Nigerian Gmail spam

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 17 Jan 2023 13:25:17 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pHsVW-0001qr-0t

for dave@doctor.nl2k.ab.ca;

Tue, 17 Jan 2023 13:24:34 -0700

Resent-From: The Doctor

Resent-Date: Tue, 17 Jan 2023 13:24:34 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f52.google.com ([209.85.160.52]:42497)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pHpPZ-000Hyl-0x

for root@nk.ca;

Tue, 17 Jan 2023 10:06:16 -0700

Received: by mail-oa1-f52.google.com with SMTP id 586e51a60fabf-142b72a728fso32594516fac.9

for ; Tue, 17 Jan 2023 09:03:40 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=8gnDCimdkg09ZTytU0e7WYcjUwaqgqSZqPD62JA9lnk=;

b=o1MG4DlCDeS8dpcUoeiUG2liRTp8vheckHpfepPYdrWQQcHLEKrLVtE1WPXRd7Vn1Z

sDrIWijUOtHHTXv6PKm22GsBHmgwrnuV7pHqXIHg5s/K0asakizngRp+CR0I22qbudeF

mlQCYYx5nUpSOVNMoFxUTaCtFzE75MDsA9Q155VqNS9GMz5k+SiWHg36GrCxPRhXi9pS

HEigZJq8pIW/YUKw1tAU+RadNQpvMYDJ8l540WIvNHAehDlEMJZBjAY7fDkRDCkUt4Lf

mvE6XdF33h8olc0qBGqp5aInXak3ybjJ0TnFJwXNwqw319QgHvMo6o0/dxC2wrO1t+Cm

GJiQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=8gnDCimdkg09ZTytU0e7WYcjUwaqgqSZqPD62JA9lnk=;

b=Ac/nVtC58bMDpqskaDb8aZNz3LQOK1zOmKm0BZDpj13gOV/JxiKUEic6DJ89Xpbwar

zHWzlAHK+spqQYY6vrByIKeMosaMLzOINTDzh2T6h24LP2Zr2sUOjax/vcLsNtdytsWt

hFFJ58KYIIDRxKgSndJZjgPsVA1LME9t1DWBsic3bOVUkJYxv9cWcUnjp8HgWnKuQuHB

lW0b8GZssamZctVWZvLTrrGO935KGQrXWz8ww/BvbD2RJ5Ed2q9dFFsEW/hAC+Az4BNg

qMZDXy8I/U4e5IvF8Ss5U++OnNsqjX/nnxVvhrWNX+ybwmZL6Z9XKdFqJYR2/GqttFbG

rJUQ==

X-Gm-Message-State: AFqh2koS24U2h9XUzE6vAV2c3oefwGLR/PTAlDjtQQGChCfHsug1w+U4

VIGpbYwy+NCBcrCG4z57TcNnhkhOcwiaWxdoBFU=

X-Google-Smtp-Source: AMrXdXuQlEio7FPlVH+WOyr90aTL9uIalRFLPy50yxEHSFCur0UeMat+7ah5CUWbnYYj+Xq9BzR6XiZOm+ifCLVCXjg=

X-Received: by 2002:a05:6871:b19c:b0:151:fe99:ddb1 with SMTP id

an28-20020a056871b19c00b00151fe99ddb1mr327017oac.145.1673975015177; Tue, 17

Jan 2023 09:03:35 -0800 (PST)

MIME-Version: 1.0

Received: by 2002:ac9:7fd1:0:0:0:0:0 with HTTP; Tue, 17 Jan 2023 09:03:34

-0800 (PST)

Reply-To: theobeisch@brew-meister.com

From: Theodor Beisch

Date: Tue, 17 Jan 2023 19:03:34 +0200

Message-ID:

Subject: Dear Beloved!!!

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: root@nk.ca



Dear Beloved,







Good evening







My name is Theo Beisch, the CEO, BestSurf GmbH located in Germany and

South Africa: I am really sorry to bother you, I found your contact on

the internet. My heart longs for some one that I can trust with a

charity work and my spirit led me to you. I have been Diagnosed with

Cancer of the Lungs and according to my Doctors I will die any moment

because despite the great medical care at numerous facilities, my

condition has continued to deteriorate so I have decided to give out

the rest of my hard-earned life savings to Charity and to the less

privileged in the society as this will enable my soul to rest in

peace. I have only 30 days to make this dream come true. I am an

Orphan who was badly treated by close associates and I don't trust all

the Monks here, I really need someone with a good heart that I can

trust even if you are not from a Christian background but someone who

has pure heart and believes in honesty and service to humanity that

can help me to handle my fortunes and Distribute these Funds to people

that need it. I am 61 years old and really Blessed with much fortunes.







I will wait here for your Response, please let me know if I can trust

you with this.







Best Regards



Theo Josef Beisch

McAfee Phish from Google

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 17 Jan 2023 08:19:16 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pHnih-000K3U-1b

for dave@doctor.nl2k.ab.ca;

Tue, 17 Jan 2023 08:17:51 -0700

Resent-From: The Doctor

Resent-Date: Tue, 17 Jan 2023 08:17:51 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-il1-f170.google.com ([209.85.166.170]:37795)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pHmWb-0006QW-1j

for doctor@netknow.ca;

Tue, 17 Jan 2023 07:03:34 -0700

Received: by mail-il1-f170.google.com with SMTP id g2so15406581ila.4

for ; Tue, 17 Jan 2023 05:58:47 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=date:mime-version:to:subject:from:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=Cxqu/6cDFvhR40r3cMvLv5f+cOzMhLlRXEL2jd88TJM=;

b=FLyRFlbA367ICQNDXxLwAoySAE5zDc0tov1u3qFpTvYJDe2RwoLJxTnT+CgIM5m/By

7ru5byJtgszSdN1r1aK4HHk2M6dT7qGYT6rAYLZT/iTiCbUlfdc5Xoy//DynOEzPil6X

RmmR3xZkmNgksD1Aly9Jbl7D5BwuCCrmQWn8auMDe9+DK5dX6hXAP0uRJe019BgUDky/

1BRMm+4hQu73pGCWLm+AC+SQ/154Evu4kGfeMDkHg7GcV1tJ3HXbQA3LY/uEg7G7tPvZ

fC7/cnyv6Dx/pmRu+CAKd9K8YKRx30zb6xraVbZNlVGVn4LhbICJEBjWrrFcpLOtsgeJ

fSPQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=date:mime-version:to:subject:from:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=Cxqu/6cDFvhR40r3cMvLv5f+cOzMhLlRXEL2jd88TJM=;

b=sQO4D8es/poGUW/2O8xUwOlfXIfmHNw+OLktm6tQOqinqY3tsuovnT9EPFIMtcS2Oh

nOnIDvJ+weFoYviF4UWGzqRbZQF789fBWnOo+gWPwrGdHpO9mgxzAOro0Yr7ZG9sZ99w

Z3vMH0G4Z2Pi2Un2gidcWjGPTDAwAe4K5Pggq7qfatyTQ7apcmtoHl64pZCUbCHxeb9P

tEobH2zXHVaabyv+QNhe5vm+7Zb+o5vIBOC2lUgLfMOx98LUw7nDGw3iB7uHEm43Jqhe

z8p49Bfvau4eiStHjmTMjlMqYgr5htRP+h3CGYmUvGiJL7g/tjSw2nL2XnsHQlxfia7i

UTQw==

X-Gm-Message-State: AFqh2kr68Jh7Dv2toZ3PKMW6qsVIvusA5Sp5MHcDnQoZAqcbYUa+ebsU

Iq7IOn51tYWIU3OzwDfDtAK38WCiKQ44rXlxmG0g6A==

X-Google-Smtp-Source: AMrXdXsXaXY6kv/poeEnSijwAYquxMsXzCWBrfIWq9XJk0+U4jClZ0ys1FsTvhAF6gwCylL1lXHhnQ==

X-Received: by 2002:ac8:6681:0:b0:3b6:2fcc:1d0e with SMTP id d1-20020ac86681000000b003b62fcc1d0emr3553142qtp.36.1673963319299;

Tue, 17 Jan 2023 05:48:39 -0800 (PST)

Received: from 194.233.98.87 ([192.145.116.86])

by smtp.gmail.com with ESMTPSA id r8-20020a05620a298800b006bb29d932e1sm20418097qkp.105.2023.01.17.05.48.37

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Tue, 17 Jan 2023 05:48:38 -0800 (PST)

Message-ID: <63c6a736.050a0220.46307.5382@mx.google.com>

From: "Carole J. Lane"

Subject: Order confirmation 43770449

To: "doctor"

Content-Type: multipart/alternative; boundary="nIZMcFvZbUgt9lpcQHkqHRNIby3RSVa=_T"

MIME-Version: 1.0

Date: Tue, 17 Jan 2023 19:18:38 +0530



This is a multi-part message in MIME format



--nIZMcFvZbUgt9lpcQHkqHRNIby3RSVa=_T

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline



Date: 17-Jan-2023



Helpline Number # +1 (833) 336 2636





Dear user doctor@netknow.ca



Annual Subscription Upgraded!



We have executed an auto debit annual fee charge of $399.99 from your =

updated account fund balance.



Your services for Device Security and Pro Internet Shield have now bee=

n restored and turned on as per your request.





Here is your plan renewal details :-



Plan Subscribed : McAfee PC Pro Ultra Shield (01 Year Plan)

Plan Renew Date : 17-Jan-2023

Plan Valid Till : 16-Jan-2024

Transaction/Order ID: MCF-814196554

Renewal Amount : $399.99



This subscription fee will be auto debited annually unless you drop th=

e charges, the service plan will be valid till (16-Jan-2024)



For instant queries or support - Contact # +1 (833) 336 2636









sincerely,



Carole J. Lane|

Service Activation Team





--nIZMcFvZbUgt9lpcQHkqHRNIby3RSVa=_T

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline



Date: 17-Jan-2023



Helpline Number # =

+1 (833) 336 2636
n>


Hello User=

doctor@netknow.ca



Thank you for renewing your PC and Network Security Subscription Pl=

an!



We have executed an auto debit annual fee charge of $399.99 =

from your updated account fund balance.



Your services for Device Security and Pro Internet Shield have now =

been restored and turned on as per your request.




Here is you=

r plan renewal details :-




e; text-indent: 0px; letter-spacing: normal; font-family: "Times New R=

oman"; font-size: medium; font-style: normal; font-weight: 400; margin=

-bottom: 10px !important; word-spacing: 0px; white-space: normal; orph=

ans: 2; widows: 2; font-variant-ligatures: normal; font-variant-caps: =

normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: ini=

tial; text-decoration-style: initial; text-decoration-color: initial;'=

>Plan Subscribed : McAfee PC Pro Ultra Shield (01 Year Plan)
Plan R=

enew Date : 17-Jan-2023
Plan Valid Till : 16-Jan-2024
Order/Rece=

ipt No.: MCF-32327690
Renewal Amount : $399.99




e; text-indent: 0px; letter-spacing: normal; font-family: "Times New R=

oman"; font-size: medium; font-style: normal; font-weight: 400; margin=

-bottom: 10px !important; word-spacing: 0px; white-space: normal; orph=

ans: 2; widows: 2; font-variant-ligatures: normal; font-variant-caps: =

normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: ini=

tial; text-decoration-style: initial; text-decoration-color: initial;'=

>This subscription fee will be auto debited annually unless you drop t=

he charges, the service plan will be valid till (16-Jan-2024)




e; text-indent: 0px; letter-spacing: normal; font-family: "Times New R=

oman"; font-size: medium; font-style: normal; font-weight: 400; margin=

-bottom: 10px !important; word-spacing: 0px; white-space: normal; orph=

ans: 2; widows: 2; font-variant-ligatures: normal; font-variant-caps: =

normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: ini=

tial; text-decoration-style: initial; text-decoration-color: initial;'=

>For Assistance - Contact   # 
lor: rgb(169, 7, 27);">+1 (833) 336 2636




e; text-indent: 0px; letter-spacing: normal; font-family: "Times New R=

oman"; font-size: medium; font-style: normal; font-weight: 400; margin=

-bottom: 10px !important; word-spacing: 0px; white-space: normal; orph=

ans: 2; widows: 2; font-variant-ligatures: normal; font-variant-caps: =

normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: ini=

tial; text-decoration-style: initial; text-decoration-color: initial;'=

>



Best regards,



Carole J. Lane|
Customer Support Helpdesk







--nIZMcFvZbUgt9lpcQHkqHRNIby3RSVa=_T--



Nigerian Gmail spam

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 17 Jan 2023 08:20:16 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pHng6-000JX1-04

for dave@doctor.nl2k.ab.ca;

Tue, 17 Jan 2023 08:15:10 -0700

Resent-From: The Doctor

Resent-Date: Tue, 17 Jan 2023 08:15:10 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f48.google.com ([209.85.216.48]:38764)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pHiJr-000Evg-1Q

for www@doctor.nl2k.ab.ca;

Tue, 17 Jan 2023 02:33:10 -0700

Received: by mail-pj1-f48.google.com with SMTP id a14-20020a17090a70ce00b00229a2f73c56so1442938pjm.3

for ; Tue, 17 Jan 2023 01:29:21 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:sender:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=Blcn4/1fZwRWt2WeKwSyjSc89EgxDar6priCiL/iajE=;

b=XO0L/O6EBaUld8NoBGEM5N52doSPLSGC9Hf1omKWLcC6uMjnXAfLuVoR4TAOsac9e1

vFLrfXzBtT6Z5hm4F9sNsya3ZmbK2CroLKcOMGfjNsaI7PDMMR7VyeBaeqaW8j5HI/eA

DdCond8Z2kVriBDFZEqqSsFwRTE7wZPJ67YZGJDw9/gvOna7ZAHV4mbIExu7vuelh+h1

U02MnQqDmkv3pque4sP1TT0O1gONcqluqO8SapuQ6q0ZxUC++Dj3DktgLiKtjzJ62IIe

YcAn4MAhpA+mAZ9vljCz7ExWBHk8D55tsJvyINLkz0/6gKtwDBjDqmB3ld+6MENOuym8

ovug==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:sender:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=Blcn4/1fZwRWt2WeKwSyjSc89EgxDar6priCiL/iajE=;

b=FwmXnNdOCdLndXMxn7JpW+3IO59S8Kwn7jO1KtOVmgPn//6rs38njHKeU2KGPTjORF

UJN79goZKd6y/Zeq+mySbQHVUm/9pgZxTH2UyOo5XlorTCIyLDZJAbQ3n42cc1F6GYZN

lB6Ku3fYc+H93eQUHHX3TH9pgjNAJc/TZyDZMXVRz/1TgHwcWqR1zr6wIKgD9C9jvUKE

PJJJ3TO256iYG2I2fgWXoCt3aXdyUdsGeh14AWC0ScEMzI7UgfbiSW2nYN6DO1Ro5aIo

GVCnwzmUfKpwjhsLJblHquThCeQkk1tqB+nWHQ05J70qFj3EB2mdCrzbroRAsjZQl7IM

rCjQ==

X-Gm-Message-State: AFqh2krjZR0uadFxvnH1Sjkk3KO5g/A0mFer5Rp5xqjRHbPa6zYFUxmu

fG3jKbrDiOmTflpHXllb7u45pXZ4WvCxa+CWx4alDSns+5EeRw==

X-Google-Smtp-Source: AMrXdXsuNJwgPdSdaGURvvYuDZcMrqVGKB5M2e+SjnheyZ3F1Z8zSeTCjs0guCISWfu2lGjxafteL0EqbzMrZYJG+mg=

X-Received: by 2002:a05:6870:4151:b0:15b:3207:42aa with SMTP id

r17-20020a056870415100b0015b320742aamr137227oad.157.1673942848335; Tue, 17

Jan 2023 00:07:28 -0800 (PST)

MIME-Version: 1.0

Sender: mrgeorgegumel17@gmail.com

Received: by 2002:a05:6358:910e:b0:eb:d80:1cce with HTTP; Tue, 17 Jan 2023

00:07:27 -0800 (PST)

From: "Mr. Ibrahim Salif"

Date: Tue, 17 Jan 2023 08:07:27 +0000

X-Google-Sender-Auth: 4diIQir8IadCrdtT6lAJv19Qj8g

Message-ID:

Subject: ATTENTION PLEASE

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: www@doctor.nl2k.ab.ca

X-Spam_score: 16.1

X-Spam_score_int: 161

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear friend, My name is Mr. Ibrahim Salif, I am a staff working

with the Bank of Africa here in Ouagadougou,Burkina Faso. I want you to help

me in receiving the sum of Twenty Seven Million Two Hundred thousand Dollars

($27,200,000) into your Bank Account. This fund was deposited in the bank

here by a foreign customer who [...]



Content analysis details: (16.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.48 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.48 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[ibrahimsalif516(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[mrgeorgegumel17(at)gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 HK_NAME_FM_MR_MRS No description available.

0.0 T_HK_NAME_FM_MR_MRS No description available.

1.0 FREEMAIL_REPLY From and body contain different freemails

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

1.7 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} ATTENTION PLEASE



Dear friend,



My name is Mr. Ibrahim Salif, I am a staff working with the Bank of

Africa here in Ouagadougou,Burkina Faso.



I want you to help me in receiving the sum of Twenty Seven Million Two

Hundred thousand Dollars ($27,200,000) into your Bank Account. This

fund was deposited in the bank here by a foreign customer who died

accidentally alongside with his entire family members many years ago.



Nobody had asked for this fund till now please contact me through my

private email address: (ibrahimsalif516@yahoo.com) for more details.



Mr. Ibrahim Salif.