donation spam from Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 27 Aug 2022 14:17:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oS1S8-000IEH-3Y
for dave@doctor.nl2k.ab.ca;
Sat, 27 Aug 2022 13:26:44 -0600
Resent-From: The Doctor
Resent-Date: Sat, 27 Aug 2022 13:26:44 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oa1-f50.google.com ([209.85.160.50]:46947)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1oS0tZ-000Eil-Eb
for doctor@nl2k.ab.ca;
Sat, 27 Aug 2022 12:51:05 -0600
Received: by mail-oa1-f50.google.com with SMTP id 586e51a60fabf-11c5505dba2so6032981fac.13
for; Sat, 27 Aug 2022 11:50:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc;
bh=onAkx+shiWrYY6L6/IV7g7skzN0SAGwVGnmRJfCTi+E=;
b=ckg5qrEWXp6Z0Nlv/kxoKc7JqmAnglTpnCF2KlWQHmzz0CLmkP/tWMZ5YfyVv4jRJv
+ExVn54ZJQ+tqzBkfCK96kCB8/CfJBk4hOg1Vkh2jgfX3Tby7qqvLs2481N/JTcbWBWD
O0bFXHXUTiQLnTJNjlBh7qjC/Z+WCwBPKl4pyWiqwDjzhUwU9gtjfWGDqE9Xv2j9dqy5
pWAuQHaEchXegX2fQlv58rj0aY+iEdh7osfNVzRHCrALTDnaXrFQGPe/kmX3kfAY5ca2
9QBxj4oGmYY25TDzMLHlPd2yGPem3r7+ZwxntzROG8HV/YKBTVqKFeouKTYP2hU5iU0K
Ic7A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc;
bh=onAkx+shiWrYY6L6/IV7g7skzN0SAGwVGnmRJfCTi+E=;
b=6dD/aYOv4wnvnd0bMQi4Zzn9HZJWH0sUrPrJLWm3h5Kc85e1gRXaokNdu+iXe2VJEf
Tr5y+fmCmJ0oycp6s0C0VnePiBXe8z48HxcUWJiH4WNPp2eZm8gpqftOwIcgfulUVvHl
xzAON+fpQh8djyWtqx9uBTH4OnIet6y9LRUIuwZppjXCzE14vTgUtQ4idFzrflZRG+IZ
12MUpIQOBb4FSvHO1q6YHwI3ZZaB7WMgf4EYKgKx7aDYwJQ5jk11v0+h2EMQB+g/QMAA
6xb4TQBYCi92oLouo2ILL/P5QHNLL03aL/6XRRQsxlXs2PyXv9O1Wtf7jF/FKAD7Oy+q
R+dw==
X-Gm-Message-State: ACgBeo0SMsTBNtAXGA5v+HmS3rAcPAqfpWmko+y+a18qKHSjG3HRDX0q
OH1L0sxTcBiFcnXemGLZMEjwS1Wy/aHmIv+BhAM=
X-Google-Smtp-Source: AA6agR4orjZRUuM251Vm17F6In6zs6niTuQ53NunrxW2zEtC+v0EM5SFFj5rvqz+vtCFFrluV8hgod6glKb0keksERE=
X-Received: by 2002:a05:6870:7386:b0:11e:cf33:9023 with SMTP id
z6-20020a056870738600b0011ecf339023mr613130oam.86.1661626237998; Sat, 27 Aug
2022 11:50:37 -0700 (PDT)
MIME-Version: 1.0
Reply-To: fcpdonations2020@gmail.com
From: "Mr & Mrs Frances & Patrick Connolly"
Date: Sat, 27 Aug 2022 18:50:25 +0000
Message-ID:
Subject: voluntary donation
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000aa601e05e73d81bf"
Bcc: doctor@nl2k.ab.ca
X-Spam_score: 10.7
X-Spam_score_int: 107
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: PLEASE READ: We are Mr & Mrs Frances & Patrick Connolly, we
live in Moira, Northern Ireland and we are the successful winner of £115m
Euro Millions win who have decided to choose you as one of the 50 [...]
Content analysis details: (10.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.160.50 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[obedtetteh241[at]gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[obedtetteh241[at]gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[fcpdonations2020[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 HTML_MESSAGE BODY: HTML included in message
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.7 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} voluntary donation
--000000000000aa601e05e73d81bf
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
PLEASE READ: We are Mr & Mrs Frances & Patrick Connolly, we live in Moira,
Northern Ireland and we are the successful winner of =C2=A3115m Euro Millio=
ns
win who have decided to choose you as one of the 50 lucky winners to
receive this month of August, 2022 Donation which happens to be =C2=A3925,0=
00.
For more information on this please reach out to this email:
fcpdonations2020@gmail.com
--000000000000aa601e05e73d81bf
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--000000000000aa601e05e73d81bf--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 27 Aug 2022 14:17:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oS1S8-000IEH-3Y
for dave@doctor.nl2k.ab.ca;
Sat, 27 Aug 2022 13:26:44 -0600
Resent-From: The Doctor
Resent-Date: Sat, 27 Aug 2022 13:26:44 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oa1-f50.google.com ([209.85.160.50]:46947)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1oS0tZ-000Eil-Eb
for doctor@nl2k.ab.ca;
Sat, 27 Aug 2022 12:51:05 -0600
Received: by mail-oa1-f50.google.com with SMTP id 586e51a60fabf-11c5505dba2so6032981fac.13
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc;
bh=onAkx+shiWrYY6L6/IV7g7skzN0SAGwVGnmRJfCTi+E=;
b=ckg5qrEWXp6Z0Nlv/kxoKc7JqmAnglTpnCF2KlWQHmzz0CLmkP/tWMZ5YfyVv4jRJv
+ExVn54ZJQ+tqzBkfCK96kCB8/CfJBk4hOg1Vkh2jgfX3Tby7qqvLs2481N/JTcbWBWD
O0bFXHXUTiQLnTJNjlBh7qjC/Z+WCwBPKl4pyWiqwDjzhUwU9gtjfWGDqE9Xv2j9dqy5
pWAuQHaEchXegX2fQlv58rj0aY+iEdh7osfNVzRHCrALTDnaXrFQGPe/kmX3kfAY5ca2
9QBxj4oGmYY25TDzMLHlPd2yGPem3r7+ZwxntzROG8HV/YKBTVqKFeouKTYP2hU5iU0K
Ic7A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc;
bh=onAkx+shiWrYY6L6/IV7g7skzN0SAGwVGnmRJfCTi+E=;
b=6dD/aYOv4wnvnd0bMQi4Zzn9HZJWH0sUrPrJLWm3h5Kc85e1gRXaokNdu+iXe2VJEf
Tr5y+fmCmJ0oycp6s0C0VnePiBXe8z48HxcUWJiH4WNPp2eZm8gpqftOwIcgfulUVvHl
xzAON+fpQh8djyWtqx9uBTH4OnIet6y9LRUIuwZppjXCzE14vTgUtQ4idFzrflZRG+IZ
12MUpIQOBb4FSvHO1q6YHwI3ZZaB7WMgf4EYKgKx7aDYwJQ5jk11v0+h2EMQB+g/QMAA
6xb4TQBYCi92oLouo2ILL/P5QHNLL03aL/6XRRQsxlXs2PyXv9O1Wtf7jF/FKAD7Oy+q
R+dw==
X-Gm-Message-State: ACgBeo0SMsTBNtAXGA5v+HmS3rAcPAqfpWmko+y+a18qKHSjG3HRDX0q
OH1L0sxTcBiFcnXemGLZMEjwS1Wy/aHmIv+BhAM=
X-Google-Smtp-Source: AA6agR4orjZRUuM251Vm17F6In6zs6niTuQ53NunrxW2zEtC+v0EM5SFFj5rvqz+vtCFFrluV8hgod6glKb0keksERE=
X-Received: by 2002:a05:6870:7386:b0:11e:cf33:9023 with SMTP id
z6-20020a056870738600b0011ecf339023mr613130oam.86.1661626237998; Sat, 27 Aug
2022 11:50:37 -0700 (PDT)
MIME-Version: 1.0
Reply-To: fcpdonations2020@gmail.com
From: "Mr & Mrs Frances & Patrick Connolly"
Date: Sat, 27 Aug 2022 18:50:25 +0000
Message-ID:
Subject: voluntary donation
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000aa601e05e73d81bf"
Bcc: doctor@nl2k.ab.ca
X-Spam_score: 10.7
X-Spam_score_int: 107
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: PLEASE READ: We are Mr & Mrs Frances & Patrick Connolly, we
live in Moira, Northern Ireland and we are the successful winner of £115m
Euro Millions win who have decided to choose you as one of the 50 [...]
Content analysis details: (10.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.160.50 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[obedtetteh241[at]gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[obedtetteh241[at]gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[fcpdonations2020[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 HTML_MESSAGE BODY: HTML included in message
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.7 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} voluntary donation
--000000000000aa601e05e73d81bf
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
PLEASE READ: We are Mr & Mrs Frances & Patrick Connolly, we live in Moira,
Northern Ireland and we are the successful winner of =C2=A3115m Euro Millio=
ns
win who have decided to choose you as one of the 50 lucky winners to
receive this month of August, 2022 Donation which happens to be =C2=A3925,0=
00.
For more information on this please reach out to this email:
fcpdonations2020@gmail.com
--000000000000aa601e05e73d81bf
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
PLEASE READ: We are Mr & Mrs Frances & Patrick Con=
nolly, we live in Moira, Northern Ireland and we are the successful winner =
of =C2=A3115m Euro Millions win who have decided to choose you as one of th=
e 50 lucky winners to receive this month of August, 2022 Donation which hap=
pens to be =C2=A3925,000. For more information on this please reach out to =
this email: fcpdonations2020@=
gmail.com
nolly, we live in Moira, Northern Ireland and we are the successful winner =
of =C2=A3115m Euro Millions win who have decided to choose you as one of th=
e 50 lucky winners to receive this month of August, 2022 Donation which hap=
pens to be =C2=A3925,000. For more information on this please reach out to =
this email: fcpdonations2020@=
gmail.com
--000000000000aa601e05e73d81bf--