Lottery Nigerian Spam from Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 14 Aug 2022 22:54:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oNS6G-000HXD-N0
for dave@doctor.nl2k.ab.ca;
Sun, 14 Aug 2022 22:53:16 -0600
Resent-From: The Doctor
Resent-Date: Sun, 14 Aug 2022 22:53:16 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yb1-f196.google.com ([209.85.219.196]:40454)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1oNQeL-0006Wt-Gb
for doctor@nl2k.ab.ca;
Sun, 14 Aug 2022 21:21:03 -0600
Received: by mail-yb1-f196.google.com with SMTP id 123so10440675ybv.7
for; Sun, 14 Aug 2022 20:19:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc;
bh=5qel0EnsPF3E7WJTkn39tZARKbuZOHlGC0mQUJSZyUk=;
b=PhGRL1ENBNH0wtV1AKpZvMaSd7btyjAS+7xp4cEzQLxVSCUosnLXst4HHMsUjH8IVe
DO/80ja1A57/2XBiNUFgXkuVeKSI4gJkZszvBfw0Qu9dnjKHHx1S1QBoSA+fe1FFa1M6
F5ApDYOsE1hu28uQuQEdbQmKSv6+XFV1fNQ2UD0v3Iq8MKcV8/ZzEKBjFrPkAi9HKg1U
NQXgOYSOt+bzMpZaHQPDtgEZ1tzPk/yuw8qZzQwGB2ipFzHFcWumDa52CRZ6bgnsMf3a
hpjQL3lDnODGGL+Z54zuuHUXJabzboh3D5ZBn1y4ZgF4kY8BZqnASJRpmjS2x8+W+66w
YD3Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc;
bh=5qel0EnsPF3E7WJTkn39tZARKbuZOHlGC0mQUJSZyUk=;
b=E2gUVprtf/RdJ+fWje9xYHAdladMBwTStjANiftzfSbvudhG4hke5Y1T3JujQJwr5b
n9FIKnB5AZvIoKeFz3InDe1wmn6PIfFM72d+zJD8UFsLKxxcey6Oxt69EfwGuZEZKY6v
J+DLXw3c+7tJLaqmxDbNwSsu6ju0AHz05mIqfZsIpjidEJnKbQYZ4juCnN9lD//0CDO3
nRcNgIyLwSS1xunbEl56vswjc2mpqA6278RfmavQi2TI7EHh4zdGa7vLgZeNxt7Gzonm
jw8ODlXtE6wkHGt/W/eKwVIzfe/cMzvwrPQXy4WyugvwIm372PZHuRjdWEGYQd30+02F
gPjA==
X-Gm-Message-State: ACgBeo0Fm56/g+786dlIaQWb3IYX3CkVpu1yYLR9zoHQYBNy6q7s/xZV
YW776Qys+zoB0YAdVUxHzUuUOrIdilDWUHwwLOk=
X-Google-Smtp-Source: AA6agR7D42JtA+k71u4XTJvNmxwFUukedqeEgYVDcTaQrfd6+pH48FZj8CMWf/sP7eJMj/fgsyaEvYfmV8eLRfleefU=
X-Received: by 2002:a05:6902:13c8:b0:684:b1c5:2df0 with SMTP id
y8-20020a05690213c800b00684b1c52df0mr7810057ybu.473.1660533592838; Sun, 14
Aug 2022 20:19:52 -0700 (PDT)
MIME-Version: 1.0
Reply-To: fcpdonations2020@gmail.com
From: "Mr & Mrs Frances & Patrick Connolly"
Date: Mon, 15 Aug 2022 03:19:40 +0000
Message-ID:
Subject: Voluntary donation
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000f0587505e63f1a2d"
Bcc: doctor@nl2k.ab.ca
X-Spam_score: 10.5
X-Spam_score_int: 105
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: LUCKY WINNER: I hope my mail meets you well. This is Mr &
Mrs Frances & Patrick Connolly, we live in Moira, Northern Ireland. We are
the successful winner of £115m Euro Millions win and we have chose [...]
Content analysis details: (10.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.219.196 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[nmafati69[at]gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[nmafati69[at]gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[fcpdonations2020[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 HTML_MESSAGE BODY: HTML included in message
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.7 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Voluntary donation
--000000000000f0587505e63f1a2d
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
LUCKY WINNER: I hope my mail meets you well. This is Mr & Mrs Frances &
Patrick Connolly, we live in Moira, Northern Ireland. We are the successful
winner of =C2=A3115m Euro Millions win and we have chosen you as one of the=
50
lucky winners to receive this month of July, 2022 Donation which happens to
be =C2=A3925,000. For more information please reach out to this email:
fcpdonations2020@gmail.com
--000000000000f0587505e63f1a2d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--000000000000f0587505e63f1a2d--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 14 Aug 2022 22:54:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oNS6G-000HXD-N0
for dave@doctor.nl2k.ab.ca;
Sun, 14 Aug 2022 22:53:16 -0600
Resent-From: The Doctor
Resent-Date: Sun, 14 Aug 2022 22:53:16 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yb1-f196.google.com ([209.85.219.196]:40454)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1oNQeL-0006Wt-Gb
for doctor@nl2k.ab.ca;
Sun, 14 Aug 2022 21:21:03 -0600
Received: by mail-yb1-f196.google.com with SMTP id 123so10440675ybv.7
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc;
bh=5qel0EnsPF3E7WJTkn39tZARKbuZOHlGC0mQUJSZyUk=;
b=PhGRL1ENBNH0wtV1AKpZvMaSd7btyjAS+7xp4cEzQLxVSCUosnLXst4HHMsUjH8IVe
DO/80ja1A57/2XBiNUFgXkuVeKSI4gJkZszvBfw0Qu9dnjKHHx1S1QBoSA+fe1FFa1M6
F5ApDYOsE1hu28uQuQEdbQmKSv6+XFV1fNQ2UD0v3Iq8MKcV8/ZzEKBjFrPkAi9HKg1U
NQXgOYSOt+bzMpZaHQPDtgEZ1tzPk/yuw8qZzQwGB2ipFzHFcWumDa52CRZ6bgnsMf3a
hpjQL3lDnODGGL+Z54zuuHUXJabzboh3D5ZBn1y4ZgF4kY8BZqnASJRpmjS2x8+W+66w
YD3Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc;
bh=5qel0EnsPF3E7WJTkn39tZARKbuZOHlGC0mQUJSZyUk=;
b=E2gUVprtf/RdJ+fWje9xYHAdladMBwTStjANiftzfSbvudhG4hke5Y1T3JujQJwr5b
n9FIKnB5AZvIoKeFz3InDe1wmn6PIfFM72d+zJD8UFsLKxxcey6Oxt69EfwGuZEZKY6v
J+DLXw3c+7tJLaqmxDbNwSsu6ju0AHz05mIqfZsIpjidEJnKbQYZ4juCnN9lD//0CDO3
nRcNgIyLwSS1xunbEl56vswjc2mpqA6278RfmavQi2TI7EHh4zdGa7vLgZeNxt7Gzonm
jw8ODlXtE6wkHGt/W/eKwVIzfe/cMzvwrPQXy4WyugvwIm372PZHuRjdWEGYQd30+02F
gPjA==
X-Gm-Message-State: ACgBeo0Fm56/g+786dlIaQWb3IYX3CkVpu1yYLR9zoHQYBNy6q7s/xZV
YW776Qys+zoB0YAdVUxHzUuUOrIdilDWUHwwLOk=
X-Google-Smtp-Source: AA6agR7D42JtA+k71u4XTJvNmxwFUukedqeEgYVDcTaQrfd6+pH48FZj8CMWf/sP7eJMj/fgsyaEvYfmV8eLRfleefU=
X-Received: by 2002:a05:6902:13c8:b0:684:b1c5:2df0 with SMTP id
y8-20020a05690213c800b00684b1c52df0mr7810057ybu.473.1660533592838; Sun, 14
Aug 2022 20:19:52 -0700 (PDT)
MIME-Version: 1.0
Reply-To: fcpdonations2020@gmail.com
From: "Mr & Mrs Frances & Patrick Connolly"
Date: Mon, 15 Aug 2022 03:19:40 +0000
Message-ID:
Subject: Voluntary donation
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000f0587505e63f1a2d"
Bcc: doctor@nl2k.ab.ca
X-Spam_score: 10.5
X-Spam_score_int: 105
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: LUCKY WINNER: I hope my mail meets you well. This is Mr &
Mrs Frances & Patrick Connolly, we live in Moira, Northern Ireland. We are
the successful winner of £115m Euro Millions win and we have chose [...]
Content analysis details: (10.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.219.196 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[nmafati69[at]gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[nmafati69[at]gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[fcpdonations2020[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 HTML_MESSAGE BODY: HTML included in message
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.7 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Voluntary donation
--000000000000f0587505e63f1a2d
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
LUCKY WINNER: I hope my mail meets you well. This is Mr & Mrs Frances &
Patrick Connolly, we live in Moira, Northern Ireland. We are the successful
winner of =C2=A3115m Euro Millions win and we have chosen you as one of the=
50
lucky winners to receive this month of July, 2022 Donation which happens to
be =C2=A3925,000. For more information please reach out to this email:
fcpdonations2020@gmail.com
--000000000000f0587505e63f1a2d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
LUCKY WINNER: I hope my mail meets you well. This is Mr &a=
mp; Mrs Frances & Patrick Connolly, we live in Moira, Northern Ireland.=
We are the successful winner of =C2=A3115m Euro Millions win and we have c=
hosen you as one of the 50 lucky winners to receive this month of July, 202=
2 Donation which happens to be =C2=A3925,000. For more information please r=
each out to this email: fcpdo=
nations2020@gmail.com
mp; Mrs Frances & Patrick Connolly, we live in Moira, Northern Ireland.=
We are the successful winner of =C2=A3115m Euro Millions win and we have c=
hosen you as one of the 50 lucky winners to receive this month of July, 202=
2 Donation which happens to be =C2=A3925,000. For more information please r=
each out to this email: fcpdo=
nations2020@gmail.com
--000000000000f0587505e63f1a2d--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments