german language gmail spam

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 28 May 2023 06:59:10 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1q3FxF-0007QS-1D

for dave@doctor.nl2k.ab.ca;

Sun, 28 May 2023 06:57:01 -0600

Resent-From: The Doctor

Resent-Date: Sun, 28 May 2023 06:57:01 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f48.google.com ([209.85.161.48]:58377)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1q3FRy-000FAb-16

for doctor@doctor.nl2k.ab.ca;

Sun, 28 May 2023 06:24:48 -0600

Received: by mail-oo1-f48.google.com with SMTP id 006d021491bc7-557de45f56aso1221640eaf.0

for ; Sun, 28 May 2023 05:22:43 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20221208; t=1685276557; x=1687868557;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=T87+0C4BWAJDgFtwyrc+vVZDKngbTiVJ2xwK3FxPGTQ=;

b=eS0qzGrz9q4WjDezgwHt1Rg1UGF7AIdfSSKsERdrPZB1Np+oEbj9UBWTvS6X2eG4dg

wJ6mwcP/A6IS3wV80hWxR4uW8Vg/WzqykUc40KfmFOFqhplCOYJjA9hpbNrcK3mwzgqd

xK37LvlFHsifA9g6SEkwOUfQdlAakiEa/IrgIMgU260gN+oAiMVkgYS7X5emGQktink+

1yH5RKg8MH8FTV2ScmN+o5jQqUlgffZeRfxgH9HR6hnivH387lxEu2ybneu7sH3bZWF7

s3PCY+56yrB98fGfZLBXyiL1QN8JRjO++NejEiGy8vdijvxwVF/7L//k+/5tB3/pdWuc

K1/g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20221208; t=1685276557; x=1687868557;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=T87+0C4BWAJDgFtwyrc+vVZDKngbTiVJ2xwK3FxPGTQ=;

b=JHSKttL0l4Xm+I7eA/M/NccpozXK0azzgUt/lbYayAU64kGElLx7xl08mF0j/AfZsz

nS5YRyXWDaxG1gGjODOefutZneCE4mr3/naobApdOLkog/mj0wE2sM+ugastbD3i7BEH

INnEOOxVoZ7tMnopkJnAi0sViMgPGZKmQxtuHj7EtM74GO8QBh2rCyzUii5FK5fe+IkN

4dMXyfepQaLaTJZs9NaQL+DC1vJiaOHklB9O8Y4uQgpTS9fOecGYKxTNmc+7e5pgYS/t

iUr+QwHsPu6DFMvD1CqDIn4u1mEeZHRrA5TR5Zk8LQCHo881VZSUHHapKPUctyZ67SaW

XVYQ==

X-Gm-Message-State: AC+VfDwu6WJcylXP91IsZBqgPcbfeayZ1o4m06bcpnlYVCokHw5YuN71

IMleXIrPIEafwZs6njZwsbK3KpW9s17/XSL5VmE=

X-Google-Smtp-Source: ACHHUZ58ynKaJ79mM3l9vOTvN6wPsnocevHLp3qJ5/45+JWbBNgRj7OD+PfSjA7d/K/PgsWoy6TNJBIz8C4DWv+cpBk=

X-Received: by 2002:a05:6808:8fb:b0:398:3c29:eb9a with SMTP id

d27-20020a05680808fb00b003983c29eb9amr3546229oic.32.1685276556968; Sun, 28

May 2023 05:22:36 -0700 (PDT)

MIME-Version: 1.0

From: James Benjamin

Date: Sun, 28 May 2023 14:22:24 +0200

Message-ID:

Subject: =?UTF-8?Q?Eine_Gesch=C3=A4ftstransaktion?=

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="00000000000086ca9d05fcc006f6"

Bcc: doctor@doctor.nl2k.ab.ca

X-Antivirus: AVG (VPS 230528-6, 5/28/2023), Inbound message

X-Antivirus-Status: Clean



--00000000000086ca9d05fcc006f6

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hallo Freund . Mein Name ist James Benjamin, ein Anwalt eines verstorbenen

Mandanten, der denselben Nachnamen wie Sie tr=C3=A4gt, und ich m=C3=B6chte,=

dass Sie

sein Erbe bei der Bank zum Wohle von uns beiden und nicht zum Vorteil der

Bank geltend machen.

Bitte teilen Sie mir Ihre WhatsApp-Nummer mit, um einen Video-Chat mit

Ihnen zu f=C3=BChren und Sie besser kennenzulernen.

Gr=C3=BC=C3=9Fe,

James.



--00000000000086ca9d05fcc006f6

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hallo Freund . Mein Name ist James Benjamin, ein Anwalt ei=

nes verstorbenen Mandanten, der denselben Nachnamen wie Sie tr=C3=A4gt, und=

ich m=C3=B6chte, dass Sie sein Erbe bei der Bank zum Wohle von uns beiden =

und nicht zum Vorteil der Bank geltend machen.
Bitte teilen Sie mir Ihre=

WhatsApp-Nummer mit, um einen Video-Chat mit Ihnen zu f=C3=BChren und Sie =

besser kennenzulernen.
Gr=C3=BC=C3=9Fe,
James.




--00000000000086ca9d05fcc006f6--

Nigerian spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 27 May 2023 17:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1q33fS-000O2u-2w

for dave@doctor.nl2k.ab.ca;

Sat, 27 May 2023 17:49:50 -0600

Resent-From: The Doctor

Resent-Date: Sat, 27 May 2023 17:49:50 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f68.google.com ([209.85.218.68]:62607)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1q2znG-0000E0-2V

for doctor@doctor.nl2k.ab.ca;

Sat, 27 May 2023 13:41:41 -0600

Received: by mail-ej1-f68.google.com with SMTP id a640c23a62f3a-95fde138693so592069266b.0

for ; Sat, 27 May 2023 12:39:39 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20221208; t=1685216373; x=1687808373;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=T8FG+7z201arRkSYdboixj3ymHlZZAey1hFVs1DAcTE=;

b=S3tzgaG/nd6x9/Rm58NB0WWFDG5922dOqf9ItfB4V4sLn/jft8fNaxX6VQZ67rZE6X

snk+6bLrxYIRM7082UR2RXY+L3nBJ8LLX3LBp/1VI1M6eW57HloYxAhMq17bQ/gFxARh

FDiS3uitM17PaKWkDf3teiycBPUIRoqn8BUgNxU4jFBKwdT+Dz5jd3vUNG1unl0VTIUC

/IWwdHV56Yu48r+aUpuXVPt2UFyMH29mRu9ujChYOf5GuaxAYJU22HfRkrG92shwyqkM

r0Kb42zWX+5ghfrXcnAgNVfBrWi0bFzmJA2Xggyo00kOsEPMf43fHJobEgwLL8vQufOA

UP9w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20221208; t=1685216373; x=1687808373;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=T8FG+7z201arRkSYdboixj3ymHlZZAey1hFVs1DAcTE=;

b=kze/BTrrsMw6VL9u94LABzh/TTkMf1DqYRoZ/3OH1D/85sftksi+UBtmZbjOiDMK33

pYgRw9ivYXsPgiLThATxDFZqVmE7G0sj2QJjNJb0s6n1AaZM845q72UkudW8SSbRmIK/

Dt6HqmWkhXt9WgClM6JR84IjY/D+hPGLcoB4WPEdCY5OBhmDBOHy10534FpEnlrQQpA4

PDr4MkP5WBLQCHNT7vZnOe3tGcOwICsP4e5V87n48lWlX9QCV0OjIsfIsVT1bbvSYtGc

Xsq5g7tmlRiGZ2vtPxJe33ntXm8KNtxgZYHRYQmn4DqvGTsUs5oQcSTGh7YSlWa8PosS

9+rA==

X-Gm-Message-State: AC+VfDzuJDcMju4VrDkiU8i2PS6tQprHX1Rmz3FnW2d/J7680RJAjdy2

GMtxRdmWvG/tIj7SBxq12YQm2bBEpCTssqCtLFI=

X-Google-Smtp-Source: ACHHUZ61RhHGy57124dd6cU0EgdKQnyxoQTUUkfQwzrlTvpm6L/gVvBD7uBxZwjjDeg1oki5mA8l2aaNkkUvjBAnVok=

X-Received: by 2002:aa7:c251:0:b0:514:224b:a48c with SMTP id

y17-20020aa7c251000000b00514224ba48cmr3069192edo.0.1685216372487; Sat, 27 May

2023 12:39:32 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:6402:386:b0:50b:8864:5f17 with HTTP; Sat, 27 May 2023

12:39:31 -0700 (PDT)

Reply-To: anitharsaliba75@gmail.com

From: Anithar Saliba

Date: Sat, 27 May 2023 19:39:31 +0000

Message-ID:

Subject: HELLOO..

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 21.2

X-Spam_score_int: 212

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: -- My name is Madam Anithar Saliba. I am working with one

of the prime banks here in Burkina Faso. Here in this bank existed a dormant

account for many years, which belong to one of our late foreign c [...]



Content analysis details: (21.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.218.68 listed in list.dnswl.org]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[anitharsaliba(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[anitharsaliba75(at)gmail.com]

2.6 HK_SCAM_N13 BODY: No description available.

2.5 HK_SCAM_N2 BODY: No description available.

1.1 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.218.68 listed in wl.mailspike.net]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

2.0 HK_SCAM No description available.

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 XFER_LOTSA_MONEY Transfer a lot of money

3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} HELLOO..

X-Antivirus: AVG (VPS 230527-6, 5/27/2023), Inbound message

X-Antivirus-Status: Clean



--

My name is Madam Anithar Saliba. I am working with one of the prime banks

here in Burkina Faso. Here in this bank existed a dormant account for

many years, which belong to one of our late foreign customer Mr.

Moises Saba Masri from Mexico.



When I discovered that there had been neither deposits nor withdrawals

from this account for this long period, I decided to carry out a

system investigation and discovered that none of the family member or

relations of the late person are aware of this account, which means

nobody will come to take it.



The amount in this account stands at $18,300, 000.00 (Eighteen Million

Three Hundred Thousand USA Dollars). I want a foreign account where

the bank will transfer this fund, I will front you in the bank as the

Next of Kin to the late customer and back you up with relevant

information.



What the bank need is proof and information about the late customer

which I will assist you on. his is a genuine, risk free and legal

business transaction, All details shall be sent to you once I hear

from you.



The information as contained herein be accorded the necessary

attention, urgency as well as the secrecy it deserves.



If you are really sure of your integrity, trustworthy and

confidentiality reply back to me urgently through my private email

here: ( anitharsaliba75@gmail.com ).



Best regards,

Madam Anithar Saliba.