Nigerian Gmail spam
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 02 Dec 2022 16:07:01 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1p1EC2-000KFl-Fx
for dave@doctor.nl2k.ab.ca;
Fri, 02 Dec 2022 15:07:38 -0700
Resent-From: The Doctor
Resent-Date: Fri, 2 Dec 2022 15:07:38 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yw1-f181.google.com ([209.85.128.181]:38440)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1p1CQA-0008fB-Uu
for doctor@doctor.nl2k.ab.ca;
Fri, 02 Dec 2022 13:14:11 -0700
Received: by mail-yw1-f181.google.com with SMTP id 00721157ae682-3bfd998fa53so59749547b3.5
for; Fri, 02 Dec 2022 12:11:38 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=content-transfer-encoding:to:subject:message-id:date:from
:mime-version:from:to:cc:subject:date:message-id:reply-to;
bh=eWIdyE7aDBlMymm7oypb1kERFRDKkv5Wh5Wnyf42VM0=;
b=C0CusvA8mjEG6nIavpsFBUtUVcQo1X2jA4bmbvvzTRMk+LdUOg1eMOVVLNXQjze2FB
eVf0fNj3Z5eiQWIXjmpV5G1UUKNyIUvIdWkuCFxxmJpRyk3Z/igMfBr1R6Q37e4j20Dz
imcSZsaMYpDWBT4fEruVZqULRtzU3rILL0biU+srFVZ5jMDOBmjR98cJnCl9FzWyIHcW
rdMCRRYkMov9BhSTzzcioaD07E0h/+cnSWt0KBhysVXCi+gnDHxJhv+UjDnKiWzChzmg
x2dRiUtVPvX4JJM/92fFpIbWM2zrBm2mf7NRYjMKu+j/GI9isZbGuHRSIwlEcDO6Veuu
jMqA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=content-transfer-encoding:to:subject:message-id:date:from
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=eWIdyE7aDBlMymm7oypb1kERFRDKkv5Wh5Wnyf42VM0=;
b=a8mzllbAau7l9qgtPyBPZZ8LNSx1M6cjwUbjbTPWndnnLn8lLUmZVfYbQWSBA+TIFT
LWaganPDoZMwRpmngUx0f5kBhOx0LJsUISXYBqXjxmMjzTPdf2LVgRfXKLiuRHrCe/ft
4v4be8x12C/H44V8firw3TTx54xacN+X0zTYU04TjWLi4gnO0wl/BfBfcG0W1N7p86L8
5+0hSFeGn4JUh/w5+DgyORfQvHuxKjGzLs4hJXwYKxlmi8OEtEZwwyQ0YZnS524IZouh
AMOCuF0seJNimVjJVvDtI+Bna3kKkL7891NsF8IWCp7ESJNFKiOwHKS3pliJ4ODWEvoK
iNAQ==
X-Gm-Message-State: ANoB5pl/3HOgJlSx9FCZxmiYFqmCGVPaAEvvRFGRD58A37m2ifP26TNR
KxxYlNsehryLsKSINEShHKpRbWXqzdy36gdhqjs=
X-Google-Smtp-Source: AA0mqf7FVh7J80Pf1U/RoNMMcLd6Uclek3GKj0C0jnmY9WhouHPKLy7bRvsyVpytDX8QuDMvH5d3rtjePe0t3I1BsnU=
X-Received: by 2002:a81:2548:0:b0:3af:d84a:1d2a with SMTP id
l69-20020a812548000000b003afd84a1d2amr43134319ywl.317.1670011892576; Fri, 02
Dec 2022 12:11:32 -0800 (PST)
MIME-Version: 1.0
Received: by 2002:a05:6918:558e:b0:e8:f9e1:718d with HTTP; Fri, 2 Dec 2022
12:11:32 -0800 (PST)
From: Mrs Maria Jonathan
Date: Fri, 2 Dec 2022 21:11:32 +0100
Message-ID:
Subject: =?UTF-8?Q?The_first_=C2=A310=2C000_was_sent_today=2E?=
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 12.6
X-Spam_score_int: 126
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Friend. The first £10,000 was sent today. My working
partner has helped me to send the first £10,000 to you through western union.
Content analysis details: (12.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[llok28117[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[llok28117[at]gmail.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.128.181 listed in wl.mailspike.net]
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLY From and body contain different freemails
0.0 FILL_THIS_FORM Fill in a form with personal information
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
2.2 FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 MONEY_FORM Lots of money if you fill out a form
3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} =?UTF-8?Q?The_first_=C2=A310=2C000_was_sent_today=2E?=
Dear Friend.
The first =C2=A310,000 was sent today.
My working partner has helped me to send the first =C2=A310,000 to you
through western union.
So contact Western union Agent to pick up this =C2=A310,000 now:
Contact person:Mr.Richard Brown
Phone Number +229 581 56524
E-mail:(union.western13@yahoo.com )
Ask him to give you the MTCN, sender name,to pick the =C2=A310,000 I
told him to keep sending you =C2=A310,000 daily until the payment of
=C2=A35.5 Million is completed.
Again forward him your Full information to avoid wrong transfer such as,
Receiver's Name _______________
Address: ________________
Country: _____________
Phone Number: _____________
Occupation _______________
Your Age _______________
Sex _______________
Cope of ID _______________
Note that if you did not send him the above information complete he
will not release your funds of =C2=A35.5 Million to you name because he
has to be sure that it is you,
Thanks,
Best Regards.
Mrs Maria Jonathan
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 02 Dec 2022 16:07:01 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1p1EC2-000KFl-Fx
for dave@doctor.nl2k.ab.ca;
Fri, 02 Dec 2022 15:07:38 -0700
Resent-From: The Doctor
Resent-Date: Fri, 2 Dec 2022 15:07:38 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yw1-f181.google.com ([209.85.128.181]:38440)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1p1CQA-0008fB-Uu
for doctor@doctor.nl2k.ab.ca;
Fri, 02 Dec 2022 13:14:11 -0700
Received: by mail-yw1-f181.google.com with SMTP id 00721157ae682-3bfd998fa53so59749547b3.5
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=content-transfer-encoding:to:subject:message-id:date:from
:mime-version:from:to:cc:subject:date:message-id:reply-to;
bh=eWIdyE7aDBlMymm7oypb1kERFRDKkv5Wh5Wnyf42VM0=;
b=C0CusvA8mjEG6nIavpsFBUtUVcQo1X2jA4bmbvvzTRMk+LdUOg1eMOVVLNXQjze2FB
eVf0fNj3Z5eiQWIXjmpV5G1UUKNyIUvIdWkuCFxxmJpRyk3Z/igMfBr1R6Q37e4j20Dz
imcSZsaMYpDWBT4fEruVZqULRtzU3rILL0biU+srFVZ5jMDOBmjR98cJnCl9FzWyIHcW
rdMCRRYkMov9BhSTzzcioaD07E0h/+cnSWt0KBhysVXCi+gnDHxJhv+UjDnKiWzChzmg
x2dRiUtVPvX4JJM/92fFpIbWM2zrBm2mf7NRYjMKu+j/GI9isZbGuHRSIwlEcDO6Veuu
jMqA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=content-transfer-encoding:to:subject:message-id:date:from
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=eWIdyE7aDBlMymm7oypb1kERFRDKkv5Wh5Wnyf42VM0=;
b=a8mzllbAau7l9qgtPyBPZZ8LNSx1M6cjwUbjbTPWndnnLn8lLUmZVfYbQWSBA+TIFT
LWaganPDoZMwRpmngUx0f5kBhOx0LJsUISXYBqXjxmMjzTPdf2LVgRfXKLiuRHrCe/ft
4v4be8x12C/H44V8firw3TTx54xacN+X0zTYU04TjWLi4gnO0wl/BfBfcG0W1N7p86L8
5+0hSFeGn4JUh/w5+DgyORfQvHuxKjGzLs4hJXwYKxlmi8OEtEZwwyQ0YZnS524IZouh
AMOCuF0seJNimVjJVvDtI+Bna3kKkL7891NsF8IWCp7ESJNFKiOwHKS3pliJ4ODWEvoK
iNAQ==
X-Gm-Message-State: ANoB5pl/3HOgJlSx9FCZxmiYFqmCGVPaAEvvRFGRD58A37m2ifP26TNR
KxxYlNsehryLsKSINEShHKpRbWXqzdy36gdhqjs=
X-Google-Smtp-Source: AA0mqf7FVh7J80Pf1U/RoNMMcLd6Uclek3GKj0C0jnmY9WhouHPKLy7bRvsyVpytDX8QuDMvH5d3rtjePe0t3I1BsnU=
X-Received: by 2002:a81:2548:0:b0:3af:d84a:1d2a with SMTP id
l69-20020a812548000000b003afd84a1d2amr43134319ywl.317.1670011892576; Fri, 02
Dec 2022 12:11:32 -0800 (PST)
MIME-Version: 1.0
Received: by 2002:a05:6918:558e:b0:e8:f9e1:718d with HTTP; Fri, 2 Dec 2022
12:11:32 -0800 (PST)
From: Mrs Maria Jonathan
Date: Fri, 2 Dec 2022 21:11:32 +0100
Message-ID:
Subject: =?UTF-8?Q?The_first_=C2=A310=2C000_was_sent_today=2E?=
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 12.6
X-Spam_score_int: 126
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Friend. The first £10,000 was sent today. My working
partner has helped me to send the first £10,000 to you through western union.
Content analysis details: (12.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[llok28117[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[llok28117[at]gmail.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.128.181 listed in wl.mailspike.net]
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLY From and body contain different freemails
0.0 FILL_THIS_FORM Fill in a form with personal information
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
2.2 FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 MONEY_FORM Lots of money if you fill out a form
3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} =?UTF-8?Q?The_first_=C2=A310=2C000_was_sent_today=2E?=
Dear Friend.
The first =C2=A310,000 was sent today.
My working partner has helped me to send the first =C2=A310,000 to you
through western union.
So contact Western union Agent to pick up this =C2=A310,000 now:
Contact person:Mr.Richard Brown
Phone Number +229 581 56524
E-mail:(union.western13@yahoo.com )
Ask him to give you the MTCN, sender name,to pick the =C2=A310,000 I
told him to keep sending you =C2=A310,000 daily until the payment of
=C2=A35.5 Million is completed.
Again forward him your Full information to avoid wrong transfer such as,
Receiver's Name _______________
Address: ________________
Country: _____________
Phone Number: _____________
Occupation _______________
Your Age _______________
Sex _______________
Cope of ID _______________
Note that if you did not send him the above information complete he
will not release your funds of =C2=A35.5 Million to you name because he
has to be sure that it is you,
Thanks,
Best Regards.
Mrs Maria Jonathan
![](3D"https://lh3.googleusercontent.com/Y6s72_J8SxAdXtSr4vyXV=<br)
I really like sex, I haven't tried =![](3D"https://lh3.googleusercontent.com/F3m9FCL-kmu9miUXeETIJ62O=<br)