parnter spam from Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 27 Jun 2022 15:09:46 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1o5vyx-000OYX-4z

for dave@doctor.nl2k.ab.ca;

Mon, 27 Jun 2022 15:09:19 -0600

Resent-From: The Doctor

Resent-Date: Mon, 27 Jun 2022 15:09:19 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vk1-f171.google.com ([209.85.221.171]:46817)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1o5rGQ-000FUE-TB

for doctor@doctor.nl2k.ab.ca;

Mon, 27 Jun 2022 10:07:06 -0600

Received: by mail-vk1-f171.google.com with SMTP id 15so4664630vko.13

for ; Mon, 27 Jun 2022 09:06:45 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:from:date:message-id:subject:to;

bh=GpehJi66kEC+m815gq5utRdUipyCawXhRJLHaeMiw24=;

b=S6q2nsOy3XnLB4xagpOR2ou83u5QdDRFpXsGsRRiJKUkVlicjEbQYf3D7MsXv3sNo2

mjrMoY7hqtW5quqEJFc2fcpxMQnxXr3P+CwIQ5oLuDREzpBDjgNlhO3mIhECdnwlM0sm

GKIt4lAtS6hovqKkBv0PNe7QBXPCT0Ii4AeityoUPWT+Dgp2zkOQSV43N1bhcy+wkcJA

tLIGxGrtiu7GPr5KE9IEy1MFEw9/TrVgm0pWAJxuplXlZnXiKlSiHL8R9tnQo9oR7Io4

4SI4ocGRjMmde948U2p/LFYAWl7Zhv/f2T0AJWcn3UvHp0RhsPRW0+0Bv3ktMYbot9Z+

9aOw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:from:date:message-id:subject:to;

bh=GpehJi66kEC+m815gq5utRdUipyCawXhRJLHaeMiw24=;

b=4d2vADe9/UyaYvPR4MYWsXxl5CpiVDmWEh22Wb0YZY2Oaln/GEcm3j7rThei6mKhN5

lQX30W797JWYUSEnFKd6WCq1TuHaVYV6R4NxmDZ5zY+y7cgioHumSdguwZZLq0E9YNIA

cUMDpeiAxzawgOMwAbJfoITUHmkmYyHWLVT1zpUpFOw+Nl+yeTmQ+WQGzeQXKXvIOtVn

fWwUhIBwREspkOsubnnyDG6gQsawUrXXKVSwYZp7u9mZsj3aSSW7XVlx7BlGUPl9OZ+E

ww/c+w3sLWpcMbv8X+NZRL5bJrLJMuA8u+YbEN+8Wb962tpU9Kwcrriprvv2pS6HtQPL

SdUQ==

X-Gm-Message-State: AJIora9CMOZUa+G47/8jWGq9Ab5fiSLScereKbAMhwgiIO/DF7CiMqkp

/ep2lvVpq28FuE8Ey4+/JamyvjlqussDQpmm2iE=

X-Google-Smtp-Source: AGRyM1sw5ykmzdjL3GnnQA+r/espe/ta/Fr/MFabWnQbD3J1kJx4AniN5jP5NuY4xYhFEdKSucPZddMBl0ax8bxTucQ=

X-Received: by 2002:a1f:300c:0:b0:36f:eb7d:746f with SMTP id

w12-20020a1f300c000000b0036feb7d746fmr3327429vkw.27.1656345999828; Mon, 27

Jun 2022 09:06:39 -0700 (PDT)

MIME-Version: 1.0

From: Dr Umar Bello

Date: Mon, 27 Jun 2022 16:05:43 -0700

Message-ID:

Subject: Greetingz partner:

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000f1ea6e05e2701a7f"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 10.5

X-Spam_score_int: 105

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetingz partner: I am contacting you on a business deal

of $19.5 Million US Dollars, ready for transfer into your account if we make

this claim, we will share it 60%/40%.100% risk free and it will be legally

backed up with government approved If you are interested reply for more details.





Content analysis details: (10.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.171 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[maki3chisom3[at]gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[umarbellod46[at]gmail.com]

3.6 NA_DOLLARS BODY: Talks about a million North American dollars

0.0 HTML_MESSAGE BODY: HTML included in message

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 T_HK_NAME_FM_DR No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

3.1 RISK_FREE No risk!

2.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Greetingz partner:



--000000000000f1ea6e05e2701a7f

Content-Type: text/plain; charset="UTF-8"



Greetingz partner:



I am contacting you on a business deal of $19.5 Million US Dollars,

ready for transfer into your account



if we make this claim, we will share it 60%/40%.100% risk free and it

will be legally backed up with government approved If you are

interested reply for more details.



Kindly reply for more details Waiting for your reply Make Sure You

Write To My Via E-mail Address...(umarbellod46@gmail.com)



Best regards

Dr.Umar Bello,



--000000000000f1ea6e05e2701a7f

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Greetingz partner:
=C2=A0 =C2=A0
=C2=A0 I am contac=

ting you on a business deal of $19.5 Million US Dollars,
ready for trans=

fer into your account

if we make this claim, we will share it 60%/40=

%.100% risk free and it
will be legally backed up with government approv=

ed If you are
interested reply for more details.

Kindly reply =C2=

=A0for more details Waiting for your reply =C2=A0Make Sure You
Write To =

My Via E-mail Address...(umarbell=

od46@gmail.com
)

Best regards
Dr.Umar Bello,




--000000000000f1ea6e05e2701a7f--

urgency spam from Google

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 27 Jun 2022 15:03:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1o5vrb-000NLZ-Cq

for dave@doctor.nl2k.ab.ca;

Mon, 27 Jun 2022 15:01:43 -0600

Resent-From: The Doctor

Resent-Date: Mon, 27 Jun 2022 15:01:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f169.google.com ([209.85.208.169]:40727)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1o5rK1-000Fzj-8A

for root@nk.ca;

Mon, 27 Jun 2022 10:10:49 -0600

Received: by mail-lj1-f169.google.com with SMTP id b23so11564789ljh.7

for ; Mon, 27 Jun 2022 09:10:24 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:from:date:message-id:subject:to;

bh=uU1SXdw4hPvKNdhQDIZEAxVwhuTPrO4NVZJP+u7dgcE=;

b=gIdO+n8A40NQrbXzvpBva3gc52oTdlfDu3EtgIgG7crdgHwzR7dZqWfuE6s9Qi6nf4

WP4VVyUDnlXJ7xA5UGRZA9YSqMJS8T8ku9Y3QmIARqpmasfm6MQVoaHTV5O+S1SMEyxC

5HnFy0DV9wVeQF3cdL+WPLJrt7/CY+qmz0Raw35if/UdhulyM/cP9nc7/oqI3ILSDK4L

djYLTwiLkC6FHBiCVnzVYd4Zcvtn6+u21fBoU3gcvjD4dzVrrAFaWRj/BRmylhWwrY3t

LZ27pUEf87VPO5nXquapuOLlKdXTlkNnP3yqFul0IEsVMPNYvG+wv2W06LFeFz+LZeup

+uYw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:from:date:message-id:subject:to;

bh=uU1SXdw4hPvKNdhQDIZEAxVwhuTPrO4NVZJP+u7dgcE=;

b=jle7hwlGzqGOJqKNb9GT6Pf2XGLCIyfgtMEMYBPNhkClL0KK9VBCfZ5pApeAHBLefF

aACvH+lppiwo/DEftzGmjaGVnHEhCqeGo/HiMbIp8QH/CAWlK7YuiQC+LbRsM7yEvt37

IcD5wrSygP8DoauN1wiydq3lWFM62+Ut6HMe/wXpEutHpWREbq1HmTZ112iNEgPwKBfk

H+VkVy7PGxmz3P5T3Kcdx9wzZFtQ9UP97yArLUFH1lgYRRDbcfHtYqacJ45g23alGSSx

ZLWc7AfjypeRntJKMqij/SY9Iqv6Rz2ctnaobP/gpaKlbQa8aLZ2WLd0ZlBRCtxQYXO1

2obg==

X-Gm-Message-State: AJIora88mlmUBJASPmoK5k34yiNzI8+g6JWFlfJC4m9OmWRa7AEj0evO

s33BTMHhxaAkf6sghUiUL3IB1VvTvD/5716q0UY=

X-Google-Smtp-Source: AGRyM1us1yC+iJOhJGVawieQxO0U9OvgQEaMtIBcFnTz5dJ4Eg2+vWhwFIfxXy34n+ASChj9FUxFOKDv2vZBiocCrb0=

X-Received: by 2002:a2e:7805:0:b0:25b:ca27:ffac with SMTP id

t5-20020a2e7805000000b0025bca27ffacmr1248510ljc.415.1656346217299; Mon, 27

Jun 2022 09:10:17 -0700 (PDT)

MIME-Version: 1.0

From: Andrew Santos

Date: Tue, 28 Jun 2022 00:09:51 +0800

Message-ID:

Subject: Re: Finally, your payment is here.

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000e8437005e27027f1"

Bcc: root@nk.ca

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello I am Andrew Santos, following up on your payment (Next

of Kin / Contract payments) already approved a year ago but I understand

you were not able to claim the same due to the charges that are in [...]



Content analysis details: (7.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.169 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[lindarich111[at]gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[lindarich111[at]gmail.com]

2.5 HK_SCAM_N2 BODY: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 HK_SCAM No description available.

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal

information

3.0 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419)

2.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

Subject: {SPAM?} Re: Finally, your payment is here.



--000000000000e8437005e27027f1

Content-Type: text/plain; charset="UTF-8"



Hello

I am Andrew Santos, following up on your payment (Next of Kin / Contract

payments) already approved a year ago but I understand you were not able to

claim the same due to the charges that are involved.

You were not able to make the payment hence the funds could not be released

to you.

However, I was contacted to review your case and recommend, if possible,

the outright cancellation of the payment since you were not able to pay the

fees before the release of funds to you either through an ATM card or wire

transfer.

If you are interested to receive your payment kindly confirm the following:



1. Your full names and address

2. Your telephone numbers

3. Any ID



Best Regards,

Andrew Santos



--000000000000e8437005e27027f1

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello
I am Andrew Santos, following up on your payment =

(Next of Kin / Contract payments) already approved a year ago but I underst=

and you were not able to claim the same due to the charges that are involve=

d.
You were not able to make the payment hence the funds could not be re=

leased to you.
However, I was contacted to review your case and recommen=

d, if possible, the outright cancellation of the payment since you were not=

able to pay the fees before the release of funds to you either through an =

ATM card or wire transfer.
If you are interested to receive your payment=

kindly confirm the following:

1. Your full names and address
2. =

Your telephone numbers
3. Any ID

Best Regards,
Andrew Santos
r>




--000000000000e8437005e27027f1--

Domain selling Spam from Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 27 Jun 2022 15:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1o5vqj-000NDi-EX

for dave@doctor.nl2k.ab.ca;

Mon, 27 Jun 2022 15:00:49 -0600

Resent-From: The Doctor

Resent-Date: Mon, 27 Jun 2022 15:00:49 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f169.google.com ([209.85.128.169]:43798)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1o5qai-000BED-TH

for sales@nk.ca;

Mon, 27 Jun 2022 09:24:01 -0600

Received: by mail-yw1-f169.google.com with SMTP id 00721157ae682-3137316bb69so88705687b3.10

for ; Mon, 27 Jun 2022 08:23:40 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:references:in-reply-to:from:date:message-id:subject:to;

bh=rITThpq+c6o4qv0OvvNP5JGWUGL2YMq8DJyiiVCSFhU=;

b=SYTZj4RXGezkVTJDA7ePeb33RFj9+56ar2LO9+wZHMdTPOCKnTZN790CDhOeqGZ6mz

fkP6zvnes9XQI1e8Wcdtte4OcAxkyYSoGr+jRIf3CC4JXjBuEcScEwsJnZQkuXnMvh91

C2h+b8/HV5+6Pc1e4XKUOsmZRpomQo4mtJ6jntMfG7ks23Gs6Y+gmcImuHo+nQRktHsk

RHr06BEuz/eSfcJVnIHfa1EPWF7gegWzD3NcsJ42NxfnsSXYeXxRMhqM+8DmsHma8MjV

vWX88OkbgpeaWUkfnh9TDAXu32kwBpFsTLlnPmHJmuxIi4yJGDpUZ4/8TyvLm+4kWNRd

zhKQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:references:in-reply-to:from:date

:message-id:subject:to;

bh=rITThpq+c6o4qv0OvvNP5JGWUGL2YMq8DJyiiVCSFhU=;

b=GP6KdROK4TlFFhQABwazrNiZmXFSia/7WGUm9jvTkAuVx5BImp3KQbHLoCvaInnjtf

WzShYBCV3AScT1PmWO7t9nuIIpGGJnL3MeH/n61Ie2G6E6C75jD78f1gIAzmgu6PHfgS

LvW/X4H1DTtA65Ue/35j8XdWVtURRMskCwRmcEuvoirQTNlzyEbX3dr6CkFMitgZH61S

nF2awjVbqoWfq8DkpmKwKcGkARICUIkzXxtIH5OF8s6nSEvfbfbPjgVRsvgvlsZTMRxe

yTpvl97YVXVat+7aowlaPXdzvdC1QcayQPTILij9FCKhOIIqMCPAMCS/xUbXoxCPPVQ6

BErQ==

X-Gm-Message-State: AJIora8qjOkPl3zzcIA109ACOJVx3O3xz3NbcY4tYqszoeKWLUxjccgE

UH4Pr4WjJ/OAYS6U1/e9Fvb8fAcjsngm0RSCLHdDWqYFBsI=

X-Google-Smtp-Source: AGRyM1tztb+/PkOc/IvgnnPB6236XdnDUtHfOmkYg1amupgtHCPZgDuoUvGyc5413+GJkwIDfGyE23HwIAWlY9T0UXc=

X-Received: by 2002:a81:9286:0:b0:317:d78b:fa41 with SMTP id

j128-20020a819286000000b00317d78bfa41mr15110383ywg.46.1656343413968; Mon, 27

Jun 2022 08:23:33 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

From: Michael Davis

Date: Mon, 27 Jun 2022 16:23:05 +0100

Message-ID:

Subject: Re: Edmonton Broadband

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000d0d60005e26f808e"



--000000000000d0d60005e26f808e

Content-Type: text/plain; charset="UTF-8"



Hello,



We have not heard from you regarding EdmontonBroadband.com



This massive domain can be forwarded to your website to capture clients

that need Broadband Services in Edmonton and nearby areas.



Price has been reduced to $399.



Go to www.EdmontonBroadband.com to get it now for $39 only.



Let me know if you have any questions.



Michael Davis.



On Mon, May 9, 2022, 6:49 PM Michael Davis wrote:



> Hello,

>

> EdmontonBroadband.com is listed for sale on Dan Domain Marketplace.

>

> The domain is often checked up on the internet in Edmonton. To capture

> more targeted customers for your business, redirect this massive domain to

> your primary website or build a new massive one on it.

>

> When you have 2 or more domains, it helps to throw a wider range and

> visibility than just 1.

>

> Go to www.EdmontonBroadband.com for immediate acquisition @ $499 only.

>

> Domain is also available @ GoDaddy.

>

> Best Regards,

> Michael Davis

> From Crown Domains.

>



--000000000000d0d60005e26f808e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,


>
We have not heard from you regarding EdmontonBroadband.c=

om

This massive domain c=

an be forwarded to your website to capture clients that need Broadband Serv=

ices in Edmonton and nearby areas.=C2=A0

<=

div dir=3D"auto">Price has been reduced to $399.=C2=A0

o">
Go to
d.com">www.EdmontonBroadband.com
to get it now for $39 only.=C2=A0
>

Let me know if you have any =

questions.

Michael Davis=

.=C2=A0


"gmail_attr">On Mon, May 9, 2022, 6:49 PM Michael Davis <
to:michaeldav2559@gmail.com">michaeldav2559@gmail.com
> wrote:

iv>

:1px #ccc solid;padding-left:1ex">
=C2=A0Hello,

"auto">
EdmontonBroadband.com is listed for sale=

on Dan Domain Marketplace.=C2=A0


=3D"auto">The domain is often checked up on the internet in Edmonton. To ca=

pture more targeted customers for your business, redirect this massive doma=

in to your primary website or build a new massive one on it.=C2=A0

v dir=3D"auto">
When you have 2 or more domains,=

it helps to throw a wider range and visibility than just 1.=C2=A0

v dir=3D"auto">

to">
Domain is also available @ GoDaddy.=C2=A0
div>

Best Regards,

ir=3D"auto">Michael Davis
From Crown Domains.
<=

/div>





--000000000000d0d60005e26f808e--

Nigerian scam from Google

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 27 Jun 2022 07:35:02 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1o5otF-0001bn-Ov

for dave@doctor.nl2k.ab.ca;

Mon, 27 Jun 2022 07:34:57 -0600

Resent-From: The Doctor

Resent-Date: Mon, 27 Jun 2022 07:34:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yb1-f177.google.com ([209.85.219.177]:47017)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1o5oma-0000hI-B0

for root@mail.nl2k.ab.ca;

Mon, 27 Jun 2022 07:28:08 -0600

Received: by mail-yb1-f177.google.com with SMTP id l11so16683593ybu.13

for ; Mon, 27 Jun 2022 06:27:44 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to

:content-transfer-encoding;

bh=1n2Tbp2UoOeJaIEJWe8PzXOuqessPWxgs3TxofVd7zc=;

b=WRcA1g3BQl3+2379eY4P9pO5v7mijMeAI8gZnsiwBr98N4dDDy6ec9iV54m23VZoNx

NYyDsQ0TxNwBPs7hgiux+E1MnTIj7T0Gkxbt5cQ85W5lkhod5sQ3iJPutXRlfC266Awb

GgjWoUOXyaV+0Cnn9+zioLsIvHpEnTWpPTsVOm6bMvq3yzfjlCjOpzrOZLG2gGYKIxln

BxOIHCsaKnYuR7mhU3TcpC/xK2HCV7oNCWT8emyVxPnbAX7i46LqhuFjQc6eZfRnBCcT

izseK+psZnFxuztBAlkpXisbZvik2FNEGH632fuAF/9g2SayE5xaBYX+tE0n+qpA+pOR

Otsw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to:content-transfer-encoding;

bh=1n2Tbp2UoOeJaIEJWe8PzXOuqessPWxgs3TxofVd7zc=;

b=0xKJM0TvnyU7diwx5HuA80hVc7HjzE1AQ8eNUlwNWZ070GhWJYNWOnliMpN6fSiOFJ

EWCYgWqLO+EkWKe7UuEcHuBvLAYl2wxNjJ8ae/QcU98B+4jwt7N1kHRjGC911A6RnLZz

6LLegONJ+nVgEZ0RM38iU1O+qyc8u65NVAgPDkHmc/PyNfsxKxERILrBhbnAVtXmfNG3

mLo6p4SCtvkWotlG9dMk1KEyFwa9axl4mv4XqwHCevX6++uPiAHQeXv1CLUDNfNErIk1

RDsd5vOvGUfMCjUze6N3CcTlkYv+Qjynbb5d4/C1z4BqFYf1V++mfhVM5ZPOSPDm5EQo

7ohQ==

X-Gm-Message-State: AJIora9QzsDAyUnwouydOCY+82VDtQClSe/0CITS8LCaLEDxCfMP0IQk

npSCcyjsfkma1XjG5lod5EsfDyi37QbdvvU7eCQiQqwZqhZI8g==

X-Google-Smtp-Source: AGRyM1tevOSGmFdTJikQHUQUWnADsZjXROo8gIhRc2HSnIzib0ZxNsWhRLRgHNETv+5IOV8V+8HEz8SfSv/xr3inCRA=

X-Received: by 2002:a25:b94:0:b0:669:b56c:e7e6 with SMTP id

142-20020a250b94000000b00669b56ce7e6mr13994972ybl.194.1656336447698; Mon, 27

Jun 2022 06:27:27 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:7000:2c96:0:0:0:0 with HTTP; Mon, 27 Jun 2022 06:27:27

-0700 (PDT)

Reply-To: ubagroupbankingplc1@gmail.com

From: UNITED NATIONS

Date: Mon, 27 Jun 2022 06:27:27 -0700

Message-ID:

Subject: IMMEDIATE PAYMENT

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Bcc: root@mail.nl2k.ab.ca

X-Spam_score: 19.4

X-Spam_score_int: 194

X-Spam_bar: +++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: WORLD BANK ASSISTED PROGRAM DIRECTORATE OF INTERNATIONAL PAYMENT

AND TRANSFER. DEBT RECONCILIATION/AUDIT UNIT UNITED NATIONS HEADQUARTERS,

NEW YORK, NY 10017, USA YOU’RE REF: WB/NF/UN/028 UNITED NAT [...]



Content analysis details: (19.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.177 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[ubagroupbankingplc1[at]gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[siliyamponsah[at]gmail.com]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

2.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to

2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.5 XFER_LOTSA_MONEY Transfer a lot of money

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal

information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

2.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

Subject: {SPAM?} IMMEDIATE PAYMENT



WORLD BANK ASSISTED PROGRAM

DIRECTORATE OF INTERNATIONAL

PAYMENT AND TRANSFER.

DEBT RECONCILIATION/AUDIT UNIT

UNITED NATIONS HEADQUARTERS,

NEW YORK, NY 10017, USA

YOU=E2=80=99RE REF: WB/NF/UN/028 UNITED NATIONS.





FASN: OSB/629578/NIG/GFS63G



Dear Sir/Ma,



We're delighted to inform you that through the LEGAL intervention of

United Nations and World Bank delegates we have successfully secured

the release of your funds which you abandoned because of those corrupt

Government officials. We=E2=80=99re obligated to comply with both Domestic =

and

International Financial Laws, which requires us to verify your

identity prior to sending or receiving wire transfer to or from

nations. Please understand that this procedure is crucial for

preventing financing terrorism and organized crime throughout the

world. Today the Global Financial Stability Report, a quarterly

publication launched to review a regular assessment of global Pending

Foreign Payments, reviewed that your contract/Inherence fund

US$15,500.000.00 which was seized and confiscated on Tuesday, July 10,

2012 by the Global Illicit Financial Team as it was tagged suspicious

fund transfer was proven to be a legal fund, free from any illegal

business and civil, criminal, or financial crime.



In view to the verification process and survey in the Joint Annual

Meetings of the Boards of Governors of the United Nations, the World

Bank and other key International Financial Intelligence Agencies, it

has been showed that you have fully complied with the International

statutory provision for payment of Huge Funds under Article 102,

section 36, SS 1a-2b of the 2012 International Financial and Allied

Matters Act. Prior to this effect, an irrevocable fund transfer

authorization letter has been forwarded to the remitting bank "United

Bank for Africa" to commence with the fund transfer as appropriate to

you as the beneficiaries with Fund Allocation Approval Serial Number:

OSB/629578/NIG/GFS63G.



With all due respect Sir/Ma, we apologize for the inconveniences and

pains this delay might have caused you and note that your fund

US$15,500,000.00 {Fifteen Million Five Hundred Thousand Dollars} shall

be release to you. Kindly contact; United Bank for Africa Plc, Email:

{ ubagroupbankingplc1@gmail.com } with your Fund Allocation Approval

Serial Number: OSB/629578/NIG/GFS63G, as your fund transfer order has

been forward to their bank and you are only required to re-confirm the

following;

(1) Full Name:.....

(2) Contact Address:....

(3) Tel:... for verification reasons only. Any hesitation or

procrastination in following up as advised here might endanger the

transfer of your fund US$15,500,000.00 into your designated Bank

account within three Bank working days.



Thanks and congratulations.



Faithfully;

ANT=C3=93NIO GUTERRES

Secretary-General United Nation

Cc: Bertrand Badr=C3=A9,

Managing Director and World Bank Group Chief Financial Officer.

Cc: Mahmoud Mohieldin

Corporate Secretary and President's Special Envoy.

Cc: UN Debt Reconciliation Committee.

cc: Mr. Kennedy Uzoka

Group Managing Director and Chief Executive Officer,

United Bank for Africa Plc

Phone Number: +2348102473294

E_MAIL:ubagroupbankingplc1@gmail.com

Nigerian Spam from Gmail in German

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 26 Jun 2022 19:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1o5dqD-0007zS-HF

for dave@doctor.nl2k.ab.ca;

Sun, 26 Jun 2022 19:47:05 -0600

Resent-From: The Doctor

Resent-Date: Sun, 26 Jun 2022 19:47:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-io1-f46.google.com ([209.85.166.46]:33569)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1o5cYY-0001AV-Tb

for doctor@doctor.nl2k.ab.ca;

Sun, 26 Jun 2022 18:24:51 -0600

Received: by mail-io1-f46.google.com with SMTP id m13so8117370ioj.0

for ; Sun, 26 Jun 2022 17:24:25 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:from:date:message-id:subject:to;

bh=RDQ7E5VZ59L3KbjS73t+9Ymd+9lsWBM26OhY2mqeW70=;

b=YdiyqIy2aOKjQqwydd+b48IlZnFNVc/+aDOQ1tKDwZmXB7MyA9ewFYm7qYAXjEmEs8

cqR1wKprtwSCy5zV9CAhn10kfznryWjB+RjBiaXpn5iREJ6Y+nOOfQkDmtpaY1YIagMJ

1IV4O41gYGbxPX+mwwUu+s2rCfW1qJhpLrNo//QWqnA0TlAV6E+YobItmFtFJu/WWZ08

R1HxuLeulQeYxXQEI5cUPuNASTi/qISkj0nW66Cam1ZxAHfjOcBkcgE3yYODNsftIshW

LxMcuQAbvGGdOx/GJCH7tBX/grlhpFEA1mmjl4++jmzR/8ceTy2ipfF99KVwiBmcT6xZ

Gluw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:from:date:message-id:subject:to;

bh=RDQ7E5VZ59L3KbjS73t+9Ymd+9lsWBM26OhY2mqeW70=;

b=YgM+x/DK0EW38FWR5QdYnrHmwztk5dSsCLRVEG/h8ePckq1pgpRGveCIsZvkADn1Ks

qKCNPbKKDDLtdOsO+ndj7ROrmzYHpzEjOZwyYx5JEMpfV+70bil/zwjtyZOu7lHhOYf9

7yN+xUo+wf30rLqZC+7fMfx25pEYq/VvMd9KFrMYEAJ7fcPSC7L9QX88UmtvOm6lpIky

WWu3ToCaz4UHT+V5CfjFuZUXRVYgY04Myvqa+yGgH8JbdfAo9EUaah9i4XFjYzqjJmkc

6CXhOwviTWWICXEKyG+GABy0S3Z1ujuNjxMQHu4dtUS3mXx2GxGjtKF1PdiARTMOsgpt

G3Dw==

X-Gm-Message-State: AJIora/OJArVcHanOUpIyvsI959CX52CvaLssMWAcRrez6E0evqGa5QZ

QiqfTGEUuwvzprMOYByMUvnyKBrr2WyNPSHtA/8=

X-Google-Smtp-Source: AGRyM1tka1ESWMYRdoZgHptyqpGvYrxKUPnLfWL5v34I3ENFbjm3ACtGrGqawvanq0qubdv6Q9Di+SAvfCSniTlb1c4=

X-Received: by 2002:a05:6602:258e:b0:675:4648:ad5f with SMTP id

p14-20020a056602258e00b006754648ad5fmr489496ioo.14.1656289460162; Sun, 26 Jun

2022 17:24:20 -0700 (PDT)

MIME-Version: 1.0

From: Sonia kouassi

Date: Mon, 27 Jun 2022 00:24:09 +0000

Message-ID:

Subject: =?UTF-8?B?R3LDvMOfZQ==?=

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000eb12de05e262f09c"

Bcc: doctor@doctor.nl2k.ab.ca



--000000000000eb12de05e262f09c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Gr=C3=BC=C3=9Fe



Ich bin Frau Sonia Kouassi aus Abidjan Elfenbeink=C3=BCste (C=C3=B4te d'Ivo=

ire). Ich

bin ein 22-j=C3=A4hriges M=C3=A4dchen, ein Waisenkind, weil ich keine Elter=

n habe.

Meine Onkel drohen, mich wegen des Erbes zu t=C3=B6ten, das mein Vater f=C3=

=BCr mich

hinterlassen hat US-Dollar) zehn Millionen f=C3=BCnfhunderttausend US-Dolla=

r,

die ich von meinem verstorbenen Vater geerbt habe, aber er hat das Geld auf

ein Fest-/Streukonto bei einer der besten Banken hier in Abidjan eingezahlt=

,

In =C3=9Cbereinstimmung mit der Bank, den Fonds auf ein ausl=C3=A4ndisches =

Bankkonto

f=C3=BCr Investitionen im Ausland zu =C3=BCberweisen, aber er starb, ohne d=

en Fonds

zu =C3=BCberweisen, verwendete mein Vater meinen Namen als ihre einzige Toc=

hter

f=C3=BCr die n=C3=A4chsten Angeh=C3=B6rigen, als er den Fonds einzahlte, un=

d der Fonds

kann nur auf ein ausl=C3=A4ndisches Bankkonto =C3=BCberwiesen werden, alles=

, was ich

brauche, ist Ihre Ehrlichkeit als meine ausl=C3=A4ndische Anleitung, und um=

mir

zu helfen, den Fonds zu investieren, und mir auch zu helfen, meine

Ausbildung in Ihrem Land fortzusetzen

Bitte, wenn Sie voll und ganz damit einverstanden sind, mir zu diesem Zweck

zu helfen, geben Sie bitte Ihr Interesse an, indem Sie mir zur=C3=BCckschre=

iben,

dann werde ich Ihnen die notwendigen Informationen zum weiteren Vorgehen

geben, ich werde Ihnen danach 20 % des Gesamtbetrags f=C3=BCr Ihre Hilfe ge=

ben

die =C3=9Cbertragung, danke f=C3=BCr Ihre Sorge

Deine

Sonja Kuassi



--000000000000eb12de05e262f09c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Gr=C3=BC=C3=9Fe

Ich bin Frau Sonia Kouassi aus Abid=

jan Elfenbeink=C3=BCste (C=C3=B4te d'Ivoire). Ich bin ein 22-j=C3=A4hri=

ges M=C3=A4dchen, ein Waisenkind, weil ich keine Eltern habe. Meine Onkel d=

rohen, mich wegen des Erbes zu t=C3=B6ten, das mein Vater f=C3=BCr mich hin=

terlassen hat US-Dollar) zehn Millionen f=C3=BCnfhunderttausend US-Dollar, =

die ich von meinem verstorbenen Vater geerbt habe, aber er hat das Geld auf=

ein Fest-/Streukonto bei einer der besten Banken hier in Abidjan eingezahl=

t,
In =C3=9Cbereinstimmung mit der Bank, den Fonds auf ein ausl=C3=A4ndi=

sches Bankkonto f=C3=BCr Investitionen im Ausland zu =C3=BCberweisen, aber =

er starb, ohne den Fonds zu =C3=BCberweisen, verwendete mein Vater meinen N=

amen als ihre einzige Tochter f=C3=BCr die n=C3=A4chsten Angeh=C3=B6rigen, =

als er den Fonds einzahlte, und der Fonds kann nur auf ein ausl=C3=A4ndisch=

es Bankkonto =C3=BCberwiesen werden, alles, was ich brauche, ist Ihre Ehrli=

chkeit als meine ausl=C3=A4ndische Anleitung, und um mir zu helfen, den Fon=

ds zu investieren, und mir auch zu helfen, meine Ausbildung in Ihrem Land f=

ortzusetzen
Bitte, wenn Sie voll und ganz damit einverstanden sind, mir =

zu diesem Zweck zu helfen, geben Sie bitte Ihr Interesse an, indem Sie mir =

zur=C3=BCckschreiben, dann werde ich Ihnen die notwendigen Informationen zu=

m weiteren Vorgehen geben, ich werde Ihnen danach 20 % des Gesamtbetrags f=

=C3=BCr Ihre Hilfe geben die =C3=9Cbertragung, danke f=C3=BCr Ihre Sorge
>Deine
Sonja Kuassi




--000000000000eb12de05e262f09c--