Beneficiary spam from Google
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 11 Sep 2022 05:49:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oXKuV-000IrQ-Hf
for dave@doctor.nl2k.ab.ca;
Sun, 11 Sep 2022 05:13:59 -0600
Resent-From: The Doctor
Resent-Date: Sun, 11 Sep 2022 05:13:59 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-wr1-f52.google.com ([209.85.221.52]:34350)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1oXHxQ-00041H-S6
for doctor@doctor.nl2k.ab.ca;
Sun, 11 Sep 2022 02:04:52 -0600
Received: by mail-wr1-f52.google.com with SMTP id d2so10549384wrn.1
for; Sun, 11 Sep 2022 01:04:27 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:sender:mime-version:from:to:cc
:subject:date;
bh=mRvFG1IRpXvjhykFOiOuj6LKoiGo2pxbZ+7xChpy/6g=;
b=bFVRdmWuOTtdc6axiEbplfi92jAT/h5FZ5cpmxagMChVBR/iadOgNAjNTmJgy0lO68
AtrUOFHv8V+lOoPbbkNzM4gj7FDASJikxJ9myIYxt5Tvrw+iQ6TE1lei09sWcQdU58qR
mRzwFhI8j0rnZHmv96e+jE2sufktzjg1SVuf8JsZNXMI3GBdEhXo/EetHsNPT07vHYhq
BpkfeHh88/RX7Z7hDSbf44B+DInImDka3ZoVG2VY+E21uAftvFJHOAzhUPrUcM95Z7nU
xnB15q3plOn1sCokPQawdAG92QVAO6qp5l9YWSIsOyeHKt0LmoK0ctLP0A9j5PkxYuJV
Qw7g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:sender:mime-version
:x-gm-message-state:from:to:cc:subject:date;
bh=mRvFG1IRpXvjhykFOiOuj6LKoiGo2pxbZ+7xChpy/6g=;
b=6gnfJjlw8l13oaHZYfxoZrSBU1602XgH71+i0ICiAlft6sFmGRuxoT84mavlPUN3cM
e0UctUSecfyRpw4R7i1S7GzsJk4ASsBUBrpQeUVzGb2/zz8V1rsb+3KIz856fyeR7qnr
j+8ItiShH1SN+s0cqMBh9eLB4rYspaCgamq9IgBTVMiLCqVIuFP7pe4SKZHASn4i7QuA
PwJ/kMCQ4/uSqwm5EQ0d+kpyaatAMWKLOyjdVGMWEuckReQgXtnDf5F17BaJa6SYIuNQ
fD3m+0skjoIhhswfhQxi9EGs/+SEO+PB7BlbCrDLt0L/u4rB52PFHu4hv5TAZ1BmXK4T
J50Q==
X-Gm-Message-State: ACgBeo2p+bW6PNh/Xw2wP8XzqnVr9w9aEzpVD3funLeDzCikEesMhhKu
dX2riACIkKR2UmUWU7PyJvFZsSu4n8F6i8kMZcs=
X-Google-Smtp-Source: AA6agR7L7TXFsMuzP/ZUoBeXAsluKihwKtgFqLlk63JQyOapA125HCNlKxJu6q2mJQfyYqYdp0ngfFvg+AsGyvYb9PY=
X-Received: by 2002:a05:6000:1563:b0:222:c827:1a19 with SMTP id
3-20020a056000156300b00222c8271a19mr11750125wrz.705.1662883460395; Sun, 11
Sep 2022 01:04:20 -0700 (PDT)
MIME-Version: 1.0
Sender: lw188904@gmail.com
Received: by 2002:a05:6020:f508:b0:213:fe23:42ed with HTTP; Sun, 11 Sep 2022
01:04:19 -0700 (PDT)
From: "Mrs Yu. Ging Yunnan"
Date: Sun, 11 Sep 2022 08:04:19 +0000
X-Google-Sender-Auth: V5bhXiCNthXalrhXayW3TR8CHnE
Message-ID:
Subject: hello dear
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 5.5
X-Spam_score_int: 55
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: hello I am Mrs Yu. Ging Yunnan, and i have Covid-19 and the
doctor said I will not survive it because all vaccines has been given to
me but to no avian, am a China woman but I base here in France because am
married here and I have no child for my late husband and now am a widow.
Content analysis details: (5.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[lw188904[at]gmail.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.221.52 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[lw188904[at]gmail.com]
2.5 MILLION_USD BODY: Talks about millions of dollars
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
1.5 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} hello dear
hello
I am Mrs Yu. Ging Yunnan, and i have Covid-19 and the doctor said I
will not survive it because all vaccines has been given to me but to
no avian, am a China
woman but I base here in France because am married here and I have no
child for my late husband and now am a widow.
My reason of communicating you is that i have $14 .2million USD which
was deposited in BNP Paribas Bank here in France by my late husband
which am the next of
kin to and I want you to stand as the beneficiary for the claim now
that am about to end my race according to my doctor.
I will want you to use the fund to build an orphanage home in my name
there in your country, please kindly reply to this message urgently if
willing to handle this project.
Mrs Yu. Ging Yunnan.
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 11 Sep 2022 05:49:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oXKuV-000IrQ-Hf
for dave@doctor.nl2k.ab.ca;
Sun, 11 Sep 2022 05:13:59 -0600
Resent-From: The Doctor
Resent-Date: Sun, 11 Sep 2022 05:13:59 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-wr1-f52.google.com ([209.85.221.52]:34350)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1oXHxQ-00041H-S6
for doctor@doctor.nl2k.ab.ca;
Sun, 11 Sep 2022 02:04:52 -0600
Received: by mail-wr1-f52.google.com with SMTP id d2so10549384wrn.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:sender:mime-version:from:to:cc
:subject:date;
bh=mRvFG1IRpXvjhykFOiOuj6LKoiGo2pxbZ+7xChpy/6g=;
b=bFVRdmWuOTtdc6axiEbplfi92jAT/h5FZ5cpmxagMChVBR/iadOgNAjNTmJgy0lO68
AtrUOFHv8V+lOoPbbkNzM4gj7FDASJikxJ9myIYxt5Tvrw+iQ6TE1lei09sWcQdU58qR
mRzwFhI8j0rnZHmv96e+jE2sufktzjg1SVuf8JsZNXMI3GBdEhXo/EetHsNPT07vHYhq
BpkfeHh88/RX7Z7hDSbf44B+DInImDka3ZoVG2VY+E21uAftvFJHOAzhUPrUcM95Z7nU
xnB15q3plOn1sCokPQawdAG92QVAO6qp5l9YWSIsOyeHKt0LmoK0ctLP0A9j5PkxYuJV
Qw7g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:sender:mime-version
:x-gm-message-state:from:to:cc:subject:date;
bh=mRvFG1IRpXvjhykFOiOuj6LKoiGo2pxbZ+7xChpy/6g=;
b=6gnfJjlw8l13oaHZYfxoZrSBU1602XgH71+i0ICiAlft6sFmGRuxoT84mavlPUN3cM
e0UctUSecfyRpw4R7i1S7GzsJk4ASsBUBrpQeUVzGb2/zz8V1rsb+3KIz856fyeR7qnr
j+8ItiShH1SN+s0cqMBh9eLB4rYspaCgamq9IgBTVMiLCqVIuFP7pe4SKZHASn4i7QuA
PwJ/kMCQ4/uSqwm5EQ0d+kpyaatAMWKLOyjdVGMWEuckReQgXtnDf5F17BaJa6SYIuNQ
fD3m+0skjoIhhswfhQxi9EGs/+SEO+PB7BlbCrDLt0L/u4rB52PFHu4hv5TAZ1BmXK4T
J50Q==
X-Gm-Message-State: ACgBeo2p+bW6PNh/Xw2wP8XzqnVr9w9aEzpVD3funLeDzCikEesMhhKu
dX2riACIkKR2UmUWU7PyJvFZsSu4n8F6i8kMZcs=
X-Google-Smtp-Source: AA6agR7L7TXFsMuzP/ZUoBeXAsluKihwKtgFqLlk63JQyOapA125HCNlKxJu6q2mJQfyYqYdp0ngfFvg+AsGyvYb9PY=
X-Received: by 2002:a05:6000:1563:b0:222:c827:1a19 with SMTP id
3-20020a056000156300b00222c8271a19mr11750125wrz.705.1662883460395; Sun, 11
Sep 2022 01:04:20 -0700 (PDT)
MIME-Version: 1.0
Sender: lw188904@gmail.com
Received: by 2002:a05:6020:f508:b0:213:fe23:42ed with HTTP; Sun, 11 Sep 2022
01:04:19 -0700 (PDT)
From: "Mrs Yu. Ging Yunnan"
Date: Sun, 11 Sep 2022 08:04:19 +0000
X-Google-Sender-Auth: V5bhXiCNthXalrhXayW3TR8CHnE
Message-ID:
Subject: hello dear
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 5.5
X-Spam_score_int: 55
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: hello I am Mrs Yu. Ging Yunnan, and i have Covid-19 and the
doctor said I will not survive it because all vaccines has been given to
me but to no avian, am a China woman but I base here in France because am
married here and I have no child for my late husband and now am a widow.
Content analysis details: (5.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[lw188904[at]gmail.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.221.52 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[lw188904[at]gmail.com]
2.5 MILLION_USD BODY: Talks about millions of dollars
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
1.5 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} hello dear
hello
I am Mrs Yu. Ging Yunnan, and i have Covid-19 and the doctor said I
will not survive it because all vaccines has been given to me but to
no avian, am a China
woman but I base here in France because am married here and I have no
child for my late husband and now am a widow.
My reason of communicating you is that i have $14 .2million USD which
was deposited in BNP Paribas Bank here in France by my late husband
which am the next of
kin to and I want you to stand as the beneficiary for the claim now
that am about to end my race according to my doctor.
I will want you to use the fund to build an orphanage home in my name
there in your country, please kindly reply to this message urgently if
willing to handle this project.
Mrs Yu. Ging Yunnan.
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments