Web Link spam from Google

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 28 Feb 2023 08:08:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pX1ZK-0008Nr-0l

for dave@doctor.nl2k.ab.ca;

Tue, 28 Feb 2023 08:07:06 -0700

Resent-From: The Doctor

Resent-Date: Tue, 28 Feb 2023 08:07:06 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f48.google.com ([209.85.160.48]:46891)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pX16x-0006Qp-2A

for root@doctor.nl2k.ab.ca;

Tue, 28 Feb 2023 07:37:51 -0700

Received: by mail-oa1-f48.google.com with SMTP id 586e51a60fabf-172a623ad9aso11049032fac.13

for ; Tue, 28 Feb 2023 06:35:48 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=68SaLkzscEjxUnsCEiOnFcqdPYpBozMGiZefE4VIhT8=;

b=awr3TXEp6z5bfMA0IqpdyMQ6ECMBMZb7IJpA9AtfqdF4jc3iZU1lzWE0XP11F91zuf

H3xjRlXe+XSoIRLgh+kWb2gnsKLgGW8k9wS2dDRbvmD532ATYz3p4AYs1cELWwArJ79C

/4M7OPsiZKcWYpqazmxG1BsWvXr7828/oeqQrJGTYMl3qirk1TEgH54ZV0JF0zhqIWeg

e1nhstUNZqIkDDuxNyzJDhiy8xbgaWYqoB8sK9QT/U8KCl0RH02tgK3odUnKZRAo52gH

NsdofB381elYleTnW8B4yH0ToywTZTilEIbVcpLMqoFPv2DPTwRgW+qYhj87NSGFxKTe

jwQw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=68SaLkzscEjxUnsCEiOnFcqdPYpBozMGiZefE4VIhT8=;

b=RF3k2WCClJuhvB6TVzGvLTW57nbL3zzloVDJPPwGNwlXxvJM254SHrw22KFsetXVVn

lNWfz4thWneAbOsnLtr3qSQSJaCx/lPMcXAGXkkMpFkrcOfwbupa3aQVqwozpjbIPeZy

NvGPNJPjHW/HnSRoWwX9HAMW3EW7wScdtTnG5h4jjg5+zjNt/AfWapDR40PuprfcquTA

QwiCmKnYpYYG+LwNuJa5dRWacEE4/JY2tI5yuUj8UMFsOJ2xXgmDmwkvf/x+xHxxzaaM

1skHQKlDFui+5EpEZRZYMx6lya7FzBAm+ix7Hod254ip1KOOvY6q5YZJztsRMlrdAoVx

eJsQ==

X-Gm-Message-State: AO0yUKX5XSux9TAxlx6hJUN8QYkh+gNlowOR0pFtQUNDpI5PGVoFfb9K

9S9MsCAu28txqM8AUqtXpm69WK0yTBeI2hriH1I=

X-Google-Smtp-Source: AK7set80FmOAXS3xrDLmZoaD9ghmLMzQcTCNKo2jZUt3CCQE5nYmlOFdTqNNXTNB9Bm6snT1MtbjPaFPJJePPsRZZrI=

X-Received: by 2002:a05:6870:1a98:b0:172:4745:f576 with SMTP id

ef24-20020a0568701a9800b001724745f576mr801328oab.10.1677594942825; Tue, 28

Feb 2023 06:35:42 -0800 (PST)

MIME-Version: 1.0

From: "evs_idea@yahoo.com"

Date: Tue, 28 Feb 2023 14:35:42 +0000

Message-ID:

Subject:

To: nacyki , nlangmuir ,

patrickhenault1 ,

pierre tremblay , romarnal ,

romtrade mtl , root

Content-Type: multipart/alternative; boundary="000000000000a4e70505f5c38229"

X-Spam_score: 12.0

X-Spam_score_int: 120

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: https://rb5jc.app.link/gdyMmOYtMxb https://rb5jc.app.link/gdyMmOYtMxb





Content analysis details: (12.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.48 listed in list.dnswl.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: rb5jc.app.link]

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 SORTED_RECIPS Recipient list is sorted by address

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[ahmadruslan1970(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[ahmadruslan1970(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address

0.0 TVD_SPACE_RATIO No description available.

0.7 PDS_FROM_2_EMAILS From header has multiple different addresses

2.0 FROM_2_EMAILS_SHORT Short body and From looks like 2 different emails

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.160.48 listed in wl.mailspike.net]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

Subject: {SPAM?}



--000000000000a4e70505f5c38229

Content-Type: text/plain; charset="UTF-8"



https://rb5jc.app.link/gdyMmOYtMxb



--000000000000a4e70505f5c38229

Content-Type: text/html; charset="UTF-8"



https://rb5jc.app.link/gdyMmOYtMxb



--000000000000a4e70505f5c38229--

Web Link spam from Google

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 28 Feb 2023 04:02:00 -0700

Received: from mail-yw1-f195.google.com ([209.85.128.195]:42929)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pWxjj-000MzY-2A

for dave@doctor.nl2k.ab.ca;

Tue, 28 Feb 2023 04:01:39 -0700

Received: by mail-yw1-f195.google.com with SMTP id 00721157ae682-536bbef1c5eso259599907b3.9

for ; Tue, 28 Feb 2023 02:59:37 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=KsPRuWfQxMM2R4w9/omRwvqKK13Oz1eqnTpm/JAAKQ8=;

b=mM0IcTZYv4PlrTXXQIJOHpeNtgQ55eKzk5YCEfKVyPIpCwFkkphZAmrRTx6hn8DkZG

1SX6JX0ZbOCKbpfBj0bC0MfBnTtCsq9VN8xQ67X9K2BWSK0FcfmUtM+Czz3DTwEazpuM

ay5TuWHATMUVWumdIkm9Vlt8Q+np+2wmp4qJ8yRxjACVYTYIsm1TopCUw+bGQL+jXFe8

qV1Zo7SmvWyIL59veTxiO2Zha1zjUowqgjYOGFYNwg3OzhNAmwId4Jm/U9k7USBlWJ8A

F2Xs2kkwqCRRnqrq/R4S+B8AtTAmzGhRFtrhhn/tpG/pd3KGS0GZ7KMHLXrWd/Kd39uS

Zw4Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=KsPRuWfQxMM2R4w9/omRwvqKK13Oz1eqnTpm/JAAKQ8=;

b=FRcI0uXiiBEL5TKrwarjj8eyx0iNvOr601bjowZPMrH2sHj/+xlRp4b424lM7b9j58

aVZb5PK0Qw+zkG9z4uFz6/2rvdrkkxUC7LaS40GmbLwGzws6ipn1U679oIio+1bJiRGW

c6CYsMvVpmkSzEGK4DMXmDbVHkZ8MD7S3FxcbnXzEdwtN5y2slQLf3GQFKnFbtVH4LEc

2NwPol7gdVpJTcTOKqXZOL3tFw3lf212xuEn5bkow+jI8ftYto3hgS8u+Nt/+OJ68Fua

Nlw3xJYzvoSmA1PX8joLuXy85JgHLphNr7D5aGPD3TBtQV5JZTLEEJw1iMw1TCclVBV/

fmcw==

X-Gm-Message-State: AO0yUKXdUmS8e1r5DKNeSscPeu6kvbev3Y1KZbAAxKmYW41dGg2o0UsE

OFvvxEg9Uo4DzrglwuhUgB3PcmtL7BcWmB6xK54=

X-Google-Smtp-Source: AK7set/Yg5j0C1xPX0HdajFNdpBHsaNmcVc0XDtIhQMUmmRrBl3I/IibgCl+GdvlZZc7uqtlpMO9aUavxsLTGTE65t0=

X-Received: by 2002:a05:6902:1205:b0:a09:314f:9f09 with SMTP id

s5-20020a056902120500b00a09314f9f09mr2549426ybu.6.1677581971356; Tue, 28 Feb

2023 02:59:31 -0800 (PST)

MIME-Version: 1.0

From: "Dr.Charles Edward"

Date: Tue, 28 Feb 2023 10:59:31 +0000

Message-ID:

Subject:

To: datsit1968 , dave ,

davelongaphie5309 ,

david cameletti2 , david100 ,

david2divizio , davidbrunstein ,

davidpalmer23

Content-Type: multipart/alternative; boundary="0000000000007c003105f5c07db2"

X-Spam_score: 9.3

X-Spam_score_int: 93

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: https://ckcwb.app.link/32beRrduMxb https://ckcwb.app.link/32beRrduMxb





Content analysis details: (9.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 SUSPICIOUS_RECIPS Similar addresses in recipient list

2.5 SORTED_RECIPS Recipient list is sorted by address

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[micael.rocha.silva(at)gmail.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.195 listed in list.dnswl.org]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 TVD_SPACE_RATIO No description available.

0.0 T_HK_NAME_FM_DR No description available.

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.195 listed in wl.mailspike.net]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

Subject: {SPAM?}



--0000000000007c003105f5c07db2

Content-Type: text/plain; charset="UTF-8"



https://ckcwb.app.link/32beRrduMxb



--0000000000007c003105f5c07db2

Content-Type: text/html; charset="UTF-8"



https://ckcwb.app.link/32beRrduMxb



--0000000000007c003105f5c07db2--

Nigerian Spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 28 Feb 2023 08:04:03 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pX1Vu-0008DY-0x

for dave@doctor.nl2k.ab.ca;

Tue, 28 Feb 2023 08:03:34 -0700

Resent-From: The Doctor

Resent-Date: Tue, 28 Feb 2023 08:03:34 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f49.google.com ([209.85.167.49]:38545)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pWwvK-000KeZ-0z

for root@nl2k.ab.ca;

Tue, 28 Feb 2023 03:09:38 -0700

Received: by mail-lf1-f49.google.com with SMTP id m6so12424431lfq.5

for ; Tue, 28 Feb 2023 02:07:31 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=y473zhrUU1LTt1xiEp50XRjl9qC28TSC0JLn3SdjZWE=;

b=n27QXPiTvOil0afB1ktkLqndPxPI+oui0jvoI6Bz5s1Tz+Sv14dg4szsUmPtV0bgHC

jRk+ahV6UR6njvWqF1jDG9fyLrdmg2o81iWESQKexQDMBG27drTs5Tw08enHkMykMVoI

ZB1m+BLvnmztuejtH82fctJPNpwsUt4FmI1byk7st89yDfUBoNldjdzgtvVvBG8lIZEi

sxdKT0G/IdkUCZKzs5mmERiliV9p7pQuTjrmSTNNQF2j+t4tFa0Slhh0AXM3Ekg4zgPB

P+HFQ6SsdMrc3VsC+YYC+HUlxWmrblJtHyN9QV61Ht4pjSRGEtvCnuDv2PDS3ApZrYS9

UpdQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=y473zhrUU1LTt1xiEp50XRjl9qC28TSC0JLn3SdjZWE=;

b=aXTNbMGydxPZVjO3hE8mx+Af4WAV/D3fg0oY9IVp+Zzi8Einzab4alRVfSDbIiiek1

meVxUcEu7oJyrnyLtFNKM2Q/S/2BmMY4UqcJ1/NdXLXBE/trakWb0aZwEhcQrkYZjie4

6VAia7FNM8s92RmyzAke2Ltqcin3XAMBOPhjXl+NxJwk83IAD5cq1RCro16gS8c/2GJW

i3X40vTDODiTMYVK447Jq0nlIkerTPwuJOz+BnUVWNzKW5WkbQNvIFD9fmsJnnfvXUEl

nNG6cMI9WHpGJODFB2DCPvSSJOzDtfuclJihD6pQeRc1f6XmiCBopO55Syh9akplQBy/

lV7Q==

X-Gm-Message-State: AO0yUKUbc2d0YPWqPcLMu+7wruIqe+Iv4UjnOlzDzasiFD2CW7Nv8eSw

EDyZszqVCsdyz96AY8+XQW3AUrgOaHGFcIsAMw==

X-Google-Smtp-Source: AK7set9aLZ454OCkvJEG9fEfhWVDACSId7TwGyrWliN0qsnF9cNyBB+kV1YZWKAomiX24cLfFOQZCiIlLfXHG32pX90=

X-Received: by 2002:ac2:46f3:0:b0:4dd:a4c5:2b42 with SMTP id

q19-20020ac246f3000000b004dda4c52b42mr538102lfo.8.1677578844523; Tue, 28 Feb

2023 02:07:24 -0800 (PST)

MIME-Version: 1.0

From: Ernest Francis

Date: Tue, 28 Feb 2023 12:07:10 +0200

Message-ID:

Subject: Message.

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000001c513605f5bfc36f"

Bcc: root@nl2k.ab.ca

X-Spam_score: 17.8

X-Spam_score_int: 178

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Ref: Business Proposal. I hope my email finds you well. Firstly,

I must solicit for your confidence in this transaction; this is by virtue

of its nature as being utterly confidential.



Content analysis details: (17.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.49 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[bryan.g.lukas(at)gmail.com]

2.5 MILLION_USD BODY: Talks about millions of dollars

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

2.5 HK_SCAM_N2 BODY: No description available.

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.49 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 HK_SCAM No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 FREEMAIL_REPLY From and body contain different freemails

0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases

3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Message.



--0000000000001c513605f5bfc36f

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Ref: Business Proposal.







I hope my email finds you well.







Firstly, I must solicit for your confidence in this transaction; this is by

virtue of its nature as being utterly confidential.







You may be surprised to receive such an email from someone you barely know.

My name is Ernest Francis, a Business consultant and facilitator. A client

of mine died last year in 2022 from a heart attack. Few weeks before his

death, he needed to make an urgent investment requiring cash payment in

which he requested me to assist him move the sum of US$28,500,000.00 to an

open beneficiary account securely for the business deal. I personally

facilitated the moving of this fund through a special security firm in

Canada to the Bank as per his instruction. The Canadian firm is an

especially private firm that accepts deposits from high net worth

individuals and blue chip corporations.







None of my client=E2=80=99s family or associate is aware of this deal becau=

se he

used me as a proxy to move the funds; as it is, I have no knowledge of any

of his relatives or next of kin and how to locate them.







Before his untimely death, I had acted as his proxy for most of his

business dealings, especially those he wanted to remain anonymous; he was a

very meticulous person when it comes to business deals.







Having made the Bank aware of his death recently, they have mandated me to

present a member of his family (heir/inheritor) to make claim to the

deposited fund. Since I do not know any of his relatives and as such there

is no specific mentioning of a next of kin in all the documents we used for

the deposit with the Bank, and it is because of this I have obtained the

letter of probate for the administration of the said estate since I was

involved in the process of moving the funds from Canada and depositing it

with the Bank.







My proposal therefore is to seek your consent to present you as the next of

kin beneficiary for this claim so that the money would be released and

transferred to you. I have exclusive access to the documents of the fund

deposit with the Bank, you will be made the next of kin beneficiary of this

fund. It is my intention that we both benefit from this fund. I know of

someone who has pulled out a similar deal in the past, it is an

opportunity. If the money is not claimed, it will be escheat and nobody

benefits from this.







I suggest that we donate One Million USD of this money to a charity

organization of our choice after the deal and we will share the remaining

fund equal between us.







In order to come up with the bank pre-requisite for the claim, I will

explain to you the step by step process that we need to take before

presenting you to the bank with all the necessary documentation; what I

need from you is trust, confidentiality and your honest co-operation in

this transaction if you are interested. I guarantee you that this

transaction is 100% Risk free and would be executed under legitimate

arrangement.







Please contact me at your earliest convenience using my private email

ernestgframcis@usa.com if you are interested and willing to work with me,

send me your telephone number and name and I will reach you as soon as

possible.







Kindest Regards







Ernest Francis



--0000000000001c513605f5bfc36f

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri,sans-serif"=

>Ref: Business Proposal.






height:107%;font-size:11pt;font-family:Calibri,sans-serif">=C2=A0






height:107%;font-size:11pt;font-family:Calibri,sans-serif">I hope my email =

finds you well.






height:107%;font-size:11pt;font-family:Calibri,sans-serif">=C2=A0






height:107%;font-size:11pt;font-family:Calibri,sans-serif">Firstly, I must =

solicit for your

confidence in this transaction; this is by virtue of its nature as being

utterly confidential.






height:107%;font-size:11pt;font-family:Calibri,sans-serif">=C2=A0






height:107%;font-size:11pt;font-family:Calibri,sans-serif">You may be surpr=

ised to receive

such an email from someone you barely know. My name is Ernest Francis, a

Business consultant and facilitator.=C2=A0 A

client of mine died last year in 2022 from a heart attack. Few weeks before=

his

death, he needed to make an urgent investment requiring cash payment in whi=

ch

he requested me to assist him move the sum of US$28,500,000.00 to an open

beneficiary account securely for the business deal. I personally facilitate=

d

the moving of this fund through a special security firm in Canada to the Ba=

nk

as per his instruction. The Canadian firm is an especially private firm tha=

t

accepts deposits from high net worth individuals and blue chip corporations=

.






height:107%;font-size:11pt;font-family:Calibri,sans-serif">=C2=A0






height:107%;font-size:11pt;font-family:Calibri,sans-serif">None of my clien=

t=E2=80=99s family or

associate is aware of this deal because he used me as a proxy to move the

funds; as it is, I have no knowledge of any of his relatives or next of kin=

and

how to locate them.






height:107%;font-size:11pt;font-family:Calibri,sans-serif">=C2=A0






height:107%;font-size:11pt;font-family:Calibri,sans-serif">Before his untim=

ely death, I had

acted as his proxy for most of his business dealings, especially those he

wanted to remain anonymous; he was a very meticulous person when it comes t=

o

business deals.






height:107%;font-size:11pt;font-family:Calibri,sans-serif">=C2=A0






height:107%;font-size:11pt;font-family:Calibri,sans-serif">Having made the =

Bank aware of his

death recently, they have mandated me to present a member of his family

(heir/inheritor) to make claim to the deposited fund. Since I do not know a=

ny

of his relatives and as such there is no specific mentioning of a next of k=

in

in all the documents we used for the deposit with the Bank, and it is becau=

se

of this I have obtained the letter of probate for the administration of the

said estate since I was involved in the process of moving the funds from Ca=

nada

and depositing it with the Bank.






height:107%;font-size:11pt;font-family:Calibri,sans-serif">=C2=A0






height:107%;font-size:11pt;font-family:Calibri,sans-serif">My proposal ther=

efore is to seek

your consent to present you as the next of kin beneficiary for this claim s=

o

that the money would be released and transferred to you. I have exclusive

access to the documents of the fund deposit with the Bank, you will be made=

the

next of kin beneficiary of this fund. It is my intention that we both benef=

it

from this fund. I know of someone who has pulled out a similar deal in the

past, it is an opportunity. If the money is not claimed, it will be escheat=

and

nobody benefits from this.






height:107%;font-size:11pt;font-family:Calibri,sans-serif">=C2=A0






height:107%;font-size:11pt;font-family:Calibri,sans-serif">I suggest that w=

e donate One

Million USD of this money to a charity organization of our choice after the

deal and we will share the remaining fund equal between us.






height:107%;font-size:11pt;font-family:Calibri,sans-serif">=C2=A0






height:107%;font-size:11pt;font-family:Calibri,sans-serif">In order to come=

up with the bank

pre-requisite for the claim, I will explain to you the step by step process

that we need to take before presenting you to the bank with all the necessa=

ry

documentation; what I need from you is trust, confidentiality and your hone=

st

co-operation in this transaction if you are interested. I guarantee you tha=

t

this transaction is 100% Risk free and would be executed under legitimate

arrangement.






height:107%;font-size:11pt;font-family:Calibri,sans-serif">=C2=A0






height:107%;font-size:11pt;font-family:Calibri,sans-serif">Please contact m=

e at your

earliest convenience using my private email
s@usa.com">ernestgframcis@usa.com if you are

interested and willing to work with me, send me your telephone number and n=

ame

and I will reach you as soon as possible.






height:107%;font-size:11pt;font-family:Calibri,sans-serif">=C2=A0






height:107%;font-size:11pt;font-family:Calibri,sans-serif">Kindest Regards<=

/p>




height:107%;font-size:11pt;font-family:Calibri,sans-serif">=C2=A0






height:107%;font-size:11pt;font-family:Calibri,sans-serif">Ernest Francis
p>





--0000000000001c513605f5bfc36f--

Nigerian partnership spam from gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 27 Feb 2023 22:56:32 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pWsx6-0000UB-1k

for dave@doctor.nl2k.ab.ca;

Mon, 27 Feb 2023 22:55:04 -0700

Resent-From: The Doctor

Resent-Date: Mon, 27 Feb 2023 22:55:04 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f171.google.com ([209.85.128.171]:45741)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pWrzj-000Nkb-1b

for doctor@doctor.nl2k.ab.ca;

Mon, 27 Feb 2023 21:53:49 -0700

Received: by mail-yw1-f171.google.com with SMTP id 00721157ae682-536bf92b55cso238097937b3.12

for ; Mon, 27 Feb 2023 20:51:44 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112; t=1677559898;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=HkIRWt2gJ2izW5rnJjwC+HKh7WnZ+LYR4lvd5mQlpVI=;

b=i5bELqkdOW0jR4Cg74/q7F+bVUIMtLx3g4Ryal/FXt8B9hms8AQEdQXPE8gjEKPe7Y

KsZPTyas8ZYzCMJGDdWMf9ykMItZ3HwUoB/sbwxDmLKLaEnxqhLXDE1RtcvWoyRiUsGn

rfZKUCibDa26UTH8veXOB+2XKnCVCfkLKmz9sJuJBHioBLC+e8Fl/33vgPWvDWD3QhV2

2pM3/3X+5+EF93HQIc0tnUdofKWDI6Jxvax4wBhU0UZzdz0wp89EgZ1J7KewYcLCDZzO

OWfdbBWNi5/GATZ6VwkVxpEvoMCsUHHgr7m4s0WihbjIWUbHTTDQNrg/WZtZuyC3kS23

ZQYA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112; t=1677559898;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=HkIRWt2gJ2izW5rnJjwC+HKh7WnZ+LYR4lvd5mQlpVI=;

b=LVQgoWewLu3lBMra3bM3RAG9UGgyKCp5B9OCyqZXcxnvf2PM5b4Jx4SJTXfE1qCcVe

IdGnfY7QQNhnR4QgpgN4JBaE3FtWQOuQa2C5ES3QOQMT3yNH93w+F5OF63+fQ+ue5tRv

RCt3Qm5gz0PMxymfstW5D/HVm+1WP/6Hb+1k5tgf1UxKH6t1KnnJPw4uop7N27R0vaL+

Z+ArVX6wISxeKGJq4vN1xnCtw3t3Sij8WjA7vLKtsg5c+R4FqUulTd2ktQrZqlWBT82V

6SQSder36iI+NEtz/xfRSYQr5wlrpc+HnApeV252p9hBBEPSKkl3cO/TqM+6xUx8i4yc

pzVA==

X-Gm-Message-State: AO0yUKXgOFItoXAIi7XyDBHwOnUD8hLaFFvVaoXKgqwNi5mB3xeFv1H/

exHbyGJT7gzG8oyvcpuTE0b5A4bvOgSohqnZceM=

X-Google-Smtp-Source: AK7set9byEZg1xgvdLpvNADx6vX9jQofZy6I1evfJkvcw6vJZZMKbO19u1B4LNeRomFNTGFkRJFn44gEXgOjXU3ukgg=

X-Received: by 2002:a81:431c:0:b0:52e:b22b:f99 with SMTP id

q28-20020a81431c000000b0052eb22b0f99mr759374ywa.4.1677559898090; Mon, 27 Feb

2023 20:51:38 -0800 (PST)

MIME-Version: 1.0

Received: by 2002:a25:248d:0:b0:9ec:8219:f04a with HTTP; Mon, 27 Feb 2023

20:51:37 -0800 (PST)

From: Carron Tim

Date: Mon, 27 Feb 2023 20:51:37 -0800

Message-ID:

Subject: Re

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@doctor.nl2k.ab.ca



--

Hello.



Your partnership is needed to set up a project.reply back for more info

Thanks

Carron Tim

Nigerian Gmail spam

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 28 Feb 2023 08:03:01 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pX1VA-0008Ag-0W

for dave@doctor.nl2k.ab.ca;

Tue, 28 Feb 2023 08:02:48 -0700

Resent-From: The Doctor

Resent-Date: Tue, 28 Feb 2023 08:02:48 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f176.google.com ([209.85.128.176]:40813)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pWvhq-000GNS-0a

for doctor@doctor.nl2k.ab.ca;

Tue, 28 Feb 2023 01:51:33 -0700

Received: by mail-yw1-f176.google.com with SMTP id 00721157ae682-53916ab0c6bso251052647b3.7

for ; Tue, 28 Feb 2023 00:49:31 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=ai58wS/jZjPzl4HXvGIx1b94+4Wgl3f9Gtg7NuwFbF8=;

b=J36KgVXQ/C2Jqf2qMpE+c7DAwYbLCo/2Y00pk+iOceK5L0K0Fudz3Sq8auRyffeiSs

BK4xNl2sYcAVzIze7RSqLTGH68lRgIb5isctMKwovycmxSBFhcHEolKylVTl1hfdFLFP

cA3GTYJbGKT88Aozek8zzJWoT28r9j3+0FC0H1tdZzAGa8dMuHYjfehyypKX50EFcUxI

Wad+Fh6l1/THUaPC24X4xroKCNFrYk895OydnU5JohtWf39CPSkPmWbelRQWERs1Xq2V

VvXYaggpbBASeCC11ljzJL0qFzSxgVfD5mrkdEefhOg7akQVXgZpNxSW8YFPBizrSx6c

U5wA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=ai58wS/jZjPzl4HXvGIx1b94+4Wgl3f9Gtg7NuwFbF8=;

b=vLC9PzQ3Q/LyRMbXLGpdcAGPB02Btjdt+0AU9gSLMZ3djmBsCRJTTm8uedodndEFbw

54MRRULK6gg9Fm+ee5S1wUlBeztOYnrZMN77FsxBcF3qNtuH7f5RLP7ntC3DVa5POoCj

SyHUJvr40t3/nwNLCvP5W7Yx2F0FG5G805t3v/dkGgOz5+BG3jGZgKy6qdbCJcvKtkrL

L4RFV0Krt2zMSU9DqyWYSkJqu1JCfOytkyT77FWngrpSO2B689t1aZoc/3SZ6cwHtPmG

HPQnOlYCPQS9ZbEb6hL/gccq2SzILE2GFIP+VxFulHyoZQbfmVntXbj79B7V36iOZV1g

WBZw==

X-Gm-Message-State: AO0yUKUsbfhig2At2pC0gac9xdfffuBQYN/iXQ9FEqrxcK02N69P3Ybm

QOShQT4uKVjBXcrq6mWk9sBH4K8XiVGz/4yBz04=

X-Google-Smtp-Source: AK7set/rpN0ufxW6AbX8U3mHmLI8nopMffl5cPuCbJawkmw5NlZWA01uaThtKMFbh/iU4fOeK6/82/RFWoobTlresRc=

X-Received: by 2002:a81:ae0e:0:b0:534:7429:2eb4 with SMTP id

m14-20020a81ae0e000000b0053474292eb4mr1157071ywh.3.1677574165673; Tue, 28 Feb

2023 00:49:25 -0800 (PST)

MIME-Version: 1.0

Received: by 2002:a05:7110:65aa:b0:1bf:32b4:3309 with HTTP; Tue, 28 Feb 2023

00:49:24 -0800 (PST)

Reply-To: magrethmc68@gmail.com

From: Mrs Margreth Guimard

Date: Tue, 28 Feb 2023 08:49:24 +0000

Message-ID:

Subject: RELIEF FUND

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 10.4

X-Spam_score_int: 104

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: At the invitation of the International Labour Organization

(ILO) Workrelated injuries and diseases FOR COVID 19 & MONKEYPOX VIRUS Recovery,

PAYMENT APPROVAL FOR pending COVID 19 & MONKEYPOX VIRUS RELI [...]



Content analysis details: (10.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.176 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[magrethmc68(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[desouzajolymichaelweezy(at)gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.176 listed in wl.mailspike.net]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

1.5 HK_NAME_FM_MR_MRS No description available.

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 T_HK_NAME_FM_MR_MRS No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to

3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} RELIEF FUND



At the invitation of the International Labour Organization (ILO)

Workrelated injuries and diseases FOR COVID 19 & MONKEYPOX VIRUS

Recovery, PAYMENT APPROVAL FOR pending COVID 19 & MONKEYPOX VIRUS

RELIEF FUNDS







The World Bank & World Health Organization (WHO) in collaboration with

its Parent Organization United Nations Economic and Social Council

(ECO-SOC), has mandated this office to diligently disburse benefit

Funds mapped out to assist (you) persons affected by the economic

meltdown the virus has caused.



We are highly pleased to inform you that you have been chosen among

150 candidates to be benefited with the sum of $550,000.00 (Five

Hundred and Fifty Thousand Dollars). The World Bank in conjunction

with Union Togolaise Bank and International Monetary Fund (IMF) has

chosen to pay out all pending unpaid relief funds to 150 beneficiaries

around the world.



You are benefit of ($550,000.00) Five hundred and fifty thousand

United States dollars is ready for disbursement, payment method is via

Union Togolaise Bank (UTB) Visa Prepaid Cards account which will be

shipped to you via Courier, and you can only withdraw a maximum of

$3500 daily till the full funds are totally withdrawn.









Warm Regards,

Mrs Sonia Guimard

Foriegn Operational Manager