Nigerian spam from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 20 Apr 2024 08:58:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1ryBun-000000003TP-3kzJ
for dave@doctor.nl2k.ab.ca;
Sat, 20 Apr 2024 08:42:05 -0600
Resent-From: The Doctor
Resent-Date: Sat, 20 Apr 2024 08:42:05 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-lf1-f46.google.com ([209.85.167.46]:53640)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1ryABu-00000000Hep-3Dh4
for doctor@doctor.nl2k.ab.ca;
Sat, 20 Apr 2024 06:51:43 -0600
Received: by mail-lf1-f46.google.com with SMTP id 2adb3069b0e04-518a3e0d2ecso4507784e87.3
for; Sat, 20 Apr 2024 05:49:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1713617377; x=1714222177; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=rg2Aoof4owgWbpdRdlChZVc5VgRfvYZvc2j3kjQ+BX8=;
b=STJWPdzuRAHyYmDRU/ITvJMWaoIr36qODGsTVr5drXANY98OixgQE3f1aXTghAKD6V
po/XkhWl2LWD/1gYlatLGRcbmZfERWy7IwGIHSKE1cBzsdMJPUMz/gJi5/NXMabZqSTt
Mx7eSKduR3I4DiydjuzOoV844SmXv92AfUOftdGBOM4G8YeP0lPzy3VTg8j6DoRUYOCd
KnGLYNB2nNJORCPb1/avdKw2lQmt9FCeD4b46tFElRMiFq3zOoPKB/cH6tHJmYz8zQ6c
EKdbw0prqMJ6r3nsY6DF70iBCo9Y6e+ROtzTLSBEYrzKBVgyIJSN12BCfnxjPU/nlXYf
IfCA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1713617377; x=1714222177;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=rg2Aoof4owgWbpdRdlChZVc5VgRfvYZvc2j3kjQ+BX8=;
b=hhX2hnucPL0YIqH8UaDd7j4iDyLiTUffJ3qr46UOdIuPxuOJJEJ7If3o5KIHWcAy6X
IoXDydHshjEzd4zZf8d+3juRCduSzj8sozy59CJT4YqwHdWD2z63DDFKpYg0iCbjOIXJ
yskDjjNWnxPLHxI279rhDiKHinoFuMcQmkmL4brxczU+mxcLPZJ0GhG3wlrSPYVQ2GYJ
I2pWH/umyfA5f9CponIqIO/MkLc4mfGgIjENB3xqFZa+XGLk1Hna34aAd3wC178lyKXN
6W15cL+h0+euktuHUU+Q/SzTs+vA8okaoLzKZ0H6PbIyFkVUXxQYn2TDphBxLg9Q9LSg
RKkg==
X-Forwarded-Encrypted: i=1; AJvYcCWWPUMCAkld0Uh22/EdIFFkXyum2owagXGjghgyEStdGaOSeeI9LqOM5xXmpiRr6fQubbYomJ9ECo2w4FymUMCVkL2llqWYTAY=
X-Gm-Message-State: AOJu0Yx4KLT5LCTr8r9cLtj0oMs2oqIf7/GxP8/DNyUEq4vM4svJL/ET
zf04ph1BTaOyRu76OBPPUv+2tSK+W2Jh6Iu5oLtX4NjhFonE3tm89+tEHrjQVOq0Z1waLSSDh1d
d9WJdBSD89gSk1ttJwawdgi4mItaIWlUSO4h9Kg==
X-Google-Smtp-Source: AGHT+IHbFJwaCScYkpoyAwHn92Fr3gnnf+tfQ8ORu6v6S2ga06S2LjcHzwVzOagT6zvJlOUvbIn2oHyPf/nmZMOoK7k=
X-Received: by 2002:ac2:5e75:0:b0:512:e02f:9fa7 with SMTP id
a21-20020ac25e75000000b00512e02f9fa7mr3523439lfr.1.1713613784811; Sat, 20 Apr
2024 04:49:44 -0700 (PDT)
MIME-Version: 1.0
From: Helen Rausing
Date: Sat, 20 Apr 2024 12:49:16 +0100
Message-ID:
Subject:
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000ed0e87061685ccb8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 10.2
X-Spam_score_int: 102
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Cordial greetings, My name is Sigrid Rausing, a Swedish
investor and philanthropist. Your email address was provided by Google Inc.
randomly selected as an active user on the network. This year, I have decided
to donate [...]
Content analysis details: (10.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.167.46 listed in dnsbl.ahbl.org]
[209.85.167.46 listed in dnsbl.ahbl.org]
[209.85.167.46 listed in dnsbl.ahbl.org]
[209.85.167.46 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.167.46 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.167.46 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.167.46 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.167.46 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.167.46 listed in will-spam-for-food.eu.org]
[209.85.167.46 listed in will-spam-for-food.eu.org]
[209.85.167.46 listed in will-spam-for-food.eu.org]
[209.85.167.46 listed in will-spam-for-food.eu.org]
[209.85.167.46 listed in will-spam-for-food.eu.org]
[209.85.167.46 listed in will-spam-for-food.eu.org]
[209.85.167.46 listed in will-spam-for-food.eu.org]
[209.85.167.46 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.167.46 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.167.46 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[helenrausing(at)gmail.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLY From and body contain different freemails
3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?}
--000000000000ed0e87061685ccb8
Content-Type: text/plain; charset="UTF-8"
--
Cordial greetings,
My name is Sigrid Rausing, a Swedish investor and philanthropist. Your
email address was provided by Google Inc. randomly selected as an active
user on the network. This year, I have decided to donate 5 percent of my
wealth to both charities and individuals due to the coronavirus pandemic
that has paralyzed the entire world.
I am giving you EUR 1,000,000,00 and I encourage you to help someone around
you at least a little.
More information about me can be found on my Wikipedia below:
https://en.wikipedia.org/wiki/Sigrid_Rausing
Contact me at this email address: sigridrausing23@gmail.com for more
information.
Regards.S.R.
--000000000000ed0e87061685ccb8
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
x">--
=3D"gmail_signature">
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 20 Apr 2024 08:58:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1ryBun-000000003TP-3kzJ
for dave@doctor.nl2k.ab.ca;
Sat, 20 Apr 2024 08:42:05 -0600
Resent-From: The Doctor
Resent-Date: Sat, 20 Apr 2024 08:42:05 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-lf1-f46.google.com ([209.85.167.46]:53640)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1ryABu-00000000Hep-3Dh4
for doctor@doctor.nl2k.ab.ca;
Sat, 20 Apr 2024 06:51:43 -0600
Received: by mail-lf1-f46.google.com with SMTP id 2adb3069b0e04-518a3e0d2ecso4507784e87.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1713617377; x=1714222177; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=rg2Aoof4owgWbpdRdlChZVc5VgRfvYZvc2j3kjQ+BX8=;
b=STJWPdzuRAHyYmDRU/ITvJMWaoIr36qODGsTVr5drXANY98OixgQE3f1aXTghAKD6V
po/XkhWl2LWD/1gYlatLGRcbmZfERWy7IwGIHSKE1cBzsdMJPUMz/gJi5/NXMabZqSTt
Mx7eSKduR3I4DiydjuzOoV844SmXv92AfUOftdGBOM4G8YeP0lPzy3VTg8j6DoRUYOCd
KnGLYNB2nNJORCPb1/avdKw2lQmt9FCeD4b46tFElRMiFq3zOoPKB/cH6tHJmYz8zQ6c
EKdbw0prqMJ6r3nsY6DF70iBCo9Y6e+ROtzTLSBEYrzKBVgyIJSN12BCfnxjPU/nlXYf
IfCA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1713617377; x=1714222177;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=rg2Aoof4owgWbpdRdlChZVc5VgRfvYZvc2j3kjQ+BX8=;
b=hhX2hnucPL0YIqH8UaDd7j4iDyLiTUffJ3qr46UOdIuPxuOJJEJ7If3o5KIHWcAy6X
IoXDydHshjEzd4zZf8d+3juRCduSzj8sozy59CJT4YqwHdWD2z63DDFKpYg0iCbjOIXJ
yskDjjNWnxPLHxI279rhDiKHinoFuMcQmkmL4brxczU+mxcLPZJ0GhG3wlrSPYVQ2GYJ
I2pWH/umyfA5f9CponIqIO/MkLc4mfGgIjENB3xqFZa+XGLk1Hna34aAd3wC178lyKXN
6W15cL+h0+euktuHUU+Q/SzTs+vA8okaoLzKZ0H6PbIyFkVUXxQYn2TDphBxLg9Q9LSg
RKkg==
X-Forwarded-Encrypted: i=1; AJvYcCWWPUMCAkld0Uh22/EdIFFkXyum2owagXGjghgyEStdGaOSeeI9LqOM5xXmpiRr6fQubbYomJ9ECo2w4FymUMCVkL2llqWYTAY=
X-Gm-Message-State: AOJu0Yx4KLT5LCTr8r9cLtj0oMs2oqIf7/GxP8/DNyUEq4vM4svJL/ET
zf04ph1BTaOyRu76OBPPUv+2tSK+W2Jh6Iu5oLtX4NjhFonE3tm89+tEHrjQVOq0Z1waLSSDh1d
d9WJdBSD89gSk1ttJwawdgi4mItaIWlUSO4h9Kg==
X-Google-Smtp-Source: AGHT+IHbFJwaCScYkpoyAwHn92Fr3gnnf+tfQ8ORu6v6S2ga06S2LjcHzwVzOagT6zvJlOUvbIn2oHyPf/nmZMOoK7k=
X-Received: by 2002:ac2:5e75:0:b0:512:e02f:9fa7 with SMTP id
a21-20020ac25e75000000b00512e02f9fa7mr3523439lfr.1.1713613784811; Sat, 20 Apr
2024 04:49:44 -0700 (PDT)
MIME-Version: 1.0
From: Helen Rausing
Date: Sat, 20 Apr 2024 12:49:16 +0100
Message-ID:
Subject:
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000ed0e87061685ccb8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 10.2
X-Spam_score_int: 102
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Cordial greetings, My name is Sigrid Rausing, a Swedish
investor and philanthropist. Your email address was provided by Google Inc.
randomly selected as an active user on the network. This year, I have decided
to donate [...]
Content analysis details: (10.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.167.46 listed in dnsbl.ahbl.org]
[209.85.167.46 listed in dnsbl.ahbl.org]
[209.85.167.46 listed in dnsbl.ahbl.org]
[209.85.167.46 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.167.46 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.167.46 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.167.46 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.167.46 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.167.46 listed in will-spam-for-food.eu.org]
[209.85.167.46 listed in will-spam-for-food.eu.org]
[209.85.167.46 listed in will-spam-for-food.eu.org]
[209.85.167.46 listed in will-spam-for-food.eu.org]
[209.85.167.46 listed in will-spam-for-food.eu.org]
[209.85.167.46 listed in will-spam-for-food.eu.org]
[209.85.167.46 listed in will-spam-for-food.eu.org]
[209.85.167.46 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.167.46 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.167.46 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[helenrausing(at)gmail.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLY From and body contain different freemails
3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?}
--000000000000ed0e87061685ccb8
Content-Type: text/plain; charset="UTF-8"
--
Cordial greetings,
My name is Sigrid Rausing, a Swedish investor and philanthropist. Your
email address was provided by Google Inc. randomly selected as an active
user on the network. This year, I have decided to donate 5 percent of my
wealth to both charities and individuals due to the coronavirus pandemic
that has paralyzed the entire world.
I am giving you EUR 1,000,000,00 and I encourage you to help someone around
you at least a little.
More information about me can be found on my Wikipedia below:
https://en.wikipedia.org/wiki/Sigrid_Rausing
Contact me at this email address: sigridrausing23@gmail.com for more
information.
Regards.S.R.
--000000000000ed0e87061685ccb8
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
x">--
=3D"gmail_signature">
Cordial greetings,
My name is =
Sigrid Rausing, a Swedish investor and philanthropist. Your email address w=
as provided by Google Inc. randomly selected as an active user on the netwo=
rk. This year, I have decided to donate 5 percent of my wealth to both char=
ities and individuals due to the coronavirus pandemic that has paralyzed th=
e entire world.
I am giving you EUR 1,000,000,00 and I encourage you to =
help someone around you at least a little.
More information about me ca=
n be found on my Wikipedia below:
Sigrid_Rausing" target=3D"_blank">https://en.wikipedia.org/wiki/Sigrid_Raus=
ing
Contact me at this email address:
g23@gmail.com" target=3D"_blank">sigridrausing23@gmail.com for more inf=
ormation.
Regards.S.R.
My name is =
Sigrid Rausing, a Swedish investor and philanthropist. Your email address w=
as provided by Google Inc. randomly selected as an active user on the netwo=
rk. This year, I have decided to donate 5 percent of my wealth to both char=
ities and individuals due to the coronavirus pandemic that has paralyzed th=
e entire world.
I am giving you EUR 1,000,000,00 and I encourage you to =
help someone around you at least a little.
More information about me ca=
n be found on my Wikipedia below:
Sigrid_Rausing" target=3D"_blank">https://en.wikipedia.org/wiki/Sigrid_Raus=
ing
Contact me at this email address:
g23@gmail.com" target=3D"_blank">sigridrausing23@gmail.com for more inf=
ormation.
Regards.S.R.
--000000000000ed0e87061685ccb8--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments