Nigerian claim spam from Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 18 Aug 2022 07:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOfIh-000JcW-By

for dave@doctor.nl2k.ab.ca;

Thu, 18 Aug 2022 07:11:07 -0600

Resent-From: The Doctor

Resent-Date: Thu, 18 Aug 2022 07:11:07 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f179.google.com ([209.85.128.179]:46960)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOdMv-000Geg-Rs

for doctor@doctor.nl2k.ab.ca;

Thu, 18 Aug 2022 05:07:26 -0600

Received: by mail-yw1-f179.google.com with SMTP id 00721157ae682-31f445bd486so30827107b3.13

for ; Thu, 18 Aug 2022 04:07:04 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=content-transfer-encoding:to:subject:message-id:date:from:reply-to

:mime-version:from:to:cc;

bh=8gNr7rgvzp12gCtVFJ/tOq/YgmtELRGTjodDRR9bQNA=;

b=Zi+A628qBWZaqvwesxMATyUKtV19XST8WNctDAaxjcpARk7PO3JPHO5KuJUIrOB1sR

KxmlWbTiOu7B+HYt/v25wtwIEG/Nwv54stwA1Uh5lnYLMJDOyxrs/pOUTVtIQOwN6k62

MtkUob4S2/MGJEP3GlqaHwbzs9e9ANXp9k/LQy5drxfZ0C0sCGTFcQFVMUvpZXDc+ce3

4qILVuxKW7kUGufx11nEC1qUWkRJWykoHgDYDY786VLEo2AZTkb4UQ+HqRCLvn+Df9d4

ckBlG//VOyXHgoQTDLiU2MRhjtpspKUdDjf1dYHQcntzrdzPQHxge6ynFq6MG6i9Xosq

rvYw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=content-transfer-encoding:to:subject:message-id:date:from:reply-to

:mime-version:x-gm-message-state:from:to:cc;

bh=8gNr7rgvzp12gCtVFJ/tOq/YgmtELRGTjodDRR9bQNA=;

b=Ur3oojxHt0PFlf96J8srzthli2oc6arhCLTdEeOruzeu7v8Wdff/czawBLneMTyGzh

IJh/oyj1dBh4gJ3gLtzYwt2wiLkD75Kthp4kjSgz2pCqvOEoi12CEWO/Wq5iDtBHq1K7

FSiVDYo5vbL003436zt2KtGLvCtdMt9xI3kzJvps+XZ2DGpULwFe9S5dXv7r2PtI4Wn5

pkxiiW8Fx9qC0ou2DEsdyEcYF/0lElJ2wPAulrNel5MiaNhnmtPWClCbo14tqUA90WwY

OedZ8Gh7AXSHCtSZ2waSmKLTHGSic3iPOec/Axtm/EhXaVkp2CEVIq2rkQNCaiqRbQ8Z

kTdA==

X-Gm-Message-State: ACgBeo0FRXR9ov7dOLXtcjigc1uABWYvvGG2sZ0FoD+lXY4ZrhLe2yD7

1lrTSLM8s2GGJkkGyQsdaPtalt7N2xb8/FYduys=

X-Google-Smtp-Source: AA6agR4wSJmNZ15aXC9BjRbX2SCTAu8HlRy2f//G/bFV0qUIKO0ryAHwPNdsDzfux5f3R/HStfASC1q6GDeI6UUfs2M=

X-Received: by 2002:a0d:cc0f:0:b0:334:c52e:83c4 with SMTP id

o15-20020a0dcc0f000000b00334c52e83c4mr2171134ywd.324.1660820818493; Thu, 18

Aug 2022 04:06:58 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a25:4ed5:0:0:0:0:0 with HTTP; Thu, 18 Aug 2022 04:06:57

-0700 (PDT)

Reply-To: juliebannie1901@yahoo.com

From: julie bannie

Date: Wed, 17 Aug 2022 23:06:57 -1200

Message-ID:

Subject: HELLO DEAR

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: base64

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 13.2

X-Spam_score_int: 132

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, I hope that this mail reach you in good health, please do not be upset

with my mail and if you find it not interested please delete it and

ignore it as i do not mean [...]



Content analysis details: (13.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.179 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[mbodjndeye51[at]gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[mbodjndeye51[at]gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[juliebannie1901[at]yahoo.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.7 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} HELLO DEAR



SGVsbG8sDQoNCknCoGhvcGXCoHRoYXTCoHRoaXPCoG1haWzCoHJlYWNowqB5b3XCoGluwqBnb29k

wqBoZWFsdGgswqBwbGVhc2XCoGRvwqBub3TCoGJlwqB1cHNldA0Kd2l0aMKgbXnCoG1haWzCoGFu

ZMKgaWbCoHlvdcKgZmluZMKgaXTCoG5vdMKgaW50ZXJlc3RlZMKgcGxlYXNlwqBkZWxldGXCoGl0

wqBhbmQNCmlnbm9yZcKgaXTCoGFzwqBpwqBkb8Kgbm90wqBtZWFuwqB0b8Kgb2ZmZW5kwqB5b3XC

oGluwqBhbnl3YXkuwqBJwqBhbcKgTXPCoEp1bGllDQpCZW5uaWUswqBJwqBhbcKgd29ya2luZ8Kg

YXPCoGF1ZGl0aW5nL2ZpbmFuY2XCoGRlcGFydG1lbnTCoG9wZXJhdGluZ8KgaW7CoG9uZQ0Kb2bC

oHRoZcKgbGVhZGluZ8KgYmFua8KgaGVyZcKgaW7CoFNlbmVnYWwswqBhbmTCoEnCoHdhbnTCoHRv

wqBpbmZvcm3CoHlvdcKgdGhhdMKgYW4NCmFtb3VudMKgb2bCoFVTJDYsMDAwLjAwMMKgTWlsbGlv

bsKgd2lsbA0KYmXCoG1vdmVkwqBvbsKgeW91csKgbmFtZcKgYXPCoHRoZcKgRm9yZWlnbsKgQnVz

aW5lc3PCoFBhcnRuZXLCoHRvwqBvdXLCoGxhdGUNCmRlY2Vhc2VkwqBjdXN0b21lcsKgTXLCoFdh

bGVlZMKgSGF6YWHCoFNhbGltLMKgScKgbmVlZMKgeW91csKgcGFydG5lcnNoaXDCoHRvDQpyZWNl

aXZlwqB0aGlzwqBtb25lecKgYXPCoHdlwqBzaGFsbMKgc2hhcmXCoHRoZcKgbW9uZXnCoGluwqB0

aGXCoHJhdGlvwqBvZsKgNDIvNTglLg0KWW91wqB3aWxswqByZWNlaXZlwqB0aGlzwqBhbW91bnTC

oHRocm91Z2jCoERpcGxvbWF0aWPCoG1lYW5zwqBvcsKgdGhyb3VnaMKgYmFuaw0KdG/CoGJhbmvC

oHRyYW5zZmVyLg0KDQppwqB3b3VsZMKgbGlrZcKgYWJzb2x1dGXCoGNvbmZpZGVudGlhbGl0ecKg

YW5kwqByZXN0wqBhc3N1cmVkwqB0aGF0wqBpwqBhbcKgaGVyZQ0KdG/CoGRpcmVjdMKgeW91wqBh

bmTCoGhlbHDCoHlvdcKgd2l0aMKgYWxswqBpbmZvcm1hdGlvbsKgcmVxdWlyZWTCoGZvcsKgdXPC

oHRvDQphY2hpZXZlwqB0aGlzwqBwcm9qZWN0wqBmb3LCoHNlY3VyaXR5wqByZWFzb24swqB0aGXC

oGRpcmVjdG9ywqBib2FyZMKgaGFzwqBoZWxkDQphwqBtZWV0aW5nwqByZWdhcmRpbmfCoHRoaXPC

oHVuY2xhaW1lZMKgZnVuZMKgZm9ywqBvdXLCoGxhdGXCoGRlY2Vhc2XCoGN1c3RvbWVyDQp3aG/C

oGRpZXPCoHllYXJzwqBhZ2/CoGFuZMKgbm/CoGZhbWlsecKgb3LCoG5leHTCoG9mwqBraW7CoHRv

wqBhcHBsecKgZm9ywqB0aGXCoGNsYWltDQpzb8KgacKgd2lsbMKgZ3VpZGXCoHlvdcKgdG/CoGFw

cGx5wqBhc8KgdGhlwqBidXNpbmVzc8KgcGFydG5lcsKgYW5kwqBnaXZlwqB5b3UNCmRpcmVjdGl2

ZXPCoHRvwqBmb2xsb3fCoHNvwqB0aGXCoHByb2plY3TCoGNhbsKgYmXCoHN1Y2Nlc3NmdWxsecKg

YWNoaWV2ZWTCoGFuZA0Kd2lsbMKgZGVsZXRlwqBhbGzCoHlvdXLCoGluZm9ybWF0aW9uwqBmcm9t

wqBvdXLCoGJhbmvCoHN5c3RlbcKgb25jZcKgd2UNCnN1Y2Nlc3NmdWxsecKgYWNoaWV2ZcKgdGhp

c8KgZnVuZMKgd2l0aMKgbXnCoHBvc2l0aW9uwqBpbsKgdGhlwqBiYW5rLg0KDQpQbGVhc2XCoHNl

bmTCoHlvdXLCoGZ1bGzCoGNvbnRhY3TCoGRldGFpbHPCoHN1Y2jCoGFzLg0KDQoxKcKgeW91csKg

ZnVsbMKgbmFtZXMuDQoyKcKgeW91csKgZGlyZWN0wqB0ZWxlcGhvbmXCoG51bWJlcnMuDQozKcKg

eW91csKgY291bnRyecKgYW5kwqBob21lwqBhZGRyZXNzLg0KNCnCoHlvdXLCoGFnZcKgYW5kwqBv

Y2N1cGF0aW9uLg0KNSnCoHlvdXLCoHBhc3Nwb3J0wqBjb3B5wqBvcsKgYW55wqBvZsKgeW91csKg

SUTCoGNhcmQuDQoNCm1vcmXCoGRldGFpbHPCoG9uwqBob3fCoHRvwqBjbGFpbcKgdGhlwqBmdW5k

wqB3aWxswqBiZcKgZ2l2ZW7CoHVwb27CoHlvdXLCoHJlcGx5Lg0KDQpZb3VywqBxdWlja8KgcmVz

cG9uc2XCoHdpbGzCoGJlwqBoaWdobHnCoGFwcHJlY2lhdGVkLg0KDQpZb3Vyc8Kgc2luY2VyZWx5

LA0KDQpNc8KgSnVsaWXCoEJlbm5pZS4NCg==

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA