Donation spam from gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 26 Dec 2022 05:53:56 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1p9myl-000PKo-1e
for dave@doctor.nl2k.ab.ca;
Mon, 26 Dec 2022 05:53:19 -0700
Resent-From: The Doctor
Resent-Date: Mon, 26 Dec 2022 05:53:19 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vk1-f196.google.com ([209.85.221.196]:34365)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from)
id 1p9l0P-000PbU-38
for doctor@nk.ca;
Mon, 26 Dec 2022 03:47:01 -0700
Received: by mail-vk1-f196.google.com with SMTP id b81so4837173vkf.1
for; Mon, 26 Dec 2022 02:44:24 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=kTSegvAhEq+PtU71+j7PDDvN94pbcVg8HmGbBuSpu+M=;
b=Fqe9djo44jgMnzngYSy51esIFjynlQnH8ndz24L9aGThOxZo7ARMBptpQIBSjPB+cl
yX6UqOmBrR1AwyvjVJsYyz04JzqeFy7RkJYmzmiVsqdAM+Wq5VDmUkZPhI9wsl474Ytv
fe50WDna/kSM/3f10eCAfReyVEDnGemMx4ujQsz2fLQRZohSneUWg2SMwAxNKlbc39t+
MZuCupe6S5eaZ0BeujCSiIkdzIkf59i53LOn9dadW8Zs3u3v3h/MtKjCWAQIcghKX9dU
lo/nzjCGCpi38WunFfSJN2kh2TPWgNnl1AFdtFyM5Pw4/PNfLediRGNcU1t4zd3bxzwB
63IQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=kTSegvAhEq+PtU71+j7PDDvN94pbcVg8HmGbBuSpu+M=;
b=NQzcLbTwrGzJkff3Pxyj260mxM7u2XekorbmgJNFAVS5VbiMjhKdhWUWjH5zUv2b9H
LqQGz+sNPKzu0iVWBIAtf6V60awvfstLjc1ZxBQBwEJ2JYZNN8PViJbfpZ16C2BqhxkB
mMpg1dZj3StRiFLPpA54VANlZA4F3S8lWKcKMxSaD8Qk4HUAARAtToKnlFM9WXAhXVDY
AnMGoXF6YCl2S67FZwEXobFk/wlOPFXCXD+w6jbodWBI2kgj1N8CshsbDd2RhAhHFrd6
6b6G9Dsc9079I7VIesdotg1usSx+Kf5s5IJorsu09buLMtYqTnaJ1g6P0aDUDM2U9L1t
itXw==
X-Gm-Message-State: AFqh2kqvsSRQU+1IxD3k8YQhQqRfPgiJrryvOIk9ST4OUReRJLcii0PF
zqP83wkbzQzw3Kj4UO4IVqUzvGhMUxrhXsadgss=
X-Google-Smtp-Source: AMrXdXsZLE0Xm3CGH4v/aG99a4SbOeXAXx81ZxSgMYUg4v9sWvqS/7pZdX8U2JhmMiwK4wRkaXVnWvXqXJ/9c4bCtTE=
X-Received: by 2002:a1f:a053:0:b0:3bc:fcf3:1d5c with SMTP id
j80-20020a1fa053000000b003bcfcf31d5cmr1810267vke.23.1672051458573; Mon, 26
Dec 2022 02:44:18 -0800 (PST)
MIME-Version: 1.0
Received: by 2002:a59:b12a:0:b0:32a:8bca:c43d with HTTP; Mon, 26 Dec 2022
02:44:18 -0800 (PST)
Reply-To: lisarobinson196010@gmail.com
From: Lisa Robinson
Date: Mon, 26 Dec 2022 01:44:18 -0900
Message-ID:
Subject: Donation
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@nk.ca
X-Spam_score: 9.7
X-Spam_score_int: 97
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- I've tried emailing you this letter several times because
i have selected you for my charity to personally receive a $1.2 million cash
donation. Email at your earliest convenience if you receive th [...]
Content analysis details: (9.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.221.196 listed in wl.mailspike.net]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/,
no trust
[209.85.221.196 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[atmcardprogramer01[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[atmcardprogramer01[at]gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[lisarobinson196010[at]gmail.com]
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
2.3 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Donation
--
I've tried emailing you this letter several times because i have
selected you for my charity to personally receive a $1.2 million cash
donation. Email at your earliest convenience if you receive this email
for more details and claims
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 26 Dec 2022 05:53:56 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1p9myl-000PKo-1e
for dave@doctor.nl2k.ab.ca;
Mon, 26 Dec 2022 05:53:19 -0700
Resent-From: The Doctor
Resent-Date: Mon, 26 Dec 2022 05:53:19 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vk1-f196.google.com ([209.85.221.196]:34365)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from
id 1p9l0P-000PbU-38
for doctor@nk.ca;
Mon, 26 Dec 2022 03:47:01 -0700
Received: by mail-vk1-f196.google.com with SMTP id b81so4837173vkf.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=kTSegvAhEq+PtU71+j7PDDvN94pbcVg8HmGbBuSpu+M=;
b=Fqe9djo44jgMnzngYSy51esIFjynlQnH8ndz24L9aGThOxZo7ARMBptpQIBSjPB+cl
yX6UqOmBrR1AwyvjVJsYyz04JzqeFy7RkJYmzmiVsqdAM+Wq5VDmUkZPhI9wsl474Ytv
fe50WDna/kSM/3f10eCAfReyVEDnGemMx4ujQsz2fLQRZohSneUWg2SMwAxNKlbc39t+
MZuCupe6S5eaZ0BeujCSiIkdzIkf59i53LOn9dadW8Zs3u3v3h/MtKjCWAQIcghKX9dU
lo/nzjCGCpi38WunFfSJN2kh2TPWgNnl1AFdtFyM5Pw4/PNfLediRGNcU1t4zd3bxzwB
63IQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=kTSegvAhEq+PtU71+j7PDDvN94pbcVg8HmGbBuSpu+M=;
b=NQzcLbTwrGzJkff3Pxyj260mxM7u2XekorbmgJNFAVS5VbiMjhKdhWUWjH5zUv2b9H
LqQGz+sNPKzu0iVWBIAtf6V60awvfstLjc1ZxBQBwEJ2JYZNN8PViJbfpZ16C2BqhxkB
mMpg1dZj3StRiFLPpA54VANlZA4F3S8lWKcKMxSaD8Qk4HUAARAtToKnlFM9WXAhXVDY
AnMGoXF6YCl2S67FZwEXobFk/wlOPFXCXD+w6jbodWBI2kgj1N8CshsbDd2RhAhHFrd6
6b6G9Dsc9079I7VIesdotg1usSx+Kf5s5IJorsu09buLMtYqTnaJ1g6P0aDUDM2U9L1t
itXw==
X-Gm-Message-State: AFqh2kqvsSRQU+1IxD3k8YQhQqRfPgiJrryvOIk9ST4OUReRJLcii0PF
zqP83wkbzQzw3Kj4UO4IVqUzvGhMUxrhXsadgss=
X-Google-Smtp-Source: AMrXdXsZLE0Xm3CGH4v/aG99a4SbOeXAXx81ZxSgMYUg4v9sWvqS/7pZdX8U2JhmMiwK4wRkaXVnWvXqXJ/9c4bCtTE=
X-Received: by 2002:a1f:a053:0:b0:3bc:fcf3:1d5c with SMTP id
j80-20020a1fa053000000b003bcfcf31d5cmr1810267vke.23.1672051458573; Mon, 26
Dec 2022 02:44:18 -0800 (PST)
MIME-Version: 1.0
Received: by 2002:a59:b12a:0:b0:32a:8bca:c43d with HTTP; Mon, 26 Dec 2022
02:44:18 -0800 (PST)
Reply-To: lisarobinson196010@gmail.com
From: Lisa Robinson
Date: Mon, 26 Dec 2022 01:44:18 -0900
Message-ID:
Subject: Donation
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@nk.ca
X-Spam_score: 9.7
X-Spam_score_int: 97
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- I've tried emailing you this letter several times because
i have selected you for my charity to personally receive a $1.2 million cash
donation. Email at your earliest convenience if you receive th [...]
Content analysis details: (9.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.221.196 listed in wl.mailspike.net]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/,
no trust
[209.85.221.196 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[atmcardprogramer01[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[atmcardprogramer01[at]gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[lisarobinson196010[at]gmail.com]
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
2.3 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Donation
--
I've tried emailing you this letter several times because i have
selected you for my charity to personally receive a $1.2 million cash
donation. Email at your earliest convenience if you receive this email
for more details and claims
![](3D"https://lh3.googleusercontent.com/Kixc0HNrM9ToPdv-pabJ=<br)
![](3D"https://lh5.googleusercontent.com/WJ2AF7=<br)