Funds spam from Google
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 17 Nov 2022 16:53:03 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1ovogP-0008ir-E9
for dave@doctor.nl2k.ab.ca;
Thu, 17 Nov 2022 16:52:37 -0700
Resent-From: The Doctor
Resent-Date: Thu, 17 Nov 2022 16:52:37 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-wr1-f41.google.com ([209.85.221.41]:40893)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1ovoca-000CNh-JK
for doctor@doctor.nl2k.ab.ca;
Thu, 17 Nov 2022 16:48:46 -0700
Received: by mail-wr1-f41.google.com with SMTP id x5so2438534wrt.7
for; Thu, 17 Nov 2022 15:46:11 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=QDRGrgtvNhU9Hu9IBu6cKdMIthibDv78/9SQl6LQSqY=;
b=moRnC10ajnJwc3N1BKky3xxLvQIkg5mmQ2ODR06W9EBvWdbhW1wlDmp8hGJk9iuQWL
vG80fR/UVzhw/Bhd9HaU8zj+BF03j/Aqj8bZby+BAvPNZY7RJmwsuiQtXRYXYSv7UKiR
NDdFooXGUf2TyRw0tSVQahgkda8Ud3+wHQbXSiYIsQu5dQ0MxrG/0BmGTd/3HxQY1bzm
WanTLQWnV7n4q67ekjUbbQ14oZ6DWsJ4rXkpxngiCYvHd7LgbU9em+RHznvmXns1aL5y
BDygQYMk4O7k4t3P1M7XzonurUdZa0U1UQsHnAy2OIhmHHsY8tLyv4swWTlEs6GEgbNu
y3rg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=QDRGrgtvNhU9Hu9IBu6cKdMIthibDv78/9SQl6LQSqY=;
b=6HXE8ovwrIQbaJlFlEHAyLfKIVl/8DnzNTH8VkNZyjzanJaWonQt1zCip+LYP7tb75
6V61K80n/2uU6uhj/cN1t5DI+oKtJjUskh+qtjN2VgB2gIbvKitBaKyzWku1oKBrCI/b
DCpHX3jBZsqtAzT3y1U2b9rFoa5tlTeHGzETEQN+N1l0OA+kitr8krv2BAAP6TykdXI7
L2LiH3fsG4SR35dk8d81P+S1e8ckUbqzEd08NAxaO9pJ97qGgcvAs7UbIV4VATY76DY2
MT8LPxpYvhKwrfPzFsO/rigIweE+ih0RU9/zyKagIh2vZzlqX9SxkDE582zH+4R95rFI
JgyA==
X-Gm-Message-State: ANoB5plkvJ6rnsgfyqbhNo1sg9BbkcG+ASC3Z0kJ5sSwpVya9FUN04v+
dcLbLG4tvS/Uh6+u0nVMgMbvC2heZIvBIAEVs1w=
X-Google-Smtp-Source: AA0mqf5LN5Q7dYdHM4Z4QAxYCgG9T0OJMyGGDnP/C4GxemZLKnoQf/X5HgBX58WIs9BgStvsAIhA9xfG2K/Kz9EdXHI=
X-Received: by 2002:adf:f084:0:b0:241:bfd0:396e with SMTP id
n4-20020adff084000000b00241bfd0396emr427956wro.133.1668728765388; Thu, 17 Nov
2022 15:46:05 -0800 (PST)
MIME-Version: 1.0
Received: by 2002:adf:dd0d:0:0:0:0:0 with HTTP; Thu, 17 Nov 2022 15:46:04
-0800 (PST)
Reply-To: mrmohammedshamekh64@gmail.com
From: Mr mohammed shamekh
Date: Thu, 17 Nov 2022 15:46:04 -0800
Message-ID:
Subject: URGENTBUSINESSPROPOSAL
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 17.1
X-Spam_score_int: 171
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Dear friend, Greetings. How are you today, I hope well?
Content analysis details: (17.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/,
no trust
[209.85.221.41 listed in list.dnswl.org]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[aishsgaddafi880[at]gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[mrmohammedshamekh64[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[aishsgaddafi880[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.9 URG_BIZ BODY: Contains urgent matter
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.221.41 listed in wl.mailspike.net]
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.0 TVD_PH_BODY_META No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
1.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
0.0 XFER_LOTSA_MONEY Transfer a lot of money
0.0 T_MONEY_PERCENT X% of a lot of money for you
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
3.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} URGENTBUSINESSPROPOSAL
--
Dear friend,
Greetings.
How are you today, I hope well?
I found your email contact before a private search while I needed your
help. My name is Mr. Mohammed Shamekh. I work with the audit
department and accounting manager here at UBA Bank of Africa. There is
this fund that was kept in my custody years ago and I need your help
to transfer this fund to your bank account. for both lifetime
investment benefit and the amount is (US$ 27,500. Million Dollars).
I have all the details of the inquiry for the bank to create and
release the fund to your bank account within 7 banking days with your
full cooperation with me after success Please note 50% for you and 50%
for me after successful transfer of funds to your bank account fine.
WAITING TO HEAR FROM YOU.
THANK YOU.
mr mohammed shekh
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 17 Nov 2022 16:53:03 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1ovogP-0008ir-E9
for dave@doctor.nl2k.ab.ca;
Thu, 17 Nov 2022 16:52:37 -0700
Resent-From: The Doctor
Resent-Date: Thu, 17 Nov 2022 16:52:37 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-wr1-f41.google.com ([209.85.221.41]:40893)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1ovoca-000CNh-JK
for doctor@doctor.nl2k.ab.ca;
Thu, 17 Nov 2022 16:48:46 -0700
Received: by mail-wr1-f41.google.com with SMTP id x5so2438534wrt.7
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=QDRGrgtvNhU9Hu9IBu6cKdMIthibDv78/9SQl6LQSqY=;
b=moRnC10ajnJwc3N1BKky3xxLvQIkg5mmQ2ODR06W9EBvWdbhW1wlDmp8hGJk9iuQWL
vG80fR/UVzhw/Bhd9HaU8zj+BF03j/Aqj8bZby+BAvPNZY7RJmwsuiQtXRYXYSv7UKiR
NDdFooXGUf2TyRw0tSVQahgkda8Ud3+wHQbXSiYIsQu5dQ0MxrG/0BmGTd/3HxQY1bzm
WanTLQWnV7n4q67ekjUbbQ14oZ6DWsJ4rXkpxngiCYvHd7LgbU9em+RHznvmXns1aL5y
BDygQYMk4O7k4t3P1M7XzonurUdZa0U1UQsHnAy2OIhmHHsY8tLyv4swWTlEs6GEgbNu
y3rg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=QDRGrgtvNhU9Hu9IBu6cKdMIthibDv78/9SQl6LQSqY=;
b=6HXE8ovwrIQbaJlFlEHAyLfKIVl/8DnzNTH8VkNZyjzanJaWonQt1zCip+LYP7tb75
6V61K80n/2uU6uhj/cN1t5DI+oKtJjUskh+qtjN2VgB2gIbvKitBaKyzWku1oKBrCI/b
DCpHX3jBZsqtAzT3y1U2b9rFoa5tlTeHGzETEQN+N1l0OA+kitr8krv2BAAP6TykdXI7
L2LiH3fsG4SR35dk8d81P+S1e8ckUbqzEd08NAxaO9pJ97qGgcvAs7UbIV4VATY76DY2
MT8LPxpYvhKwrfPzFsO/rigIweE+ih0RU9/zyKagIh2vZzlqX9SxkDE582zH+4R95rFI
JgyA==
X-Gm-Message-State: ANoB5plkvJ6rnsgfyqbhNo1sg9BbkcG+ASC3Z0kJ5sSwpVya9FUN04v+
dcLbLG4tvS/Uh6+u0nVMgMbvC2heZIvBIAEVs1w=
X-Google-Smtp-Source: AA0mqf5LN5Q7dYdHM4Z4QAxYCgG9T0OJMyGGDnP/C4GxemZLKnoQf/X5HgBX58WIs9BgStvsAIhA9xfG2K/Kz9EdXHI=
X-Received: by 2002:adf:f084:0:b0:241:bfd0:396e with SMTP id
n4-20020adff084000000b00241bfd0396emr427956wro.133.1668728765388; Thu, 17 Nov
2022 15:46:05 -0800 (PST)
MIME-Version: 1.0
Received: by 2002:adf:dd0d:0:0:0:0:0 with HTTP; Thu, 17 Nov 2022 15:46:04
-0800 (PST)
Reply-To: mrmohammedshamekh64@gmail.com
From: Mr mohammed shamekh
Date: Thu, 17 Nov 2022 15:46:04 -0800
Message-ID:
Subject: URGENTBUSINESSPROPOSAL
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 17.1
X-Spam_score_int: 171
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Dear friend, Greetings. How are you today, I hope well?
Content analysis details: (17.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/,
no trust
[209.85.221.41 listed in list.dnswl.org]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[aishsgaddafi880[at]gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[mrmohammedshamekh64[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[aishsgaddafi880[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.9 URG_BIZ BODY: Contains urgent matter
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.221.41 listed in wl.mailspike.net]
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.0 TVD_PH_BODY_META No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
1.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
0.0 XFER_LOTSA_MONEY Transfer a lot of money
0.0 T_MONEY_PERCENT X% of a lot of money for you
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
3.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} URGENTBUSINESSPROPOSAL
--
Dear friend,
Greetings.
How are you today, I hope well?
I found your email contact before a private search while I needed your
help. My name is Mr. Mohammed Shamekh. I work with the audit
department and accounting manager here at UBA Bank of Africa. There is
this fund that was kept in my custody years ago and I need your help
to transfer this fund to your bank account. for both lifetime
investment benefit and the amount is (US$ 27,500. Million Dollars).
I have all the details of the inquiry for the bank to create and
release the fund to your bank account within 7 banking days with your
full cooperation with me after success Please note 50% for you and 50%
for me after successful transfer of funds to your bank account fine.
WAITING TO HEAR FROM YOU.
THANK YOU.
mr mohammed shekh
![](3D"https://lh4.googleusercontent.com/bqI1KbzIiw6npov_K=<br)
![](3D"https://lh3.googleusercontent.com/D_LmHpgW_MB9Z86E-C9=<br)