Business deal spam from Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 14 Sep 2022 07:07:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oYS5Y-000MNT-OH
for dave@doctor.nl2k.ab.ca;
Wed, 14 Sep 2022 07:06:00 -0600
Resent-From: The Doctor
Resent-Date: Wed, 14 Sep 2022 07:06:00 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-lj1-f173.google.com ([209.85.208.173]:42621)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1oYN5B-0009Jh-Sc
for doctor@doctor.nl2k.ab.ca;
Wed, 14 Sep 2022 01:45:21 -0600
Received: by mail-lj1-f173.google.com with SMTP id l12so17202468ljg.9
for; Wed, 14 Sep 2022 00:45:00 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date;
bh=fI8FVxk8qFBjRisSy+R5dbptBQHa/0ksyQMmVsF1ZSQ=;
b=D9SnrBoPpOqxRea1Y9nsb0xaaBH0xt47j3s/pc3AaqRVYmFRRcITbxYXo7YhGB3CTa
QeSPIjQx1OVkDWRI1/FewLt/RH+KfW/FZG9uuGPRKCrKkywVm7DE331SGMhTAA1iXlv5
AhRzaS49aYnEjw7EZGVJRY7rBYMeVeNLZ12rfHUmzodu6Yzny1C+UH1JCEtpSbhdVltE
5DIqo+ENLJvHoPOFYRlTe8ujJfj5Nmo7vUvE3Ij8DrW2NvFMnQnVEbrmU4Y896QfSZy7
uIrvqUR5MDU5/8jII283Si681jdCGdCKSpSXgyeqM05qycv8S656rRm05J2WQTx0LeV0
33AA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date;
bh=fI8FVxk8qFBjRisSy+R5dbptBQHa/0ksyQMmVsF1ZSQ=;
b=PaFlzSzM8gzswTxR9J4VlsVpx4QVsXNxvGcyq8/1H7+wA6B/j2s6JtH56jDFsqG/Kk
P6t0Mg09I4gt3m1SphD0i87HlZCUv4W+jaSxDP5c36TIdzxZZAkcDIc5rjOqz7yFNDdL
+N4NoXgaIQvXiBQn0jI2sUuJsG/Qr2d2BriVzX+GVug9oNPmwgPmocukBw46bYft4vVW
zgybtbYfaicASUH615nrh4n7qnNJ1Jd6FFql++crE950K+2Nr0b5Cc50UyV/VKxdYDwA
KgMbPfiIRNQFw83/ALeXXhdZlSKuL+6iBqwDvtwtnIhk3JdK0mahgG1ujOAV+HDYJAOI
zxeQ==
X-Gm-Message-State: ACgBeo1r3OA0h6rei/3mBBiJZaG70QTsSRre+9hcnrIiscUxDZkXFnye
msZ9IfG1UpqQxV/djITNXKbuQ9262kclGyQE1UY=
X-Google-Smtp-Source: AA6agR5LTeCOfUDolh9m//jEr6E+RsiAveD69Hh8ysAWqb91XATj2GPKGD1d4Jp2QWLYPZ7VvE5//CDT7fqWEXO50lU=
X-Received: by 2002:a2e:97d5:0:b0:26c:1d93:1a0 with SMTP id
m21-20020a2e97d5000000b0026c1d9301a0mr1656639ljj.322.1663141493816; Wed, 14
Sep 2022 00:44:53 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a2e:be14:0:0:0:0:0 with HTTP; Wed, 14 Sep 2022 00:44:53
-0700 (PDT)
Reply-To: tonybanneth@gmail.com
From: "Mr. Tony Banneth"
Date: Wed, 14 Sep 2022 00:44:53 -0700
Message-ID:
Subject: hello
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 16.7
X-Spam_score_int: 167
X-Spam_bar: ++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: DEAR FRIEND I am(Mr.Tony Banneth),With the business proposal
deal of US(US$10.5 million) to transfer into your account, if you are interested
get back to me for more detail at my E-Your Urgent,my private Email Address,(
tonybanneth@gmail.com )
Content analysis details: (16.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.173 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[rnandluise552[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[rnandluise552[at]gmail.com]
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal
information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
1.5 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} hello
DEAR FRIEND
I am(Mr.Tony Banneth),With the business proposal deal of US(US$10.5
million) to transfer into your account, if you are interested get back
to me for more detail at my E-Your
Urgent,my private Email Address,( tonybanneth@gmail.com )
Thanks with my Best Regards
Thanks
Mr.Tony Banneth
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 14 Sep 2022 07:07:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oYS5Y-000MNT-OH
for dave@doctor.nl2k.ab.ca;
Wed, 14 Sep 2022 07:06:00 -0600
Resent-From: The Doctor
Resent-Date: Wed, 14 Sep 2022 07:06:00 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-lj1-f173.google.com ([209.85.208.173]:42621)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1oYN5B-0009Jh-Sc
for doctor@doctor.nl2k.ab.ca;
Wed, 14 Sep 2022 01:45:21 -0600
Received: by mail-lj1-f173.google.com with SMTP id l12so17202468ljg.9
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date;
bh=fI8FVxk8qFBjRisSy+R5dbptBQHa/0ksyQMmVsF1ZSQ=;
b=D9SnrBoPpOqxRea1Y9nsb0xaaBH0xt47j3s/pc3AaqRVYmFRRcITbxYXo7YhGB3CTa
QeSPIjQx1OVkDWRI1/FewLt/RH+KfW/FZG9uuGPRKCrKkywVm7DE331SGMhTAA1iXlv5
AhRzaS49aYnEjw7EZGVJRY7rBYMeVeNLZ12rfHUmzodu6Yzny1C+UH1JCEtpSbhdVltE
5DIqo+ENLJvHoPOFYRlTe8ujJfj5Nmo7vUvE3Ij8DrW2NvFMnQnVEbrmU4Y896QfSZy7
uIrvqUR5MDU5/8jII283Si681jdCGdCKSpSXgyeqM05qycv8S656rRm05J2WQTx0LeV0
33AA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date;
bh=fI8FVxk8qFBjRisSy+R5dbptBQHa/0ksyQMmVsF1ZSQ=;
b=PaFlzSzM8gzswTxR9J4VlsVpx4QVsXNxvGcyq8/1H7+wA6B/j2s6JtH56jDFsqG/Kk
P6t0Mg09I4gt3m1SphD0i87HlZCUv4W+jaSxDP5c36TIdzxZZAkcDIc5rjOqz7yFNDdL
+N4NoXgaIQvXiBQn0jI2sUuJsG/Qr2d2BriVzX+GVug9oNPmwgPmocukBw46bYft4vVW
zgybtbYfaicASUH615nrh4n7qnNJ1Jd6FFql++crE950K+2Nr0b5Cc50UyV/VKxdYDwA
KgMbPfiIRNQFw83/ALeXXhdZlSKuL+6iBqwDvtwtnIhk3JdK0mahgG1ujOAV+HDYJAOI
zxeQ==
X-Gm-Message-State: ACgBeo1r3OA0h6rei/3mBBiJZaG70QTsSRre+9hcnrIiscUxDZkXFnye
msZ9IfG1UpqQxV/djITNXKbuQ9262kclGyQE1UY=
X-Google-Smtp-Source: AA6agR5LTeCOfUDolh9m//jEr6E+RsiAveD69Hh8ysAWqb91XATj2GPKGD1d4Jp2QWLYPZ7VvE5//CDT7fqWEXO50lU=
X-Received: by 2002:a2e:97d5:0:b0:26c:1d93:1a0 with SMTP id
m21-20020a2e97d5000000b0026c1d9301a0mr1656639ljj.322.1663141493816; Wed, 14
Sep 2022 00:44:53 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a2e:be14:0:0:0:0:0 with HTTP; Wed, 14 Sep 2022 00:44:53
-0700 (PDT)
Reply-To: tonybanneth@gmail.com
From: "Mr. Tony Banneth"
Date: Wed, 14 Sep 2022 00:44:53 -0700
Message-ID:
Subject: hello
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 16.7
X-Spam_score_int: 167
X-Spam_bar: ++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: DEAR FRIEND I am(Mr.Tony Banneth),With the business proposal
deal of US(US$10.5 million) to transfer into your account, if you are interested
get back to me for more detail at my E-Your Urgent,my private Email Address,(
tonybanneth@gmail.com )
Content analysis details: (16.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.173 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[rnandluise552[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[rnandluise552[at]gmail.com]
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal
information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
1.5 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} hello
DEAR FRIEND
I am(Mr.Tony Banneth),With the business proposal deal of US(US$10.5
million) to transfer into your account, if you are interested get back
to me for more detail at my E-Your
Urgent,my private Email Address,( tonybanneth@gmail.com )
Thanks with my Best Regards
Thanks
Mr.Tony Banneth
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments