SEO spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Aug 2022 14:55:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRgLV-000NID-AE

for dave@doctor.nl2k.ab.ca;

Fri, 26 Aug 2022 14:54:29 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Aug 2022 14:54:29 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f176.google.com ([209.85.208.176]:38674)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRe5E-000AbG-1i

for sales@nk.ca;

Fri, 26 Aug 2022 12:29:37 -0600

Received: by mail-lj1-f176.google.com with SMTP id s8so2368654ljj.5

for ; Fri, 26 Aug 2022 11:29:10 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=webdesignoutsourcers-com.20210112.gappssmtp.com; s=20210112;

h=to:subject:message-id:date:from:sender:mime-version:from:to:cc;

bh=Cy8D8sK1/xLxTFOHJjlt1cRkN5XE1wBgRPoU2ENtT58=;

b=DF4qnd5ZQZkPhTEjCsCJi0Odqo3S29CmnXIOOtmua6ys/NsdSOEUIG2G+UPW6voneX

FHPL2wMoqYIxWkEk6769H9v0zboPYXm97TfZo8tt454pCmhTHvqmIf8KmSSioChFI5bJ

E+49iHKoczHwFMslhY4KsCt/ZzGvRCCWGQDVwp1DpPiPfTS+axVR9rfQl0rRqTIr+j5a

QpVcprOtkHYdvVevuH9U82UDoR8AQBYukZJ+I6nGSeN9vgDSUxnd9Ehkp8PfbX1i+0B8

jAVNdyDhiF+imYOjVZ6/fUbWw4V5Vb1Ua5tbtMTCDAk2kwsnFrmqP8qeXBrQfFSAZNi4

1/3w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:sender:mime-version

:x-gm-message-state:from:to:cc;

bh=Cy8D8sK1/xLxTFOHJjlt1cRkN5XE1wBgRPoU2ENtT58=;

b=q7wLgDsQdWPOiO/gru6N4mLvajAkEkWMBOwE1sf/p0cMWspCUcA4O4BPTk5iJuOzxO

gc/sY5M8UsEx85MA4AYj5eA/5TVGYvhFNwcAigcYiZSdgl6SrnxKL46xt9b0QoSBEMeU

mv6RwZtVICljStSHQeTGR7wDqTPK+9c/bQ1r44h7aqFUFmykDB2Si4We7XkXTJAi9ZhG

wukSKqp9ecTTsjI4IOlnl31wtgpEnQu9M8WjygKXocp2VGmcGFbz2R5oKI7+uu1WJmnw

9jpUdSWa6KWE/QbfxX5s+TSZ8bRjpKmAtVJSsmyqIsDhCL0/zGfNgilZ4UkkdOMTrcMW

/UBw==

X-Gm-Message-State: ACgBeo1khzlnUUVa7FAvV33cGvBsbk2WQGVnpP1tB3lanFg1bhswYPUm

JNaewm1RsNorx/fKptCnqmW+ek8IoKzbNOYCoHUgbzO0Z8qcog==

X-Google-Smtp-Source: AA6agR6KEgtF92VcollSKULUOHlyvog9xf751fkTTW3UMGXbRgN84ZMMOGb1wpWg+smfID6CZXtotirHf4UyH/Nt6Yc=

X-Received: by 2002:a05:651c:238c:b0:261:d468:d633 with SMTP id

bk12-20020a05651c238c00b00261d468d633mr2636239ljb.479.1661538543455; Fri, 26

Aug 2022 11:29:03 -0700 (PDT)

Received: from 586015324275 named unknown by gmailapi.google.com with

HTTPREST; Fri, 26 Aug 2022 14:29:02 -0400

MIME-Version: 1.0

Sender: Fahad Hassen

From: Fahad Hassen

Date: Fri, 26 Aug 2022 14:29:02 -0400

X-Google-Sender-Auth: H5yvPH2XgWbqv68Xj56cgyZvHAE

Message-ID:

Subject: mypaintsshop website question - Google Business Profile

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000a9d63505e7291610"



--000000000000a9d63505e7291610

Content-Type: text/plain; charset="UTF-8"



Hi,



I found your email from mypaintsshop.com and would like to ask if anyone is

handling your digital marketing as a whole? If not, I am eager to take this

up for you and can guarantee results - I am really enthusiastic about this

and if you too are excited to discuss, I can send you my strategy for your

quick review, of course under no obligation. Who knows - it could be a game

changer if everything strikes up right and if no action taken, no reward

can be expected anyway.



A little about me - I am Fahad Hassen, and I am a Google certified "Google

My Business" specialist, and "Google Ads" specialist - I will give you

verifiable references upon interest. With "Google My Business", you will

not pay anything to Google and with the correct setup, you can get very

good results. But with Google Ads of course, you can get quick results but

it comes at a cost, and if you have a good process to handle the traffic,

you could strike it big.



If I send you a small overview report, will you give it 10min to read? That

is all I want to know and if you say "Yes", I will send it in :-)



Fahad Hassen

(Google My Business/Google Ads specialist, certified by Google Inc)



Note - I'll send in my contact details, LinkedIn, website and work samples

upon your interest. I have been working with local businesses on their

digital marketing for the past 20 years and I am sure you will be impressed

with what I can do for you. I get the certifications renewed every year

from Google, and will present it to you upon reply. Thank you.



--000000000000a9d63505e7291610

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi,

I found your email from
ntsshop.com">mypaintsshop.com and would like to ask if anyone is handli=

ng your digital marketing as a whole? If not, I am eager to take this up fo=

r you and can guarantee results - I am really enthusiastic about this and i=

f you too are excited to discuss, I can send you my strategy for your quick=

review, of course under no obligation. Who knows - it could be a game chan=

ger if everything strikes up right and if no action taken, no reward can be=

expected anyway.

A little about me - I am Fahad Hassen, and I am a =

Google certified "Google My Business" specialist, and "Googl=

e Ads" specialist - I will give you verifiable references upon interes=

t. With "Google My Business", you will not pay anything to Google=

and with the correct setup, you can get very good results. But with Google=

Ads of course, you can get quick results but it comes at a cost, and if yo=

u have a good process to handle the traffic, you could strike it big.

r>If I send you a small overview report, will you give it 10min to read? Th=

at is all I want to know and if you say "Yes", I will send it in =

:-)

Fahad Hassen
(Google My Business/Google Ads specialist, certif=

ied by Google Inc)
=C2=A0
Note - I'll send in my contact details,=

LinkedIn, website and work samples upon your interest. I have been working=

with local businesses on their digital marketing for the past 20 years and=

I am sure you will be impressed with what I can do for you. I get the cert=

ifications renewed every year from Google, and will present it to you upon =

reply. Thank you.




--000000000000a9d63505e7291610--

Nigerian Gmail spam

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Aug 2022 10:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRcDu-000PwA-2z

for dave@doctor.nl2k.ab.ca;

Fri, 26 Aug 2022 10:30:22 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Aug 2022 10:30:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f68.google.com ([209.85.210.68]:34452)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRbJd-000KVt-QN

for doctor@doctor.nl2k.ab.ca;

Fri, 26 Aug 2022 09:32:18 -0600

Received: by mail-ot1-f68.google.com with SMTP id q39-20020a056830442700b0063889adc0ddso1242330otv.1

for ; Fri, 26 Aug 2022 08:31:56 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:mime-version:from:to:cc;

bh=45M5w7GXGhDaHEQwL25lX9CTGRVaeOJaQXcMnDBQBJA=;

b=Whwrk+Tv0ND8qfQnhD3YJZWKo48t/V5ocNnwxwyc6meJJT809NuIRKF73pVANvmWzg

Yuit4rPF1uD3qDggQObwTX9nEbPY1bxmkjXI7fNzqOtQfXPsxAn7ZZK+y7Nndlsxas0B

tnASJkA7MlxW98AzcDrEIQkcA09/0fXTvPiIRILh0PMrFjTG9obguUTSICVUztUm0B+d

YPZdiW0YX1i1jYcLvSWQpDnd6k907IuhP5k8MPDO012rclyIW4zS0czIAFYwZc8Ryc8D

OBsSxHfEMAO01B1d6ma2JEIwTRjZL4TJNJOu9H1bpvib0VgdtqmB0xkB6JqhI3wh0Fs1

xkdg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc;

bh=45M5w7GXGhDaHEQwL25lX9CTGRVaeOJaQXcMnDBQBJA=;

b=eNdrdge7FIIpILeSQrb7Me+uP1yVZTUozXD3uQZAWiDCRJ/DQaFS8etNGCbieAJKKx

xqyXa58VwLkA2/HTujNltMdr7gSovxSPhN5+anvfvFsl+KW0PotTvnlE/tao4p5Pj88Q

u6ZM75L5ttZTuc01Xot7I8fIYTTq22YE8JvvalSSgYZKy+WlNZBb1/N+Fyf1/tFqpdW7

Hiwnbh1PUzJF+5KGss7xH/rD27/nbs5s+smjoR+MSAmbuYFQbf2YSKjcQmRzNcpF1lLU

LOg/z/bh0GFB//qBJHc1P8RMtQ317Scx/EGS789iaOFGuu0eUGQ2votFnfbBPUfcdMML

+8Vw==

X-Gm-Message-State: ACgBeo0yp+tUXFx1ypGDKCUHNKYVCielt6/eI08jn5QUmU/gz0+/X+h8

y5c04JlcGqjqlyj7NulMn+Hqxie8x7TflrR41yk=

X-Google-Smtp-Source: AA6agR4kZ80nVwiXnJ6iiNX83SE85pNMZcw4p426vCh/hpFY2lTOgx5dWBiCWNZz1flUbelddWcFszSCKlCHFn7e73I=

X-Received: by 2002:a05:6830:18c4:b0:636:ee33:158e with SMTP id

v4-20020a05683018c400b00636ee33158emr1590921ote.239.1661527910426; Fri, 26

Aug 2022 08:31:50 -0700 (PDT)

MIME-Version: 1.0

From: Mrs Aisha Al-Qaddafi

Date: Fri, 26 Aug 2022 08:31:30 -0700

Message-ID:

Subject: MY Beloved one, i need your assistance

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000e2af6305e7269c88"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 11.8

X-Spam_score_int: 118

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: MY Beloved one, i need your assistance Please bear with me.

I am writing this letter to you with tears and sorrow from my heart. I am

Aisha Muammar Gaddafi, the only daughter of the embattled president of Libya,

Hon. Muammar Gaddafi. I know my mail might come to you as a surprise because

you don’t know me, but due to the unso [...]



Content analysis details: (11.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

DNSWL was blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[209.85.210.68 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.68 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[leahsamson87[at]gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[leahsamson87[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 HK_SCAM_N2 BODY: No description available.

0.1 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

1.0 HK_SCAM_N15 BODY: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 HK_NAME_FM_MR_MRS No description available.

0.0 T_HK_NAME_FM_MR_MRS No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 HK_SCAM No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 XFER_LOTSA_MONEY Transfer a lot of money

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} MY Beloved one, i need your assistance



--000000000000e2af6305e7269c88

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



MY Beloved one, i need your assistance



Please bear with me. I am writing this letter to you with tears and sorrow

from my heart.



I am Aisha Muammar Gaddafi, the only daughter of the embattled president of

Libya, Hon. Muammar Gaddafi. I know my mail might come to you as a surprise

because you don=E2=80=99t know me, but due to the unsolicited nature of my

situation here in Refugee camp Ouagadougou Burkina Faso i decided to

contact you for help. I have passed through pains and sorrowful moments

since the death of my father. At the same time, my family is the target of

Western nations led by Nato who want to destroy my father at all costs. Our

investments and bank accounts in several countries are their targets to

freeze.



My Father of blessed memory deposited the sum of $27.5M (Twenty Seven

Million Five Hundred Thousand Dollars) in a Bank at Burkina Faso which he

used my name as the next of kin. I have been commissioned by the (BOA) bank

to present an interested foreign investor/partner who can stand as my

trustee and receive the fund in his account for a possible investment in

his country due to my refugee status here in Burkina Faso.



I am in search of an honest and reliable person who will help me and stand

as my trustee so that I will present him to the Bank for the transfer of

the fund to his bank account overseas. I have chosen to contact you after

my prayers and I believe that you will not betray my trust but rather take

me as your own sister or daughter. If this transaction interests you, you

don't have to disclose it to anybody because of what is going on with my

entire family, if the United nation happens to know this account, they will

freeze it as they freeze others, so please keep this transaction only to

yourself until we finalize it.



Sorry for my pictures. I will enclose it in my next mail and more about me

when I hear from you okay.



Yours Sincerely

Best Regard,

Aisha Gaddafi



--000000000000e2af6305e7269c88

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



MY Beloved one, i need your assistance

Please bear =

with me. I am writing this letter to you with tears and sorrow from my hear=

t.

I am Aisha Muammar Gaddafi, the only daughter of the embattled pr=

esident of Libya, Hon. Muammar Gaddafi. I know my mail might come to you as=

a surprise because you don=E2=80=99t know me, but due to the unsolicited n=

ature of my situation here in Refugee camp Ouagadougou Burkina Faso i decid=

ed to contact you for help. I have passed through pains and sorrowful momen=

ts since the death of my father. At the same time, my family is the target =

of Western nations led by Nato who want to destroy my father at all costs. =

Our investments and bank accounts in several countries are their targets to=

freeze.

My Father of blessed memory deposited the sum of $27.5M (Tw=

enty Seven Million Five Hundred Thousand Dollars) in a Bank at Burkina Faso=

which he used my name as the next of kin. I have been commissioned by the =

(BOA) bank to present an interested foreign investor/partner who can stand =

as my trustee and receive the fund in his account for a possible investment=

in his country due to my refugee status here in Burkina Faso.

I am =

in search of an honest and reliable person who will help me and stand as my=

trustee so that I will present him to the Bank for the transfer of the fun=

d to his bank account overseas. I have chosen to contact you after my praye=

rs and I believe that you will not betray my trust but rather take me as yo=

ur own sister or daughter. If this transaction interests you, you don't=

have to disclose it to anybody because of what is going on with my entire =

family, if the United nation happens to know this account, they will freeze=

it as they freeze others, so please keep this transaction only to yourself=

until we finalize it.

Sorry for my pictures. I will enclose it in m=

y next mail and more about me when I hear from you okay.

Yours Since=

rely
Best Regard, =C2=A0
Aisha Gaddafi




--000000000000e2af6305e7269c88--

Business deal spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Aug 2022 08:03:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRZuT-000BwN-Pt

for dave@doctor.nl2k.ab.ca;

Fri, 26 Aug 2022 08:02:09 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Aug 2022 08:02:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f174.google.com ([209.85.210.174]:44622)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRYOo-0008dq-4D

for doctor@doctor.nl2k.ab.ca;

Fri, 26 Aug 2022 06:25:26 -0600

Received: by mail-pf1-f174.google.com with SMTP id f17so1385155pfk.11

for ; Fri, 26 Aug 2022 05:25:04 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:mime-version:from:to:cc;

bh=4IAVCA2gJTTjDt5CBjLggMJFJuBSUP41/Lvi+HTqvVI=;

b=Hi2HpAK1yqHNv8ZJAjUUQVvu/VaJoMdZP2U9qLSSsp0N3GQr63+HtJflOqAV3+Wqkv

zPmAIFZEVisSDLO3fSN6070WHOvnD3aycgWBHN0+z95yLo2vzcctR7T96v+6vlENjQMG

CeMjes9YEs9eN0lphxJR7avwLJofMPQGj0u2qVd0aaEfEAZOnB/pB4k6ok9lEnN/NOnh

d8t6PHKzP467hp0YG0w8MJ4/bMrnYfE7VCKImQVRvcB2YJNQ/ueB5xQSA+gBneEAtRkG

12X49/kNYrE/vLATGkEnucplZ+gRdvlQCXTtiHAMWsKwZRIY6kuU7b6rb+3h4R+uZT40

2krQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc;

bh=4IAVCA2gJTTjDt5CBjLggMJFJuBSUP41/Lvi+HTqvVI=;

b=Rr3uBf9+BmM2grdqv4OZY5AWqiqMAp9NM8UjcBkx+AtdUMJr9bGtJsK1/nJjFt38x9

0pfq41X2uIMYenLoTenlyX7faMm+ArDuKSwL0d+8DX/yVgeoqSzaN4990VTWHeNWqiQt

esohKyQqUhTLH4xwPYNBmUeyZyn6chV+siWyrqGgfRrz3j+j3cJl4TKVkMfJgFlp6jnU

wdWXIgCVKIu2YgmqvlapJLWLuvAobcPV4l0LvLJX208PPT2mOX6DtfJGQBm4tHw4B315

7Ao7CBLax3mQ1CsufCfvwVw02USE/FWSuRAB6H7D6SiiIWcDuXBw3mf27wNDpCfh/ItM

DrbQ==

X-Gm-Message-State: ACgBeo1jX2QzHinQMK6Wq4FMFxa1m1+FQdxMdw2inWF4xysiNEP9PZhj

jQY3sVXyugIpyOX0u/gzT+IiIUlfz8Pph8n3C6U=

X-Google-Smtp-Source: AA6agR6xvnytaeYdZtNYeqXPsePMrnbBVDx55vnGbLoW8Uts2rwTaJUif96M+Y6Cs+oO3uwBZiH44IALgPGc0RnLfgw=

X-Received: by 2002:a65:6755:0:b0:41d:70c1:be0 with SMTP id

c21-20020a656755000000b0041d70c10be0mr3145387pgu.99.1661516699418; Fri, 26

Aug 2022 05:24:59 -0700 (PDT)

MIME-Version: 1.0

From: "Dr. Umar Bello"

Date: Fri, 26 Aug 2022 05:24:45 -0700

Message-ID:

Subject: Greetings dear Friend:

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000a846f905e7240097"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 13.3

X-Spam_score_int: 133

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings dear Friend: I am contacting you on a business deal

of $19.5 Million US Dollars, ready for transfer into your account if we make

this claim, we will share it 60%/40%.100% risk free and it will be legally

backed up with government approved If you are interested reply for more details.





Content analysis details: (13.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.174 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[a0sis4ite31[at]gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[a0sis4ite31[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

3.6 NA_DOLLARS BODY: Talks about a million North American dollars

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_HK_NAME_FM_DR No description available.

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

3.1 RISK_FREE No risk!

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Greetings dear Friend:



--000000000000a846f905e7240097

Content-Type: text/plain; charset="UTF-8"



Greetings dear Friend:



I am contacting you on a business deal of $19.5 Million US Dollars,

ready for transfer into your account



if we make this claim, we will share it 60%/40%.100% risk free and it

will be legally backed up with government approved If you are

interested reply for more details.



Kindly reply for more details Waiting for your reply Make Sure You

Write To My Via E-mail Address...(umarbellod46@gmail.com)



Best regards

Dr.Umar Bello,



--000000000000a846f905e7240097

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Greetings dear Friend:
=C2=A0 =C2=A0
=C2=A0 I am co=

ntacting you on a business deal of $19.5 Million US Dollars,
ready for t=

ransfer into your account

if we make this claim, we will share it 60=

%/40%.100% risk free and it
will be legally backed up with government ap=

proved If you are
interested reply for more details.

Kindly reply=

=C2=A0for more details Waiting for your reply =C2=A0Make Sure You
Write=

To My Via E-mail Address...(umar=

bellod46@gmail.com)

Best regards
Dr.Umar Bello,




--000000000000a846f905e7240097--

Bank deposit phish from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Aug 2022 08:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRZu8-000Btw-Ay

for dave@doctor.nl2k.ab.ca;

Fri, 26 Aug 2022 08:01:48 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Aug 2022 08:01:48 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-il1-f169.google.com ([209.85.166.169]:40460)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRXbc-0004Jt-03

for doctor@nl2k.ab.ca;

Fri, 26 Aug 2022 05:34:36 -0600

Received: by mail-il1-f169.google.com with SMTP id m8so457686ilg.7

for ; Fri, 26 Aug 2022 04:34:09 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:sender:mime-version:from:to:cc;

bh=g+G6KwMGqKTv9KBq+u9XSag1LenF14W0ni2JrKw/1S4=;

b=WHl8RkNZgEGFJFMiLBRTBdo/rowkvdwxJRJqMjroTEsUwAF+mPcCSZMW4yq5nYrQFY

Dlnx08q3KumEZHi/36wymLuTYfc2Hgy5mGetYhaAxIWwrbm3xHF8Dfz9spOlusE2pUHP

ObvlO5Y+9LmxClyaeFrzrxLPoiArfw1EOku9deXJKdyQ1kaR+ScovOvZsBAHIqh56aJ8

zAe9CysZMiFgpWVXIUvFMR6MrCuJPv8MiZeaZ3iAkptb3YivjGOaBQshjI2pYZOd1faG

NWa9XOApEmjO5ZNIRXcmopKpd3d5nu/ts7MKNCTODm0Q2Ic0I3qGP+EtQOayFHMX9C1V

gPdA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:sender:mime-version

:x-gm-message-state:from:to:cc;

bh=g+G6KwMGqKTv9KBq+u9XSag1LenF14W0ni2JrKw/1S4=;

b=vTgVvkGWF76jRuBqoQOK67+AD/0PnUy2FndHDXO3nTgxHmPeK77Lrir4qdXJvqV/EZ

l3XI+/8GDkbAphQtqoF1WNqK16MuHrSs128C70RwiKGNYsKlWEdSPL1kAE/O1yqyh43D

296CnxVCAfJhTWhO9TmmuY273kcizP3hHQVu1xXgm5yCOMWeqWIvpni+U8ajcWqz2Q7G

ZiMgMGZCYOd3THbPzTL1rdcMiSQeuinWZS8MrWJpv5yC6d96apfMfhudTA2GRsCUhv3x

8AtTiae+yEK1eTmPR5lUB/y5rpQdikRMKoQ4siye2mgfFDrrVhqc+HBQ9jYEp/tXadjX

Obeg==

X-Gm-Message-State: ACgBeo2cybyWYrTMUaCy5YmuqAf+R4fUqS/Niv1a1Ngtkgy8lX/+TM9h

JaKgnEl6RcDyAaBkh7hi4k4jbfqj13t8VL8wNmU=

X-Google-Smtp-Source: AA6agR4lvJ0cTeEtYcMwjiaWMTAFHN44viHHry81nKSBHzDyCijG/IgEArFKxXExeHqtZra1ARBlN7rUkAUgBYvbG+A=

X-Received: by 2002:a92:c6c2:0:b0:2e9:627c:78bc with SMTP id

v2-20020a92c6c2000000b002e9627c78bcmr3795174ilm.288.1661513643284; Fri, 26

Aug 2022 04:34:03 -0700 (PDT)

MIME-Version: 1.0

Sender: bombirialfred@gmail.com

Received: by 2002:a4f:f186:0:0:0:0:0 with HTTP; Fri, 26 Aug 2022 04:34:02

-0700 (PDT)

From: sofiaoleksander

Date: Fri, 26 Aug 2022 12:34:02 +0100

X-Google-Sender-Auth: KJea-Phrr-9oE243_-kbqZ_lqZs

Message-ID:

Subject: Dearest,

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 7.1

X-Spam_score_int: 71

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dearest, My Name is, sofia oleksander, a 20 years old girl

from Ukraine and am presently in a refugee camp here in Poland. I lost my

parents in the recent war in Ukraine, right now am in a refugee camp in Pol

[...]



Content analysis details: (7.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.166.169 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[sofiaoleksander2[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 MILLION_USD BODY: Talks about millions of dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.0 TVD_PH_BODY_META No description available.

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Dearest,



Dearest,



My Name is, sofia oleksander, a 20 years old girl from Ukraine and

am presently in a refugee camp here in Poland. I lost my parents in

the recent war in Ukraine, right now am in a refugee camp in Poland.

Please am in great need of your help in transferring my late father

deposited fund, the sum of $3.5 MILLION UNITED STATES DOLLAR, he

deposited in a bank in United State.



the deposited money was from the sale of the company shares death

benefits payment, and entitlements of my deceased father by his

company. I have every necessary document for the fund, I seek for an

honest foreigner who will stand as my foreign partner and investor. I

just need this fund to be transferred to your bank account so that I

will come over to your country and complete my education over there in

your country. as you know, my country has been in a deep crisis due to

the recent war and I cannot go back.



Please I need your urgent,

sofia oleksander,

Oil Nigerian spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Aug 2022 07:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRZqL-000BZq-VQ

for dave@doctor.nl2k.ab.ca;

Fri, 26 Aug 2022 07:57:53 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Aug 2022 07:57:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f65.google.com ([209.85.128.65]:46726)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRU0C-000C17-8V

for sales@nk.ca;

Fri, 26 Aug 2022 01:43:45 -0600

Received: by mail-wm1-f65.google.com with SMTP id k6-20020a05600c1c8600b003a54ecc62f6so361114wms.5

for ; Fri, 26 Aug 2022 00:43:22 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc;

bh=LeeQxhXRRGI+H/HFNWXMdSDJLgJ0hJDp+WrfttuPZRI=;

b=XWc4mTPpzPkibXfrxUsHgktE/FfLxM0NDlfsiC8tyqjcVEQLyflMTZCyVPDaTx6QLY

GRtyj7zeOX116kjcEvQogiGmcSVgBd0/xMGyMT4iz6zuChdKPcc0ZEtkJvuUwqr0Qi1t

IAkcJP9dyCUGulYPm8PAvTsigeeQOaHKxauG2oCa4xBP/4IGnt4V//ZvI+WqylOWKKHe

sp2D+X2VICJICsYzenEkquIhI33OgvCnK/0ILhLvYVLoqnEeqfCcID1SACXibUBnu4Vb

KRK1ZLrOOh/cr7SWxxNd/j9McqFlXs2tLfIqioqxG/MWuc0KankXIR9RoiXofOtAUP6e

7FNQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc;

bh=LeeQxhXRRGI+H/HFNWXMdSDJLgJ0hJDp+WrfttuPZRI=;

b=pG1zHHFW00oqndElyKulLSfsZY+B0fnzw3X2sCJeqqTD8cw3h1MFRNT9YVypfTJ7wb

gBQncg5e/mFpr4m4JzYQSCEiHhFVINOI0/uKT/1h1EWPfWd80yaCzV+q2hA5VpOKAQ7d

F9i0ycKg59hqexTmzWuU8c08JacWYEs0+ob+ILhO5c17nXOjqpbY6Ie+NPrmvYV9adul

Ix5DP0MH0WAju00vLNG68HTQm9CrndS9tvR2RhXz1H3oclwXWbChvdzxUk9NaN/kAE2W

l1AGEh6yng/i/ivx63sbw7zzag675KWUjnkv1ydAQfVXmZHcwdmYt8vzJPRpZ4iV0LuP

iN4w==

X-Gm-Message-State: ACgBeo0P5IhSW33bzEsRjp3Mt3dlewQ56NvOYNW9a1d5b/AvPzX79QeY

WTyAOK1C4Q8Mc2qJNIRDNmSU7ww8epAdWJy6zg==

X-Google-Smtp-Source: AA6agR66ZQlQYyklIkQ2OdYYYyMT0XUk8XfYqe7uEvCMvVn3SBvg2Wsn6JVjm1TDtTgsHahGuvojHfDDzxHJCEs2vS8=

X-Received: by 2002:a7b:ca58:0:b0:3a5:3c1c:6d71 with SMTP id

m24-20020a7bca58000000b003a53c1c6d71mr10473194wml.118.1661499796200; Fri, 26

Aug 2022 00:43:16 -0700 (PDT)

MIME-Version: 1.0

Reply-To: michaeladrian.cs@yahoo.com

From: Michael Adrain

Date: Fri, 26 Aug 2022 08:43:06 +0100

Message-ID:

Subject: Petroleum & Oil Marketing

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="00000000000025a02605e72011d8"

Bcc: sales@nk.ca

X-Spam_score: 10.5

X-Spam_score_int: 105

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: -- Attention: Dear Friend, I wish to introduce you to this

highly prospective crude oil sale venture, I propose that you may become

a partner the a crude oil & Petroleum products sales project under the umbrella

of the West Afr [...]



Content analysis details: (10.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.65 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[michadrian.cs[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.7 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Petroleum & Oil Marketing



--00000000000025a02605e72011d8

Content-Type: text/plain; charset="UTF-8"



--

Attention: Dear Friend,



I wish to introduce you to this highly prospective crude oil sale venture,

I propose that you may become a partner the a crude oil & Petroleum

products sales project under the umbrella of the West Africa Petroleum &

Oil Marketing Agency.

In this project, we will register you as our partner and act as

representative in selling crude oil & Petroleum products to the end buyers.



In the end of period review, some of the companies could not actualize

their target in the project as a result of incapability, so their license

have been frozen and declared vacant.

We will re-assign the failed license to you, this will give you the legal

authority to act as agent/representative.



The assignment of the crude oil & Petroleum products sale and refining

license allocation to you the privilege to operate as first lifters of

crude oil & Petroleum products from the block. This attracts US$2.00

discount per barrel to the lifter on crude oil. The US$2.00 is our

(lifter) entitlement from the local petroleum agency, also been able to get

final buyers entitles you also to a US$1.00 discount from the discount

given to the end buyer as "mandates", as you are expected to be lifting 2

million barrels per month from the block.



This totals to US$6 million gross coming to your group per transaction.

What is so interesting about the project is that whereby you do not have

immediate end buyer, such people who do not have license would be ready

buyers on the spot and you part with your due commission.

We will gladly appreciate your kind interest to be part of this venture,

get back to me.





Mr. Michael Adrain

W. Licensing & Procurement Department.

WAOPMA Crude Oil & Petroleum Product Marketing Agency.

Official E-mail; wacoppma@consultant.com



--00000000000025a02605e72011d8

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





--

il=3D"gmail_signature">
<=

div>Attention: Dear =

Friend,

-size:12px">

e=3D"font-size:12px">I

wish to introduce you to this highly prospective crude oil sale=20

venture, I propose that you=C2=A0 may become a partner the a crude oil &=

;=20

Petroleum products sales project under the umbrella of the West Africa=20

Petroleum & Oil Marketing Agency.

=3D"#000000">In

this project, we will register you as our partner and act as=20

representative in selling crude oil & Petroleum products to the end=20

buyers.

-size:12px">

e=3D"font-size:12px">In

the end of period review, some of the companies could not actualize=20

their target in the project as a result of incapability, so their=20

license have been frozen and declared vacant.

color=3D"#000000">We will re-assign the fai=

led license to you, this will give you the legal authority to act as agent/=

representative.

=3D"font-size:12px">

pan style=3D"font-size:12px">The

assignment of the crude oil & Petroleum products sale and refining=20

license allocation to you the privilege to operate as first lifters of=20

crude oil & Petroleum products from the block.=C2=A0 This attracts=20

US$2.00 discount per barrel to the lifter on crude oil. The US$2.00 is=20

our

e:12px">(lifter)

entitlement from the local petroleum agency, also been able to get=20

final buyers entitles you also to a US$1.00 discount from the discount=20

given to the end buyer as "mandates", as you are expected to be l=

ifting 2

million barrels per month from the block.=C2=A0

ont color=3D"#000000">

v>
This

totals to US$6 million gross coming to your group per transaction. What

is so interesting about the project is that whereby you do not have=20

immediate end buyer, such people who do not have license would be ready=20

buyers on the spot and you part with your due commission.
v>
We will gladl=

y appreciate your kind interest to be part of this venture, get back to me.=


2px">

nt-size:12px">

yle=3D"font-size:12px">Mr. Michael Adrain

color=3D"#000000">W. Licensing & Procur=

ement Department.

le=3D"font-size:12px">WAOPMA Crude Oil & Petroleum Product Marketing Ag=

ency.




--00000000000025a02605e72011d8--

Wealth spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 25 Aug 2022 22:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRRKc-000OHy-6S

for dave@doctor.nl2k.ab.ca;

Thu, 25 Aug 2022 22:52:34 -0600

Resent-From: The Doctor

Resent-Date: Thu, 25 Aug 2022 22:52:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f180.google.com ([209.85.214.180]:34512)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRQEX-000Jat-E2

for root@doctor.nl2k.ab.ca;

Thu, 25 Aug 2022 21:42:17 -0600

Received: by mail-pl1-f180.google.com with SMTP id io24so544190plb.1

for ; Thu, 25 Aug 2022 20:41:52 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:mime-version:from:to:cc;

bh=SRD61DhjE+olsWnXHhz0T7pdvB9WWyr7Cqd6nWIbZsw=;

b=jJMZCp+VllG0p5ytiYgib3FjYaeYCjktstzj9Ryp3+2Ak4g3o7QenFFZ/ZGTh4Kief

Kb08SHCLwiAloWjCfBJ/vBrkuyBiO2RYBtg5gtBQUMcfceyrBq0KwFJzsrxu2aC76g3a

CbwDBY1qRBvXwAMp0tRwY+/MGN76klnv+Vx59RpyElQMY6NbeHTFwNy66uF6giE9ZVfN

v6czdZ7r9uW3JDE+ax+g70ZHC7sQq1AqXQyg8Hixs4PFPCXhtZDdgv5OyIgFuBr18VgT

yUDYuOeDE8yEiIqMRVvZMucqll0NyHiTwlTK+8TllZ2qgdyM06X1/RTk70+Yak2BbB8u

XKig==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc;

bh=SRD61DhjE+olsWnXHhz0T7pdvB9WWyr7Cqd6nWIbZsw=;

b=8B40jgVSMtUZmGEOjAFAUsnxl6waO4uAp0+h+H3lP4TtjNJr9Qfg6xR1erMxtYINXT

Qni42+gfTuztEVetIlkTq2RBx0SvriTLFmd2hO29hfC+NxZj4tywaXwF5Z/HjqlTP/Qq

eDJLqBzWb5LbFQWkp9qkCl+RNbKYGx5ZSsr0XmFgoZ2nhfLj7W49QGAZGkDp/eEXNjYb

MmsMHESdsZfAkNLYEDESAhmjXICYG1AOyReMJEwCxIi3la1W3GPdttF/NzrU4tXVsgIY

5DGup5ytQFeT7RhpXUQtBikW1XmXcqs0JvhKt1JxwE2EVYja2tHBNipcE8wItWGhRuJJ

fK7Q==

X-Gm-Message-State: ACgBeo1DSccVsbhtcoRSOwT6KDcAd6hXD1mVMCyyU3l52OsOTfeHE6MR

Yj4Pyd6BI0jGmtRlk9uUZuz9RmlKz6+1A6+PO/0=

X-Google-Smtp-Source: AA6agR6KAgsbR/c/s3dl84np4oJKXpxmsfY6LoydEZOZkoDB4JOFxjiK4qqsEHCk6hWY3BqCx/0lC//ufFPE0pf2m7s=

X-Received: by 2002:a17:90b:1a85:b0:1fb:1f0b:dd43 with SMTP id

ng5-20020a17090b1a8500b001fb1f0bdd43mr2283105pjb.213.1661485306613; Thu, 25

Aug 2022 20:41:46 -0700 (PDT)

MIME-Version: 1.0

From: Graham Fabin

Date: Fri, 26 Aug 2022 04:41:15 +0100

Message-ID:

Subject: LIFE TRANSFORMING WORD-WEALTH

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="00000000000080140405e71cb14c"

Bcc: root@doctor.nl2k.ab.ca



--00000000000080140405e71cb14c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Greetings



My name is Graham Eric Fabin, a Poland citizen and a banker by profession,

but I lived in the United States and United Kingdom almost all my entire

life. I am pleased to have found your contact information and I would

appreciate your quick response, so I can provide you with more information

on why I contacted you.



If you=E2=80=99re interested to hear the LIFE TRANSFORMING WORD/WEALTH, jus=

t

respond via this Email: erikagraham27@gmail.com



Regards,

Graham Eric Fabin



--00000000000080140405e71cb14c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Greetings=C2=A0

=

My name is Graham Eric Fabin, a Poland citizen and a banker by profess=

ion, but I lived in the United States and United Kingdom almost all my enti=

re life. I am pleased to have found your contact information and I would ap=

preciate your quick response, so I can provide you with more information on=

why I contacted you.

If you=E2=80=99re interested=

to hear the LIFE TRANSFORMING WORD/WEALTH, just respond via this Email:
href=3D"mailto:erikagraham27@gmail.com">erikagraham27@gmail.com
<=

div>
Regards,
Graham Eric Fabin




--00000000000080140405e71cb14c--