Business proposal spam from Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 31 Aug 2022 14:58:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oTUmN-0008kz-I4
for dave@doctor.nl2k.ab.ca;
Wed, 31 Aug 2022 14:57:43 -0600
Resent-From: The Doctor
Resent-Date: Wed, 31 Aug 2022 14:57:43 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oa1-f53.google.com ([209.85.160.53]:41547)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1oTUlM-0008Y2-RQ
for doctor@doctor.nl2k.ab.ca;
Wed, 31 Aug 2022 14:56:44 -0600
Received: by mail-oa1-f53.google.com with SMTP id 586e51a60fabf-12243fcaa67so4412403fac.8
for; Wed, 31 Aug 2022 13:56:19 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date;
bh=fI8FVxk8qFBjRisSy+R5dbptBQHa/0ksyQMmVsF1ZSQ=;
b=d+UdpGXu1h5+HYlqggPapg6/Xk2sUoca1+aiRZAz69AQCSahn3CmMmpV/cipGqd5OU
PQuycId6Fpf99nnpcheHjVBc518y2G9nNf+PezVf6j9n+XABdXotOek8Gs/EKe4VnKaT
kV2irhZCbL+DGyXl1qBHj5HCV9eBBY+XAGV0KQ21Ny5oH56qPWa5KK+hgNd15Nw8J/3N
BARuO8p4Nt7gKdmERT+261V/GVrfH/GkEYpaQoMbWstX8DLSoxeTYjendhrjKRiS2vDy
+uNVilI/1z9Jb9HfG2s6p3uJcUfBd6ZcyXLt/102mALBViFBNzhIg/MT40BPhDXXqYxm
R54g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date;
bh=fI8FVxk8qFBjRisSy+R5dbptBQHa/0ksyQMmVsF1ZSQ=;
b=g2JTDdbZ7R+/ZN9UwA5wwSpm30EpW2NDPvM371aqiyBJG0lY03Zn4J1ZkZVGSUYJyz
B0D1EmiSnIiMJRYLRHW+uHGZp40zhoplHSWRklrHBBVtvT4R+h5XIV9jtLDkokeJLU1y
pTwxHhX5Z+7/nrNgo7W/GaE4Fxs1D+R+S1eAZ5WxFeunYcpOqZ9A3zb1EZE57Zj/xgEe
MTEABiwy2uCtZ5thkQK2tC4ALIMCceudn+TY0MVU/xXZ2CBjIyrsDDuyfKy0dcFhns8o
l0H/egvkexKO+ZmhIQfp3b22RKKvsYrydPOo7BT0YsT93xH7iUk8ji1eJ6Z//ZX9cUQP
1QcQ==
X-Gm-Message-State: ACgBeo0T24H+ljaoCjsSyd2mXeH1d6gD/cluFWuSkIKI1Ku/7IUZ7PZQ
LLkbpwgywuSbS9r5Zfsuy1J4s/yV78TgjauNtbU=
X-Google-Smtp-Source: AA6agR4O3U/oUFJctmACjeyywaDr3BVj6ID4CaWHyLkuZKWOUrOHe3BQL4sXKOXkIj1Kug/WJpyuoT0ZqWH4nmXy7Mk=
X-Received: by 2002:a05:6870:f152:b0:11e:7366:4a28 with SMTP id
l18-20020a056870f15200b0011e73664a28mr2412481oac.170.1661979373647; Wed, 31
Aug 2022 13:56:13 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6838:3da6:0:0:0:0 with HTTP; Wed, 31 Aug 2022 13:56:13
-0700 (PDT)
Reply-To: tonybanneth@gmail.com
From: "Mr. Tony Banneth"
Date: Wed, 31 Aug 2022 13:56:13 -0700
Message-ID:
Subject: hello
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 16.7
X-Spam_score_int: 167
X-Spam_bar: ++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: DEAR FRIEND I am(Mr.Tony Banneth),With the business proposal
deal of US(US$10.5 million) to transfer into your account, if you are interested
get back to me for more detail at my E-Your Urgent,my private Email Address,(
tonybanneth@gmail.com )
Content analysis details: (16.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[ptishamichael[at]gmail.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.160.53 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal
information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
1.5 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} hello
DEAR FRIEND
I am(Mr.Tony Banneth),With the business proposal deal of US(US$10.5
million) to transfer into your account, if you are interested get back
to me for more detail at my E-Your
Urgent,my private Email Address,( tonybanneth@gmail.com )
Thanks with my Best Regards
Thanks
Mr.Tony Banneth
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 31 Aug 2022 14:58:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oTUmN-0008kz-I4
for dave@doctor.nl2k.ab.ca;
Wed, 31 Aug 2022 14:57:43 -0600
Resent-From: The Doctor
Resent-Date: Wed, 31 Aug 2022 14:57:43 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oa1-f53.google.com ([209.85.160.53]:41547)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1oTUlM-0008Y2-RQ
for doctor@doctor.nl2k.ab.ca;
Wed, 31 Aug 2022 14:56:44 -0600
Received: by mail-oa1-f53.google.com with SMTP id 586e51a60fabf-12243fcaa67so4412403fac.8
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date;
bh=fI8FVxk8qFBjRisSy+R5dbptBQHa/0ksyQMmVsF1ZSQ=;
b=d+UdpGXu1h5+HYlqggPapg6/Xk2sUoca1+aiRZAz69AQCSahn3CmMmpV/cipGqd5OU
PQuycId6Fpf99nnpcheHjVBc518y2G9nNf+PezVf6j9n+XABdXotOek8Gs/EKe4VnKaT
kV2irhZCbL+DGyXl1qBHj5HCV9eBBY+XAGV0KQ21Ny5oH56qPWa5KK+hgNd15Nw8J/3N
BARuO8p4Nt7gKdmERT+261V/GVrfH/GkEYpaQoMbWstX8DLSoxeTYjendhrjKRiS2vDy
+uNVilI/1z9Jb9HfG2s6p3uJcUfBd6ZcyXLt/102mALBViFBNzhIg/MT40BPhDXXqYxm
R54g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date;
bh=fI8FVxk8qFBjRisSy+R5dbptBQHa/0ksyQMmVsF1ZSQ=;
b=g2JTDdbZ7R+/ZN9UwA5wwSpm30EpW2NDPvM371aqiyBJG0lY03Zn4J1ZkZVGSUYJyz
B0D1EmiSnIiMJRYLRHW+uHGZp40zhoplHSWRklrHBBVtvT4R+h5XIV9jtLDkokeJLU1y
pTwxHhX5Z+7/nrNgo7W/GaE4Fxs1D+R+S1eAZ5WxFeunYcpOqZ9A3zb1EZE57Zj/xgEe
MTEABiwy2uCtZ5thkQK2tC4ALIMCceudn+TY0MVU/xXZ2CBjIyrsDDuyfKy0dcFhns8o
l0H/egvkexKO+ZmhIQfp3b22RKKvsYrydPOo7BT0YsT93xH7iUk8ji1eJ6Z//ZX9cUQP
1QcQ==
X-Gm-Message-State: ACgBeo0T24H+ljaoCjsSyd2mXeH1d6gD/cluFWuSkIKI1Ku/7IUZ7PZQ
LLkbpwgywuSbS9r5Zfsuy1J4s/yV78TgjauNtbU=
X-Google-Smtp-Source: AA6agR4O3U/oUFJctmACjeyywaDr3BVj6ID4CaWHyLkuZKWOUrOHe3BQL4sXKOXkIj1Kug/WJpyuoT0ZqWH4nmXy7Mk=
X-Received: by 2002:a05:6870:f152:b0:11e:7366:4a28 with SMTP id
l18-20020a056870f15200b0011e73664a28mr2412481oac.170.1661979373647; Wed, 31
Aug 2022 13:56:13 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6838:3da6:0:0:0:0 with HTTP; Wed, 31 Aug 2022 13:56:13
-0700 (PDT)
Reply-To: tonybanneth@gmail.com
From: "Mr. Tony Banneth"
Date: Wed, 31 Aug 2022 13:56:13 -0700
Message-ID:
Subject: hello
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 16.7
X-Spam_score_int: 167
X-Spam_bar: ++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: DEAR FRIEND I am(Mr.Tony Banneth),With the business proposal
deal of US(US$10.5 million) to transfer into your account, if you are interested
get back to me for more detail at my E-Your Urgent,my private Email Address,(
tonybanneth@gmail.com )
Content analysis details: (16.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[ptishamichael[at]gmail.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.160.53 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal
information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
1.5 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} hello
DEAR FRIEND
I am(Mr.Tony Banneth),With the business proposal deal of US(US$10.5
million) to transfer into your account, if you are interested get back
to me for more detail at my E-Your
Urgent,my private Email Address,( tonybanneth@gmail.com )
Thanks with my Best Regards
Thanks
Mr.Tony Banneth
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments