Dead man funds Nigerian spam from gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 06 Sep 2022 14:33:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oVf6Z-0006wq-2M
for dave@doctor.nl2k.ab.ca;
Tue, 06 Sep 2022 14:23:31 -0600
Resent-From: The Doctor
Resent-Date: Tue, 6 Sep 2022 14:23:31 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yw1-f169.google.com ([209.85.128.169]:41894)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1oVa9f-0001WC-VC
for www@doctor.nl2k.ab.ca;
Tue, 06 Sep 2022 09:06:27 -0600
Received: by mail-yw1-f169.google.com with SMTP id 00721157ae682-346cd4c3d7aso8984297b3.8
for; Tue, 06 Sep 2022 08:06:06 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date;
bh=fPytvSKXaG3qwmEN3zxY8eh0BMj4YK7z1vO5FX6FolU=;
b=mfOjEiUbZBtElSz5zLyLuiSEx23TCTwD5PKPDAN/rDiWrwIa9W3RkakOtxAAy3F8eM
gJq8b5omActZdwwx4nmfyTQ942Mfjg6R/MKdkuyAu/eeYytsvOlmSmzlZgewKc+swzfz
Jru8bpyB4NsP2Nr5kAFO5F91pawYH84v75ZWgOPag7/Wst9FVr/NULBD2rlPo/jEzq5B
1NVplMOvXs6lG7J8Ls0xpOgnjxGzk4cD3vs2sTy1CrQ+t6UIp9LWYBDdq0lX/3IO0nzu
yG54hHos1G0mT46u0Id0JHETpnfs1BXa6oS8dINIzKhD8A/9Aokx1sSBAi9lxtkPH6kI
0QMg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date;
bh=fPytvSKXaG3qwmEN3zxY8eh0BMj4YK7z1vO5FX6FolU=;
b=PNsrs9vOuBtmjDMUK/rVxaQ788nRj1gYIZkytPHdSQL74m++NfHHgwJGT5Xdxyf+pK
BVG5pmAeXotZFgOOSuN0AxEJYk+WyS4cy9Rh7Io0HXBpri58n5Uq2T6nbUQKtnXSXvdG
vL4C3unkj1L2MqsEPoMpBFENKtdMj4fEPNhEBvANgkjz33IDCI4vv6XLnN//Dz4vIq2L
r11mX0+VDOrBtHSqQjHaWcryr/+1KpHMj8CyW49EWPriO5YrLCM0PYeUWNezOFf62tLi
5ojcAIiP4tWGhB7cm7ZvP0phGfrAstB+3Bg+shLJtY2jwlQcC6LptxlB5ZEClKN8I2jE
4tVQ==
X-Gm-Message-State: ACgBeo2JQ5t1ZDZ+DijuZRdt1PKQvAIAYcQTfmX2oZGN7Nzb2Ba6wx6Q
awvQXgEZjXYHMqHwe/z+2PZgoFKOtZQYApTqZlc=
X-Google-Smtp-Source: AA6agR6LlyU2egmtOUnHzf1XOFglZsyoxRQYqvdaLBNLHbWZrCOnUbH7Vqk1EnYukyTzc2GdEGnHWO3wp+7uP+KlvD4=
X-Received: by 2002:a0d:dbc4:0:b0:345:65d1:aabb with SMTP id
d187-20020a0ddbc4000000b0034565d1aabbmr5589230ywe.221.1662476759464; Tue, 06
Sep 2022 08:05:59 -0700 (PDT)
MIME-Version: 1.0
Reply-To: audit.jeff@gmail.com
From: 11jcob
Date: Tue, 6 Sep 2022 16:05:43 +0100
Message-ID:
Subject: =?UTF-8?Q?=E2=99=A6=EF=B8=8F_I_am_Mr_Jacob_Jeff=2C_the_Auditor_in_the_=27UTB=27_?=
=?UTF-8?Q?Bank=2C_when_auditing_I_discovered_a_floating_fund_in_an_accou?=
=?UTF-8?Q?nt=2C_which_was_opened_in_1999_belonging_to_a_dead_foreigner_w?=
=?UTF-8?Q?ho_died_in_2007=2E_I_have_made_every_effort_to_track_any_membe?=
=?UTF-8?Q?r_of_his_family_or_next_of_kin_but_none=2C_hence_I_got_in_cont?=
=?UTF-8?Q?act_with_you_to_stand_as_his_next_of_kin=2C_He_died_leaving_no?=
=?UTF-8?Q?_heir_or_a_will=2C_I_will_explain_my_intention_to_you_only_if_?=
=?UTF-8?Q?you_are_interested_=E2=99=A6=EF=B8=8F?=
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000b1fded05e80388ba"
Bcc: www@doctor.nl2k.ab.ca
X-Spam_score: 10.3
X-Spam_score_int: 103
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:
Content analysis details: (10.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.128.169 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[anniebeautys125[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[anniebeautys125[at]gmail.com]
2.5 HK_SCAM_N2 BODY: No description available.
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 HK_SCAM No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.5 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} =?UTF-8?Q?=E2=99=A6=EF=B8=8F_I_am_Mr_Jacob_Jeff=2C_the_Auditor_in_the_=27UTB=27_?=
=?UTF-8?Q?Bank=2C_when_auditing_I_discovered_a_floating_fund_in_an_accou?=
=?UTF-8?Q?nt=2C_which_was_opened_in_1999_belonging_to_a_dead_foreigner_w?=
=?UTF-8?Q?ho_died_in_2007=2E_I_have_made_every_effort_to_track_any_membe?=
=?UTF-8?Q?r_of_his_family_or_next_of_kin_but_none=2C_hence_I_got_in_cont?=
=?UTF-8?Q?act_with_you_to_stand_as_his_next_of_kin=2C_He_died_leaving_no?=
=?UTF-8?Q?_heir_or_a_will=2C_I_will_explain_my_intention_to_you_only_if_?=
=?UTF-8?Q?you_are_interested_=E2=99=A6=EF=B8=8F?=
--000000000000b1fded05e80388ba
Content-Type: text/plain; charset="UTF-8"
--000000000000b1fded05e80388ba
Content-Type: text/html; charset="UTF-8"
--000000000000b1fded05e80388ba--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 06 Sep 2022 14:33:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oVf6Z-0006wq-2M
for dave@doctor.nl2k.ab.ca;
Tue, 06 Sep 2022 14:23:31 -0600
Resent-From: The Doctor
Resent-Date: Tue, 6 Sep 2022 14:23:31 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yw1-f169.google.com ([209.85.128.169]:41894)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1oVa9f-0001WC-VC
for www@doctor.nl2k.ab.ca;
Tue, 06 Sep 2022 09:06:27 -0600
Received: by mail-yw1-f169.google.com with SMTP id 00721157ae682-346cd4c3d7aso8984297b3.8
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date;
bh=fPytvSKXaG3qwmEN3zxY8eh0BMj4YK7z1vO5FX6FolU=;
b=mfOjEiUbZBtElSz5zLyLuiSEx23TCTwD5PKPDAN/rDiWrwIa9W3RkakOtxAAy3F8eM
gJq8b5omActZdwwx4nmfyTQ942Mfjg6R/MKdkuyAu/eeYytsvOlmSmzlZgewKc+swzfz
Jru8bpyB4NsP2Nr5kAFO5F91pawYH84v75ZWgOPag7/Wst9FVr/NULBD2rlPo/jEzq5B
1NVplMOvXs6lG7J8Ls0xpOgnjxGzk4cD3vs2sTy1CrQ+t6UIp9LWYBDdq0lX/3IO0nzu
yG54hHos1G0mT46u0Id0JHETpnfs1BXa6oS8dINIzKhD8A/9Aokx1sSBAi9lxtkPH6kI
0QMg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date;
bh=fPytvSKXaG3qwmEN3zxY8eh0BMj4YK7z1vO5FX6FolU=;
b=PNsrs9vOuBtmjDMUK/rVxaQ788nRj1gYIZkytPHdSQL74m++NfHHgwJGT5Xdxyf+pK
BVG5pmAeXotZFgOOSuN0AxEJYk+WyS4cy9Rh7Io0HXBpri58n5Uq2T6nbUQKtnXSXvdG
vL4C3unkj1L2MqsEPoMpBFENKtdMj4fEPNhEBvANgkjz33IDCI4vv6XLnN//Dz4vIq2L
r11mX0+VDOrBtHSqQjHaWcryr/+1KpHMj8CyW49EWPriO5YrLCM0PYeUWNezOFf62tLi
5ojcAIiP4tWGhB7cm7ZvP0phGfrAstB+3Bg+shLJtY2jwlQcC6LptxlB5ZEClKN8I2jE
4tVQ==
X-Gm-Message-State: ACgBeo2JQ5t1ZDZ+DijuZRdt1PKQvAIAYcQTfmX2oZGN7Nzb2Ba6wx6Q
awvQXgEZjXYHMqHwe/z+2PZgoFKOtZQYApTqZlc=
X-Google-Smtp-Source: AA6agR6LlyU2egmtOUnHzf1XOFglZsyoxRQYqvdaLBNLHbWZrCOnUbH7Vqk1EnYukyTzc2GdEGnHWO3wp+7uP+KlvD4=
X-Received: by 2002:a0d:dbc4:0:b0:345:65d1:aabb with SMTP id
d187-20020a0ddbc4000000b0034565d1aabbmr5589230ywe.221.1662476759464; Tue, 06
Sep 2022 08:05:59 -0700 (PDT)
MIME-Version: 1.0
Reply-To: audit.jeff@gmail.com
From: 11jcob
Date: Tue, 6 Sep 2022 16:05:43 +0100
Message-ID:
Subject: =?UTF-8?Q?=E2=99=A6=EF=B8=8F_I_am_Mr_Jacob_Jeff=2C_the_Auditor_in_the_=27UTB=27_?=
=?UTF-8?Q?Bank=2C_when_auditing_I_discovered_a_floating_fund_in_an_accou?=
=?UTF-8?Q?nt=2C_which_was_opened_in_1999_belonging_to_a_dead_foreigner_w?=
=?UTF-8?Q?ho_died_in_2007=2E_I_have_made_every_effort_to_track_any_membe?=
=?UTF-8?Q?r_of_his_family_or_next_of_kin_but_none=2C_hence_I_got_in_cont?=
=?UTF-8?Q?act_with_you_to_stand_as_his_next_of_kin=2C_He_died_leaving_no?=
=?UTF-8?Q?_heir_or_a_will=2C_I_will_explain_my_intention_to_you_only_if_?=
=?UTF-8?Q?you_are_interested_=E2=99=A6=EF=B8=8F?=
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000b1fded05e80388ba"
Bcc: www@doctor.nl2k.ab.ca
X-Spam_score: 10.3
X-Spam_score_int: 103
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:
Content analysis details: (10.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.128.169 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[anniebeautys125[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[anniebeautys125[at]gmail.com]
2.5 HK_SCAM_N2 BODY: No description available.
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 HK_SCAM No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.5 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} =?UTF-8?Q?=E2=99=A6=EF=B8=8F_I_am_Mr_Jacob_Jeff=2C_the_Auditor_in_the_=27UTB=27_?=
=?UTF-8?Q?Bank=2C_when_auditing_I_discovered_a_floating_fund_in_an_accou?=
=?UTF-8?Q?nt=2C_which_was_opened_in_1999_belonging_to_a_dead_foreigner_w?=
=?UTF-8?Q?ho_died_in_2007=2E_I_have_made_every_effort_to_track_any_membe?=
=?UTF-8?Q?r_of_his_family_or_next_of_kin_but_none=2C_hence_I_got_in_cont?=
=?UTF-8?Q?act_with_you_to_stand_as_his_next_of_kin=2C_He_died_leaving_no?=
=?UTF-8?Q?_heir_or_a_will=2C_I_will_explain_my_intention_to_you_only_if_?=
=?UTF-8?Q?you_are_interested_=E2=99=A6=EF=B8=8F?=
--000000000000b1fded05e80388ba
Content-Type: text/plain; charset="UTF-8"
--000000000000b1fded05e80388ba
Content-Type: text/html; charset="UTF-8"
--000000000000b1fded05e80388ba--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments