelope-from <3WOfZXxcJAJMB225z19x58F1EI5z1UOOUNO39x58.zB9@trix.bounces.google.com>)
id 1kpUSP-00028s-1S
for ; Wed, 16 Dec 2020 10:54:58 +0000
Received: by mail-yb1-f198.google.com with SMTP id e68so20448468yba.7
for <>; Wed, 16 Dec 2020 02:54:36 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:reply-to:message-id:date:subject:from:to;
bh=WFyGv15CjeSSxj2bSDuozBmr3XNFnacQqhaqUp1YEws=;
b=RxEiavVPKRBJv63NkH0iIPnjZMQrkSS/nGFh8lKjssx/PtSmOHx0Szlqh9KM0ciwNV
1j6VkVU3AgzMKM7iWk/2CLXk+LAZatu1vRjybWKzV/Kz4G4XJxHv3bI8QLEdj+OiqmIO
V2dGky5cyld2MKBsRyB3spK6uORzYxLIK+4rkQCOxywY3XRtHPt0SeHLbCIS909xMX22
eBnJR9c1/6cSXu2UzPoqHap+VULue1wsKt+wQ264RflVd8ug7eq9WY+fjiaywZkfouTd
q623Mcfn4GVluWptYNG+9xxjh64Cvh4ynSM1hpzCQuRtruLEY/nDG1fDjzF3No6YSauR
VouQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:reply-to:message-id:date:subject
:from:to;
bh=WFyGv15CjeSSxj2bSDuozBmr3XNFnacQqhaqUp1YEws=;
b=QnPEeC6KU0bdp4zxWxPNaw/3thrF6AC78O5K6wgcALXg/vcLylYYszfT/QfZLJD7yW
yF+wzSh63gkXxNjdAGvfyQ0zx2V0LqUFvOJrVaafNqgb8aiGX0z7KF3c9VYX0hKwYVGO
7d9J4+//c+07qz7TlchDz9k6FTjisAOni0RDXVHAGTEJV4Cm2jlIdyqYOC45t+xJTFcQ
KESmwb+QsAOUW29wHUF8mKTyHWXHabNnoczCeOQqTsPXMOZZk97whnPrQSn1jVzP9PTs
22S5X8VM7YwJxKaD/itt0oMl6JO38nRusWXnP9bpk5FRdxJOU/ZivftRZM5ITzv462SB
LW+Q==
X-Gm-Message-State: AOAM532RdMR8p83LARCAZ2bHkGQmlwLGdZWYRGMrM3WndQHBZasbFeHt
ykzi39mBHpXqQ8XPvCotB/rZMKyv3TN8FDCKQCHo
MIME-Version: 1.0
X-Received: by 2002:a25:24d5:: with SMTP id k204mt45490401ybk.167.1608116056071;
Wed, 16 Dec 2020 02:54:16 -0800 (PST)
Reply-To: [email protected]
X-No-Auto-Attachment: 1
Message-ID: <[email protected]>
Date: Wed, 16 Dec 2020 10:54:16 +0000
From: [email protected]
To:
Content-Type: multipart/alternative; boundary="0000000000004cc12d05b692b2c7"
X-Spam-Status: Yes, score=10.2
X-Spam-Score: 102
X-Spam-Bar: ++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: I've invited you to fill out the following form: Untitled
form To fill it out, visit: https://docs.google.com/forms/d/e/1FAIp ... _form_link
Content analysis details: (10.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[officemailservice711701[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[officemailservice711701[at]gmail.com]
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and
EnvelopeFrom freemail headers are
different
1.1 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
2.5 GOOGLE_DOC_SUSP Suspicious use of Google Docs
X-Spam-Flag: YES
Subject: ***SPAM*** Re: Get Back to me asap
--0000000000004cc12d05b692b2c7
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
Office of the IMF Representative in Nigeria
Rev . Jesmin Rahman Mission Chief/Senior
Resident Representative
Address #9 Hon. Justice Mohammed Bello St.
Asokoro Abuja
Tel: (234) 704 954 9411
Attn:
In view of this on going payment verification exercise, It may interest you to note that I and my team delegates have personally completed investigations about your delayed payment down to the fund origin and have established in the course of my investigation that you are actually not the original beneficiary of the funds in question rather you are only being used to claim this outstanding payment through the help of your partners for their own selfish interest. I know this discovery might be a surprise to you but that is the truth.
Please note that I have really kept this development to myself and have been contemplating whether to report my findings to the entire verification team for onward cancellation of your payment, but owing to your recorded loses in this project I have this second thought of contacting you directly since I am in the position to assist you get this outstanding payment to your bank account.
Hence its based on this subject that I solicit for your cooperation to enable me assist you process your delayed wire transfer into your nominated bank account with my earnest desire that you will in turn show appreciation towards the new Church Cathedral we are erecting in my Parish if God touches you at the end of the transfer which will not be longer than five working days.
There is no way your partners could have succeeded in manipulating this transfer in your favor before this time because both the deposit passwords and ownership clearance papers on this payment respectively are not within their disposals, henceforth it may interest you to note that spending any more money on this project without my consent is a complete waste of resources. Now that this truth has been revealed the ball is on your court.
Reverend Jesmin Rahman
Mission Chief/Senior
Chairman Joint Payment Verification Team
Delivered-To:
Received: from
by = with LMTP
id OGFyF4Ln2V9PIAAAibB4EA
(envelope-from <3WOfZXxcJAJMB225z19x58F1EI5z1UOOUNO39x58.zB9@trix.bounces.google.com>)
for <>; Wed, 16 Dec 2020 10:54:58 +0000
Return-path: <3WOfZXxcJAJMB225z19x58F1EI5z1UOOUNO39x58.zB9@trix.bounces.google.com>
Envelope-to:
Delivery-date: Wed, 16 Dec 2020 10:54:58 +0000
Received: from mail-yb1-f198.google.com ([209.85.219.198]:40376)
by with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.93)
(envelope-from <3WOfZXxcJAJMB225z19x58F1EI5z1UOOUNO39x58.zB9@trix.bounces.google.com>)
id 1kpUSP-00028s-1S
for ; Wed, 16 Dec 2020 10:54:58 +0000
Received: by mail-yb1-f198.google.com with SMTP id e68so20448468yba.7
for <>; Wed, 16 Dec 2020 02:54:36 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:reply-to:message-id:date:subject:from:to;
bh=WFyGv15CjeSSxj2bSDuozBmr3XNFnacQqhaqUp1YEws=;
b=RxEiavVPKRBJv63NkH0iIPnjZMQrkSS/nGFh8lKjssx/PtSmOHx0Szlqh9KM0ciwNV
1j6VkVU3AgzMKM7iWk/2CLXk+LAZatu1vRjybWKzV/Kz4G4XJxHv3bI8QLEdj+OiqmIO
V2dGky5cyld2MKBsRyB3spK6uORzYxLIK+4rkQCOxywY3XRtHPt0SeHLbCIS909xMX22
eBnJR9c1/6cSXu2UzPoqHap+VULue1wsKt+wQ264RflVd8ug7eq9WY+fjiaywZkfouTd
q623Mcfn4GVluWptYNG+9xxjh64Cvh4ynSM1hpzCQuRtruLEY/nDG1fDjzF3No6YSauR
VouQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:reply-to:message-id:date:subject
:from:to;
bh=WFyGv15CjeSSxj2bSDuozBmr3XNFnacQqhaqUp1YEws=;
b=QnPEeC6KU0bdp4zxWxPNaw/3thrF6AC78O5K6wgcALXg/vcLylYYszfT/QfZLJD7yW
yF+wzSh63gkXxNjdAGvfyQ0zx2V0LqUFvOJrVaafNqgb8aiGX0z7KF3c9VYX0hKwYVGO
7d9J4+//c+07qz7TlchDz9k6FTjisAOni0RDXVHAGTEJV4Cm2jlIdyqYOC45t+xJTFcQ
KESmwb+QsAOUW29wHUF8mKTyHWXHabNnoczCeOQqTsPXMOZZk97whnPrQSn1jVzP9PTs
22S5X8VM7YwJxKaD/itt0oMl6JO38nRusWXnP9bpk5FRdxJOU/ZivftRZM5ITzv462SB
LW+Q==
X-Gm-Message-State: AOAM532RdMR8p83LARCAZ2bHkGQmlwLGdZWYRGMrM3WndQHBZasbFeHt
ykzi39mBHpXqQ8XPvCotB/rZMKyv3TN8FDCKQCHo
MIME-Version: 1.0
X-Received: by 2002:a25:24d5:: with SMTP id k204mt45490401ybk.167.1608116056071;
Wed, 16 Dec 2020 02:54:16 -0800 (PST)
Reply-To: [email protected]
X-No-Auto-Attachment: 1
Message-ID: <[email protected]>
Date: Wed, 16 Dec 2020 10:54:16 +0000
From: [email protected]
To:
Content-Type: multipart/alternative; boundary="0000000000004cc12d05b692b2c7"
X-Spam-Status: Yes, score=10.2
X-Spam-Score: 102
X-Spam-Bar: ++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: I've invited you to fill out the following form: Untitled
form To fill it out, visit: https://docs.google.com/forms/d/e/1FAIp ... _form_link
Content analysis details: (10.2 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[officemailservice711701[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[officemailservice711701[at]gmail.com]
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and
EnvelopeFrom freemail headers are
different
1.1 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
2.5 GOOGLE_DOC_SUSP Suspicious use of Google Docs
X-Spam-Flag: YES
Subject: ***SPAM*** Re: Get Back to me asap
--0000000000004cc12d05b692b2c7
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
Office of the IMF Representative in Nigeria
Rev . Jesmin Rahman Mission Chief/Senior
Resident Representative
Address #9 Hon. Justice Mohammed Bello St.
Asokoro Abuja
Tel: (234) 704 954 9411
Attn:
In view of this on going payment verification exercise, It may interest you to note that I and my team delegates have personally completed investigations about your delayed payment down to the fund origin and have established in the course of my investigation that you are actually not the original beneficiary of the funds in question rather you are only being used to claim this outstanding payment through the help of your partners for their own selfish interest. I know this discovery might be a surprise to you but that is the truth.
Please note that I have really kept this development to myself and have been contemplating whether to report my findings to the entire verification team for onward cancellation of your payment, but owing to your recorded loses in this project I have this second thought of contacting you directly since I am in the position to assist you get this outstanding payment to your bank account.
Hence its based on this subject that I solicit for your cooperation to enable me assist you process your delayed wire transfer into your nominated bank account with my earnest desire that you will in turn show appreciation towards the new Church Cathedral we are erecting in my Parish if God touches you at the end of the transfer which will not be longer than five working days.
There is no way your partners could have succeeded in manipulating this transfer in your favor before this time because both the deposit passwords and ownership clearance papers on this payment respectively are not within their disposals, henceforth it may interest you to note that spending any more money on this project without my consent is a complete waste of resources. Now that this truth has been revealed the ball is on your court.
Reverend Jesmin Rahman
Mission Chief/Senior
Chairman Joint Payment Verification Team
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces