Nigerian spam from Google Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jul 2024 10:50:00 -0600

Received: from mail-ed1-f51.google.com ([209.85.208.51]:46086)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1sVDGa-000000009ez-1WgV

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jul 2024 10:49:08 -0600

Received: by mail-ed1-f51.google.com with SMTP id 4fb4d7f45d1cf-5a10bb7b237so2119266a12.0

for ; Sat, 20 Jul 2024 09:47:09 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1721494023; x=1722098823; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:in-reply-to:references

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=ZEgpHqie6U1sGpAclZpzBQxoImQkUb7xbRzzbn1gez4=;

b=GXyMrxFE1kg1FBPtz8XVmAldClc4bN3/Ulsh/+JmP6YaiCOQPZ4K6HQnkxejRW2ekW

/afpkjUZ5vi9O0E4lYbPTq1lkmTe6H8TIJcNtPDub7rkpYCLtfxqvzQyZVOqimGKqfHY

5qmIuX0tI9BXDQZAQg8ochyqfR0MhtQV2JgspqD0xVb2JoPXuASv6Uh95feylYLucLq5

aKtA5HfSJj5HXrpuLxVV03DAS365tRHIjTsOPB3mXA0rjNM9vurDorgtFJQbDf7mwY2K

tu7f00y+1+131/VbQOs7O8ZZY2H7l5yL8iK8viSGFUfnZSnoCsuk1WCHXxWfFTIdszSf

O0Og==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1721494023; x=1722098823;

h=to:subject:message-id:date:from:reply-to:in-reply-to:references

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=ZEgpHqie6U1sGpAclZpzBQxoImQkUb7xbRzzbn1gez4=;

b=Yddyy1OJs8D2o9bt1HBCO8QYslnlKAey6QT9gDGbZWmZNSKR6WHEohYAVi0tpGpxvV

axsrE/kCW1lgBHfFavcDF31x3dUC9Cqi/UJl0LXCGSbylDQOjK7qIovlNv9DNT8KMlV3

0A5/jphnJCIC4wwTJNwcwC3r+A3zVtt68Lp0JSCuhClVWE0j429PIKzryASkU2bmC8q4

8MRIjD7ID8QgoNOStTO+lTS2gKisNQT7/KocmtWhWKsRrINkjMAuJnLoH9HO50YYE7e0

g3OK3yxROObnR2utLh8TN0GfqffyDAxiCz9vr63G4pZQ/4G26+/i0eHZ6EaLCLuW4307

hDNQ==

X-Forwarded-Encrypted: i=1; AJvYcCVBCigEhcK4XxsJo0ejNm05RRiJviPbDNf94uWBSjfjSFcSoZ4Vm5ILA+Y5j1kWt0WcI1ih8O3JPvbhxQRc/JKbBAOBeofi

X-Gm-Message-State: AOJu0YyLO+6uaE0JlRW8PChSgQzrhJVcaEQLYCtn/uYHGr0MOij6WCN8

/BNXPPUWMjmYR80dfCLGWTQF17IxQllNJbInIFCqfSSDu99/eOQ3KP12fyNuEzCmaztQFME0jNQ

wymD8bvvnlDNvA0xwFWpoZ3bYumA=

X-Google-Smtp-Source: AGHT+IEqIbiU6vNlo/v+FHQxOo9QnJDL/E5HMLZUwxUYFvhAJ7TylaAz0tU64fvQCmic749YA+9byNCeH/QXCuvXpWY=

X-Received: by 2002:a50:bb6c:0:b0:5a2:c750:f47d with SMTP id

4fb4d7f45d1cf-5a479f562c6mr1110720a12.12.1721494022742; Sat, 20 Jul 2024

09:47:02 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

Reply-To: cfc.ubagroup02@gmail.com

From: kristalina georgieva

Date: Sat, 20 Jul 2024 17:44:03 +0100

Message-ID:

Subject: Attention please

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000b569ed061db08f30"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 16.0

X-Spam_score_int: 160

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Beneficiary, I sent this letter to you a month ago, but

I did not hear from you, I'm not sure if you got it, And that is why I sent

it again, Firstly, I'm Mrs. Kristalina Georgieva, Managing Dire [...]



Content analysis details: (16.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.51 listed in dnsbl.ahbl.org]

[209.85.208.51 listed in dnsbl.ahbl.org]

[209.85.208.51 listed in dnsbl.ahbl.org]

[209.85.208.51 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.51 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.51 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.51 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.51 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.51 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.51 listed in list.dnswl.org]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[carlsmith3241(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[carlsmith3241(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[cfc.ubagroup02(at)gmail.com]

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 LOTS_OF_MONEY Huge... sums of money

3.1 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

0.7 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Attention please



--000000000000b569ed061db08f30

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Dear Beneficiary,

I sent this letter to you a month ago, but I did not hear from you, I'm not

sure if you got it, And that is why I sent it again, Firstly, I'm Mrs.

Kristalina Georgieva, Managing Director and Chairwoman of the International

Monetary Fund.



Indeed We have reviewed all the obstacles and problems surrounded your

uncompleted transaction and your inability to meet up with transfer charges

levied, against you, for the past transfer options, view our site for your

confirmation 38=C2=B053=E2=80=B256=E2=80=B3N 77=C2=B02=E2=80=B239=E2=80=B3W



We are the Board of Directors, World Bank and International Monetary Fund

(IMF) Washington, D.C. in conjunction with The U.S. Department of the

Treasury and some other relevant Investigation Agencies here in the United

States of America. has ordered our Foreign Payment Remittance Unit, United

Bank of Africa Lome Togo to issue you a VISA Card, where your fund $1.5

million will be uploaded, for further withdrawal of your fund.



During the course of our investigation, we discovered with dismay that your

payment has been delayed by corrupt officials of the Bank who are Trying to

divert your funds into their private accounts.



And today we notify you that your fund has been credited into a VISA Card

by UBA Bank and also ready to be delivered. Now contact UBA Bank director

his name is Mr. Tony Elumelu, email: (cfc.ubagroup02@gmail.com) to direct

you on how to receive your ATM VISA card.



Sincerely,



Mrs. Kristalina Georgieva



--000000000000b569ed061db08f30

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Dear Beneficiary, =C2=A0

v dir=3D"ltr">I sent this letter to you a month ago, but I did not hear fro=

m you, I'm not sure if you got it, And that is why I sent it again, Fir=

stly, I'm Mrs. Kristalina Georgieva, Managing Director and Chairwoman o=

f the International Monetary Fund.

Indeed We have reviewed all the o=

bstacles and problems surrounded your uncompleted transaction and your inab=

ility to meet up with transfer charges levied, against you, for the past tr=

ansfer options, view our site for your confirmation 38=C2=B053=E2=80=B256=

=E2=80=B3N 77=C2=B02=E2=80=B239=E2=80=B3W

We are the Board of Direct=

ors, World Bank and International Monetary Fund (IMF) Washington, D.C. in c=

onjunction with The U.S. Department of the Treasury and some other relevant=

Investigation Agencies here in the United States of America. has ordered o=

ur Foreign Payment Remittance Unit, United Bank of Africa Lome Togo to issu=

e you a VISA Card, where your fund $1.5 million will be uploaded, for furth=

er withdrawal of your fund.

During the course of our investigation, =

we discovered with dismay that your payment has been delayed by corrupt off=

icials of the Bank who are Trying to divert your funds into their private a=

ccounts.

And today we notify you that your fund has been credited in=

to a VISA Card by UBA Bank and also ready to be delivered. Now contact UBA =

Bank director his name is Mr. Tony Elumelu, email: (
bagroup02@gmail.com" target=3D"_blank">cfc.ubagroup02@gmail.com
) to dir=

ect you on how to receive your ATM VISA card.

Sincerely,

Mrs.=

Kristalina Georgieva






--000000000000b569ed061db08f30--

Ukrainian dating spam from Microsoft Outlook

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jul 2024 07:35:00 -0600

Received: from mail-psaapc01olkn2043.outbound.protection.outlook.com ([40.92.52.43]:9647 helo=APC01-PSA-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1sVADj-000000005UH-2yGi

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jul 2024 07:34:00 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=L2MHaHbXMX2Fo9zaXWl2/cWgQMQXc7/T7WTsWpn7m7t24OK+/UvKFUZiQM8NJ+11lY5axEk+vB7GZOnd8pymilZE5KUVxAmaeFe7+DTefNowetF7gwXEH3HxeLrrc9MVDl5eILiiAFAtoODux1wUxc7nRlf8izKs80o0d0lRlQg6LhmUQHcc9Z0RqFhYueVJcz8UFBABNbtDIkLkNVTXWLWD09ZEMUSJlu4EDcVm1YqQkbnGtctof9GhiDCFs9FFMH7xVl9xCYSOmLsrn4XRnUM+7u8OUUc+eRE90I39Ws919lhhnjqcXbyLYu0JV4j0OT/hcveakSJgEXoxv7Pf2Q==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=2iYhFcEUL6BnQW3oCkBwrRl8mIeYNB75blXFxJGnEjg=;

b=qslm7vt0+GY/PD2pR/NNaKR59SbGyYhDu+z3SNhxVLbJuq4vX4vLId0kNgu/nrmUSC7XMqecswhuNSCHJzAeHrq3eozC72mbTNpPiE3xZl0vVv7jvxSNV8n2mFPdZLsjimwPLcV7epfuin5bBOkyKHO2GQ8slDhaTVpGr8g5e6O0crtPv8airzurOgBVZCRCcBa0Vf1iomJHaDomd4DTLL87Y9x0xPKIegHNPNkCpRd7slCvFYW7MIW6+ShfCEhbVsBh+9cxn8hbGRn0CfXklKBbSAJMyzacNHEC1v33X9FTAJr//bupqBTyp8xuMuIM9HPInSES5K9r7jBCRqpwKw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=2iYhFcEUL6BnQW3oCkBwrRl8mIeYNB75blXFxJGnEjg=;

b=MrK/EoDofCxYpZZOEq12/KcK1u00UGs+1hdAQQ5r3cal1F63uc0epefjLvKUE+OFA63w7gHX6TcxhT+IXRJaVVVTIpYzOEskvXzckQARAuaMV5g7qekP4l2CtL77Bt3zV25lvZ6XBv5iY/vC06vYWEBv1sW9w9Sd61pkZWRYkOj0tFMcXjV6PzV3Tc/5XghEHZ9rQoa2Txefg6SqKl4nDZ5f3T33uAytHitwQ68mB/c3vi0/cWPCesI1IvnoxueUXP8SsSS15WKzDfQfln7LW5L3wHeKLE85OyR7HqHeV4zBOH0jXBkb+aCQ0yxWbxfaE5WCw497y/8M3Qqxsm11fw==

Received: from PUZPR04MB5397.apcprd04.prod.outlook.com (2603:1096:301:a4::13)

by SEZPR04MB7902.apcprd04.prod.outlook.com (2603:1096:101:231::9) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7807.8; Sat, 20 Jul

2024 13:30:51 +0000

Received: from PUZPR04MB5397.apcprd04.prod.outlook.com

([fe80::d620:5644:2d5d:96a8]) by PUZPR04MB5397.apcprd04.prod.outlook.com

([fe80::d620:5644:2d5d:96a8%5]) with mapi id 15.20.7807.005; Sat, 20 Jul 2024

13:30:51 +0000

Content-Type: multipart/alternative; boundary="===============3823538353311800247=="

Subject: Your Perfect Match Is Waiting

From:

CC:

Date: Sat, 20 Jul 2024 13:29:15 +0000

X-TMN: [z+kFWRs+RQqYj0VQAYYXk+PGVAoUAhgZ]

X-ClientProxiedBy: VI1PR02CA0053.eurprd02.prod.outlook.com

(2603:10a6:802:14::24) To PUZPR04MB5397.apcprd04.prod.outlook.com

(2603:1096:301:a4::13)

Message-ID:



MIME-Version: 1.0

X-MS-Exchange-MessageSentRepresentingType: 1

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: PUZPR04MB5397:EE_|SEZPR04MB7902:EE_

X-MS-Office365-Filtering-Correlation-Id: 4a8291ee-e197-47a0-a9ae-08dca8c02b2d

X-Microsoft-Antispam:

BCL:0;ARA:14566002|1680799051|8060799006|9000799047|9400799024|19110799003|461199028|42300799015|12050799009|56899033|3412199025|4302099013|1602099012|440099028|4601999012|2406899039|1710799026;

X-Microsoft-Antispam-Message-Info:

=?us-ascii?Q?Gl+665Klf/UCIW2QCGcnFt2aSYO65mYTSyX564SbskPXRVanoVYV4NJMk6Ja?=

=?us-ascii?Q?X7zLxHUe9NmJVbABNA0wtI5fJOM0wCJiWjyXI1vX6xkeOt8JlcziHUmvM3qL?=

=?us-ascii?Q?s1ZPYs74GWx3zgemPzTDjPKolOjAhkqYXCdBbgoPw01DeV2aWPafm+tBaSOs?=

=?us-ascii?Q?g86PL++J3X4vHhKByjyMR3bwg9wYJZlsAexRJmtwSnRoWiAEEGsvi7Zq2+tf?=

=?us-ascii?Q?uJE70haMKWGhsFjXuEacJCoJNvrOJ50R/lCWeY+FQJmSAy9aLmj4DdY+jlTT?=

=?us-ascii?Q?gkYDs/2qs61iqvGclr3VoMaC2465ryzVnli1vfhx4SW7ew0TVb+g62rJ2pFC?=

=?us-ascii?Q?4sEThI69uct6FqdQthSB6VA5SGYM/lTStDFOvsubMlScYLo5Cj6U/YcMgAjc?=

=?us-ascii?Q?xnHze7Yx48AW6HXCehE+bcag8KZY7/nvpve83JvKT8Z4tN2k2ZgqeHkik7fV?=

=?us-ascii?Q?2fe7mB+7I+zJV4q5askVG4PWR68RbPpqDxurNJRZhrNFoAxyXPW5HZgS161t?=

=?us-ascii?Q?x7FBuGF8kAg6jph8JDIiAsdAfOfTAVaw7iwzHf+XkOHlYVKvh9XL8W2phJ4o?=

=?us-ascii?Q?JtoJcdfUo8KPR+i/MVAtJmM7kjd+vEhJTyycIXJwNYlG94G6QrLMX7Mi2VMe?=

=?us-ascii?Q?HXDHyzWwQkMKxlTn8GcXcp+BXdluwEGZbABdILyYDBRWD+qgYlsclQsBZ7kS?=

=?us-ascii?Q?o2BcAoLMtDp+sIE0MWwGJqOYejcE2BnyuHjYOumcrmAmmuWuYXlTrG2a+8f/?=

=?us-ascii?Q?sWuUg/VgQ6CdjzGNsvqsuBrMv0rhKHO8P6ZHQnfxNwNWqfLlOdwdz3eg1J3M?=

=?us-ascii?Q?FzpVRqn5uRKyDEibn47lq7X0FbKps/vXxrk5VAdkq9IhMdrjzK/nPknztxjx?=

=?us-ascii?Q?55ZfwlQluH7rlr/R8DiDchH6PUUU3maP2XwVm4IMMYsQ70OXYFP6JvxNzFTV?=

=?us-ascii?Q?HyF+r45tJ3TSGU0Cq7hZLg=3D=3D?=

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?us-ascii?Q?0juiwWPWlI81mskFHR9mODU6ejq/f2iTHNPwO3uf9uI/9UtTHXR50JCrHsgW?=

=?us-ascii?Q?1AFLE8/TtSvWiwOO1YZxgnoxXUtAwV54Sl+uh5wyWwxiJqlysI3R2mcbw+ZT?=

=?us-ascii?Q?35F3J+sJoYDvrkOQMoHz0/Qk8uWSk2eTyasSFmoF3X1CHcvGBup4NrSc8Q0R?=

=?us-ascii?Q?kEWblaCJgStt6zD3ZdtvAT4h6FE6XZ+qp3qDThKCRWDMyocKwU9+noaZtsOv?=

=?us-ascii?Q?jFZXxxAurkIKo5ZnrqqLxAQSO20rhLlN62ZxdATIV9RhSYzcwxIAC+jPvrz9?=

=?us-ascii?Q?hFXkPCXf+tvuuEe9OLYSdmHQde5tOXKoPqbsKe44Wgh9SPRvvJ/pChx40J1U?=

=?us-ascii?Q?hvLAMdN3elXJTOgt7dwW25/Pkgoew6qpyfEGRXMEQKQmuBg6czjXGK3+FK1G?=

=?us-ascii?Q?QRtXoc6PBOgwoVNCKGMaensr5h0KKiE48Rvw9zz+4W/KUmCM/FkqwtnhzKZ/?=

=?us-ascii?Q?OAf9c1P9+CKzZ4cc3pA04vaXwPGymb1tWHqhb8d/uKDOInjh/iPK+U4M8ts2?=

=?us-ascii?Q?OUZqLx2O5TAyvo4PlXNXD2TzbyShmF7NpQVZCKdF7UkQW6eN7zSdOwMusta6?=

=?us-ascii?Q?P5TYC9lRFIdtFFVnV8SrFs90cDKmwZ2SX5p8gg1GJJixfB3zhCnAyBwq3XIu?=

=?us-ascii?Q?qm/l1MVSqKhs7MhVjc4B8HWWxgX7YB3MQtKpC5O3WDGv6NNBIrIsk0prsPuY?=

=?us-ascii?Q?hqiGmydLMjjLpaqds2Ubxr7kljhFSlpza70hgbS4veOASKUvrkGtfwG5VXjT?=

=?us-ascii?Q?Fl+4XyWI3mquMJLmWWXWRR724kTb/VPV/AmxPpbuDoKdoGjGrbUrVsYPL2p5?=

=?us-ascii?Q?o9q8mNT0vGYmEgmrj7jj07u65LG68z6U7mkGy7/6e1jAwkmNYmdytQ/G2k1d?=

=?us-ascii?Q?iDUsi8Erl9ukNSQ5z+CwPhn3dQMimpCUzFivkmhkCxY3Abey/rtr1OZRWsca?=

=?us-ascii?Q?CWsrDhtHBFAoTv/ZRqZRk6RXmerTpc5dJZf4QY4oDyx7Fd8vDAXvpqwCDdEj?=

=?us-ascii?Q?YsPLoYxMA6MRomYx7kgzrsvXdXTy1dM8HVb07LrnHR09nBja/vCwKQFyuXBO?=

=?us-ascii?Q?YuH7owyM8vJ8sqSrOJJQeM+7qdSYr0KEB0EIE4KL9dcm9ZI/5zOgOr+YMkv5?=

=?us-ascii?Q?AS/dYD7nNAX3K8/03rkUyO7n4DvAqwfJathoOAMcf9RxDCDp2yBKIPvs50cy?=

=?us-ascii?Q?NCRT9H4dWpMsli/i9g1aNa+zqjR3KnbR5T30hO/8dgnUk9QCevnLDR8rgYoV?=

=?us-ascii?Q?LJHnMhP6docx/wb6v3Ys?=

X-OriginatorOrg: sct-15-20-7719-19-msonline-outlook-4bae0.templateTenant

X-MS-Exchange-CrossTenant-Network-Message-Id: 4a8291ee-e197-47a0-a9ae-08dca8c02b2d

X-MS-Exchange-CrossTenant-AuthSource: PUZPR04MB5397.apcprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Jul 2024 13:30:50.1860

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:

00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SEZPR04MB7902

X-Spam_score: 16.0

X-Spam_score_int: 160

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: If you are looking for a Ukrainian woman to start a relationship

with, you are in luck! Many Ukrainian women turn to online dating sites to

find a compatible partner. These women are intelligent, attr [...]



Content analysis details: (16.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.92.52.43 listed in dnsbl.ahbl.org]

[40.92.52.43 listed in dnsbl.ahbl.org]

[40.92.52.43 listed in dnsbl.ahbl.org]

[40.92.52.43 listed in dnsbl.ahbl.org]

[2603:1096:301:a4:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:1096:301:a4:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:1096:301:a4:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:1096:301:a4:0:0:0:13 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.92.52.43 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.92.52.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.92.52.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.92.52.43 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[40.92.52.43 listed in will-spam-for-food.eu.org]

[40.92.52.43 listed in will-spam-for-food.eu.org]

[40.92.52.43 listed in will-spam-for-food.eu.org]

[40.92.52.43 listed in will-spam-for-food.eu.org]

[40.92.52.43 listed in will-spam-for-food.eu.org]

[40.92.52.43 listed in will-spam-for-food.eu.org]

[40.92.52.43 listed in will-spam-for-food.eu.org]

[40.92.52.43 listed in will-spam-for-food.eu.org]

[2603:1096:301:a4:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:1096:301:a4:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:1096:301:a4:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:1096:301:a4:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:1096:301:a4:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:1096:301:a4:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:1096:301:a4:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:1096:301:a4:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.92.52.43 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.92.52.43 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.0 ARC_SIGNED Message has a ARC signature

0.0 ARC_VALID Message has a valid ARC signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[garretmarch6oj(at)hotmail.com]

1.2 MISSING_HEADERS Missing To: header

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.6 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image area

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: clck.ru]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: clck.ru]

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} Your Perfect Match Is Waiting



--===============3823538353311800247==

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: 7bit



If you are looking for a Ukrainian woman to start a relationship with, you are in luck! Many Ukrainian women turn to online dating sites to find a compatible partner. These women are intelligent, attractive and have strong family values. They are looking for men who share their interests and are ready to enter into a serious relationship. On our dating site you can browse the profiles of these beautiful women and start a conversation with them. Your perfect partner could be just a click away!

 

CHAT NOW 

 

 

 

 

 

 

 

 

 

Click hereto unsubscribe.



--===============3823538353311800247==--

Nigerian spam from Google Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jul 2024 10:50:00 -0600

Received: from mail-ed1-f51.google.com ([209.85.208.51]:46086)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1sVDGa-000000009ez-1WgV

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jul 2024 10:49:08 -0600

Received: by mail-ed1-f51.google.com with SMTP id 4fb4d7f45d1cf-5a10bb7b237so2119266a12.0

for ; Sat, 20 Jul 2024 09:47:09 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1721494023; x=1722098823; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:in-reply-to:references

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=ZEgpHqie6U1sGpAclZpzBQxoImQkUb7xbRzzbn1gez4=;

b=GXyMrxFE1kg1FBPtz8XVmAldClc4bN3/Ulsh/+JmP6YaiCOQPZ4K6HQnkxejRW2ekW

/afpkjUZ5vi9O0E4lYbPTq1lkmTe6H8TIJcNtPDub7rkpYCLtfxqvzQyZVOqimGKqfHY

5qmIuX0tI9BXDQZAQg8ochyqfR0MhtQV2JgspqD0xVb2JoPXuASv6Uh95feylYLucLq5

aKtA5HfSJj5HXrpuLxVV03DAS365tRHIjTsOPB3mXA0rjNM9vurDorgtFJQbDf7mwY2K

tu7f00y+1+131/VbQOs7O8ZZY2H7l5yL8iK8viSGFUfnZSnoCsuk1WCHXxWfFTIdszSf

O0Og==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1721494023; x=1722098823;

h=to:subject:message-id:date:from:reply-to:in-reply-to:references

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=ZEgpHqie6U1sGpAclZpzBQxoImQkUb7xbRzzbn1gez4=;

b=Yddyy1OJs8D2o9bt1HBCO8QYslnlKAey6QT9gDGbZWmZNSKR6WHEohYAVi0tpGpxvV

axsrE/kCW1lgBHfFavcDF31x3dUC9Cqi/UJl0LXCGSbylDQOjK7qIovlNv9DNT8KMlV3

0A5/jphnJCIC4wwTJNwcwC3r+A3zVtt68Lp0JSCuhClVWE0j429PIKzryASkU2bmC8q4

8MRIjD7ID8QgoNOStTO+lTS2gKisNQT7/KocmtWhWKsRrINkjMAuJnLoH9HO50YYE7e0

g3OK3yxROObnR2utLh8TN0GfqffyDAxiCz9vr63G4pZQ/4G26+/i0eHZ6EaLCLuW4307

hDNQ==

X-Forwarded-Encrypted: i=1; AJvYcCVBCigEhcK4XxsJo0ejNm05RRiJviPbDNf94uWBSjfjSFcSoZ4Vm5ILA+Y5j1kWt0WcI1ih8O3JPvbhxQRc/JKbBAOBeofi

X-Gm-Message-State: AOJu0YyLO+6uaE0JlRW8PChSgQzrhJVcaEQLYCtn/uYHGr0MOij6WCN8

/BNXPPUWMjmYR80dfCLGWTQF17IxQllNJbInIFCqfSSDu99/eOQ3KP12fyNuEzCmaztQFME0jNQ

wymD8bvvnlDNvA0xwFWpoZ3bYumA=

X-Google-Smtp-Source: AGHT+IEqIbiU6vNlo/v+FHQxOo9QnJDL/E5HMLZUwxUYFvhAJ7TylaAz0tU64fvQCmic749YA+9byNCeH/QXCuvXpWY=

X-Received: by 2002:a50:bb6c:0:b0:5a2:c750:f47d with SMTP id

4fb4d7f45d1cf-5a479f562c6mr1110720a12.12.1721494022742; Sat, 20 Jul 2024

09:47:02 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

Reply-To: cfc.ubagroup02@gmail.com

From: kristalina georgieva

Date: Sat, 20 Jul 2024 17:44:03 +0100

Message-ID:

Subject: Attention please

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000b569ed061db08f30"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 16.0

X-Spam_score_int: 160

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Beneficiary, I sent this letter to you a month ago, but

I did not hear from you, I'm not sure if you got it, And that is why I sent

it again, Firstly, I'm Mrs. Kristalina Georgieva, Managing Dire [...]



Content analysis details: (16.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.51 listed in dnsbl.ahbl.org]

[209.85.208.51 listed in dnsbl.ahbl.org]

[209.85.208.51 listed in dnsbl.ahbl.org]

[209.85.208.51 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.51 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.51 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.51 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.51 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

[209.85.208.51 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.51 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.51 listed in list.dnswl.org]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[carlsmith3241(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[carlsmith3241(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[cfc.ubagroup02(at)gmail.com]

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 LOTS_OF_MONEY Huge... sums of money

3.1 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

0.7 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Attention please



--000000000000b569ed061db08f30

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Dear Beneficiary,

I sent this letter to you a month ago, but I did not hear from you, I'm not

sure if you got it, And that is why I sent it again, Firstly, I'm Mrs.

Kristalina Georgieva, Managing Director and Chairwoman of the International

Monetary Fund.



Indeed We have reviewed all the obstacles and problems surrounded your

uncompleted transaction and your inability to meet up with transfer charges

levied, against you, for the past transfer options, view our site for your

confirmation 38=C2=B053=E2=80=B256=E2=80=B3N 77=C2=B02=E2=80=B239=E2=80=B3W



We are the Board of Directors, World Bank and International Monetary Fund

(IMF) Washington, D.C. in conjunction with The U.S. Department of the

Treasury and some other relevant Investigation Agencies here in the United

States of America. has ordered our Foreign Payment Remittance Unit, United

Bank of Africa Lome Togo to issue you a VISA Card, where your fund $1.5

million will be uploaded, for further withdrawal of your fund.



During the course of our investigation, we discovered with dismay that your

payment has been delayed by corrupt officials of the Bank who are Trying to

divert your funds into their private accounts.



And today we notify you that your fund has been credited into a VISA Card

by UBA Bank and also ready to be delivered. Now contact UBA Bank director

his name is Mr. Tony Elumelu, email: (cfc.ubagroup02@gmail.com) to direct

you on how to receive your ATM VISA card.



Sincerely,



Mrs. Kristalina Georgieva



--000000000000b569ed061db08f30

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Dear Beneficiary, =C2=A0

v dir=3D"ltr">I sent this letter to you a month ago, but I did not hear fro=

m you, I'm not sure if you got it, And that is why I sent it again, Fir=

stly, I'm Mrs. Kristalina Georgieva, Managing Director and Chairwoman o=

f the International Monetary Fund.

Indeed We have reviewed all the o=

bstacles and problems surrounded your uncompleted transaction and your inab=

ility to meet up with transfer charges levied, against you, for the past tr=

ansfer options, view our site for your confirmation 38=C2=B053=E2=80=B256=

=E2=80=B3N 77=C2=B02=E2=80=B239=E2=80=B3W

We are the Board of Direct=

ors, World Bank and International Monetary Fund (IMF) Washington, D.C. in c=

onjunction with The U.S. Department of the Treasury and some other relevant=

Investigation Agencies here in the United States of America. has ordered o=

ur Foreign Payment Remittance Unit, United Bank of Africa Lome Togo to issu=

e you a VISA Card, where your fund $1.5 million will be uploaded, for furth=

er withdrawal of your fund.

During the course of our investigation, =

we discovered with dismay that your payment has been delayed by corrupt off=

icials of the Bank who are Trying to divert your funds into their private a=

ccounts.

And today we notify you that your fund has been credited in=

to a VISA Card by UBA Bank and also ready to be delivered. Now contact UBA =

Bank director his name is Mr. Tony Elumelu, email: (
bagroup02@gmail.com" target=3D"_blank">cfc.ubagroup02@gmail.com
) to dir=

ect you on how to receive your ATM VISA card.

Sincerely,

Mrs.=

Kristalina Georgieva






--000000000000b569ed061db08f30--