Nigerian spam from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 08 Oct 2024 12:27:01 -0600
Received: from mail-ej1-f68.google.com ([209.85.218.68]:59898)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98 (FreeBSD))
(envelope-from)
id 1syEtO-00000000H1F-1FCM
for dave@doctor.nl2k.ab.ca;
Tue, 08 Oct 2024 12:26:22 -0600
Received: by mail-ej1-f68.google.com with SMTP id a640c23a62f3a-a9960371b62so225232566b.3
for; Tue, 08 Oct 2024 11:23:11 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1728411785; x=1729016585; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=x9RElXgXFP3Y5kjIgR6CqP8wrj3FOFk8cQWJbpcziy0=;
b=PmxWtHWUl1IJ1bfjUYZ0iiyyZM10kNYf8pIBY6CJKceWFtaUBsB12In3/f4B8BDfMs
QOCkWcvWoMkG3e5q3aqIPvEPoTaew3HmAuQzSFOUbRfDnIFyvyAkM6S5v/0W/GkbGNpA
mnkyYu03o2A7kHUgAA/biexzKkcdGRw7AfS4SY/bzzw29vEhdhEDbJP0cttyl/2kjAHb
+xTBv+8E8ldWRbD+ehGrJd1dDibuQLQg77Fujqmd+lUSrwEjzf/s8wAftY5zSRu5pB1l
HNI9Vx2kch+cwk2U6Guge/V7KjHhQKEzFpBRv8LJSmwZFaKqRBi7r8wRSnWulyYAHUdi
E1qg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1728411785; x=1729016585;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=x9RElXgXFP3Y5kjIgR6CqP8wrj3FOFk8cQWJbpcziy0=;
b=FNQwD+LGL2xMf2TUHShWpoLoX3jjk8W6+sG9T4KwhLqTsDcv1e7kuKjHzWyzPyNpMF
RD3BNLDrtzCRA7heHAKSSkwZ0uXjOQHS1w5Y+IMpoPvY3uj1zyA3YqEZ/qSyCSZZRjtu
JSA6lw52i5EN3FGfV+IWu17UjISC4r4+CNp919yoTHqHA8EIWrLwjv7p4QWk2A8Cxz9O
thuPPyU/xhyMH+OUngAIdBCEi0TfDCKo9HEC5rRxXLE1w5S3BUBFt5jfS3wnsxIOUXg+
17/XqsaK3McfBIEI0B9KWG4uePIjR+O8WZXf9TxuyX68k+bjP5vxsTIxmdCuEmmOFEta
8suA==
X-Forwarded-Encrypted: i=1; AJvYcCUsFYmC1W0FdRg45MyVUDWi3ZSNqeKMExqn3qz1DQLaMgbzR1w3XUfoIb3tjeUyEF4iutkd@doctor.nl2k.ab.ca
X-Gm-Message-State: AOJu0YzO9maZegdeGgdMxe6Ea0loY6ONkjkXVgehYYPGsB1gXDv3I0eG
K5sD5/okzk3OXax4WHg0bqqnViBNt8HpMSAltVVSaohN1FpMmrdAfECjoEpimNDj8w/mjKf51+S
I5iD798pBlujJOEu/YR3eMOS9pQ==
X-Google-Smtp-Source: AGHT+IE18mQ97p7O8G6xptuNKe47m3dge0V5KyQsj9Ybptj69Dqu0CemIrfC3t5SIu5NIkSmHVBZcoh9V+aJ8tdl8D0=
X-Received: by 2002:a05:600c:1daa:b0:42f:8515:e482 with SMTP id
5b1f17b1804b1-42f85ab59b8mr131229635e9.9.1728411129644; Tue, 08 Oct 2024
11:12:09 -0700 (PDT)
MIME-Version: 1.0
From: Aisha Gaddafi
Date: Tue, 8 Oct 2024 11:11:56 -0700
Message-ID:
Subject: dearest beloved friend,
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000688f7f0623fb1383"
Bcc: dave@doctor.nl2k.ab.ca
X-Spam_score: 19.6
X-Spam_score_int: 196
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: dearest beloved friend, Please forgive me for stressing you
with my predicaments and I am sorry to approach you through this media. It
is because it serves as the fastest means of communication. I came across
your email from my personal search and I decided to contact you. Mrs. Aisha
Al-Gaddafi is my name, the only biological daughter of the Former late Libyan
president, Col. Muammar Gaddafi. [...]
Content analysis details: (19.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.218.68 listed in wl.mailspike.net]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.218.68 listed in will-spam-for-food.eu.org]
[209.85.218.68 listed in will-spam-for-food.eu.org]
[209.85.218.68 listed in will-spam-for-food.eu.org]
[209.85.218.68 listed in will-spam-for-food.eu.org]
[209.85.218.68 listed in will-spam-for-food.eu.org]
[209.85.218.68 listed in will-spam-for-food.eu.org]
[209.85.218.68 listed in will-spam-for-food.eu.org]
[209.85.218.68 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.218.68 listed in dnsbl.ahbl.org]
[209.85.218.68 listed in dnsbl.ahbl.org]
[209.85.218.68 listed in dnsbl.ahbl.org]
[209.85.218.68 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.218.68 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.218.68 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.218.68 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.218.68 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.218.68 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[nancylee7153(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[nancylee7153(at)gmail.com]
0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
2.5 MILLION_USD BODY: Talks about millions of dollars
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLY From and body contain different freemails
0.0 T_MONEY_PERCENT X% of a lot of money for you
2.5 BODY_EMAIL_419_FRAUD_GM Email address in body is likely advance fee
fraud collector mailbox
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
1.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
Subject: {SPAM?} dearest beloved friend,
--000000000000688f7f0623fb1383
Content-Type: text/plain; charset="UTF-8"
dearest beloved friend,
Please forgive me for stressing you with my predicaments and I am sorry to
approach you through this media. It is because it serves as the fastest
means of communication.
I came across your email from my personal search and I decided to contact
you. Mrs. Aisha Al-Gaddafi is my name, the only biological daughter of the
Former late Libyan president, Col. Muammar Gaddafi. I am a single mother
and a widow. I have investment funds worth the sum of Twenty-seven million
Two hundred thousand United States Dollars ($27,200,000.00 million USD) for
investment. I am interested in you for investment project assistance in
your country because of my current refugee status here in Oman. I shall
compensate you with 30% of the total sum after the funds have been
successfully transferred into your account. I am also willing to negotiate
an investment/business profit sharing ratio with you based on the future
investment earning profits.
If you are interested, reply to me urgently for more details on my private
email address below (aishagaddafilibya5@gmail.com).
Best Regards,
Yours Truly,
Aisha Gaddafi.
--000000000000688f7f0623fb1383
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--000000000000688f7f0623fb1383--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 08 Oct 2024 12:27:01 -0600
Received: from mail-ej1-f68.google.com ([209.85.218.68]:59898)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98 (FreeBSD))
(envelope-from
id 1syEtO-00000000H1F-1FCM
for dave@doctor.nl2k.ab.ca;
Tue, 08 Oct 2024 12:26:22 -0600
Received: by mail-ej1-f68.google.com with SMTP id a640c23a62f3a-a9960371b62so225232566b.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1728411785; x=1729016585; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=x9RElXgXFP3Y5kjIgR6CqP8wrj3FOFk8cQWJbpcziy0=;
b=PmxWtHWUl1IJ1bfjUYZ0iiyyZM10kNYf8pIBY6CJKceWFtaUBsB12In3/f4B8BDfMs
QOCkWcvWoMkG3e5q3aqIPvEPoTaew3HmAuQzSFOUbRfDnIFyvyAkM6S5v/0W/GkbGNpA
mnkyYu03o2A7kHUgAA/biexzKkcdGRw7AfS4SY/bzzw29vEhdhEDbJP0cttyl/2kjAHb
+xTBv+8E8ldWRbD+ehGrJd1dDibuQLQg77Fujqmd+lUSrwEjzf/s8wAftY5zSRu5pB1l
HNI9Vx2kch+cwk2U6Guge/V7KjHhQKEzFpBRv8LJSmwZFaKqRBi7r8wRSnWulyYAHUdi
E1qg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1728411785; x=1729016585;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=x9RElXgXFP3Y5kjIgR6CqP8wrj3FOFk8cQWJbpcziy0=;
b=FNQwD+LGL2xMf2TUHShWpoLoX3jjk8W6+sG9T4KwhLqTsDcv1e7kuKjHzWyzPyNpMF
RD3BNLDrtzCRA7heHAKSSkwZ0uXjOQHS1w5Y+IMpoPvY3uj1zyA3YqEZ/qSyCSZZRjtu
JSA6lw52i5EN3FGfV+IWu17UjISC4r4+CNp919yoTHqHA8EIWrLwjv7p4QWk2A8Cxz9O
thuPPyU/xhyMH+OUngAIdBCEi0TfDCKo9HEC5rRxXLE1w5S3BUBFt5jfS3wnsxIOUXg+
17/XqsaK3McfBIEI0B9KWG4uePIjR+O8WZXf9TxuyX68k+bjP5vxsTIxmdCuEmmOFEta
8suA==
X-Forwarded-Encrypted: i=1; AJvYcCUsFYmC1W0FdRg45MyVUDWi3ZSNqeKMExqn3qz1DQLaMgbzR1w3XUfoIb3tjeUyEF4iutkd@doctor.nl2k.ab.ca
X-Gm-Message-State: AOJu0YzO9maZegdeGgdMxe6Ea0loY6ONkjkXVgehYYPGsB1gXDv3I0eG
K5sD5/okzk3OXax4WHg0bqqnViBNt8HpMSAltVVSaohN1FpMmrdAfECjoEpimNDj8w/mjKf51+S
I5iD798pBlujJOEu/YR3eMOS9pQ==
X-Google-Smtp-Source: AGHT+IE18mQ97p7O8G6xptuNKe47m3dge0V5KyQsj9Ybptj69Dqu0CemIrfC3t5SIu5NIkSmHVBZcoh9V+aJ8tdl8D0=
X-Received: by 2002:a05:600c:1daa:b0:42f:8515:e482 with SMTP id
5b1f17b1804b1-42f85ab59b8mr131229635e9.9.1728411129644; Tue, 08 Oct 2024
11:12:09 -0700 (PDT)
MIME-Version: 1.0
From: Aisha Gaddafi
Date: Tue, 8 Oct 2024 11:11:56 -0700
Message-ID:
Subject: dearest beloved friend,
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000688f7f0623fb1383"
Bcc: dave@doctor.nl2k.ab.ca
X-Spam_score: 19.6
X-Spam_score_int: 196
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: dearest beloved friend, Please forgive me for stressing you
with my predicaments and I am sorry to approach you through this media. It
is because it serves as the fastest means of communication. I came across
your email from my personal search and I decided to contact you. Mrs. Aisha
Al-Gaddafi is my name, the only biological daughter of the Former late Libyan
president, Col. Muammar Gaddafi. [...]
Content analysis details: (19.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.218.68 listed in wl.mailspike.net]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.218.68 listed in will-spam-for-food.eu.org]
[209.85.218.68 listed in will-spam-for-food.eu.org]
[209.85.218.68 listed in will-spam-for-food.eu.org]
[209.85.218.68 listed in will-spam-for-food.eu.org]
[209.85.218.68 listed in will-spam-for-food.eu.org]
[209.85.218.68 listed in will-spam-for-food.eu.org]
[209.85.218.68 listed in will-spam-for-food.eu.org]
[209.85.218.68 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.218.68 listed in dnsbl.ahbl.org]
[209.85.218.68 listed in dnsbl.ahbl.org]
[209.85.218.68 listed in dnsbl.ahbl.org]
[209.85.218.68 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.218.68 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.218.68 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.218.68 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.218.68 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.218.68 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[nancylee7153(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[nancylee7153(at)gmail.com]
0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
2.5 MILLION_USD BODY: Talks about millions of dollars
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLY From and body contain different freemails
0.0 T_MONEY_PERCENT X% of a lot of money for you
2.5 BODY_EMAIL_419_FRAUD_GM Email address in body is likely advance fee
fraud collector mailbox
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
1.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
Subject: {SPAM?} dearest beloved friend,
--000000000000688f7f0623fb1383
Content-Type: text/plain; charset="UTF-8"
dearest beloved friend,
Please forgive me for stressing you with my predicaments and I am sorry to
approach you through this media. It is because it serves as the fastest
means of communication.
I came across your email from my personal search and I decided to contact
you. Mrs. Aisha Al-Gaddafi is my name, the only biological daughter of the
Former late Libyan president, Col. Muammar Gaddafi. I am a single mother
and a widow. I have investment funds worth the sum of Twenty-seven million
Two hundred thousand United States Dollars ($27,200,000.00 million USD) for
investment. I am interested in you for investment project assistance in
your country because of my current refugee status here in Oman. I shall
compensate you with 30% of the total sum after the funds have been
successfully transferred into your account. I am also willing to negotiate
an investment/business profit sharing ratio with you based on the future
investment earning profits.
If you are interested, reply to me urgently for more details on my private
email address below (aishagaddafilibya5@gmail.com).
Best Regards,
Yours Truly,
Aisha Gaddafi.
--000000000000688f7f0623fb1383
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
dearest beloved friend,
Please forgive me for stres=
sing you with my predicaments and I am sorry to approach you through this m=
edia. It is because it serves as the fastest means of communication.
>I came across your email from my personal search and I decided to contact =
you. Mrs. Aisha Al-Gaddafi is my name, the only biological daughter of the =
Former late Libyan president, Col. Muammar Gaddafi. I am a single mother an=
d a widow. I have investment funds worth the sum of Twenty-seven million Tw=
o hundred thousand United States Dollars ($27,200,000.00 million USD) for i=
nvestment. I am interested in you for investment project assistance in your=
country because of my current refugee status here in Oman. I shall compens=
ate you with 30% of the total sum after the funds have been successfully tr=
ansferred into your account. I am also willing to negotiate an investment/b=
usiness profit sharing ratio with you based on the future investment earnin=
g profits.
If you are interested, reply to me urgently for more deta=
ils on my private email address below (
@gmail.com">aishagaddafilibya5@gmail.com).
Best Regards,
Your=
s Truly,
Aisha Gaddafi.
Please forgive me for stres=
sing you with my predicaments and I am sorry to approach you through this m=
edia. It is because it serves as the fastest means of communication.
>I came across your email from my personal search and I decided to contact =
you. Mrs. Aisha Al-Gaddafi is my name, the only biological daughter of the =
Former late Libyan president, Col. Muammar Gaddafi. I am a single mother an=
d a widow. I have investment funds worth the sum of Twenty-seven million Tw=
o hundred thousand United States Dollars ($27,200,000.00 million USD) for i=
nvestment. I am interested in you for investment project assistance in your=
country because of my current refugee status here in Oman. I shall compens=
ate you with 30% of the total sum after the funds have been successfully tr=
ansferred into your account. I am also willing to negotiate an investment/b=
usiness profit sharing ratio with you based on the future investment earnin=
g profits.
If you are interested, reply to me urgently for more deta=
ils on my private email address below (
@gmail.com">aishagaddafilibya5@gmail.com).
Best Regards,
Your=
s Truly,
Aisha Gaddafi.
--000000000000688f7f0623fb1383--
