nigerian spam from Google Gmail Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 28 May 2026 07:15:00 -0600
Received: from mail-ej1-f42.google.com ([209.85.218.42]:43130)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wSaYZ-00000000NOA-04Pr
for dave@doctor.nl2k.ab.ca;
Thu, 28 May 2026 07:14:00 -0600
Received: by mail-ej1-f42.google.com with SMTP id a640c23a62f3a-bce57c132b2so2281535766b.0
for; Thu, 28 May 2026 06:13:05 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1779973979; cv=none;
d=google.com; s=arc-20240605;
b=aKDwiN0ITcUt9wUZ6q54vZx38b8gH4RsgPxir0zuP3e902N8ZK7fn0j+2myXGYiLcQ
dBv3SBOWYZXW/RSvljGSVBqE3/GQHFf0zhKqPKyDF0sQXXgYOdHSoynlUw+qEtkXMfcz
MfoJOwAXJfT2pyJ6QJAUHi7xbxb4ZliWuGXF+Y33gZRoJqkNDNgRxfqNZPPuHNsX57qv
uLgzB7IFSX5U3BcCPPP904EmtImpDTXhFwxjpLH8qykONPv45dX4RdQTFI26Ac8PqUpW
WhsLPkA3IIoGuhe5PQKhVGy70l2viJ1m0F5d6Nng3iiALG3fzyBalHUuMhMX5MzAKHVD
cI+Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
h=to:subject:message-id:date:from:reply-to:mime-version
:dkim-signature;
bh=IqWIKGCjC0hqttQrOGEeiK+v1iFbmL5ccCEpS+eWvxU=;
fh=pvw6p2keuTT5SMq3lAuDta2pNUgEu6ebeatz9/FpLVg=;
b=FWLuBBf50jIgP0ZQrC7TcnA/VeltwSdPisjVeMYV6zsIhvpHXcXO7QE31SY8Gfgw64
JnfZocmTr3Ift7biSrCgJpAFAfUnHfLEPo+le4cvlLCfBBKITuQqcEUxjODEdDkvLZdq
zxOxuDiplqEm9RAlExpyJ/Px7llH2flX3Pxprs+klYRV3Gt90lyV8pldK3877wROOoUW
SfMv/SgrwC8u9fZaqdtLXYSQ59/J+rohrmuGzx/TF8noA0laW4xCqBc02FNgBaEqacs6
FAm1oo5HPOGxzzEvZSox9SQ6p/UlhYl9xxe8guB3hsVvY4Be6gJPZ7HJ24bUFmpVWEag
lhpg==;
darn=doctor.nl2k.ab.ca
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20251104; t=1779973979; x=1780578779; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=IqWIKGCjC0hqttQrOGEeiK+v1iFbmL5ccCEpS+eWvxU=;
b=fXVuOLWy8Sr8q2hWN/h/kNwhvfRq/t4GUy9ig5q6JBN9slScy+OcsxfFH67zMuLZTb
m+lVs/Bg4LGQyGofcSV2ZmqFuAXli85r+z1pTNyV3D3sb7y20GmzzGsg696MvPpnmjOT
7xlVKGLWSiDoYBezalFutr8nwxjQ6IQHfIrr78fxEJsuI3g1SqC2JMUZn9yZzIy9JXgR
674u3ZY6gBDT/2uo9TFidCROlkAezsTKkQiICynJ41pgL3pxXa5Rq4LvX33Jty1/W9/O
q9IvVhe/RZ+xbkBq3XH/LiBa1w1sAAiSkAoIonjaL3KeLNKW6IfYCOE2lcr/C1E9wIMz
rnWw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1779973979; x=1780578779;
h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=IqWIKGCjC0hqttQrOGEeiK+v1iFbmL5ccCEpS+eWvxU=;
b=NmLZTz/pLXwLTidUZkklB5CNXau0uDSrfvm5rHaitQhnzegL24+8nq/CvypWgxsnrT
IpVayLjfzheL5iaDc/yGqeXmWU6dvUCNFgpPapxnvqpm9aU6qbvmnsRZ6Lmum2aiDZkF
2/K7Z7jzwrQblE/yLZeug0XqXS3dLnDNXIKnP1MP6jHeHC/MNx7/C5PCPMnMs3nbRsxT
i013GY72yb6QJY3obMBvVNIzbpp13RMsegozoGozzmsNiOki2/jEL4xJEB1OFHTfNjQd
MpbbGGeI0F2ta8bG1rgUlXtS/q9sJvflJiHMo2YBTcqmiS+x9EwIZHk1JJhqCWdMDwf8
77ag==
X-Forwarded-Encrypted: i=1; AFNElJ9gzWk92/v6gSeLXS2vr7K/lr2sgzv2tigLX2MKHG0IrI4oPH9xHCFqcAeyl2C3mHTrbqYm@doctor.nl2k.ab.ca
X-Gm-Message-State: AOJu0YzYVB4PmIINmqEOD72OPoLc0zUJY4R9+dkFWBkVAS+u3t3p75e4
414aghsAJ+3T6kqh48sHT+Kf8roPOaqO7RerMQOST1QOwTtOXIgNwa1jePyQB4lpmBqKd3eNcmz
9EzCspevNQttSyqZKhNvp3ZP9wUoak0Y=
X-Gm-Gg: Acq92OFRdtUXg5SW2fKkdJuC1ASc2KGgUQpTSdgNX7Cql3EW6G3ZF6XsbE9vvpBHDAq
NiAVscduy9VusINs5gqrM9v4hDc5FQp26LKr72NQic3bWqyBs0xso30zEkBuOhFSgvP3L6Mewos
qLHpoblgw8oR2ty2LNtFwCGfhqEgZccz5qxkH6zbbF7xfHGSdf3u3OzgP6CA9Cxk3PlgUf1G51t
7uValS8dfxyBMhEkyCU0L5tzSt4nSTEJrCd0cjktjrAKDm69dWnxvpryx1Lngz1gAv0nmlv61Dr
hRgEuZ3FA1NAbIkB1rXMQIAOWbrybATUUBrU2KIMuhckokP35Sv7SuA=
X-Received: by 2002:a17:907:e989:b0:be3:d120:9118 with SMTP id
a640c23a62f3a-be87c324cbfmr91797866b.26.1779973977475; Thu, 28 May 2026
06:12:57 -0700 (PDT)
MIME-Version: 1.0
Reply-To: allartankler01@gmail.com
From: ALLAR TANKLER
Date: Thu, 28 May 2026 11:54:06 -0700
X-Gm-Features: AVHnY4L45LhKdsKhKyqk958YmI9lItbJLMvbaNgYoNnE0qUx9NYdQxTNs4lm7S4
Message-ID:
Subject: RE
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000a310540652e07c7a"
Bcc: dave@doctor.nl2k.ab.ca
X-Spam_score: 19.2
X-Spam_score_int: 192
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: EUROPEAN INVESTMENT BANK ‎98-100 KONRAD ADENAUER BOULEVARD
L-2950 LUXEMBOURG, ‎LUXEMBOURG.
Content analysis details: (19.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.218.42 listed in dnsbl.ahbl.org]
[209.85.218.42 listed in dnsbl.ahbl.org]
[209.85.218.42 listed in dnsbl.ahbl.org]
[209.85.218.42 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.218.42 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.218.42 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.218.42 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.218.42 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.218.42 listed in will-spam-for-food.eu.org]
[209.85.218.42 listed in will-spam-for-food.eu.org]
[209.85.218.42 listed in will-spam-for-food.eu.org]
[209.85.218.42 listed in will-spam-for-food.eu.org]
[209.85.218.42 listed in will-spam-for-food.eu.org]
[209.85.218.42 listed in will-spam-for-food.eu.org]
[209.85.218.42 listed in will-spam-for-food.eu.org]
[209.85.218.42 listed in will-spam-for-food.eu.org]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.218.42 listed in bl.score.senderscore.com]
-0.0 SPF_PASS SPF: sender matches SPF record
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.218.42 listed in list.dnswl.org]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.218.42 listed in wl.mailspike.net]
2.4 DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after Received: date
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[annabelle6140(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[allartankler01(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[annabelle6140(at)gmail.com]
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
2.5 MILLION_USD BODY: Talks about millions of dollars
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.2 HTML_OBFUSCATE_10_20 BODY: Message is 10% to 20% HTML obfuscation
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} RE
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 28 May 2026 07:15:00 -0600
Received: from mail-ej1-f42.google.com ([209.85.218.42]:43130)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wSaYZ-00000000NOA-04Pr
for dave@doctor.nl2k.ab.ca;
Thu, 28 May 2026 07:14:00 -0600
Received: by mail-ej1-f42.google.com with SMTP id a640c23a62f3a-bce57c132b2so2281535766b.0
for
ARC-Seal: i=1; a=rsa-sha256; t=1779973979; cv=none;
d=google.com; s=arc-20240605;
b=aKDwiN0ITcUt9wUZ6q54vZx38b8gH4RsgPxir0zuP3e902N8ZK7fn0j+2myXGYiLcQ
dBv3SBOWYZXW/RSvljGSVBqE3/GQHFf0zhKqPKyDF0sQXXgYOdHSoynlUw+qEtkXMfcz
MfoJOwAXJfT2pyJ6QJAUHi7xbxb4ZliWuGXF+Y33gZRoJqkNDNgRxfqNZPPuHNsX57qv
uLgzB7IFSX5U3BcCPPP904EmtImpDTXhFwxjpLH8qykONPv45dX4RdQTFI26Ac8PqUpW
WhsLPkA3IIoGuhe5PQKhVGy70l2viJ1m0F5d6Nng3iiALG3fzyBalHUuMhMX5MzAKHVD
cI+Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
h=to:subject:message-id:date:from:reply-to:mime-version
:dkim-signature;
bh=IqWIKGCjC0hqttQrOGEeiK+v1iFbmL5ccCEpS+eWvxU=;
fh=pvw6p2keuTT5SMq3lAuDta2pNUgEu6ebeatz9/FpLVg=;
b=FWLuBBf50jIgP0ZQrC7TcnA/VeltwSdPisjVeMYV6zsIhvpHXcXO7QE31SY8Gfgw64
JnfZocmTr3Ift7biSrCgJpAFAfUnHfLEPo+le4cvlLCfBBKITuQqcEUxjODEdDkvLZdq
zxOxuDiplqEm9RAlExpyJ/Px7llH2flX3Pxprs+klYRV3Gt90lyV8pldK3877wROOoUW
SfMv/SgrwC8u9fZaqdtLXYSQ59/J+rohrmuGzx/TF8noA0laW4xCqBc02FNgBaEqacs6
FAm1oo5HPOGxzzEvZSox9SQ6p/UlhYl9xxe8guB3hsVvY4Be6gJPZ7HJ24bUFmpVWEag
lhpg==;
darn=doctor.nl2k.ab.ca
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20251104; t=1779973979; x=1780578779; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=IqWIKGCjC0hqttQrOGEeiK+v1iFbmL5ccCEpS+eWvxU=;
b=fXVuOLWy8Sr8q2hWN/h/kNwhvfRq/t4GUy9ig5q6JBN9slScy+OcsxfFH67zMuLZTb
m+lVs/Bg4LGQyGofcSV2ZmqFuAXli85r+z1pTNyV3D3sb7y20GmzzGsg696MvPpnmjOT
7xlVKGLWSiDoYBezalFutr8nwxjQ6IQHfIrr78fxEJsuI3g1SqC2JMUZn9yZzIy9JXgR
674u3ZY6gBDT/2uo9TFidCROlkAezsTKkQiICynJ41pgL3pxXa5Rq4LvX33Jty1/W9/O
q9IvVhe/RZ+xbkBq3XH/LiBa1w1sAAiSkAoIonjaL3KeLNKW6IfYCOE2lcr/C1E9wIMz
rnWw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1779973979; x=1780578779;
h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=IqWIKGCjC0hqttQrOGEeiK+v1iFbmL5ccCEpS+eWvxU=;
b=NmLZTz/pLXwLTidUZkklB5CNXau0uDSrfvm5rHaitQhnzegL24+8nq/CvypWgxsnrT
IpVayLjfzheL5iaDc/yGqeXmWU6dvUCNFgpPapxnvqpm9aU6qbvmnsRZ6Lmum2aiDZkF
2/K7Z7jzwrQblE/yLZeug0XqXS3dLnDNXIKnP1MP6jHeHC/MNx7/C5PCPMnMs3nbRsxT
i013GY72yb6QJY3obMBvVNIzbpp13RMsegozoGozzmsNiOki2/jEL4xJEB1OFHTfNjQd
MpbbGGeI0F2ta8bG1rgUlXtS/q9sJvflJiHMo2YBTcqmiS+x9EwIZHk1JJhqCWdMDwf8
77ag==
X-Forwarded-Encrypted: i=1; AFNElJ9gzWk92/v6gSeLXS2vr7K/lr2sgzv2tigLX2MKHG0IrI4oPH9xHCFqcAeyl2C3mHTrbqYm@doctor.nl2k.ab.ca
X-Gm-Message-State: AOJu0YzYVB4PmIINmqEOD72OPoLc0zUJY4R9+dkFWBkVAS+u3t3p75e4
414aghsAJ+3T6kqh48sHT+Kf8roPOaqO7RerMQOST1QOwTtOXIgNwa1jePyQB4lpmBqKd3eNcmz
9EzCspevNQttSyqZKhNvp3ZP9wUoak0Y=
X-Gm-Gg: Acq92OFRdtUXg5SW2fKkdJuC1ASc2KGgUQpTSdgNX7Cql3EW6G3ZF6XsbE9vvpBHDAq
NiAVscduy9VusINs5gqrM9v4hDc5FQp26LKr72NQic3bWqyBs0xso30zEkBuOhFSgvP3L6Mewos
qLHpoblgw8oR2ty2LNtFwCGfhqEgZccz5qxkH6zbbF7xfHGSdf3u3OzgP6CA9Cxk3PlgUf1G51t
7uValS8dfxyBMhEkyCU0L5tzSt4nSTEJrCd0cjktjrAKDm69dWnxvpryx1Lngz1gAv0nmlv61Dr
hRgEuZ3FA1NAbIkB1rXMQIAOWbrybATUUBrU2KIMuhckokP35Sv7SuA=
X-Received: by 2002:a17:907:e989:b0:be3:d120:9118 with SMTP id
a640c23a62f3a-be87c324cbfmr91797866b.26.1779973977475; Thu, 28 May 2026
06:12:57 -0700 (PDT)
MIME-Version: 1.0
Reply-To: allartankler01@gmail.com
From: ALLAR TANKLER
Date: Thu, 28 May 2026 11:54:06 -0700
X-Gm-Features: AVHnY4L45LhKdsKhKyqk958YmI9lItbJLMvbaNgYoNnE0qUx9NYdQxTNs4lm7S4
Message-ID:
Subject: RE
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000a310540652e07c7a"
Bcc: dave@doctor.nl2k.ab.ca
X-Spam_score: 19.2
X-Spam_score_int: 192
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: EUROPEAN INVESTMENT BANK ‎98-100 KONRAD ADENAUER BOULEVARD
L-2950 LUXEMBOURG, ‎LUXEMBOURG.
Content analysis details: (19.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.218.42 listed in dnsbl.ahbl.org]
[209.85.218.42 listed in dnsbl.ahbl.org]
[209.85.218.42 listed in dnsbl.ahbl.org]
[209.85.218.42 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.218.42 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.218.42 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.218.42 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.218.42 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.218.42 listed in will-spam-for-food.eu.org]
[209.85.218.42 listed in will-spam-for-food.eu.org]
[209.85.218.42 listed in will-spam-for-food.eu.org]
[209.85.218.42 listed in will-spam-for-food.eu.org]
[209.85.218.42 listed in will-spam-for-food.eu.org]
[209.85.218.42 listed in will-spam-for-food.eu.org]
[209.85.218.42 listed in will-spam-for-food.eu.org]
[209.85.218.42 listed in will-spam-for-food.eu.org]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.218.42 listed in bl.score.senderscore.com]
-0.0 SPF_PASS SPF: sender matches SPF record
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.218.42 listed in list.dnswl.org]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.218.42 listed in wl.mailspike.net]
2.4 DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after Received: date
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[annabelle6140(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[allartankler01(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[annabelle6140(at)gmail.com]
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
2.5 MILLION_USD BODY: Talks about millions of dollars
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.2 HTML_OBFUSCATE_10_20 BODY: Message is 10% to 20% HTML obfuscation
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} RE