Nigerian Gmail spam
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 22 Sep 2022 17:16:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1obVPQ-000Dv0-SF
for dave@doctor.nl2k.ab.ca;
Thu, 22 Sep 2022 17:15:08 -0600
Resent-From: The Doctor
Resent-Date: Thu, 22 Sep 2022 17:15:08 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from smtp11-ia4-sp3.mta.salesforce.com ([13.110.74.202]:43422)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1obTav-0007er-QS
for doctor@nl2k.ab.ca;
Thu, 22 Sep 2022 15:18:58 -0600
Authentication-Results: mx2-ia4-sp3.mta.salesforce.com x-tls.subject="/C=US/ST=California/L=San Francisco/O=salesforce.com, inc./OU=0:app;1:ia4;2:ia4-sp3;3:na150;4:prod/CN=na150-app2-15-ia4.ops.sfdc.net"; auth=pass (cipher=ECDHE-RSA-AES256-GCM-SHA384)
Received: from [10.180.202.81] ([10.180.202.81:56189] helo=na150-app2-15-ia4.ops.sfdc.net)
by mx2-ia4-sp3.mta.salesforce.com (envelope-from)
(ecelerity 4.4.0.19839 r(msys-ecelerity:tags/4.4.0.0^0)) with ESMTPS (cipher=ECDHE-RSA-AES256-GCM-SHA384
subject="/C=US/ST=California/L=San Francisco/O=salesforce.com, inc./OU=0:app;1:ia4;2:ia4-sp3;3:na150;4:prod/CN=na150-app2-15-ia4.ops.sfdc.net")
id E1/D1-10547-021DC236; Thu, 22 Sep 2022 21:18:24 +0000
Date: Thu, 22 Sep 2022 21:18:24 +0000 (GMT)
From: BARIS ISMAIL
Message-ID:
Subject: Hello Dear,
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_Part_9915_1983144822.1663881504854"
X-Priority: 3
X-SFDC-LK: 00D4x000008Zq0e
X-SFDC-User: 0054x000006IFUI
X-Sender: postmaster@salesforce.com
X-mail_abuse_inquiries: http://www.salesforce.com/company/abuse.jsp
X-SFDC-TLS-NoRelay: 1
X-SFDC-Binding: iCBT705cy8bBFz3B
X-SFDC-EmailCategory: apiSingleMail
X-SFDC-Interface: internal
X-Spam_score: 18.9
X-Spam_score_int: 189
X-Spam_bar: ++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello Dear, My name is barrister Baris Ismail of Ismailchambers.
I am sending you this email over the interest of my late client from your
country who was a contractor with the Turkish rail network here in Turkey
[...]
Content analysis details: (18.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[mustafabaris193[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received'
headers
1.2 MISSING_HEADERS Missing To: header
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
2.7 UNCLAIMED_MONEY BODY: People just leave money laying around
2.5 HK_SCAM_N2 BODY: No description available.
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.0 HTML_MESSAGE BODY: HTML included in message
1.4 MALFORMED_FREEMAIL Bad headers on message from free email
service
-0.0 T_SCC_BODY_TEXT_LINE No description available.
2.0 HK_SCAM No description available.
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and
EnvelopeFrom freemail headers are
different
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 MONEY_BARRISTER Lots of money from a UK lawyer
0.0 T_MONEY_PERCENT X% of a lot of money for you
0.0 FILL_THIS_FORM Fill in a form with personal information
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
0.0 MONEY_FORM Lots of money if you fill out a form
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
1.8 ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of
money
Subject: {SPAM?} Hello Dear,
------=_Part_9915_1983144822.1663881504854
Content-Type: multipart/alternative;
boundary="----=_Part_9914_888878578.1663881504854"
------=_Part_9914_888878578.1663881504854
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Hello Dear,
My name is barrister Baris Ismail of Ismailchambers. I am sending you this email over the interest of my late client from your country who was a contractor with the Turkish rail network here in Turkey in the late 80s and early 90s. He was a man loved by all before his tragic death. Since his demise, we have made several attempts to reach a family member or any relative to no avail.
The bank contacted me to present his next of kin to claim his deposit of $36,000,000.00 with Turkish business bank (ISBANK) here in turkey within the next 7 working days or the bank will confiscate his account as an unclaimed fund, because of this mandate, I went in search and i find out you are also from the same country, I am writing to inform you that I will like to present you to the bank as his next of kin. You will be entitled to 50%, I will take 50% also.
Before we proceed, I will like you to send me your personal data such as:
Your full names
Address, City, Country, Telephone numbers,
Private email Occupation, Date of birth
Marital Status
As soon as you provide your contact details, I will complete the application and forward it to the bank to get in contact with you regarding the fund transfer proper. Do not be afraid, everything will work out in good faith and you will never have anything to regret.
Warmest Regards,
Barrister Baris Ismail
------=_Part_9914_888878578.1663881504854
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
Hello Dear,
My name is barrister Baris Ismail of Ismailchambers. I am sending you this email over the interest of my late client from your country who was a contractor with the Turkish rail network here in Turkey in the late 80s and early 90s. He was a man loved by all before his tragic death. Since his demise, we have made several attempts to reach a family member or any relative to no avail.
The bank contacted me to present his next of kin to claim his deposit of $36,000,000.00 with Turkish business bank (ISBANK) here in turkey within the next 7 working days or the bank will confiscate his account as an unclaimed fund, because of this mandate, I went in search and i find out you are also from the same country, I am writing to inform you that I will like to present you to the bank as his next of kin. You will be entitled to 50%, I will take 50% also.
Before we proceed, I will like you to send me your personal data such as:
Your full names
Address, City, Country, Telephone numbers,
Private email Occupation, Date of birth
Marital Status
As soon as you provide your contact details, I will complete the application and forward it to the bank to get in contact with you regarding the fund transfer proper. Do not be afraid, everything will work out in good faith and you will never have anything to regret.
Warmest Regards,
Barrister Baris Ismail
------=_Part_9914_888878578.1663881504854--
------=_Part_9915_1983144822.1663881504854--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 22 Sep 2022 17:16:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1obVPQ-000Dv0-SF
for dave@doctor.nl2k.ab.ca;
Thu, 22 Sep 2022 17:15:08 -0600
Resent-From: The Doctor
Resent-Date: Thu, 22 Sep 2022 17:15:08 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from smtp11-ia4-sp3.mta.salesforce.com ([13.110.74.202]:43422)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from
id 1obTav-0007er-QS
for doctor@nl2k.ab.ca;
Thu, 22 Sep 2022 15:18:58 -0600
Authentication-Results: mx2-ia4-sp3.mta.salesforce.com x-tls.subject="/C=US/ST=California/L=San Francisco/O=salesforce.com, inc./OU=0:app;1:ia4;2:ia4-sp3;3:na150;4:prod/CN=na150-app2-15-ia4.ops.sfdc.net"; auth=pass (cipher=ECDHE-RSA-AES256-GCM-SHA384)
Received: from [10.180.202.81] ([10.180.202.81:56189] helo=na150-app2-15-ia4.ops.sfdc.net)
by mx2-ia4-sp3.mta.salesforce.com (envelope-from
(ecelerity 4.4.0.19839 r(msys-ecelerity:tags/4.4.0.0^0)) with ESMTPS (cipher=ECDHE-RSA-AES256-GCM-SHA384
subject="/C=US/ST=California/L=San Francisco/O=salesforce.com, inc./OU=0:app;1:ia4;2:ia4-sp3;3:na150;4:prod/CN=na150-app2-15-ia4.ops.sfdc.net")
id E1/D1-10547-021DC236; Thu, 22 Sep 2022 21:18:24 +0000
Date: Thu, 22 Sep 2022 21:18:24 +0000 (GMT)
From: BARIS ISMAIL
Message-ID:
Subject: Hello Dear,
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_Part_9915_1983144822.1663881504854"
X-Priority: 3
X-SFDC-LK: 00D4x000008Zq0e
X-SFDC-User: 0054x000006IFUI
X-Sender: postmaster@salesforce.com
X-mail_abuse_inquiries: http://www.salesforce.com/company/abuse.jsp
X-SFDC-TLS-NoRelay: 1
X-SFDC-Binding: iCBT705cy8bBFz3B
X-SFDC-EmailCategory: apiSingleMail
X-SFDC-Interface: internal
X-Spam_score: 18.9
X-Spam_score_int: 189
X-Spam_bar: ++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello Dear, My name is barrister Baris Ismail of Ismailchambers.
I am sending you this email over the interest of my late client from your
country who was a contractor with the Turkish rail network here in Turkey
[...]
Content analysis details: (18.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[mustafabaris193[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received'
headers
1.2 MISSING_HEADERS Missing To: header
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
2.7 UNCLAIMED_MONEY BODY: People just leave money laying around
2.5 HK_SCAM_N2 BODY: No description available.
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.0 HTML_MESSAGE BODY: HTML included in message
1.4 MALFORMED_FREEMAIL Bad headers on message from free email
service
-0.0 T_SCC_BODY_TEXT_LINE No description available.
2.0 HK_SCAM No description available.
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and
EnvelopeFrom freemail headers are
different
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 MONEY_BARRISTER Lots of money from a UK lawyer
0.0 T_MONEY_PERCENT X% of a lot of money for you
0.0 FILL_THIS_FORM Fill in a form with personal information
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
0.0 MONEY_FORM Lots of money if you fill out a form
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
1.8 ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of
money
Subject: {SPAM?} Hello Dear,
------=_Part_9915_1983144822.1663881504854
Content-Type: multipart/alternative;
boundary="----=_Part_9914_888878578.1663881504854"
------=_Part_9914_888878578.1663881504854
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Hello Dear,
My name is barrister Baris Ismail of Ismailchambers. I am sending you this email over the interest of my late client from your country who was a contractor with the Turkish rail network here in Turkey in the late 80s and early 90s. He was a man loved by all before his tragic death. Since his demise, we have made several attempts to reach a family member or any relative to no avail.
The bank contacted me to present his next of kin to claim his deposit of $36,000,000.00 with Turkish business bank (ISBANK) here in turkey within the next 7 working days or the bank will confiscate his account as an unclaimed fund, because of this mandate, I went in search and i find out you are also from the same country, I am writing to inform you that I will like to present you to the bank as his next of kin. You will be entitled to 50%, I will take 50% also.
Before we proceed, I will like you to send me your personal data such as:
Your full names
Address, City, Country, Telephone numbers,
Private email Occupation, Date of birth
Marital Status
As soon as you provide your contact details, I will complete the application and forward it to the bank to get in contact with you regarding the fund transfer proper. Do not be afraid, everything will work out in good faith and you will never have anything to regret.
Warmest Regards,
Barrister Baris Ismail
------=_Part_9914_888878578.1663881504854
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
Hello Dear,
My name is barrister Baris Ismail of Ismailchambers. I am sending you this email over the interest of my late client from your country who was a contractor with the Turkish rail network here in Turkey in the late 80s and early 90s. He was a man loved by all before his tragic death. Since his demise, we have made several attempts to reach a family member or any relative to no avail.
The bank contacted me to present his next of kin to claim his deposit of $36,000,000.00 with Turkish business bank (ISBANK) here in turkey within the next 7 working days or the bank will confiscate his account as an unclaimed fund, because of this mandate, I went in search and i find out you are also from the same country, I am writing to inform you that I will like to present you to the bank as his next of kin. You will be entitled to 50%, I will take 50% also.
Before we proceed, I will like you to send me your personal data such as:
Your full names
Address, City, Country, Telephone numbers,
Private email Occupation, Date of birth
Marital Status
As soon as you provide your contact details, I will complete the application and forward it to the bank to get in contact with you regarding the fund transfer proper. Do not be afraid, everything will work out in good faith and you will never have anything to regret.
Warmest Regards,
Barrister Baris Ismail
------=_Part_9914_888878578.1663881504854--
------=_Part_9915_1983144822.1663881504854--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments