Banking spam from gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 23 Mar 2023 05:17:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pfIvh-000HFz-2r
for dave@doctor.nl2k.ab.ca;
Thu, 23 Mar 2023 05:16:25 -0600
Resent-From: The Doctor
Resent-Date: Thu, 23 Mar 2023 05:16:25 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vs1-f45.google.com ([209.85.217.45]:38785)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from)
id 1pfHFq-0000vK-0v
for doctor@doctor.nl2k.ab.ca;
Thu, 23 Mar 2023 03:29:13 -0600
Received: by mail-vs1-f45.google.com with SMTP id i10so3034834vss.5
for; Thu, 23 Mar 2023 02:27:07 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1679563621;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=35AgU16iiUsWAaQRUe4m6I88xgjWCBI2379g3b0buvE=;
b=mCIIfaj0r0tUQshDfXAFgp17IvQsWPKFXSqhFyBLzNieRk7VPF0cLmGbJ7D8rQeH6N
Z5XQ0n1kWFWb2M5lTL/FbH4L1JK6iaXH5iEPs0UDPSURzsQcJ+Ih8Yt/Qccr+pvI2zkM
LfPH1N6m8VpKuSw9sJ8O0udQ+9rZGTqg+sfR9pSnywdobLCqsDW4ub/ytcjHq9OBFgL+
dFd0c62Bov0RJ395B2KDfdM07drW+w/oU4SnGWkWwjlPte9CxHPAlnRMVMYq7gpu5MT+
9u+7beJNMKNn5pBMwfV8/Tr240o1hl9DNCuRcG1PYWbmhSu3LDolR6NVlcgEGVSUQmeq
/9Pw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1679563621;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=35AgU16iiUsWAaQRUe4m6I88xgjWCBI2379g3b0buvE=;
b=kZG3wXOpC7MoMm2sLgHLUEIcGIlkB+WWvXbQuPnONQGmVxpSdYmdf9yC/vRNZWKPsO
MBuiTfWpWvI5yowubZ9owqJbFZvsxYVMLi0oHaEMvwIeeq2t3bK561oZce+eYs0ckcb4
6rL1T9LDM2vVjwUmcyJCW8rnlt1/Qlc9LrFz7pmvYoec/y14aXcLDviamldmXXWeijcr
m9DTu7Vi1JmatZX7y94PqmWtx0MqIy+kQcnLVJ/pqAQzA0jXpZ63zhY+PSYflns20FoH
GKrjmdkHN4yi0b1NCaaheWMWJKmLJz7Ivtq2nZnid8YB/sCFv5ybWrCF+llnQeLLHQvf
h30Q==
X-Gm-Message-State: AO0yUKX2lE1VSkVnYusnaXpgv4TqPMjqvbmIq4f99/kDZWV0zKopg83b
DoU8yiUrC5GWaAtu3w4wVA5nuyP2zXm81hFVsdM=
X-Google-Smtp-Source: AK7set/LFju/ppmTtgXh99OoP3jdgN/p5ayBOnSd5UdnuooELqZSKqYXnyH2Mkx0r62bF5O771D+YFcp64r1SFsUfX0=
X-Received: by 2002:a67:c31c:0:b0:425:d255:dd38 with SMTP id
r28-20020a67c31c000000b00425d255dd38mr1355299vsj.1.1679563621085; Thu, 23 Mar
2023 02:27:01 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a59:c9e1:0:b0:3aa:b55c:70a6 with HTTP; Thu, 23 Mar 2023
02:27:00 -0700 (PDT)
Reply-To: magrethmc68@gmail.com
From: HELLO BANK
Date: Thu, 23 Mar 2023 09:27:00 +0000
Message-ID:
Subject: HELLO BANK
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 14.7
X-Spam_score_int: 147
X-Spam_bar: ++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: ATTN: CONGRATULATION YOU HAVE BEEN REWARDED WITH THE SUM OF
($1,300,000 USD) GRANT FUNDS FROM INTERNATIONAL MONETARY FUND ( IMF) EMPOWERMENT
FUNDS PROGRAM. CONTACT US FOR MORE DETAILS ABOUT YOUR PAYMENT.
Content analysis details: (14.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[magrethmc68(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[mazabalotchinguilou(at)gmail.com]
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.2 UPPERCASE_75_100 message body is 75-100% uppercase
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 LOTTO_DEPT Claims Department
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.217.45 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.217.45 listed in wl.mailspike.net]
Subject: {SPAM?} HELLO BANK
ATTN:
CONGRATULATION YOU HAVE BEEN REWARDED WITH THE SUM OF ($1,300,000 USD)
GRANT FUNDS FROM INTERNATIONAL MONETARY FUND ( IMF) EMPOWERMENT FUNDS
PROGRAM.
CONTACT US FOR MORE DETAILS ABOUT YOUR PAYMENT.
BEST REGARDS
MS MAGRETH GUIMARD
PAYMENT DEPARTMENT BNP PARIBAS
HELLO BANK PARIS FRANCE
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 23 Mar 2023 05:17:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pfIvh-000HFz-2r
for dave@doctor.nl2k.ab.ca;
Thu, 23 Mar 2023 05:16:25 -0600
Resent-From: The Doctor
Resent-Date: Thu, 23 Mar 2023 05:16:25 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vs1-f45.google.com ([209.85.217.45]:38785)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from
id 1pfHFq-0000vK-0v
for doctor@doctor.nl2k.ab.ca;
Thu, 23 Mar 2023 03:29:13 -0600
Received: by mail-vs1-f45.google.com with SMTP id i10so3034834vss.5
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1679563621;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=35AgU16iiUsWAaQRUe4m6I88xgjWCBI2379g3b0buvE=;
b=mCIIfaj0r0tUQshDfXAFgp17IvQsWPKFXSqhFyBLzNieRk7VPF0cLmGbJ7D8rQeH6N
Z5XQ0n1kWFWb2M5lTL/FbH4L1JK6iaXH5iEPs0UDPSURzsQcJ+Ih8Yt/Qccr+pvI2zkM
LfPH1N6m8VpKuSw9sJ8O0udQ+9rZGTqg+sfR9pSnywdobLCqsDW4ub/ytcjHq9OBFgL+
dFd0c62Bov0RJ395B2KDfdM07drW+w/oU4SnGWkWwjlPte9CxHPAlnRMVMYq7gpu5MT+
9u+7beJNMKNn5pBMwfV8/Tr240o1hl9DNCuRcG1PYWbmhSu3LDolR6NVlcgEGVSUQmeq
/9Pw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1679563621;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=35AgU16iiUsWAaQRUe4m6I88xgjWCBI2379g3b0buvE=;
b=kZG3wXOpC7MoMm2sLgHLUEIcGIlkB+WWvXbQuPnONQGmVxpSdYmdf9yC/vRNZWKPsO
MBuiTfWpWvI5yowubZ9owqJbFZvsxYVMLi0oHaEMvwIeeq2t3bK561oZce+eYs0ckcb4
6rL1T9LDM2vVjwUmcyJCW8rnlt1/Qlc9LrFz7pmvYoec/y14aXcLDviamldmXXWeijcr
m9DTu7Vi1JmatZX7y94PqmWtx0MqIy+kQcnLVJ/pqAQzA0jXpZ63zhY+PSYflns20FoH
GKrjmdkHN4yi0b1NCaaheWMWJKmLJz7Ivtq2nZnid8YB/sCFv5ybWrCF+llnQeLLHQvf
h30Q==
X-Gm-Message-State: AO0yUKX2lE1VSkVnYusnaXpgv4TqPMjqvbmIq4f99/kDZWV0zKopg83b
DoU8yiUrC5GWaAtu3w4wVA5nuyP2zXm81hFVsdM=
X-Google-Smtp-Source: AK7set/LFju/ppmTtgXh99OoP3jdgN/p5ayBOnSd5UdnuooELqZSKqYXnyH2Mkx0r62bF5O771D+YFcp64r1SFsUfX0=
X-Received: by 2002:a67:c31c:0:b0:425:d255:dd38 with SMTP id
r28-20020a67c31c000000b00425d255dd38mr1355299vsj.1.1679563621085; Thu, 23 Mar
2023 02:27:01 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a59:c9e1:0:b0:3aa:b55c:70a6 with HTTP; Thu, 23 Mar 2023
02:27:00 -0700 (PDT)
Reply-To: magrethmc68@gmail.com
From: HELLO BANK
Date: Thu, 23 Mar 2023 09:27:00 +0000
Message-ID:
Subject: HELLO BANK
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 14.7
X-Spam_score_int: 147
X-Spam_bar: ++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: ATTN: CONGRATULATION YOU HAVE BEEN REWARDED WITH THE SUM OF
($1,300,000 USD) GRANT FUNDS FROM INTERNATIONAL MONETARY FUND ( IMF) EMPOWERMENT
FUNDS PROGRAM. CONTACT US FOR MORE DETAILS ABOUT YOUR PAYMENT.
Content analysis details: (14.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[magrethmc68(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[mazabalotchinguilou(at)gmail.com]
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.2 UPPERCASE_75_100 message body is 75-100% uppercase
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 LOTTO_DEPT Claims Department
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.217.45 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.217.45 listed in wl.mailspike.net]
Subject: {SPAM?} HELLO BANK
ATTN:
CONGRATULATION YOU HAVE BEEN REWARDED WITH THE SUM OF ($1,300,000 USD)
GRANT FUNDS FROM INTERNATIONAL MONETARY FUND ( IMF) EMPOWERMENT FUNDS
PROGRAM.
CONTACT US FOR MORE DETAILS ABOUT YOUR PAYMENT.
BEST REGARDS
MS MAGRETH GUIMARD
PAYMENT DEPARTMENT BNP PARIBAS
HELLO BANK PARIS FRANCE