Loan spam offer from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 22 Jun 2024 09:37:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1sL2nA-00000000JCc-3F0g
for dave@doctor.nl2k.ab.ca;
Sat, 22 Jun 2024 09:36:40 -0600
Resent-From: The Doctor
Resent-Date: Sat, 22 Jun 2024 09:36:40 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-lf1-f66.google.com ([209.85.167.66]:44096)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1sL2bn-00000000Gew-1x7G
for doctor@doctor.nl2k.ab.ca;
Sat, 22 Jun 2024 09:25:08 -0600
Received: by mail-lf1-f66.google.com with SMTP id 2adb3069b0e04-52cd9f9505cso1636521e87.0
for; Sat, 22 Jun 2024 08:23:00 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1719069774; x=1719674574; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=djR8FnmY1J3ilXnknACexIIFkea5wENbKrGtuE2ljlc=;
b=mBD6GXyOw2mOUjy8kOziat20j/b2OC7sdMQWhjr5C1Bm/2Cnba7zpPl3jciN0dd9vD
CTX1ZwwcGgOT+8g1Dv/1EZ6XhtWoJTEdZFgz3pBATFEfB47JwxUk4Bgxo9E7hFHxJom1
BPgQDFviIGGTpFcoLiknSvLpLSK+05chA792qgsOrY786CyKk6D+KmoiFcV4cPjyLJ4E
VWfSih2ypKgYExBhG3e4B2iC5ffrDhgZXbmu/C/z+WW18l5NZbklq4zyI5P+0NDzfhii
Z5sGSGcr5IDGdgOAA23kJRmlF6DDUZ7ij4Pr7L/tRDZfYJ/DPi2t6t3zfnWMHBYIMTtD
n1ag==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1719069774; x=1719674574;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=djR8FnmY1J3ilXnknACexIIFkea5wENbKrGtuE2ljlc=;
b=aNKT1gjV+ixMmAg6xtys7h02IIdPDGpq61s5Gyn5Ox+WJALYrq9p2Lj2BEQimR0tLU
hUyQcbajeWB6f8eYWKGBShLivBDE1cbTfy64LYRWFCAL1bZl4rQXbr5IXMFxd2259M24
1LcUxTVVlXOzZ6jJfwwA0xaUeOeqv+Isr6qb4LcIbfAwk/riDUFQ6NG5UokoRAgvxyq+
USNAc+/I0yboeMS7QCRwmwbEhRGOAscmnwqVoqm3HstaIwlNxbnF4jDO8q92QzCSzcwa
EttI4vCXpoKa0AacUMSROjVnjFdpTvfVHPInI7a0diAEH7pLwyY8gEOxXw7H4SjfoE9Y
tWvQ==
X-Forwarded-Encrypted: i=1; AJvYcCVZCEHP+g9wtIs75ySvDZWWa20dPCBapQsMKND3ARn3/Koogjh3vdYCpaz8um3RenqSB4UG7mJhwjdo/6g6PLLMVneBWaFA2Ec=
X-Gm-Message-State: AOJu0YxbWhAjqi8E//eyhrBdyrxpzxX58tRSCTX720r2i8mZP1wSmHQs
7VXxACJcQdv1io3va/7rqD8gcaqZwpnB4/ZTFeZXhwKkrGVdUytBYIJq8QtAPB+CZs+1GIGKwRS
Bf24DDfR+7JGqvFMQx7n0hS5K0PzEEwopwdEOyg==
X-Google-Smtp-Source: AGHT+IFCypQl727UIG7ErlUOayCvF/cRLaZBftJ9j4PpfSR9N02fbbAb5+Q7Fs8aQ/eZ99qhINR9zVVArQnP3HsisOE=
X-Received: by 2002:a05:6512:48f:b0:52c:8920:875 with SMTP id
2adb3069b0e04-52cdf7f164cmr586565e87.20.1719069319841; Sat, 22 Jun 2024
08:15:19 -0700 (PDT)
MIME-Version: 1.0
Reply-To: moussaahmed.loan15@gmail.com
From: Ahmed Moussa
Date: Sat, 22 Jun 2024 07:15:10 -0800
Message-ID:
Subject: LOAN OFFER
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000275307061b7c04b0"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 15.1
X-Spam_score_int: 151
X-Spam_bar: +++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Sheikh Tamim Bin Hamad Finance House Al Maha Building, 29,
Al Rida Street, Fereej Bin Omran, Doha. Qatar. Dear, My name is Mr. Moussa
Ahmed, the financial Consultant, Sheikh Tamim Bin Hamad Finance House; we
are independent financial advisors offering high quality and independent
financial services for gulf reg [...]
Content analysis details: (15.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.167.66 listed in dnsbl.ahbl.org]
[209.85.167.66 listed in dnsbl.ahbl.org]
[209.85.167.66 listed in dnsbl.ahbl.org]
[209.85.167.66 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.167.66 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.167.66 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.167.66 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.167.66 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.167.66 listed in list.dnswl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.167.66 listed in will-spam-for-food.eu.org]
[209.85.167.66 listed in will-spam-for-food.eu.org]
[209.85.167.66 listed in will-spam-for-food.eu.org]
[209.85.167.66 listed in will-spam-for-food.eu.org]
[209.85.167.66 listed in will-spam-for-food.eu.org]
[209.85.167.66 listed in will-spam-for-food.eu.org]
[209.85.167.66 listed in will-spam-for-food.eu.org]
[209.85.167.66 listed in will-spam-for-food.eu.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.167.66 listed in wl.mailspike.net]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[moussaahmed.loan7540(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[moussaahmed.loan15(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[moussaahmed.loan7540(at)gmail.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.0 HTML_MESSAGE BODY: HTML included in message
3.1 DEAR_NOBODY RAW: Message contains Dear but with no name
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to
Subject: {SPAM?} LOAN OFFER
--000000000000275307061b7c04b0
Content-Type: text/plain; charset="UTF-8"
Sheikh Tamim Bin Hamad Finance House
Al Maha Building, 29, Al Rida Street, Fereej Bin Omran, Doha.
Qatar.
Dear,
My name is Mr. Moussa Ahmed, the financial Consultant, Sheikh Tamim Bin
Hamad Finance House; we are independent financial advisors offering high
quality and independent financial services for gulf region residents and
expatriates living abroad.
We offer corporate and personal loans at 3% interest rate for the duration
of (fifteen 15 years) available for both gulf residents and expatriates or
business owners worldwide.
We also have 1% commission for all our brokers worldwide who introduce
business and project owners for finance or other opportunities.
Kindly keep me posted if you are interested in more details.
Till then please keep enjoying your day.
Regards,
Moussa Ahmed
Financial Consultant
Sheikh Tamim Bin Hamad Finance House
--000000000000275307061b7c04b0
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
nature" data-smartmail=3D"gmail_signature">
=3D"times new roman, serif" size=3D"4">
times new roman, serif" size=3D"4">Sheikh Tamim Bin Hamad Finance House
nt>
ce=3D"times new roman, serif" size=3D"4">Qatar.
=3D"times new roman, serif" size=3D"4">
times new roman, serif" size=3D"4">Dear,
es new roman, serif" size=3D"4">
ew roman, serif" size=3D"4">My name is Mr. Moussa Ahmed, the financial Cons=
ultant, Sheikh Tamim Bin Hamad Finance House; we are independent financial =
advisors offering high quality and independent financial services for gulf =
region residents and expatriates living abroad.=C2=A0=C2=A0
v>
ont face=3D"times new roman, serif" size=3D"4">We offer corporate and perso=
nal loans at 3% interest rate for the duration of (fifteen 15 years) availa=
ble for both gulf residents and expatriates or business owners worldwide.=
font>
>
=3D"times new roman, serif" size=3D"4">
times new roman, serif" size=3D"4">Kindly keep me posted if you are interes=
ted in more details.=C2=A0=C2=A0
oman, serif" size=3D"4">
, serif" size=3D"4">Till then please keep enjoying your day.
iv>
iv>Financial Consultant
ont>
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 22 Jun 2024 09:37:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1sL2nA-00000000JCc-3F0g
for dave@doctor.nl2k.ab.ca;
Sat, 22 Jun 2024 09:36:40 -0600
Resent-From: The Doctor
Resent-Date: Sat, 22 Jun 2024 09:36:40 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-lf1-f66.google.com ([209.85.167.66]:44096)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1sL2bn-00000000Gew-1x7G
for doctor@doctor.nl2k.ab.ca;
Sat, 22 Jun 2024 09:25:08 -0600
Received: by mail-lf1-f66.google.com with SMTP id 2adb3069b0e04-52cd9f9505cso1636521e87.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1719069774; x=1719674574; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=djR8FnmY1J3ilXnknACexIIFkea5wENbKrGtuE2ljlc=;
b=mBD6GXyOw2mOUjy8kOziat20j/b2OC7sdMQWhjr5C1Bm/2Cnba7zpPl3jciN0dd9vD
CTX1ZwwcGgOT+8g1Dv/1EZ6XhtWoJTEdZFgz3pBATFEfB47JwxUk4Bgxo9E7hFHxJom1
BPgQDFviIGGTpFcoLiknSvLpLSK+05chA792qgsOrY786CyKk6D+KmoiFcV4cPjyLJ4E
VWfSih2ypKgYExBhG3e4B2iC5ffrDhgZXbmu/C/z+WW18l5NZbklq4zyI5P+0NDzfhii
Z5sGSGcr5IDGdgOAA23kJRmlF6DDUZ7ij4Pr7L/tRDZfYJ/DPi2t6t3zfnWMHBYIMTtD
n1ag==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1719069774; x=1719674574;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=djR8FnmY1J3ilXnknACexIIFkea5wENbKrGtuE2ljlc=;
b=aNKT1gjV+ixMmAg6xtys7h02IIdPDGpq61s5Gyn5Ox+WJALYrq9p2Lj2BEQimR0tLU
hUyQcbajeWB6f8eYWKGBShLivBDE1cbTfy64LYRWFCAL1bZl4rQXbr5IXMFxd2259M24
1LcUxTVVlXOzZ6jJfwwA0xaUeOeqv+Isr6qb4LcIbfAwk/riDUFQ6NG5UokoRAgvxyq+
USNAc+/I0yboeMS7QCRwmwbEhRGOAscmnwqVoqm3HstaIwlNxbnF4jDO8q92QzCSzcwa
EttI4vCXpoKa0AacUMSROjVnjFdpTvfVHPInI7a0diAEH7pLwyY8gEOxXw7H4SjfoE9Y
tWvQ==
X-Forwarded-Encrypted: i=1; AJvYcCVZCEHP+g9wtIs75ySvDZWWa20dPCBapQsMKND3ARn3/Koogjh3vdYCpaz8um3RenqSB4UG7mJhwjdo/6g6PLLMVneBWaFA2Ec=
X-Gm-Message-State: AOJu0YxbWhAjqi8E//eyhrBdyrxpzxX58tRSCTX720r2i8mZP1wSmHQs
7VXxACJcQdv1io3va/7rqD8gcaqZwpnB4/ZTFeZXhwKkrGVdUytBYIJq8QtAPB+CZs+1GIGKwRS
Bf24DDfR+7JGqvFMQx7n0hS5K0PzEEwopwdEOyg==
X-Google-Smtp-Source: AGHT+IFCypQl727UIG7ErlUOayCvF/cRLaZBftJ9j4PpfSR9N02fbbAb5+Q7Fs8aQ/eZ99qhINR9zVVArQnP3HsisOE=
X-Received: by 2002:a05:6512:48f:b0:52c:8920:875 with SMTP id
2adb3069b0e04-52cdf7f164cmr586565e87.20.1719069319841; Sat, 22 Jun 2024
08:15:19 -0700 (PDT)
MIME-Version: 1.0
Reply-To: moussaahmed.loan15@gmail.com
From: Ahmed Moussa
Date: Sat, 22 Jun 2024 07:15:10 -0800
Message-ID:
Subject: LOAN OFFER
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000275307061b7c04b0"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 15.1
X-Spam_score_int: 151
X-Spam_bar: +++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Sheikh Tamim Bin Hamad Finance House Al Maha Building, 29,
Al Rida Street, Fereej Bin Omran, Doha. Qatar. Dear, My name is Mr. Moussa
Ahmed, the financial Consultant, Sheikh Tamim Bin Hamad Finance House; we
are independent financial advisors offering high quality and independent
financial services for gulf reg [...]
Content analysis details: (15.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.167.66 listed in dnsbl.ahbl.org]
[209.85.167.66 listed in dnsbl.ahbl.org]
[209.85.167.66 listed in dnsbl.ahbl.org]
[209.85.167.66 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.167.66 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.167.66 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.167.66 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.167.66 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.167.66 listed in list.dnswl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.167.66 listed in will-spam-for-food.eu.org]
[209.85.167.66 listed in will-spam-for-food.eu.org]
[209.85.167.66 listed in will-spam-for-food.eu.org]
[209.85.167.66 listed in will-spam-for-food.eu.org]
[209.85.167.66 listed in will-spam-for-food.eu.org]
[209.85.167.66 listed in will-spam-for-food.eu.org]
[209.85.167.66 listed in will-spam-for-food.eu.org]
[209.85.167.66 listed in will-spam-for-food.eu.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.167.66 listed in wl.mailspike.net]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[moussaahmed.loan7540(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[moussaahmed.loan15(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[moussaahmed.loan7540(at)gmail.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.0 HTML_MESSAGE BODY: HTML included in message
3.1 DEAR_NOBODY RAW: Message contains Dear but with no name
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to
Subject: {SPAM?} LOAN OFFER
--000000000000275307061b7c04b0
Content-Type: text/plain; charset="UTF-8"
Sheikh Tamim Bin Hamad Finance House
Al Maha Building, 29, Al Rida Street, Fereej Bin Omran, Doha.
Qatar.
Dear,
My name is Mr. Moussa Ahmed, the financial Consultant, Sheikh Tamim Bin
Hamad Finance House; we are independent financial advisors offering high
quality and independent financial services for gulf region residents and
expatriates living abroad.
We offer corporate and personal loans at 3% interest rate for the duration
of (fifteen 15 years) available for both gulf residents and expatriates or
business owners worldwide.
We also have 1% commission for all our brokers worldwide who introduce
business and project owners for finance or other opportunities.
Kindly keep me posted if you are interested in more details.
Till then please keep enjoying your day.
Regards,
Moussa Ahmed
Financial Consultant
Sheikh Tamim Bin Hamad Finance House
--000000000000275307061b7c04b0
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
nature" data-smartmail=3D"gmail_signature">
=3D"times new roman, serif" size=3D"4">
times new roman, serif" size=3D"4">Sheikh Tamim Bin Hamad Finance House
nt>
Al Maha Buil=
ding, 29, Al Rida Street, Fereej Bin Omran, Doha.
ding, 29, Al Rida Street, Fereej Bin Omran, Doha.
ce=3D"times new roman, serif" size=3D"4">Qatar.
=3D"times new roman, serif" size=3D"4">
times new roman, serif" size=3D"4">Dear,
es new roman, serif" size=3D"4">
ew roman, serif" size=3D"4">My name is Mr. Moussa Ahmed, the financial Cons=
ultant, Sheikh Tamim Bin Hamad Finance House; we are independent financial =
advisors offering high quality and independent financial services for gulf =
region residents and expatriates living abroad.=C2=A0=C2=A0
v>
ont face=3D"times new roman, serif" size=3D"4">We offer corporate and perso=
nal loans at 3% interest rate for the duration of (fifteen 15 years) availa=
ble for both gulf residents and expatriates or business owners worldwide.=
font>
>
We also have 1=
% commission for all our brokers worldwide who introduce business and proje=
ct owners for finance or other opportunities.
% commission for all our brokers worldwide who introduce business and proje=
ct owners for finance or other opportunities.
=3D"times new roman, serif" size=3D"4">
times new roman, serif" size=3D"4">Kindly keep me posted if you are interes=
ted in more details.=C2=A0=C2=A0
oman, serif" size=3D"4">
, serif" size=3D"4">Till then please keep enjoying your day.
iv>
<=
font face=3D"times new roman, serif" size=3D"4">Regards,
font face=3D"times new roman, serif" size=3D"4">Regards,
<=
font face=3D"times new roman, serif" size=3D"4">Moussa Ahmed
font face=3D"times new roman, serif" size=3D"4">Moussa Ahmed
iv>Financial Consultant
ont>
Sheikh Tami=
m Bin Hamad Finance House
m Bin Hamad Finance House
v>
--000000000000275307061b7c04b0--