Investment spam from Google
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 09 Sep 2022 09:04:03 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oWdp6-000Neb-Ke
for dave@doctor.nl2k.ab.ca;
Fri, 09 Sep 2022 07:13:32 -0600
Resent-From: The Doctor
Resent-Date: Fri, 9 Sep 2022 07:13:32 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vs1-f45.google.com ([209.85.217.45]:44632)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1oWZ7y-000DGj-Kl
for doctor@doctor.nl2k.ab.ca;
Fri, 09 Sep 2022 02:12:46 -0600
Received: by mail-vs1-f45.google.com with SMTP id h1so929339vsr.11
for; Fri, 09 Sep 2022 01:12:25 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date;
bh=qaFYmRMNPEgnf3EOUF70fFe71LfdmFWp/jSTNZa8W0k=;
b=BVjq1U8tev+l+P0ARNZekg1SqTs3JzneQI7dl8dUfrY4TYfptaB3jFQjm+n9YeX/8q
Im8cfi6uBlLQF9g7ijo5WEGYmcV/JBFUJCNBLKUW3kBW/xPhcaMm/Ejm++z/vCPu81YJ
gFDPslpkHDHlBbM3alSQXbYTXeUIvliivMnQ+eMea2DKRPzp/Ao6CCAEWwvecSoi8nDX
Iih+WoinQ32XzOLZm0lbILulWGLzpk/qieP08+0xj3m/JvKQgOH74U6vT9TjsEez1vMD
tU9Olu/r55FS+c/2wsk+CUdDa9FMVhybuCuzqOPhXDeLq/vCmfoFRsmrlX8rvi7YULbA
q6tQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date;
bh=qaFYmRMNPEgnf3EOUF70fFe71LfdmFWp/jSTNZa8W0k=;
b=bVuLRB62BvAq/Q0kdpibeHxySzxxTe7iCLPPgQWb59SeVzj6MqvOY+7C8QEf5F5XrI
fjcGLhh4t4/NE1G+Alo6j0WHaj05DDYq8zmfJisYf+B4f2q5TGgTp/C2n+soHj4NI3sc
AN18aBzOEbkp7IIUJXH8CosL7xjhboDedUYTCUo/fc1xyYW65yU7K0EsvqLmwBfzYKf2
SW10D5UefVx2kp+EH7g80KDHCz0Doddz+pYSo00WTH2cn9trI1O236kgqjgBf4kmwqcF
NSdG1fKtmyBNalOdjbg2pZyT7+b8keYsBNA1qbr0cbY11rO1BSJUGw/bEAo8cS+HBCLC
i73Q==
X-Gm-Message-State: ACgBeo1nMSvpkBBEg8R+HGM3Q7XiklofXDpFcPB6LA69ahqyE5L1vy6K
0hOaxPrNwVhelVXvg71mLsNTrBDbLVZdvaoWvx4=
X-Google-Smtp-Source: AA6agR6lR/M7p+BaQ8hk/nFQuA0syY384bUGxgEQSyo5wCwLLVQOrSND04PF5bLwrFhg2hDbeRruNmkjX8ZQXaYvMWQ=
X-Received: by 2002:a67:f116:0:b0:397:778d:c426 with SMTP id
n22-20020a67f116000000b00397778dc426mr4388503vsk.42.1662711137769; Fri, 09
Sep 2022 01:12:17 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6124:2010:b0:310:96a0:14d with HTTP; Fri, 9 Sep 2022
01:12:17 -0700 (PDT)
Reply-To: ayishagddafi@mail.ru
From: AISHA GADDAFI
Date: Fri, 9 Sep 2022 09:12:17 +0100
Message-ID:
Subject: Dearest Friend,?
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 14.9
X-Spam_score_int: 149
X-Spam_bar: ++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dearest Friend, In the name of God, Most Gracious, Most Merciful.
Peace be upon you and mercy be upon you and blessings be upon you. I have
the sum of $27.5 million USD for investment, I am interested in you for investment
project assistance in your country. My name [...]
Content analysis details: (14.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 REPTO_419_FRAUD Reply-To is known advance fee fraud collector
mailbox
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[fasoburkina03[at]gmail.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.217.45 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[fasoburkina03[at]gmail.com]
2.7 HK_SCAM_N1 BODY: No description available.
2.5 MILLION_USD BODY: Talks about millions of dollars
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
1.5 UNDISC_MONEY Undisclosed recipients + money/fraud signs
2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Dearest Friend,?
Dearest Friend,
In the name of God, Most Gracious, Most Merciful.
Peace be upon you and mercy be upon you and blessings be upon you.
I have the sum of $27.5 million USD for investment, I am interested in
you for investment project assistance in your country. My name is
Aisha Gaddafi and presently living in Oman, I am a Widow and single
Mother with three Children, the only biological Daughter of late
Libyan President (Late Colonel Muammar Gaddafi) and presently I am
under political asylum protection by the Omani Government.
Kindly reply urgently for more details.
my email address below: ayishagddafi@mail.ru
Thanks
Yours Truly Aisha
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 09 Sep 2022 09:04:03 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oWdp6-000Neb-Ke
for dave@doctor.nl2k.ab.ca;
Fri, 09 Sep 2022 07:13:32 -0600
Resent-From: The Doctor
Resent-Date: Fri, 9 Sep 2022 07:13:32 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vs1-f45.google.com ([209.85.217.45]:44632)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1oWZ7y-000DGj-Kl
for doctor@doctor.nl2k.ab.ca;
Fri, 09 Sep 2022 02:12:46 -0600
Received: by mail-vs1-f45.google.com with SMTP id h1so929339vsr.11
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date;
bh=qaFYmRMNPEgnf3EOUF70fFe71LfdmFWp/jSTNZa8W0k=;
b=BVjq1U8tev+l+P0ARNZekg1SqTs3JzneQI7dl8dUfrY4TYfptaB3jFQjm+n9YeX/8q
Im8cfi6uBlLQF9g7ijo5WEGYmcV/JBFUJCNBLKUW3kBW/xPhcaMm/Ejm++z/vCPu81YJ
gFDPslpkHDHlBbM3alSQXbYTXeUIvliivMnQ+eMea2DKRPzp/Ao6CCAEWwvecSoi8nDX
Iih+WoinQ32XzOLZm0lbILulWGLzpk/qieP08+0xj3m/JvKQgOH74U6vT9TjsEez1vMD
tU9Olu/r55FS+c/2wsk+CUdDa9FMVhybuCuzqOPhXDeLq/vCmfoFRsmrlX8rvi7YULbA
q6tQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date;
bh=qaFYmRMNPEgnf3EOUF70fFe71LfdmFWp/jSTNZa8W0k=;
b=bVuLRB62BvAq/Q0kdpibeHxySzxxTe7iCLPPgQWb59SeVzj6MqvOY+7C8QEf5F5XrI
fjcGLhh4t4/NE1G+Alo6j0WHaj05DDYq8zmfJisYf+B4f2q5TGgTp/C2n+soHj4NI3sc
AN18aBzOEbkp7IIUJXH8CosL7xjhboDedUYTCUo/fc1xyYW65yU7K0EsvqLmwBfzYKf2
SW10D5UefVx2kp+EH7g80KDHCz0Doddz+pYSo00WTH2cn9trI1O236kgqjgBf4kmwqcF
NSdG1fKtmyBNalOdjbg2pZyT7+b8keYsBNA1qbr0cbY11rO1BSJUGw/bEAo8cS+HBCLC
i73Q==
X-Gm-Message-State: ACgBeo1nMSvpkBBEg8R+HGM3Q7XiklofXDpFcPB6LA69ahqyE5L1vy6K
0hOaxPrNwVhelVXvg71mLsNTrBDbLVZdvaoWvx4=
X-Google-Smtp-Source: AA6agR6lR/M7p+BaQ8hk/nFQuA0syY384bUGxgEQSyo5wCwLLVQOrSND04PF5bLwrFhg2hDbeRruNmkjX8ZQXaYvMWQ=
X-Received: by 2002:a67:f116:0:b0:397:778d:c426 with SMTP id
n22-20020a67f116000000b00397778dc426mr4388503vsk.42.1662711137769; Fri, 09
Sep 2022 01:12:17 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6124:2010:b0:310:96a0:14d with HTTP; Fri, 9 Sep 2022
01:12:17 -0700 (PDT)
Reply-To: ayishagddafi@mail.ru
From: AISHA GADDAFI
Date: Fri, 9 Sep 2022 09:12:17 +0100
Message-ID:
Subject: Dearest Friend,?
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 14.9
X-Spam_score_int: 149
X-Spam_bar: ++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dearest Friend, In the name of God, Most Gracious, Most Merciful.
Peace be upon you and mercy be upon you and blessings be upon you. I have
the sum of $27.5 million USD for investment, I am interested in you for investment
project assistance in your country. My name [...]
Content analysis details: (14.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 REPTO_419_FRAUD Reply-To is known advance fee fraud collector
mailbox
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[fasoburkina03[at]gmail.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.217.45 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[fasoburkina03[at]gmail.com]
2.7 HK_SCAM_N1 BODY: No description available.
2.5 MILLION_USD BODY: Talks about millions of dollars
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
1.5 UNDISC_MONEY Undisclosed recipients + money/fraud signs
2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Dearest Friend,?
Dearest Friend,
In the name of God, Most Gracious, Most Merciful.
Peace be upon you and mercy be upon you and blessings be upon you.
I have the sum of $27.5 million USD for investment, I am interested in
you for investment project assistance in your country. My name is
Aisha Gaddafi and presently living in Oman, I am a Widow and single
Mother with three Children, the only biological Daughter of late
Libyan President (Late Colonel Muammar Gaddafi) and presently I am
under political asylum protection by the Omani Government.
Kindly reply urgently for more details.
my email address below: ayishagddafi@mail.ru
Thanks
Yours Truly Aisha
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments