Business proposal spam from Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 31 Aug 2022 14:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oTUmN-0008kz-I4

for dave@doctor.nl2k.ab.ca;

Wed, 31 Aug 2022 14:57:43 -0600

Resent-From: The Doctor

Resent-Date: Wed, 31 Aug 2022 14:57:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f53.google.com ([209.85.160.53]:41547)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oTUlM-0008Y2-RQ

for doctor@doctor.nl2k.ab.ca;

Wed, 31 Aug 2022 14:56:44 -0600

Received: by mail-oa1-f53.google.com with SMTP id 586e51a60fabf-12243fcaa67so4412403fac.8

for ; Wed, 31 Aug 2022 13:56:19 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date;

bh=fI8FVxk8qFBjRisSy+R5dbptBQHa/0ksyQMmVsF1ZSQ=;

b=d+UdpGXu1h5+HYlqggPapg6/Xk2sUoca1+aiRZAz69AQCSahn3CmMmpV/cipGqd5OU

PQuycId6Fpf99nnpcheHjVBc518y2G9nNf+PezVf6j9n+XABdXotOek8Gs/EKe4VnKaT

kV2irhZCbL+DGyXl1qBHj5HCV9eBBY+XAGV0KQ21Ny5oH56qPWa5KK+hgNd15Nw8J/3N

BARuO8p4Nt7gKdmERT+261V/GVrfH/GkEYpaQoMbWstX8DLSoxeTYjendhrjKRiS2vDy

+uNVilI/1z9Jb9HfG2s6p3uJcUfBd6ZcyXLt/102mALBViFBNzhIg/MT40BPhDXXqYxm

R54g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date;

bh=fI8FVxk8qFBjRisSy+R5dbptBQHa/0ksyQMmVsF1ZSQ=;

b=g2JTDdbZ7R+/ZN9UwA5wwSpm30EpW2NDPvM371aqiyBJG0lY03Zn4J1ZkZVGSUYJyz

B0D1EmiSnIiMJRYLRHW+uHGZp40zhoplHSWRklrHBBVtvT4R+h5XIV9jtLDkokeJLU1y

pTwxHhX5Z+7/nrNgo7W/GaE4Fxs1D+R+S1eAZ5WxFeunYcpOqZ9A3zb1EZE57Zj/xgEe

MTEABiwy2uCtZ5thkQK2tC4ALIMCceudn+TY0MVU/xXZ2CBjIyrsDDuyfKy0dcFhns8o

l0H/egvkexKO+ZmhIQfp3b22RKKvsYrydPOo7BT0YsT93xH7iUk8ji1eJ6Z//ZX9cUQP

1QcQ==

X-Gm-Message-State: ACgBeo0T24H+ljaoCjsSyd2mXeH1d6gD/cluFWuSkIKI1Ku/7IUZ7PZQ

LLkbpwgywuSbS9r5Zfsuy1J4s/yV78TgjauNtbU=

X-Google-Smtp-Source: AA6agR4O3U/oUFJctmACjeyywaDr3BVj6ID4CaWHyLkuZKWOUrOHe3BQL4sXKOXkIj1Kug/WJpyuoT0ZqWH4nmXy7Mk=

X-Received: by 2002:a05:6870:f152:b0:11e:7366:4a28 with SMTP id

l18-20020a056870f15200b0011e73664a28mr2412481oac.170.1661979373647; Wed, 31

Aug 2022 13:56:13 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:6838:3da6:0:0:0:0 with HTTP; Wed, 31 Aug 2022 13:56:13

-0700 (PDT)

Reply-To: tonybanneth@gmail.com

From: "Mr. Tony Banneth"

Date: Wed, 31 Aug 2022 13:56:13 -0700

Message-ID:

Subject: hello

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 16.7

X-Spam_score_int: 167

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: DEAR FRIEND I am(Mr.Tony Banneth),With the business proposal

deal of US(US$10.5 million) to transfer into your account, if you are interested

get back to me for more detail at my E-Your Urgent,my private Email Address,(

tonybanneth@gmail.com )



Content analysis details: (16.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[ptishamichael[at]gmail.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.53 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

1.5 HK_NAME_FM_MR_MRS No description available.

0.0 T_HK_NAME_FM_MR_MRS No description available.

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to

2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal

information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

1.5 UNDISC_MONEY Undisclosed recipients + money/fraud signs

3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} hello



DEAR FRIEND



I am(Mr.Tony Banneth),With the business proposal deal of US(US$10.5

million) to transfer into your account, if you are interested get back

to me for more detail at my E-Your



Urgent,my private Email Address,( tonybanneth@gmail.com )







Thanks with my Best Regards







Thanks

Mr.Tony Banneth

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA