Nigerian Spam from Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 28 Oct 2022 07:12:00 -0600
Received: from mail-ej1-f45.google.com ([209.85.218.45]:35372)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1ooP7C-0005PE-LD
for dave@doctor.nl2k.ab.ca;
Fri, 28 Oct 2022 07:09:42 -0600
Received: by mail-ej1-f45.google.com with SMTP id k2so12838359ejr.2
for; Fri, 28 Oct 2022 06:06:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=YylRXckiME2pjmaz75rKj87/Ohoz0jSgXcLk3jQYJRI=;
b=kCFg0AHnzfLQ2GOXrKDgJ1UUczUJMcutey4v/Zex4zfTRAqTZeAo+cN7t3pQcbpyCC
ADhMQXzzCWep8rKY0TkF6Evo90aaQ9ngzHepIIXJgouAqddTF8s+Hy5sL8zky+YlgU3R
Jkkf+IEphlYiofrtVUqqpETYJm0jv8shghdbxq0ksjvArHxqw6oBLKrJ3Vtm0Hk+Z21z
/5mupWgqfpqCOC8CkooZ30+RiOTxsQjtsI0n9AU8yetIgq+w11eYLzTMtKCVXEXewbQH
jTv89ufkhoX6d3xFBX4+mJ4EJQ4wqdk5rcduvi7wmlWKbj8gYsS1IcJWNUGUPLJ0E/Sm
fvxw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=YylRXckiME2pjmaz75rKj87/Ohoz0jSgXcLk3jQYJRI=;
b=k+Jm7iYbAoWaLiH/XMBCoieUGnl/kYTOUUeVOMUcPmNNn1HKMLMx6r8XJrHpLo0/jS
mj0RLQcloQp5K2REWuJWwhURTxHRJOk1UiGsGMmYxnSYbAo5jo/RqyN31hDVeCWIjmOx
7QL8bnRZUKyfX4qexRr3rh5miZTvyaeu5BoJILNPZIfwa+LqjBxnbsD4JIfKiMNuFJkN
C5N/1HmgIYBqUcV7lXAe7pXLTY1iLiUcsz6iZAS68wAnJPn+CRCT8GPXNOi5SuVMVw2A
g6sb47TOjnuW87On8ib0EW7VCqAYH3+L8Vn5P2jmgcuGBCRgOeqiaFvxGj5vcwowmbm8
LYIA==
X-Gm-Message-State: ACrzQf0zkQdu7hi71gqgZKKQqXZHZv9ZgSxBkJpHbPpqU35gmCJIG/uh
mR2CiZHtN4PLq8TL/hVYRnWqv37U0xSqxyuy8LM=
X-Google-Smtp-Source: AMsMyM6foMOTG7Pd4YFhs53oWQkf914VJQ3GNSPoJetg70vo4UXm0bPFodJVKjZYGzQ5HZm24yCspfF0+MeJljeijPc=
X-Received: by 2002:a17:907:3188:b0:741:4bf7:ec1a with SMTP id
xe8-20020a170907318800b007414bf7ec1amr48148030ejb.448.1666962406778; Fri, 28
Oct 2022 06:06:46 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a98:8244:0:b0:186:5c33:4a72 with HTTP; Fri, 28 Oct 2022
06:06:45 -0700 (PDT)
Reply-To: fedminorg384@gmail.com
From: Johnny Rostov
Date: Fri, 28 Oct 2022 14:06:45 +0100
Message-ID:
Subject: Russian invation
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: dave@doctor.nl2k.ab.ca
X-Spam_score: 10.9
X-Spam_score_int: 109
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Sir, My name is Johnny Rostov I am a Ukrain business Entrepreneur
presently in a difficult predicament, as a result of the Invasion of Russia
by the Russian Government. Russia has been involved in a very horrible and
bloody war with Ukrain in which so many lives and properties were destroyed
and many atrocities were committed against humanity. I lost my immediate
fam [...]
Content analysis details: (10.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.218.45 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[fedminorg384[at]gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[tony.ajamba1968[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[tony.ajamba1968[at]gmail.com]
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.1 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Russian invation
Sir,
My name is Johnny Rostov I am a Ukrain business Entrepreneur
presently in a difficult predicament, as a result of the Invasion of
Russia by the Russian Government.
Russia has been involved in a very horrible and bloody war with Ukrain
in which so many lives and properties were destroyed and many
atrocities were committed against humanity. I lost my immediate family
(Wife and daughter) last week, so I decided to Reside here in a
refugee asylum as i survive the war since my late wife was from
Ukraine,
I have an existence funds deposited in Holland with a security firm
(15.5M Dollar), I want you to help me claim it to assist humanity if
possible displaced Ukraine citizens and to help me buy a house in your
country. Reply via email kiho7191@gmail.com
I shall provide you with full details upon your reply.
Sincerely,
Pray for us
Johnny Rostov
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 28 Oct 2022 07:12:00 -0600
Received: from mail-ej1-f45.google.com ([209.85.218.45]:35372)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1ooP7C-0005PE-LD
for dave@doctor.nl2k.ab.ca;
Fri, 28 Oct 2022 07:09:42 -0600
Received: by mail-ej1-f45.google.com with SMTP id k2so12838359ejr.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=YylRXckiME2pjmaz75rKj87/Ohoz0jSgXcLk3jQYJRI=;
b=kCFg0AHnzfLQ2GOXrKDgJ1UUczUJMcutey4v/Zex4zfTRAqTZeAo+cN7t3pQcbpyCC
ADhMQXzzCWep8rKY0TkF6Evo90aaQ9ngzHepIIXJgouAqddTF8s+Hy5sL8zky+YlgU3R
Jkkf+IEphlYiofrtVUqqpETYJm0jv8shghdbxq0ksjvArHxqw6oBLKrJ3Vtm0Hk+Z21z
/5mupWgqfpqCOC8CkooZ30+RiOTxsQjtsI0n9AU8yetIgq+w11eYLzTMtKCVXEXewbQH
jTv89ufkhoX6d3xFBX4+mJ4EJQ4wqdk5rcduvi7wmlWKbj8gYsS1IcJWNUGUPLJ0E/Sm
fvxw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=YylRXckiME2pjmaz75rKj87/Ohoz0jSgXcLk3jQYJRI=;
b=k+Jm7iYbAoWaLiH/XMBCoieUGnl/kYTOUUeVOMUcPmNNn1HKMLMx6r8XJrHpLo0/jS
mj0RLQcloQp5K2REWuJWwhURTxHRJOk1UiGsGMmYxnSYbAo5jo/RqyN31hDVeCWIjmOx
7QL8bnRZUKyfX4qexRr3rh5miZTvyaeu5BoJILNPZIfwa+LqjBxnbsD4JIfKiMNuFJkN
C5N/1HmgIYBqUcV7lXAe7pXLTY1iLiUcsz6iZAS68wAnJPn+CRCT8GPXNOi5SuVMVw2A
g6sb47TOjnuW87On8ib0EW7VCqAYH3+L8Vn5P2jmgcuGBCRgOeqiaFvxGj5vcwowmbm8
LYIA==
X-Gm-Message-State: ACrzQf0zkQdu7hi71gqgZKKQqXZHZv9ZgSxBkJpHbPpqU35gmCJIG/uh
mR2CiZHtN4PLq8TL/hVYRnWqv37U0xSqxyuy8LM=
X-Google-Smtp-Source: AMsMyM6foMOTG7Pd4YFhs53oWQkf914VJQ3GNSPoJetg70vo4UXm0bPFodJVKjZYGzQ5HZm24yCspfF0+MeJljeijPc=
X-Received: by 2002:a17:907:3188:b0:741:4bf7:ec1a with SMTP id
xe8-20020a170907318800b007414bf7ec1amr48148030ejb.448.1666962406778; Fri, 28
Oct 2022 06:06:46 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a98:8244:0:b0:186:5c33:4a72 with HTTP; Fri, 28 Oct 2022
06:06:45 -0700 (PDT)
Reply-To: fedminorg384@gmail.com
From: Johnny Rostov
Date: Fri, 28 Oct 2022 14:06:45 +0100
Message-ID:
Subject: Russian invation
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: dave@doctor.nl2k.ab.ca
X-Spam_score: 10.9
X-Spam_score_int: 109
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Sir, My name is Johnny Rostov I am a Ukrain business Entrepreneur
presently in a difficult predicament, as a result of the Invasion of Russia
by the Russian Government. Russia has been involved in a very horrible and
bloody war with Ukrain in which so many lives and properties were destroyed
and many atrocities were committed against humanity. I lost my immediate
fam [...]
Content analysis details: (10.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.218.45 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[fedminorg384[at]gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[tony.ajamba1968[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[tony.ajamba1968[at]gmail.com]
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.1 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Russian invation
Sir,
My name is Johnny Rostov I am a Ukrain business Entrepreneur
presently in a difficult predicament, as a result of the Invasion of
Russia by the Russian Government.
Russia has been involved in a very horrible and bloody war with Ukrain
in which so many lives and properties were destroyed and many
atrocities were committed against humanity. I lost my immediate family
(Wife and daughter) last week, so I decided to Reside here in a
refugee asylum as i survive the war since my late wife was from
Ukraine,
I have an existence funds deposited in Holland with a security firm
(15.5M Dollar), I want you to help me claim it to assist humanity if
possible displaced Ukraine citizens and to help me buy a house in your
country. Reply via email kiho7191@gmail.com
I shall provide you with full details upon your reply.
Sincerely,
Pray for us
Johnny Rostov
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments