Investment Gmail spam
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 04 May 2022 15:05:01 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1nmMAs-0007Mf-3J
for dave@doctor.nl2k.ab.ca;
Wed, 04 May 2022 15:04:42 -0600
Resent-From: The Doctor
Resent-Date: Wed, 4 May 2022 15:04:42 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pf1-f179.google.com ([209.85.210.179]:41559)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1nmG1s-000ADF-D1
for doctor@doctor.nl2k.ab.ca;
Wed, 04 May 2022 08:31:05 -0600
Received: by mail-pf1-f179.google.com with SMTP id p8so1266829pfh.8
for; Wed, 04 May 2022 07:30:35 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:from:date:message-id:subject:to;
bh=c1UoIhgVbIPFEBuuRlAY0HeIXt1ctiasSj1b/fbtwk0=;
b=Kor2V9+vGj4oZU3SvNGAp5xuCmt78eyia4mxkByrXzJJp1XIXlSAy/tVBXnCwiST4Y
jOVEJEfem/Tr4FP6IDOFCN8h1ISRJYvk+DYXrj11CeJK0cUiwMB3FGOdhJM1ikJvva4q
Woc+8hYasje+ifcJCzHtTWaoBoUQCZuk2IduZHqiRHpIsPNr3Gw0X8gbSDpX4fNw/mOo
uEUPOWf8o4f7xny5dabkCuPx0A+s6hmzwC74BQ3iumo+rbWkX2txQPr5g7P80+drssh1
I7+UXGwoIMmHms4LDqlCf9+c8kGUIE1HSnMM8gOR9Ca5xFUMAD0q1jrV/DT832zXKKkR
xbwA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
bh=c1UoIhgVbIPFEBuuRlAY0HeIXt1ctiasSj1b/fbtwk0=;
b=b1F9A0fkgAUs3oO72/yLettDZeyMyF9ti4870Xh4mLdtrmqW2V8emDQoYQAETxo/w+
bIDHuHQtmF2MW/aWI8fyZucBJ9CBK++JQseh0DsPRHjja0bFgrmSJSoiwVjR/2pyXx1W
5PcyA/7gSFqPkfg61xnsmGtMuUD2TFEIhxiE9j9hCXHbsBe1gxAwx54wJ9QeaOGqZQKZ
AN+MvJJO6778YmCYeN/bkinhlMX5G1sJz2njQMALOjGqqOTUuz+8tfJ4uUM5v189zpN6
Zc6I3S0Q9Y82WoQQbGZuCRfCMCxXibMcrNMBpdOzuOQ70B7G4fREk+iUIN99WPmxMFrO
FcPw==
X-Gm-Message-State: AOAM530hzNi7UGxvJ4bm2Aw6YyGx1VFoApQPUtYHPPCAiyI1uLEUwsxt
ocWtzj66KfXOUUL7Fui2Murvqh22xKCllvsdXik=
X-Google-Smtp-Source: ABdhPJy22+6BWM/ITghu2FV3Nic6BKlcBQr2+aaNLnWtCFAX9TpVfSdCY5EUkvAuKqcuqTb5989kmvmVeLD9OSOwRkA=
X-Received: by 2002:a63:1d4d:0:b0:3c2:698b:9698 with SMTP id
d13-20020a631d4d000000b003c2698b9698mr8030527pgm.594.1651674629645; Wed, 04
May 2022 07:30:29 -0700 (PDT)
MIME-Version: 1.0
From: Vuthanong Khemara
Date: Wed, 4 May 2022 16:21:48 -0700
Message-ID:
Subject: INVESTMENT INQUIRY
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="00000000000095a9c605de307782"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 9.4
X-Spam_score_int: 94
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear friend, I have an intention of investing in your country
and would like to have you as a local partner. My name is Mr. Fabrice Welsch,
a senior staff member of BCV Bank of Switzerland. I will provide you with
the details of my investment plans as soon as I have your remarks via my
personal email: fabric [...]
Content analysis details: (9.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.6 SUBJ_ALL_CAPS Subject is all capitals
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.210.179 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[vuthanongk[at]gmail.com]
0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
0.0 HTML_MESSAGE BODY: HTML included in message
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
-0.0 T_SCC_BODY_TEXT_LINE No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.0 FREEMAIL_REPLY From and body contain different freemails
2.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
1.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} INVESTMENT INQUIRY
--00000000000095a9c605de307782
Content-Type: text/plain; charset="UTF-8"
Dear friend,
I have an intention of investing in your country and would like to have you
as a local partner.
My name is Mr. Fabrice Welsch, a senior staff member of BCV Bank of
Switzerland. I will provide you with the details of my investment plans as
soon as I have your remarks via my personal email: fabricewelsch1@gmail.com
Thank You.
--00000000000095a9c605de307782
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
argin:0in 0in 10pt;line-height:115%;font-size:11pt;font-family:"Calibr=
i","sans-serif"">
15%;font-family:"News701 BT","serif";color:rgb(34,34,34=
)">Dear friend,
I have an intention of investing in your country and would like to have you=
as
a local partner.
argin:0in 0in 10pt;line-height:115%;font-size:11pt;font-family:"Calibr=
i","sans-serif"">
15%;font-family:"News701 BT","serif";color:rgb(34,34,34=
)">My name is Mr. Fabrice Welsch,
a=C2=A0senior staff member of BCV Bank of Switzerland. I will provide you w=
ith
the details of my investment plans as soon as I have your remarks via my
personal email:=C2=A0
_blank" style=3D"color:blue;text-decoration:underline">
:blue">fabricewelsch1@gmail.com=C2=A0
Thank You.
--00000000000095a9c605de307782--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 04 May 2022 15:05:01 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1nmMAs-0007Mf-3J
for dave@doctor.nl2k.ab.ca;
Wed, 04 May 2022 15:04:42 -0600
Resent-From: The Doctor
Resent-Date: Wed, 4 May 2022 15:04:42 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pf1-f179.google.com ([209.85.210.179]:41559)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1nmG1s-000ADF-D1
for doctor@doctor.nl2k.ab.ca;
Wed, 04 May 2022 08:31:05 -0600
Received: by mail-pf1-f179.google.com with SMTP id p8so1266829pfh.8
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:from:date:message-id:subject:to;
bh=c1UoIhgVbIPFEBuuRlAY0HeIXt1ctiasSj1b/fbtwk0=;
b=Kor2V9+vGj4oZU3SvNGAp5xuCmt78eyia4mxkByrXzJJp1XIXlSAy/tVBXnCwiST4Y
jOVEJEfem/Tr4FP6IDOFCN8h1ISRJYvk+DYXrj11CeJK0cUiwMB3FGOdhJM1ikJvva4q
Woc+8hYasje+ifcJCzHtTWaoBoUQCZuk2IduZHqiRHpIsPNr3Gw0X8gbSDpX4fNw/mOo
uEUPOWf8o4f7xny5dabkCuPx0A+s6hmzwC74BQ3iumo+rbWkX2txQPr5g7P80+drssh1
I7+UXGwoIMmHms4LDqlCf9+c8kGUIE1HSnMM8gOR9Ca5xFUMAD0q1jrV/DT832zXKKkR
xbwA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
bh=c1UoIhgVbIPFEBuuRlAY0HeIXt1ctiasSj1b/fbtwk0=;
b=b1F9A0fkgAUs3oO72/yLettDZeyMyF9ti4870Xh4mLdtrmqW2V8emDQoYQAETxo/w+
bIDHuHQtmF2MW/aWI8fyZucBJ9CBK++JQseh0DsPRHjja0bFgrmSJSoiwVjR/2pyXx1W
5PcyA/7gSFqPkfg61xnsmGtMuUD2TFEIhxiE9j9hCXHbsBe1gxAwx54wJ9QeaOGqZQKZ
AN+MvJJO6778YmCYeN/bkinhlMX5G1sJz2njQMALOjGqqOTUuz+8tfJ4uUM5v189zpN6
Zc6I3S0Q9Y82WoQQbGZuCRfCMCxXibMcrNMBpdOzuOQ70B7G4fREk+iUIN99WPmxMFrO
FcPw==
X-Gm-Message-State: AOAM530hzNi7UGxvJ4bm2Aw6YyGx1VFoApQPUtYHPPCAiyI1uLEUwsxt
ocWtzj66KfXOUUL7Fui2Murvqh22xKCllvsdXik=
X-Google-Smtp-Source: ABdhPJy22+6BWM/ITghu2FV3Nic6BKlcBQr2+aaNLnWtCFAX9TpVfSdCY5EUkvAuKqcuqTb5989kmvmVeLD9OSOwRkA=
X-Received: by 2002:a63:1d4d:0:b0:3c2:698b:9698 with SMTP id
d13-20020a631d4d000000b003c2698b9698mr8030527pgm.594.1651674629645; Wed, 04
May 2022 07:30:29 -0700 (PDT)
MIME-Version: 1.0
From: Vuthanong Khemara
Date: Wed, 4 May 2022 16:21:48 -0700
Message-ID:
Subject: INVESTMENT INQUIRY
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="00000000000095a9c605de307782"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 9.4
X-Spam_score_int: 94
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear friend, I have an intention of investing in your country
and would like to have you as a local partner. My name is Mr. Fabrice Welsch,
a senior staff member of BCV Bank of Switzerland. I will provide you with
the details of my investment plans as soon as I have your remarks via my
personal email: fabric [...]
Content analysis details: (9.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.6 SUBJ_ALL_CAPS Subject is all capitals
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.210.179 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[vuthanongk[at]gmail.com]
0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
0.0 HTML_MESSAGE BODY: HTML included in message
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
-0.0 T_SCC_BODY_TEXT_LINE No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.0 FREEMAIL_REPLY From and body contain different freemails
2.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
1.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} INVESTMENT INQUIRY
--00000000000095a9c605de307782
Content-Type: text/plain; charset="UTF-8"
Dear friend,
I have an intention of investing in your country and would like to have you
as a local partner.
My name is Mr. Fabrice Welsch, a senior staff member of BCV Bank of
Switzerland. I will provide you with the details of my investment plans as
soon as I have your remarks via my personal email: fabricewelsch1@gmail.com
Thank You.
--00000000000095a9c605de307782
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
argin:0in 0in 10pt;line-height:115%;font-size:11pt;font-family:"Calibr=
i","sans-serif"">
15%;font-family:"News701 BT","serif";color:rgb(34,34,34=
)">Dear friend,
I have an intention of investing in your country and would like to have you=
as
a local partner.
argin:0in 0in 10pt;line-height:115%;font-size:11pt;font-family:"Calibr=
i","sans-serif"">
15%;font-family:"News701 BT","serif";color:rgb(34,34,34=
)">My name is Mr. Fabrice Welsch,
a=C2=A0senior staff member of BCV Bank of Switzerland. I will provide you w=
ith
the details of my investment plans as soon as I have your remarks via my
personal email:=C2=A0
_blank" style=3D"color:blue;text-decoration:underline">
:blue">fabricewelsch1@gmail.com=C2=A0
Thank You.
--00000000000095a9c605de307782--