Aggressive Domain Name selling spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 03 Sep 2022 11:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oUWRL-0002rs-IQ

for dave@doctor.nl2k.ab.ca;

Sat, 03 Sep 2022 10:56:15 -0600

Resent-From: The Doctor

Resent-Date: Sat, 3 Sep 2022 10:56:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ed1-f53.google.com ([209.85.208.53]:47056)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oUTrQ-0006Wc-HU

for sales@nk.ca;

Sat, 03 Sep 2022 08:11:05 -0600

Received: by mail-ed1-f53.google.com with SMTP id s11so6048222edd.13

for ; Sat, 03 Sep 2022 07:10:40 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:from:to:cc:subject:date;

bh=LDmVJqchVGQnL3nIniFfboGT6RHabhmo6KdCx7EgEmo=;

b=QWU/XQq/JY5WB/R9qRN3ZgHGA6/suAzy6lR4+6J9cQFdSK1EZqqzkVe/O13sSWIZ6A

q7meP2KTL5tRWJTDJdSUQrU2pnHxSmr5n1Ume/xTWmE6NQ66NjTDEmNKVh081+xBcHbz

v4JoZOWLoteEJaqfIgj75lRweZx3ukkrBpT9GXv15NqIX6sxkxnYHYEqjolsxzPZVDxw

o+iTniYIhtmJcl9L0W06iT78RG+rYmKM4CTVdiyaAtZQY41i1c8FMaVFbe0ll2SRf8nK

jUoclC4nWFOPBb3HZu5+5voCQiSMVAaZ2U4//oE5LgCQ3Xxi0EwWns3Sdn0+QheVOkCj

UMLA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:x-gm-message-state:from:to:cc:subject:date;

bh=LDmVJqchVGQnL3nIniFfboGT6RHabhmo6KdCx7EgEmo=;

b=cszjjLGfl6iYmMZ1vKGpAXLjYeLEAXLD4sZjU3Ko/RJ+OjaN7KVvkQ8vGqZmItp018

1Ckz6Dbi06Q5JZAZkeUq1yIDU1xNFdi8/jASj6Vh99Zh+aizLhvw/dgT2pCEatQE5vJy

r1LPHkUV8+gOUlIAELELDst74PP5KPLlovjXFJV9WsWtIAOj9noLJwo0s5FRvA0BP2ik

znXSC5GfEDQwr8MubiNGC3dYQPDRUbvFaYhGfX/uIMiBb6yI4q2wz/aFzu8UDtahCWZU

m7p8tZNhw6OYByvs3ISSiLiYia90G+yg++UZK+18+zExWbdQkFYbogfXqhcUM9lEauXu

lckw==

X-Gm-Message-State: ACgBeo2Z3RPEoVJDqsedM8YZwA5qgFufKZscB5CTGvEW1NlfaXZhSymV

znzqV64+r0falffObfQNYVKnlgUjlJad8CcRSj7nJL8WPGs=

X-Google-Smtp-Source: AA6agR5wLkBO1Wi/EpqvUY7fZZwDBrMpGrI3s3mZaPLvST7hQW1Dt2OFUmkcPvt78Bdw69U80RuSAEzWpXNWOoePlNI=

X-Received: by 2002:a05:6402:31e7:b0:447:d664:83eb with SMTP id

dy7-20020a05640231e700b00447d66483ebmr32890746edb.276.1662214233483; Sat, 03

Sep 2022 07:10:33 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

From: Mathew Henderson

Date: Sat, 3 Sep 2022 15:10:08 +0100

Message-ID:

Subject: Re: BROADBAND ALBERTA

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000ed6b9105e7c66890"



--000000000000ed6b9105e7c66890

Content-Type: text/plain; charset="UTF-8"



Hello,



Just following up on my previous email regarding the domain name

BroadbandAlberta.com



Are you interested?



You can forward the domain to your current website to effectively promote

your service to prospects who are out of reach in Alberta. Having two or

more related domains throws a wider range than one.



Visit www.BroadbandAlberta.com for instant ownership. You can as well make

us an offer.



Further inquiries are welcome.



Best regards,

Mathew Henderson

For Wisdom Domains



On Thu, Sep 1, 2022, 12:32 PM Mathew Henderson

wrote:



> Hello

>

> BroadbandAlberta.com

>

> Concerning the above domain, we are reaching out to Broadband Companies in

> Alberta for a sale of the domain

>

> The domain align with your Broadband Service and you could use it to

> authenticate your brand by redirecting it to your primary website.

>

> It's available for $599 and If interested in the domain for your

> company, kind take action as soon as possible by visiting

> www.BroadbandAlberta.com to purchase the domain name.

>

>

> Thanks

> Mathew Henderson

> For Wisdom Domains

>



--000000000000ed6b9105e7c66890

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,=C2=A0

>
Just following up on my previous email regarding t=

he domain name BroadbandAlberta.com


ir=3D"auto">Are you interested?


=3D"auto">You can forward the domain to your current website to effectively=

promote your service to prospects who are out of reach in Alberta. Having =

two or more related domains throws a wider range than one.

"auto">
Visit
erta.com">www.BroadbandAlberta.com for instant ownership. You can as we=

ll make us an offer.

Fur=

ther inquiries are welcome.


to">Best regards,
Mathew Henderson

auto">For Wisdom Domains


=3D"ltr" class=3D"gmail_attr">On Thu, Sep 1, 2022, 12:32 PM Mathew Henderso=

n <wisdommhdomains@gmail.co=

m> wrote:

:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
=

Hello

=

=C2=A0BroadbandAlberta.com


o">Concerning the above domain, we are reaching out to Broadband Companies =

in Alberta for a sale of the domain=C2=A0

=

The domain align with your Broadband Service and you coul=

d use it to authenticate your brand by redirecting it to your primary websi=

te.

It's available f=

or $599 and If=C2=A0 interested in the domain for your company,=C2=A0 kind =

take action as soon as possible by visiting
Alberta.com" target=3D"_blank" rel=3D"noreferrer">www.BroadbandAlberta.com<=

/a> to purchase the domain name.







--000000000000ed6b9105e7c66890--

Consignment boxes spam from gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 03 Sep 2022 05:40:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oURUO-000NAx-4w

for dave@doctor.nl2k.ab.ca;

Sat, 03 Sep 2022 05:39:04 -0600

Resent-From: The Doctor

Resent-Date: Sat, 3 Sep 2022 05:39:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-io1-f50.google.com ([209.85.166.50]:43975)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oUNak-0001xA-1m

for doctor@doctor.nl2k.ab.ca;

Sat, 03 Sep 2022 01:29:26 -0600

Received: by mail-io1-f50.google.com with SMTP id b142so3323327iof.10

for ; Sat, 03 Sep 2022 00:29:01 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date;

bh=T5RsusdVGCFojL0sWpoTWwpTOkpG9tUNKHkV/+RE5gU=;

b=iAhbRacrddPdinK3FsfV7MBa4eNh6HuCVa81V7Mdd/p7LXK//78T3erqPdmIt23IaI

ZHruL5jdBLHhJllAsqRr7UMW70ODA7Aw+rgdRh1kj3GPpBdfPunWh4Cn2nWSUG5AhhEt

fLZtFlspJ+o76dyJ6Ic0e9eCsX0+m2Gqa6oXtl1ouX8jE/4Yhupy94B0Eb1TuZNIQ77Z

yOGRCYUkxMzi4cPY+WDQD8dcORsmY5iMc5c8cXSUcIwtHv4wTqeEbVEXpQM1KJSwYfeg

8AEr7fiGe3XaOPAoCtr2nHGUK+u+2b+wvx4smb1dzb9weEwfpVnk8H9hkbuVRHwSL2Yn

zvOg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date;

bh=T5RsusdVGCFojL0sWpoTWwpTOkpG9tUNKHkV/+RE5gU=;

b=Eq/CtN0/o4C0sUhiXMynd1A32oQcFYl9GMXNjWfaSG1wZVcLaE/T8kfqe1PYhx8D9D

D29FVxfWNH7kRnWRDypcOeFRvGbUBM0xmOCCEoKY1AKlnLsErrUqzHNapoz+BvTBrzHi

/HTp21fdJsT/8FQKbtu+QIGJ6O4uB8MKXFzhrxK2iT/twDd+Dd4P8K4QIqGSIEG2E0P0

i7FVFvoPKbvnv1J/m2qQa6sTXOEjxpnIUMhsA45wHPuzPgXJE5UU0zSPf2GT++nqGLmm

uperZKImCN/V12x/VEwzrYAeSFD59dz+2UZD3TL2z1Y1KyZ4PlrC4+zD/iHZwfi+5Fbm

yddw==

X-Gm-Message-State: ACgBeo3WzsPwBHwxch9wmHkahwt09ha1x12WizdupgmZiG/kOg4SQL2u

HM4mzfp5UeY+yDMCZYpnSF0ezlmYIvTx1e4lrNc=

X-Google-Smtp-Source: AA6agR7M8Lvm+L4vJw527FSweFJ5GIldfLuwkipArkwGQNqXs9mqQ3Ry7itNvkyb3WmSHdMJx6fiK4W6U/Rr9JQURIw=

X-Received: by 2002:a6b:b581:0:b0:68b:bfbc:5ffb with SMTP id

e123-20020a6bb581000000b0068bbfbc5ffbmr10455472iof.103.1662190135642; Sat, 03

Sep 2022 00:28:55 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:6e02:1a05:0:0:0:0 with HTTP; Sat, 3 Sep 2022 00:28:55

-0700 (PDT)

Reply-To: davidcarllee2315@outlook.com

From: David Carl Lee

Date: Sat, 3 Sep 2022 00:28:55 -0700

Message-ID:

Subject: The Delivery OF Your Consignment Boxes,

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 9.0

X-Spam_score_int: 90

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: The Delivery OF Your Consignment Boxes J.F Kennedy International

Airport New York Hi, I am David C. Lee, I discovered an abandoned shipment

from a Diplomat from London, UK and when scanned it revealed an undisclosed

sum of money in a metal trunk box weighing approximately 25kg each. Th [...]





Content analysis details: (9.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[davidcarllee2315[at]outlook.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.166.50 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[yasirayunusamohd[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to

2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal

information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

1.5 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} The Delivery OF Your Consignment Boxes,



The Delivery OF Your Consignment Boxes

J.F Kennedy International Airport New York





Hi,





I am David C. Lee, I discovered an abandoned shipment from a Diplomat

from London, UK and when scanned it revealed an undisclosed sum

of money in a metal trunk box weighing approximately 25kg each.

The consignment was abandoned because the Content was not properly

declared by the consignee as money rather it was declared as

personal effect to avoid diversion by the shipping agent and also







the Diplomat inability to pay for Non Inspection Fees.

Each of the boxes contain about $3Million to $4Million each and

the consignment is still left in the storage house till today.

The consignment are two metal boxes with weight of about

25kg each (Internal dimension: W61 x H156 x D73 (cm). Effective

capacity: 110 LBS.). Approximately, the details of the consignment

including your name and address, the official document from United

Nation office in London are tagged on the Metal Trunk boxes.



Provide Your Name, phone number and full address also the

Name of your nearest airport around your city



You can send the required details to me by email for onward delivery.

All communication must be held extremely confidential. I can get

everything concluded within 5-6 hours upon your acceptance and proceed

to your address for delivery if you assure me of sharing the content

30% for me / 70% with you on my arrival to your house.



David C. Lee

INSPECTION UNIT

+1(302)209-0096