IMF Nigerian spam from Google Gmail Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 03 Mar 2026 13:51:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vxWhg-00000000IOG-0YW7
for dave@doctor.nl2k.ab.ca;
Tue, 03 Mar 2026 13:50:52 -0700
Resent-From: The Doctor
Resent-Date: Tue, 3 Mar 2026 13:50:52 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-wm1-f47.google.com ([209.85.128.47]:42479)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vxVjC-00000000FQ6-3Pmc
for doctor@netknow.ca;
Tue, 03 Mar 2026 12:48:35 -0700
Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-483703e4b08so56962525e9.1
for; Tue, 03 Mar 2026 11:47:36 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1772567250; x=1773172050; darn=netknow.ca;
h=reply-to:date:to:subject:content-description
:content-transfer-encoding:mime-version:from:message-id:from:to:cc
:subject:date:message-id:reply-to;
bh=/1WakjoHzu1fYA2ix9Lw9khdxBks04kiRRrrHAwk3FQ=;
b=MCvs8lDQBlrurb6wJKR9XLCyKfzjktcpjFy+DIaW4XEd0nQusMN2o2ngt7YWk8Phqm
yzsZKrA4HcoR4MGr4vyl1ifLblqDxB1DYz6YWiWivRDwbOP0Jx+aXtEpcxpeENin+T6U
G4To6BZ+iqHMbjDGOd5UuV1xeKId4hdqHLgBc7H6YH4+eIV7IYWTq6Y003j28qN4DoJ1
Oq0rkZ+woxOyXxsjTA1fFQJR8NONNPT3nkKdUYryDsv98NkFRUqxMyQeBI32xNcrmp4H
bVWNwZPllRbdA3VQ7egsIUEktKT4gF+uD4bVleuMdNdlQFbM8Cg/dUEJmVh69lOrMnoa
UG+A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1772567250; x=1773172050;
h=reply-to:date:to:subject:content-description
:content-transfer-encoding:mime-version:from:message-id:x-gm-gg
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=/1WakjoHzu1fYA2ix9Lw9khdxBks04kiRRrrHAwk3FQ=;
b=ML+bGqbc22sckaKfd62G1KmE+B1KFpnzEGUGL5sd2Hp1fKU5zSIofIEMwTUcaXr3c+
gmFKM+/1uGdk9tmoTsvvu5MF+mx6rMXTx4JZWYaMxO2HW9n7LL2dMYsGu0PR5oq8jUvQ
Y+IVSNdXHmt9xcveesIsPjPKt06KovQe4Ayhu767BIwRICSCw9JEjxKy6yK2L3QvLHjQ
0fuHfPMQQR2bg1o4W5qNGv+FQ8xtEPFiGHDBF6roLU08BTQZcuq+XUF3CZD83myADU9u
zR/5JQJ/C9Jx/ZeRnOy0ZoOZ4BEtwrhOtEkWJKB8hXqoIe0kc3FkVWUgCmJqtniRKi3A
emUg==
X-Forwarded-Encrypted: i=1; AJvYcCWtptOpZIMXvK6XNGeTfMPkEjGFPG30gjm+KUOvo66JBir4LJX/fuN8qFR9NjyvaGpwh180WK8=@netknow.ca
X-Gm-Message-State: AOJu0YwZBYbef5Ufc//PUR2bAtnHvIizc7AQ6Q8bT3WUTFjtG8/z6IYN
qCG1udiS54zzZf7tO4Br4h2p+wa3mfrU1PCILzizu593HAWWFEEz3lJ8
X-Gm-Gg: ATEYQzxMX6iiOQEznoIomBAeHRIAqpjHovw6lc35QK6GlDn92X+rUxdt6YmjoCuiL6j
zviVNYva9hI0SZi3Rz4l8k3S8pnaQ5GdbPQokcL9+GHTRxYpzA5VnICoOyaqACtV/rurFuCxpSD
wxXcpP3dNIERGSMsuEEsJBedX3TC9tXAg5lM0XBAJt0gpN9umhDIlTGF5rAiOKkUBPVEok17XWs
4jGF96eDHLhc3tZs/QZBFtOlvyjveCuXAf6A6XMkCegLuIU2Zcp4HUz/3JGPBXS+SFMQeGFvHtT
2K90tB17/M7GNnBDi1TFGcrLlzSUctiwhGV6qduGDsH7ZgsEEiePP5EKd0/m0Y45IlVc/A4CCKm
PUf7hc/VE3s4ruDzN9aPdfM3msBqPVEDaWSB5aXeYIpozfVgAAbjMzeMEGNJZ/UsXpVqkRfATXu
Ew0Q7AM3wid//2oBnsGvv2vMoitHLavcuIZaN8xQ==
X-Received: by 2002:a05:600c:5308:b0:483:a352:b4e4 with SMTP id 5b1f17b1804b1-48513a66cf5mr53632865e9.6.1772567249578;
Tue, 03 Mar 2026 11:47:29 -0800 (PST)
Received: from [10.114.60.112] ([105.112.10.222])
by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4851334f9edsm40953205e9.4.2026.03.03.11.47.25
(version=TLS1 cipher=AES128-SHA bits=128/128);
Tue, 03 Mar 2026 11:47:28 -0800 (PST)
Message-ID: <69a73ad0.050a0220.264259.fa91@mx.google.com>
From: IMFOFFICE
X-Google-Original-From: "IMFOFFICE"
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Notice of Pending Compensation Payment
To: Recipients
Date: Tue, 03 Mar 2026 11:47:25 -0800
Reply-To: imf_consultantoffice01@consultant.com
X-Spam_score: 13.2
X-Spam_score_int: 132
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: INTERNATIONAL MONETARY FUND (IMF) Washington D.C. Office
1900 Pennsylvania Ave NW, Washington, DC 20431 Ref: XVGNN82020 | Fund Release
Code: 601 Mobile : +17712204464 WhatsApp : +13472215926 Subject: Notice of
Pending Compensation Payment
Content analysis details: (13.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[105.112.10.222 listed in will-spam-for-food.eu.org]
[105.112.10.222 listed in will-spam-for-food.eu.org]
[105.112.10.222 listed in will-spam-for-food.eu.org]
[105.112.10.222 listed in will-spam-for-food.eu.org]
[105.112.10.222 listed in will-spam-for-food.eu.org]
[105.112.10.222 listed in will-spam-for-food.eu.org]
[105.112.10.222 listed in will-spam-for-food.eu.org]
[105.112.10.222 listed in will-spam-for-food.eu.org]
[209.85.128.47 listed in will-spam-for-food.eu.org]
[209.85.128.47 listed in will-spam-for-food.eu.org]
[209.85.128.47 listed in will-spam-for-food.eu.org]
[209.85.128.47 listed in will-spam-for-food.eu.org]
[209.85.128.47 listed in will-spam-for-food.eu.org]
[209.85.128.47 listed in will-spam-for-food.eu.org]
[209.85.128.47 listed in will-spam-for-food.eu.org]
[209.85.128.47 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[105.112.10.222 listed in dnsbl.ahbl.org]
[105.112.10.222 listed in dnsbl.ahbl.org]
[105.112.10.222 listed in dnsbl.ahbl.org]
[105.112.10.222 listed in dnsbl.ahbl.org]
[209.85.128.47 listed in dnsbl.ahbl.org]
[209.85.128.47 listed in dnsbl.ahbl.org]
[209.85.128.47 listed in dnsbl.ahbl.org]
[209.85.128.47 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[105.112.10.222 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[105.112.10.222 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[105.112.10.222 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[105.112.10.222 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.128.47 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[imf_consultantoffice01(at)consultant.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[captainsalca67(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[captainsalca67(at)gmail.com]
1.5 HK_SCAM_N8 BODY: No description available.
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.128.47 listed in wl.mailspike.net]
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 HK_SCAM No description available.
0.0 NO_RDNS2 Sending MTA has no reverse DNS
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 LOTS_OF_MONEY Huge... sums of money
0.5 MONEY_NOHTML Lots of money in plain text
1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.0 XFER_LOTSA_MONEY Transfer a lot of money
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Notice of Pending Compensation Payment
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 03 Mar 2026 13:51:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vxWhg-00000000IOG-0YW7
for dave@doctor.nl2k.ab.ca;
Tue, 03 Mar 2026 13:50:52 -0700
Resent-From: The Doctor
Resent-Date: Tue, 3 Mar 2026 13:50:52 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-wm1-f47.google.com ([209.85.128.47]:42479)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vxVjC-00000000FQ6-3Pmc
for doctor@netknow.ca;
Tue, 03 Mar 2026 12:48:35 -0700
Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-483703e4b08so56962525e9.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1772567250; x=1773172050; darn=netknow.ca;
h=reply-to:date:to:subject:content-description
:content-transfer-encoding:mime-version:from:message-id:from:to:cc
:subject:date:message-id:reply-to;
bh=/1WakjoHzu1fYA2ix9Lw9khdxBks04kiRRrrHAwk3FQ=;
b=MCvs8lDQBlrurb6wJKR9XLCyKfzjktcpjFy+DIaW4XEd0nQusMN2o2ngt7YWk8Phqm
yzsZKrA4HcoR4MGr4vyl1ifLblqDxB1DYz6YWiWivRDwbOP0Jx+aXtEpcxpeENin+T6U
G4To6BZ+iqHMbjDGOd5UuV1xeKId4hdqHLgBc7H6YH4+eIV7IYWTq6Y003j28qN4DoJ1
Oq0rkZ+woxOyXxsjTA1fFQJR8NONNPT3nkKdUYryDsv98NkFRUqxMyQeBI32xNcrmp4H
bVWNwZPllRbdA3VQ7egsIUEktKT4gF+uD4bVleuMdNdlQFbM8Cg/dUEJmVh69lOrMnoa
UG+A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1772567250; x=1773172050;
h=reply-to:date:to:subject:content-description
:content-transfer-encoding:mime-version:from:message-id:x-gm-gg
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=/1WakjoHzu1fYA2ix9Lw9khdxBks04kiRRrrHAwk3FQ=;
b=ML+bGqbc22sckaKfd62G1KmE+B1KFpnzEGUGL5sd2Hp1fKU5zSIofIEMwTUcaXr3c+
gmFKM+/1uGdk9tmoTsvvu5MF+mx6rMXTx4JZWYaMxO2HW9n7LL2dMYsGu0PR5oq8jUvQ
Y+IVSNdXHmt9xcveesIsPjPKt06KovQe4Ayhu767BIwRICSCw9JEjxKy6yK2L3QvLHjQ
0fuHfPMQQR2bg1o4W5qNGv+FQ8xtEPFiGHDBF6roLU08BTQZcuq+XUF3CZD83myADU9u
zR/5JQJ/C9Jx/ZeRnOy0ZoOZ4BEtwrhOtEkWJKB8hXqoIe0kc3FkVWUgCmJqtniRKi3A
emUg==
X-Forwarded-Encrypted: i=1; AJvYcCWtptOpZIMXvK6XNGeTfMPkEjGFPG30gjm+KUOvo66JBir4LJX/fuN8qFR9NjyvaGpwh180WK8=@netknow.ca
X-Gm-Message-State: AOJu0YwZBYbef5Ufc//PUR2bAtnHvIizc7AQ6Q8bT3WUTFjtG8/z6IYN
qCG1udiS54zzZf7tO4Br4h2p+wa3mfrU1PCILzizu593HAWWFEEz3lJ8
X-Gm-Gg: ATEYQzxMX6iiOQEznoIomBAeHRIAqpjHovw6lc35QK6GlDn92X+rUxdt6YmjoCuiL6j
zviVNYva9hI0SZi3Rz4l8k3S8pnaQ5GdbPQokcL9+GHTRxYpzA5VnICoOyaqACtV/rurFuCxpSD
wxXcpP3dNIERGSMsuEEsJBedX3TC9tXAg5lM0XBAJt0gpN9umhDIlTGF5rAiOKkUBPVEok17XWs
4jGF96eDHLhc3tZs/QZBFtOlvyjveCuXAf6A6XMkCegLuIU2Zcp4HUz/3JGPBXS+SFMQeGFvHtT
2K90tB17/M7GNnBDi1TFGcrLlzSUctiwhGV6qduGDsH7ZgsEEiePP5EKd0/m0Y45IlVc/A4CCKm
PUf7hc/VE3s4ruDzN9aPdfM3msBqPVEDaWSB5aXeYIpozfVgAAbjMzeMEGNJZ/UsXpVqkRfATXu
Ew0Q7AM3wid//2oBnsGvv2vMoitHLavcuIZaN8xQ==
X-Received: by 2002:a05:600c:5308:b0:483:a352:b4e4 with SMTP id 5b1f17b1804b1-48513a66cf5mr53632865e9.6.1772567249578;
Tue, 03 Mar 2026 11:47:29 -0800 (PST)
Received: from [10.114.60.112] ([105.112.10.222])
by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4851334f9edsm40953205e9.4.2026.03.03.11.47.25
(version=TLS1 cipher=AES128-SHA bits=128/128);
Tue, 03 Mar 2026 11:47:28 -0800 (PST)
Message-ID: <69a73ad0.050a0220.264259.fa91@mx.google.com>
From: IMFOFFICE
X-Google-Original-From: "IMFOFFICE"
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Notice of Pending Compensation Payment
To: Recipients
Date: Tue, 03 Mar 2026 11:47:25 -0800
Reply-To: imf_consultantoffice01@consultant.com
X-Spam_score: 13.2
X-Spam_score_int: 132
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: INTERNATIONAL MONETARY FUND (IMF) Washington D.C. Office
1900 Pennsylvania Ave NW, Washington, DC 20431 Ref: XVGNN82020 | Fund Release
Code: 601 Mobile : +17712204464 WhatsApp : +13472215926 Subject: Notice of
Pending Compensation Payment
Content analysis details: (13.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[105.112.10.222 listed in will-spam-for-food.eu.org]
[105.112.10.222 listed in will-spam-for-food.eu.org]
[105.112.10.222 listed in will-spam-for-food.eu.org]
[105.112.10.222 listed in will-spam-for-food.eu.org]
[105.112.10.222 listed in will-spam-for-food.eu.org]
[105.112.10.222 listed in will-spam-for-food.eu.org]
[105.112.10.222 listed in will-spam-for-food.eu.org]
[105.112.10.222 listed in will-spam-for-food.eu.org]
[209.85.128.47 listed in will-spam-for-food.eu.org]
[209.85.128.47 listed in will-spam-for-food.eu.org]
[209.85.128.47 listed in will-spam-for-food.eu.org]
[209.85.128.47 listed in will-spam-for-food.eu.org]
[209.85.128.47 listed in will-spam-for-food.eu.org]
[209.85.128.47 listed in will-spam-for-food.eu.org]
[209.85.128.47 listed in will-spam-for-food.eu.org]
[209.85.128.47 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[105.112.10.222 listed in dnsbl.ahbl.org]
[105.112.10.222 listed in dnsbl.ahbl.org]
[105.112.10.222 listed in dnsbl.ahbl.org]
[105.112.10.222 listed in dnsbl.ahbl.org]
[209.85.128.47 listed in dnsbl.ahbl.org]
[209.85.128.47 listed in dnsbl.ahbl.org]
[209.85.128.47 listed in dnsbl.ahbl.org]
[209.85.128.47 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[105.112.10.222 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[105.112.10.222 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[105.112.10.222 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[105.112.10.222 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.128.47 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[imf_consultantoffice01(at)consultant.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[captainsalca67(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[captainsalca67(at)gmail.com]
1.5 HK_SCAM_N8 BODY: No description available.
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.128.47 listed in wl.mailspike.net]
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 HK_SCAM No description available.
0.0 NO_RDNS2 Sending MTA has no reverse DNS
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 LOTS_OF_MONEY Huge... sums of money
0.5 MONEY_NOHTML Lots of money in plain text
1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.0 XFER_LOTSA_MONEY Transfer a lot of money
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Notice of Pending Compensation Payment