Powerball spam from gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 22 Mar 2023 10:50:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pf1dx-0002vv-2n
for dave@doctor.nl2k.ab.ca;
Wed, 22 Mar 2023 10:48:57 -0600
Resent-From: The Doctor
Resent-Date: Wed, 22 Mar 2023 10:48:57 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vs1-f43.google.com ([209.85.217.43]:42519)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from)
id 1pf1Rf-000IeR-37
for doctor@doctor.nl2k.ab.ca;
Wed, 22 Mar 2023 10:36:19 -0600
Received: by mail-vs1-f43.google.com with SMTP id d2so10485937vso.9
for; Wed, 22 Mar 2023 09:34:17 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1679502851;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=od3w3sPX0IMRZ7TGMnJZWRoAe+QbixjcSIwlGfWaiRA=;
b=LgR0fnpT94QDa2Pmkn/adgmurA5L3GKQScGpQriythDLlQYtnLAqhibAt4ob60WxH1
9SApdenV8E9187QxyaK5gftefby4YpSmKzGld+NICbchPmtRAqK8YFGmJRFl129BVbGk
SFsbIsaQXJI8Y1L0CvDOVNY5GqYgHf+YVE7b1RbToamBED0xaWvBLoUK1VHpPCazzidi
Vw9sPbfPENvpwfA4C8OpTYf6q/7LH60V4R0peOgoBkHvCJ8tq+q/9eUzrftRJvkhZLKg
n81d+0CQgk3/Ch0B1thBRQ5q+38YMH8zUv/cjyVJSNzfEDXBS49k/eLK95rU/v+zKADT
btgg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1679502851;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=od3w3sPX0IMRZ7TGMnJZWRoAe+QbixjcSIwlGfWaiRA=;
b=qdo80H+1SFdidrNK1/BBUe7d55xluo4ZiAmslKKpTYJWaGOeXaG/AFlRwsfDmhPkEt
DTn36nXcKPWnjd2vZ1XEnR+kOYSeO7Zt7JnjW4ULYQiGczDK1zTvElzFojn31z3pbj4K
4tsBNtNi22vO99vqxcucJi4LI6y0/fAQSERBeKlxia3KTi23k9OfBjR1MbYot5ni24bj
Hphmu7maQMmzK5+yuDpQQaqno78pw1q8hULqHgNdJ3/fO/aO5zJyld00V6x43GxHdPD9
El4QlZcR7HaASnFYq2UAAPhDvMGbC9a9Mvi85sq4iB0/o0KUZs2nV3o+W4FkgpTrwlm+
Ro5Q==
X-Gm-Message-State: AO0yUKXaO1NoybB1YZTK1rScgxY/ab0A+ge35Cv1T7a3AkneWuAjgBtE
t5NjrnWR8CQaewROEFrgbRemsMvUprPIAtFOuc0=
X-Google-Smtp-Source: AK7set8D5uslnwajKS9sb7PeYBxZMP5u9JLU9rBW9zLvaC0MpiQuf3jLqorwclBbhDr7Yvs9dB5VwANEcZfll7nSAE8=
X-Received: by 2002:a67:c110:0:b0:425:8cbd:f74f with SMTP id
d16-20020a67c110000000b004258cbdf74fmr24793vsj.3.1679502851207; Wed, 22 Mar
2023 09:34:11 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a59:d954:0:b0:3b6:649a:5d63 with HTTP; Wed, 22 Mar 2023
09:34:10 -0700 (PDT)
Reply-To: lopowerball1@gmail.com
From: Powerball Promo
Date: Wed, 22 Mar 2023 09:34:10 -0700
Message-ID:
Subject: Powerball promo
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 20.3
X-Spam_score_int: 203
X-Spam_bar: ++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Dear: e-Mail Winner, This is to formally inform you that
you have won a prize money of $3,000,000.00 from Powerball promo Your Email
Address" were selected through a computer ballot system drawn from over 20,000
companies [...]
Content analysis details: (20.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.217.43 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[ashuallan96(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[lopowerball1(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ashuallan96(at)gmail.com]
3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
3.0 BIGNUM_EMAILS Lots of email addresses/leads
0.0 LOTS_OF_MONEY Huge... sums of money
0.8 HK_LOTTO No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.1 BIGNUM_EMAILS_FREEM Lots of email addresses/leads, free email account
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 FILL_THIS_FORM Fill in a form with personal information
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
2.3 ADVANCE_FEE_3_NEW_FRM_MNY Advance Fee fraud form and lots of money
0.0 MONEY_FORM Lots of money if you fill out a form
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.217.43 listed in wl.mailspike.net]
Subject: {SPAM?} Powerball promo
--
Dear: e-Mail Winner,
This is to formally inform you that you have won a prize money of
$3,000,000.00 from Powerball promo Your Email Address" were selected
through a computer ballot system drawn from over 20,000 companies and
30,000,000 individual email addresses and names from all over the
world. As part of our international promotions program, which is
conducted annually, we have only selected 20 people as our winners,
through an electronic ballot System without the winner applying.
1.Full Name:
2.Full Address:
3.Status:
4.Occupation:
5.Age
6.Phone Number:
7.Country:
SEND YOUR ABOVE DETAILS Email: lopowerball1@gmail.com
Congratulations!!
Sincerely,
Mrs. Melissa Castellon
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 22 Mar 2023 10:50:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pf1dx-0002vv-2n
for dave@doctor.nl2k.ab.ca;
Wed, 22 Mar 2023 10:48:57 -0600
Resent-From: The Doctor
Resent-Date: Wed, 22 Mar 2023 10:48:57 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vs1-f43.google.com ([209.85.217.43]:42519)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from
id 1pf1Rf-000IeR-37
for doctor@doctor.nl2k.ab.ca;
Wed, 22 Mar 2023 10:36:19 -0600
Received: by mail-vs1-f43.google.com with SMTP id d2so10485937vso.9
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1679502851;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=od3w3sPX0IMRZ7TGMnJZWRoAe+QbixjcSIwlGfWaiRA=;
b=LgR0fnpT94QDa2Pmkn/adgmurA5L3GKQScGpQriythDLlQYtnLAqhibAt4ob60WxH1
9SApdenV8E9187QxyaK5gftefby4YpSmKzGld+NICbchPmtRAqK8YFGmJRFl129BVbGk
SFsbIsaQXJI8Y1L0CvDOVNY5GqYgHf+YVE7b1RbToamBED0xaWvBLoUK1VHpPCazzidi
Vw9sPbfPENvpwfA4C8OpTYf6q/7LH60V4R0peOgoBkHvCJ8tq+q/9eUzrftRJvkhZLKg
n81d+0CQgk3/Ch0B1thBRQ5q+38YMH8zUv/cjyVJSNzfEDXBS49k/eLK95rU/v+zKADT
btgg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1679502851;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=od3w3sPX0IMRZ7TGMnJZWRoAe+QbixjcSIwlGfWaiRA=;
b=qdo80H+1SFdidrNK1/BBUe7d55xluo4ZiAmslKKpTYJWaGOeXaG/AFlRwsfDmhPkEt
DTn36nXcKPWnjd2vZ1XEnR+kOYSeO7Zt7JnjW4ULYQiGczDK1zTvElzFojn31z3pbj4K
4tsBNtNi22vO99vqxcucJi4LI6y0/fAQSERBeKlxia3KTi23k9OfBjR1MbYot5ni24bj
Hphmu7maQMmzK5+yuDpQQaqno78pw1q8hULqHgNdJ3/fO/aO5zJyld00V6x43GxHdPD9
El4QlZcR7HaASnFYq2UAAPhDvMGbC9a9Mvi85sq4iB0/o0KUZs2nV3o+W4FkgpTrwlm+
Ro5Q==
X-Gm-Message-State: AO0yUKXaO1NoybB1YZTK1rScgxY/ab0A+ge35Cv1T7a3AkneWuAjgBtE
t5NjrnWR8CQaewROEFrgbRemsMvUprPIAtFOuc0=
X-Google-Smtp-Source: AK7set8D5uslnwajKS9sb7PeYBxZMP5u9JLU9rBW9zLvaC0MpiQuf3jLqorwclBbhDr7Yvs9dB5VwANEcZfll7nSAE8=
X-Received: by 2002:a67:c110:0:b0:425:8cbd:f74f with SMTP id
d16-20020a67c110000000b004258cbdf74fmr24793vsj.3.1679502851207; Wed, 22 Mar
2023 09:34:11 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a59:d954:0:b0:3b6:649a:5d63 with HTTP; Wed, 22 Mar 2023
09:34:10 -0700 (PDT)
Reply-To: lopowerball1@gmail.com
From: Powerball Promo
Date: Wed, 22 Mar 2023 09:34:10 -0700
Message-ID:
Subject: Powerball promo
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 20.3
X-Spam_score_int: 203
X-Spam_bar: ++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Dear: e-Mail Winner, This is to formally inform you that
you have won a prize money of $3,000,000.00 from Powerball promo Your Email
Address" were selected through a computer ballot system drawn from over 20,000
companies [...]
Content analysis details: (20.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.217.43 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[ashuallan96(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[lopowerball1(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ashuallan96(at)gmail.com]
3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
3.0 BIGNUM_EMAILS Lots of email addresses/leads
0.0 LOTS_OF_MONEY Huge... sums of money
0.8 HK_LOTTO No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.1 BIGNUM_EMAILS_FREEM Lots of email addresses/leads, free email account
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 FILL_THIS_FORM Fill in a form with personal information
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
2.3 ADVANCE_FEE_3_NEW_FRM_MNY Advance Fee fraud form and lots of money
0.0 MONEY_FORM Lots of money if you fill out a form
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.217.43 listed in wl.mailspike.net]
Subject: {SPAM?} Powerball promo
--
Dear: e-Mail Winner,
This is to formally inform you that you have won a prize money of
$3,000,000.00 from Powerball promo Your Email Address" were selected
through a computer ballot system drawn from over 20,000 companies and
30,000,000 individual email addresses and names from all over the
world. As part of our international promotions program, which is
conducted annually, we have only selected 20 people as our winners,
through an electronic ballot System without the winner applying.
1.Full Name:
2.Full Address:
3.Status:
4.Occupation:
5.Age
6.Phone Number:
7.Country:
SEND YOUR ABOVE DETAILS Email: lopowerball1@gmail.com
Congratulations!!
Sincerely,
Mrs. Melissa Castellon