link spam / phish from gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 13 Nov 2022 15:23:27 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ouLLR-000BEG-6I

for dave@doctor.nl2k.ab.ca;

Sun, 13 Nov 2022 15:20:53 -0700

Resent-From: The Doctor

Resent-Date: Sun, 13 Nov 2022 15:20:53 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f43.google.com ([209.85.216.43]:46764)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ouGOp-000MpT-Hs

for doctor@nl2k.ab.ca;

Sun, 13 Nov 2022 10:04:07 -0700

Received: by mail-pj1-f43.google.com with SMTP id v4-20020a17090a088400b00212cb0ed97eso8590069pjc.5

for ; Sun, 13 Nov 2022 09:01:19 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=xqSSHMQWng+ISwQ3kaY2Ov/F8WaIUEads/ROKfbnyvA=;

b=jvZ1UPTwVQ9z5OoG4nih1bLm0xRW9oiQoz3Nz8gN8a3CROY8LrB1IgEfw9a+ElA+uk

Tj6W9glkXvP0PYFtf0n6vNWL6lPfzM+NoAgip/4e9pAhZC+cTLM9gQlT1pOz1ejOcfki

96lIszx7EAjLwhmiI2O7mr63vZDi3y4/epk2GT2QzCe/7py39hv3uauvjAk2BqXnjxCf

K1sHiX/wZ0BKkG2jHeskFvlUL00bL9YQ1iLKOrRCRx05yUBc5TA4Aeiry+24MB7MNTTy

8EiyVOBYI/CvYUk/Sgs3m2v1NI8kS0YzmQoKGQ7jSjHvLfSZ1kMyPfYGNnNp6w/ndTEt

8kwA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=xqSSHMQWng+ISwQ3kaY2Ov/F8WaIUEads/ROKfbnyvA=;

b=R80tYsmJEkBs0ES9khSN0BGLkkRsRcvBpJMy8EOuAB9WsZR2e+4xGchxknRmVx4UIJ

YwEZcduZTDMGfnnFm0E7ag76+2HGi7w4st46jyCassv8ko0H+KaixtiezCc/VkwIZtzH

sYN6rxWhyS8E4YKCeWrKK523fChBrQTxbrTsLJOAoh4Glp/nCdmLyIC1ggLVLrBzXHHb

uFkHVV2s2V4+7nTWngghrBdiLc6ugewddA8CmA+ykWkdLDeAxwfzZ1NLhirNPRya/fsd

MqLPDNZpKPNL+sR/ELVlVCphV//PmEcBUOvxNf31iog+2KS6VtK4DWNSB0J4K5Xmvyd2

s8MQ==

X-Gm-Message-State: ANoB5pk+70QE/SDvb8m6GI5SzC2evv7atnJhS3Lkmfb2OD3hwvDcxB6q

Yq+LO2s24u9rTfiN+UQTIBcsMOsf4MGWtSFd9k0=

X-Google-Smtp-Source: AA0mqf7BPFaqX9aOfJgOE7kdxIi4S4l/LdUlyo9Tacw7T0kPp7GydZj6BDt2M1/dSXWFWtiffDUFJbmMOVwVKM5WvOE=

X-Received: by 2002:a17:90a:f2cf:b0:212:c8bc:1cf5 with SMTP id

gt15-20020a17090af2cf00b00212c8bc1cf5mr10620922pjb.151.1668358874331; Sun, 13

Nov 2022 09:01:14 -0800 (PST)

MIME-Version: 1.0

Received: by 2002:a05:6a20:b2a5:b0:a4:133b:edc3 with HTTP; Sun, 13 Nov 2022

09:01:13 -0800 (PST)

From: Dhanesh Kanna

Date: Sun, 13 Nov 2022 22:31:13 +0530

Message-ID:

Subject: Re:Mr.Elias Ahoueke

To: dcbolen , ddegraaf ,

ddorward , devinderkumar ,

dgonor , dmarshall ,

doctor , domainreginter

Content-Type: text/plain; charset="UTF-8"



https://bit.ly/3AdyPJX

UN/WEB Nigerian Phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 13 Nov 2022 05:31:03 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ouBuM-000NBP-Gc

for dave@doctor.nl2k.ab.ca;

Sun, 13 Nov 2022 05:16:18 -0700

Resent-From: The Doctor

Resent-Date: Sun, 13 Nov 2022 05:16:18 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail109.syd.optusnet.com.au ([211.29.132.80]:55113)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ou5gu-000558-ED

for root@nl2k.ab.ca;

Sat, 12 Nov 2022 22:38:04 -0700

Received: from [45.137.22.87] (n175-36-124-185.meb3.vic.optusnet.com.au [175.36.124.185])

by mail109.syd.optusnet.com.au (Postfix) with ESMTP id C06A5E5677;

Sun, 13 Nov 2022 16:34:41 +1100 (AEDT)

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Payment Notice

To: Recipients

From: "Mr.Robert Russell"

Date: Sun, 13 Nov 2022 06:33:23 +0100

Reply-To: infounitednation07765@gmail.com

X-Optus-CM-Score: 0

X-Optus-CM-Analysis: v=2.4 cv=OJNEYQWB c=1 sm=1 tr=0 ts=6370820f

a=Qh19sU4PrRHUIDzuJgD7VA==:117 a=Qh19sU4PrRHUIDzuJgD7VA==:17

a=HpEJnUlJZJkA:10 a=_IUsQ1co-1UA:10 a=8nJEP1OIZ-IA:10 a=RSmzAf-M6YYA:10

a=x7bEGLp0ZPQA:10 a=pGLkceISAAAA:8 a=GRZakz-nDAW9irTYye0A:9

a=wPNLvfGTeEIA:10 a=k5A6HeMUMLUA:10 a=6LyXM_O20UwA:10

a=A79Ps6posTezYoQVTBad:22 a=Dvwa2XG2fJc9wuFW9sVX:22

X-Spam_score: 15.4

X-Spam_score_int: 154

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: UNITED NATIONS OFFICE 405 East 42nd Street, New York, NY,

10017,USA OUR REF: UN / US / 021.7XXVX / 901 YOUR REF: UNA / USA / 255-U7

/ 2022 Attention: Beneficiary NOTICE TO PAY YOU.



Content analysis details: (15.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/,

low trust

[211.29.132.80 listed in list.dnswl.org]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[infounitednation07765[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

3.6 NA_DOLLARS BODY: Talks about a million North American dollars

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

0.0 HK_NAME_MR_MRS No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

0.1 MISSING_MID Missing Message-Id: header

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.8 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.5 XFER_LOTSA_MONEY Transfer a lot of money

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal

information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Payment Notice



UNITED NATIONS OFFICE

405 East 42nd Street, New York, NY, 10017,USA

OUR REF: UN / US / 021.7XXVX / 901

YOUR REF: UNA / USA / 255-U7 / 2022

=



Attention: Beneficiary

=



NOTICE TO PAY YOU.



Following the Resolution of the World Bank Economic Forum with the Director=

s of International Monitoring Fund (IMF) passed at the United Nations Assem=

bly Conference held in Washington DC USA recently, It was unanimously agree=

d that all outstanding debts relating to Share Bond, Contract Payment, Lott=

ery/Inheritance Fund owed to Foreign Contractors and Corporate Individuals =

should be settle before the 1st Quarter of the year runs out.



As one of the Beneficiary affected in the list submitted to the United Nati=

ons Assembly by the World Bank Auditors for consideration, we hereby notify=

you that the sum of $18.5 million US Dollars has been approved for you.Ple=

ase furnish us with your full name, address and Telephone number for immedi=

ate payment.



For your information we have only a few weeks to complete this payment exer=

cise, and upon receipt of your mail you will be notified by the correspondi=

ng bank to receive the money from.



We look forward to hearing from you soon.





Robert Russell.

UN Audit Officer.

Reply to email infounitednation07765@gmail.com