money spam from Hotmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 05 Jul 2022 14:06:42 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1o8oo2-000Nsh-Sg
for dave@doctor.nl2k.ab.ca;
Tue, 05 Jul 2022 14:05:58 -0600
Resent-From: The Doctor
Resent-Date: Tue, 5 Jul 2022 14:05:58 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pj1-f48.google.com ([209.85.216.48]:47038)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1o8odv-000NFW-0w
for doctor@doctor.nl2k.ab.ca;
Tue, 05 Jul 2022 13:55:34 -0600
Received: by mail-pj1-f48.google.com with SMTP id t5-20020a17090a6a0500b001ef965b262eso3397177pjj.5
for; Tue, 05 Jul 2022 12:55:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:from:date:message-id:subject:to;
bh=4LPbyU3ysBP6O6o/bZq7J1D3jm8JnIRgqs5U2ltUjbQ=;
b=X6EUVIS+y7Zq1qC3FqVegQVPJ4Pk9PSFrmXwKnUVUJrwneLIEvXc70piBqvn8V//1A
NcLvZIYcyOGD1iEmoRw0enpiBZ4r4dq+F1bCvTofVbfjeTUCQzMSH/9lWLfa4Gu9IwEX
BDklucUzyXv4qVAr2TMKnNXnxXDLDXbqAfExEzonAP1INNYfF+DwldQhvQ5tEbzfRVwF
2dJIUzsbU3TZ5zedikZSna6Z10oQTpyRiD5qEzhnSv8AEVbB0ay373oEsY+MXsflnG2o
eJ3lREKZpnTQWjbnrbfrX4o/XvT3ReoVI8HTTG4HZBI0gQMYqYH6qvOhvLO71xCthO75
xXxQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
bh=4LPbyU3ysBP6O6o/bZq7J1D3jm8JnIRgqs5U2ltUjbQ=;
b=apzvikub0Jj2IRlo7v5fyRga0LdM8HBpUU8qxBAn8mrX/ShESgRuQ/vBzb2anPv5Vw
wIalAbjtS08UM45K3JX3GwuFYNs4RzIHxBTgJZXak3d8mSOMthoOHftp4QCsvWNJgkpP
cLTIZ7pxaStslHlVEsqzgB2F7OoY4/DsjZ2n1CsXIO64KitM2gXmQR0qlDhg6zPwhmmn
N281I3SyILiNqzaxlvz79UyIfNTGGWIDtOIN/vvtcbztTT3IendrpOe/7ccWIzstfVRB
ZVBqgB+bwg3pYa6y6xTT8SJ6XS1xfLDTJkQt2DQZl1Ii+pdTa9L29GygA1Y8I2wh88W/
IdHA==
X-Gm-Message-State: AJIora8AsmmXQgTMk+b0CC9VGucUluPJoUiFTR9b0k0jnX3j7dUlq6S8
ou0Nw3uOS2qE1oXMaURcmeRqtMQFgA0iJjTMJtE=
X-Google-Smtp-Source: AGRyM1sqw9sszkkLLlJm7Ige+l/ZKsOWzOtPXuhNDy19G/2CyOBkGCSIiznfcCi1oNhHxklI7aklEEKy4I8PsppOvZM=
X-Received: by 2002:a17:903:41c1:b0:16a:55ef:3688 with SMTP id
u1-20020a17090341c100b0016a55ef3688mr43040390ple.161.1657050908145; Tue, 05
Jul 2022 12:55:08 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6a20:c90a:b0:84:42e2:cdae with HTTP; Tue, 5 Jul 2022
12:55:07 -0700 (PDT)
From: Stephen Anthoney
Date: Tue, 5 Jul 2022 20:55:07 +0100
Message-ID:
Subject: CONGRATULATIONS MY DEAR FRIEND.
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 17.4
X-Spam_score_int: 174
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello Dear Friend, This is to inform you about my success
in getting the money moved under the co-operation of a new partner from London.
Presently, I'm in Saudi Arabia for the purpose of investing my own share
of the m [...]
Content analysis details: (17.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.216.48 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[tntcourier653[at]gmail.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[tntcourier653[at]gmail.com]
2.4 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.0 FREEMAIL_REPLY From and body contain different freemails
0.0 FILL_THIS_FORM Fill in a form with personal information
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
2.2 FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 MONEY_FORM Lots of money if you fill out a form
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
2.3 ADVANCE_FEE_3_NEW_FRM_MNY Advance Fee fraud form and lots of
money
3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases
Subject: {SPAM?} CONGRATULATIONS MY DEAR FRIEND.
Hello Dear Friend,
This is to inform you about my success in getting the money moved
under the co-operation of a new partner from London. Presently, I'm in
Saudi Arabia for the purpose of investing my own share of the money,
Meanwhile I didn't forget your past efforts and attempts in assisting
me to move the fund evendo we were not successful. Now contact my
account officer in Benin Republic on the under listed contact
immediately:
Name: Mr James Walsh
Email: mrjameswalshdept9@gmail.com
Ask him to send you a bank draft worth of (US$ 3.2,000.00) Three
Million two hundred thousand dollars. which I kept for you as
compensation for all your past efforts and attempts to assist me in
this matter.I appreciated your efforts at that time so much. while
contacting Mr.Dave Lawrence Please include and i give him instructions
on where to send the money to you. I will advise you to contact him
with.
NAME:....................................
AGE:......................................
SEX:........................................
ADDRESS:...............................
EMAIL:....................................
PHONE:...................................
OCCUPATION:.........................
COMPANY:..............................
COUNTRY:.............................
Regard
Mr.Stephen Anthony
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 05 Jul 2022 14:06:42 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1o8oo2-000Nsh-Sg
for dave@doctor.nl2k.ab.ca;
Tue, 05 Jul 2022 14:05:58 -0600
Resent-From: The Doctor
Resent-Date: Tue, 5 Jul 2022 14:05:58 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pj1-f48.google.com ([209.85.216.48]:47038)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1o8odv-000NFW-0w
for doctor@doctor.nl2k.ab.ca;
Tue, 05 Jul 2022 13:55:34 -0600
Received: by mail-pj1-f48.google.com with SMTP id t5-20020a17090a6a0500b001ef965b262eso3397177pjj.5
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:from:date:message-id:subject:to;
bh=4LPbyU3ysBP6O6o/bZq7J1D3jm8JnIRgqs5U2ltUjbQ=;
b=X6EUVIS+y7Zq1qC3FqVegQVPJ4Pk9PSFrmXwKnUVUJrwneLIEvXc70piBqvn8V//1A
NcLvZIYcyOGD1iEmoRw0enpiBZ4r4dq+F1bCvTofVbfjeTUCQzMSH/9lWLfa4Gu9IwEX
BDklucUzyXv4qVAr2TMKnNXnxXDLDXbqAfExEzonAP1INNYfF+DwldQhvQ5tEbzfRVwF
2dJIUzsbU3TZ5zedikZSna6Z10oQTpyRiD5qEzhnSv8AEVbB0ay373oEsY+MXsflnG2o
eJ3lREKZpnTQWjbnrbfrX4o/XvT3ReoVI8HTTG4HZBI0gQMYqYH6qvOhvLO71xCthO75
xXxQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
bh=4LPbyU3ysBP6O6o/bZq7J1D3jm8JnIRgqs5U2ltUjbQ=;
b=apzvikub0Jj2IRlo7v5fyRga0LdM8HBpUU8qxBAn8mrX/ShESgRuQ/vBzb2anPv5Vw
wIalAbjtS08UM45K3JX3GwuFYNs4RzIHxBTgJZXak3d8mSOMthoOHftp4QCsvWNJgkpP
cLTIZ7pxaStslHlVEsqzgB2F7OoY4/DsjZ2n1CsXIO64KitM2gXmQR0qlDhg6zPwhmmn
N281I3SyILiNqzaxlvz79UyIfNTGGWIDtOIN/vvtcbztTT3IendrpOe/7ccWIzstfVRB
ZVBqgB+bwg3pYa6y6xTT8SJ6XS1xfLDTJkQt2DQZl1Ii+pdTa9L29GygA1Y8I2wh88W/
IdHA==
X-Gm-Message-State: AJIora8AsmmXQgTMk+b0CC9VGucUluPJoUiFTR9b0k0jnX3j7dUlq6S8
ou0Nw3uOS2qE1oXMaURcmeRqtMQFgA0iJjTMJtE=
X-Google-Smtp-Source: AGRyM1sqw9sszkkLLlJm7Ige+l/ZKsOWzOtPXuhNDy19G/2CyOBkGCSIiznfcCi1oNhHxklI7aklEEKy4I8PsppOvZM=
X-Received: by 2002:a17:903:41c1:b0:16a:55ef:3688 with SMTP id
u1-20020a17090341c100b0016a55ef3688mr43040390ple.161.1657050908145; Tue, 05
Jul 2022 12:55:08 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6a20:c90a:b0:84:42e2:cdae with HTTP; Tue, 5 Jul 2022
12:55:07 -0700 (PDT)
From: Stephen Anthoney
Date: Tue, 5 Jul 2022 20:55:07 +0100
Message-ID:
Subject: CONGRATULATIONS MY DEAR FRIEND.
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 17.4
X-Spam_score_int: 174
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello Dear Friend, This is to inform you about my success
in getting the money moved under the co-operation of a new partner from London.
Presently, I'm in Saudi Arabia for the purpose of investing my own share
of the m [...]
Content analysis details: (17.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.216.48 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[tntcourier653[at]gmail.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[tntcourier653[at]gmail.com]
2.4 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.0 FREEMAIL_REPLY From and body contain different freemails
0.0 FILL_THIS_FORM Fill in a form with personal information
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
2.2 FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 MONEY_FORM Lots of money if you fill out a form
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
2.3 ADVANCE_FEE_3_NEW_FRM_MNY Advance Fee fraud form and lots of
money
3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases
Subject: {SPAM?} CONGRATULATIONS MY DEAR FRIEND.
Hello Dear Friend,
This is to inform you about my success in getting the money moved
under the co-operation of a new partner from London. Presently, I'm in
Saudi Arabia for the purpose of investing my own share of the money,
Meanwhile I didn't forget your past efforts and attempts in assisting
me to move the fund evendo we were not successful. Now contact my
account officer in Benin Republic on the under listed contact
immediately:
Name: Mr James Walsh
Email: mrjameswalshdept9@gmail.com
Ask him to send you a bank draft worth of (US$ 3.2,000.00) Three
Million two hundred thousand dollars. which I kept for you as
compensation for all your past efforts and attempts to assist me in
this matter.I appreciated your efforts at that time so much. while
contacting Mr.Dave Lawrence Please include and i give him instructions
on where to send the money to you. I will advise you to contact him
with.
NAME:....................................
AGE:......................................
SEX:........................................
ADDRESS:...............................
EMAIL:....................................
PHONE:...................................
OCCUPATION:.........................
COMPANY:..............................
COUNTRY:.............................
Regard
Mr.Stephen Anthony
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments