Nigerian Gmail spam
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 17 Nov 2022 05:12:22 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1ovdjt-000K7h-Sq
for dave@doctor.nl2k.ab.ca;
Thu, 17 Nov 2022 05:11:29 -0700
Resent-From: The Doctor
Resent-Date: Thu, 17 Nov 2022 05:11:29 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pl1-f172.google.com ([209.85.214.172]:33283)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1ovbvc-000LeH-SA
for doctor@doctor.nl2k.ab.ca;
Thu, 17 Nov 2022 03:15:33 -0700
Received: by mail-pl1-f172.google.com with SMTP id 4so1216577pli.0
for; Thu, 17 Nov 2022 02:13:00 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=content-transfer-encoding:to:subject:message-id:date:from
:mime-version:from:to:cc:subject:date:message-id:reply-to;
bh=zmhFbuHYca4cp38KpngWPJ1shQyp0x6oc7UpOh3xY3o=;
b=O3BlQPd0CuH3AyoXYUP4Iw1Oge73xtw4vwOKqYtj9wUiAiV2543r11Tf42+xLk7lJ8
uECexDp+U62GJlx8bGy5AjcOWr45nYuu6wDTpfa8JQ35f6AkFAH8sYwTcbz8H7eRJKhH
saQuC5X/NcVVGc1gJCbcXTm/l6EKQugtfeJM7JCTndjoFDtX64v4ujjWFKevYAzwwW9h
nbJeKOXxZn7fOOtnvVXr8gUugf3hHKUrW/xCs3tJMjRNQEtLuyX6vY3pCXJsxa5kaDtE
oR/srgE6uBtkMM+2egI8L+NgBFxiBm/cfr169GpGBoVI1tvZT8+Ub0eW5VmHZtV6/LS9
NRLA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=content-transfer-encoding:to:subject:message-id:date:from
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=zmhFbuHYca4cp38KpngWPJ1shQyp0x6oc7UpOh3xY3o=;
b=WzRuzov7XtKPD6Rl4s9LskDimCA3ECMyUS5f0+PklSR7GTPJKYzhhq5ZNuDrQkS/B+
9X+vuduXHMuo1uNzxXpy6nvGsNiOFsf+X/el87Mw2/Ayjb7Rt/afFFnkzsLfIaykrtcI
ly5NIliIt8qyCrs4TMF//qaCHtn/f3iG9zZS5249PpOaDyFqn2oGgxxp+/ArpS2luewF
9cI8fD262FIMXQGq7OO+oQqOlrP7plL7Et1lEsVn9DCndgT7sW+Gyhv8ixZSIsULFM9/
D/2NKoP7nZb65P4lSiUkg9e/JCf9wjlrrULXCeQKFKx3DFfEfmlYsNoSe1QRAJp3CIIa
0a+Q==
X-Gm-Message-State: ANoB5pn7Wk0qoa0LWwNNRB5mOStox6krccCHFTxo/jb5mp41RZWMWL8n
r+GSYkRmAeHrC5x+K6WDUy7oADMS5jo64TxYlck=
X-Google-Smtp-Source: AA0mqf6grAFpE+nyNRKNZiJt70hdEsSvDOHqwGPZoplbLZncwDbLKSUtj3ZQyuKr/UowAgrQ8WwwDT6i3y8o+mSmGNo=
X-Received: by 2002:a17:90a:ce97:b0:20a:8f71:4fc with SMTP id
g23-20020a17090ace9700b0020a8f7104fcmr8064742pju.59.1668679974478; Thu, 17
Nov 2022 02:12:54 -0800 (PST)
MIME-Version: 1.0
Received: by 2002:a05:6a10:e253:b0:358:9b0c:36a with HTTP; Thu, 17 Nov 2022
02:12:54 -0800 (PST)
From: INFO ECOWAS
Date: Thu, 17 Nov 2022 10:12:54 +0000
Message-ID:
Subject: Contact this office
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 10.8
X-Spam_score_int: 108
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: The Economic Community of West African States (ECOWAS) pays
3.5 million dollars in compensation to all scammed victims and those whose
email addresses and other personal data are being restored. Your [...]
Content analysis details: (10.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[infoecowas55[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[infoecowas55[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/,
no trust
[209.85.214.172 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.214.172 listed in wl.mailspike.net]
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLY From and body contain different freemails
1.5 MONEY_ATM_CARD Lots of money on an ATM card
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal
information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
3.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Contact this office
The Economic Community of West African States (ECOWAS) pays 3.5
million dollars in compensation to all scammed victims and those whose
email addresses and other personal data are being restored.
Your money will be sent directly to you in the form of an ATM card,
the card contains an amount of 3.500 million dollars.
Our official diplomat will take your package to your doorstep to avoid
being intercepted
The information below are required where your ATM card will be
delivered, such as;
Your receiver=E2=80=99s name:--------
Country of origin:-----------
Address:---------------------
Phone number:----------------
Thanks,
Sincerely,
I am Mr PAUL KITTO, Contact this office e-mail: for more.(ecowasinf@gmail.c=
om)
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 17 Nov 2022 05:12:22 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1ovdjt-000K7h-Sq
for dave@doctor.nl2k.ab.ca;
Thu, 17 Nov 2022 05:11:29 -0700
Resent-From: The Doctor
Resent-Date: Thu, 17 Nov 2022 05:11:29 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pl1-f172.google.com ([209.85.214.172]:33283)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1ovbvc-000LeH-SA
for doctor@doctor.nl2k.ab.ca;
Thu, 17 Nov 2022 03:15:33 -0700
Received: by mail-pl1-f172.google.com with SMTP id 4so1216577pli.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=content-transfer-encoding:to:subject:message-id:date:from
:mime-version:from:to:cc:subject:date:message-id:reply-to;
bh=zmhFbuHYca4cp38KpngWPJ1shQyp0x6oc7UpOh3xY3o=;
b=O3BlQPd0CuH3AyoXYUP4Iw1Oge73xtw4vwOKqYtj9wUiAiV2543r11Tf42+xLk7lJ8
uECexDp+U62GJlx8bGy5AjcOWr45nYuu6wDTpfa8JQ35f6AkFAH8sYwTcbz8H7eRJKhH
saQuC5X/NcVVGc1gJCbcXTm/l6EKQugtfeJM7JCTndjoFDtX64v4ujjWFKevYAzwwW9h
nbJeKOXxZn7fOOtnvVXr8gUugf3hHKUrW/xCs3tJMjRNQEtLuyX6vY3pCXJsxa5kaDtE
oR/srgE6uBtkMM+2egI8L+NgBFxiBm/cfr169GpGBoVI1tvZT8+Ub0eW5VmHZtV6/LS9
NRLA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=content-transfer-encoding:to:subject:message-id:date:from
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=zmhFbuHYca4cp38KpngWPJ1shQyp0x6oc7UpOh3xY3o=;
b=WzRuzov7XtKPD6Rl4s9LskDimCA3ECMyUS5f0+PklSR7GTPJKYzhhq5ZNuDrQkS/B+
9X+vuduXHMuo1uNzxXpy6nvGsNiOFsf+X/el87Mw2/Ayjb7Rt/afFFnkzsLfIaykrtcI
ly5NIliIt8qyCrs4TMF//qaCHtn/f3iG9zZS5249PpOaDyFqn2oGgxxp+/ArpS2luewF
9cI8fD262FIMXQGq7OO+oQqOlrP7plL7Et1lEsVn9DCndgT7sW+Gyhv8ixZSIsULFM9/
D/2NKoP7nZb65P4lSiUkg9e/JCf9wjlrrULXCeQKFKx3DFfEfmlYsNoSe1QRAJp3CIIa
0a+Q==
X-Gm-Message-State: ANoB5pn7Wk0qoa0LWwNNRB5mOStox6krccCHFTxo/jb5mp41RZWMWL8n
r+GSYkRmAeHrC5x+K6WDUy7oADMS5jo64TxYlck=
X-Google-Smtp-Source: AA0mqf6grAFpE+nyNRKNZiJt70hdEsSvDOHqwGPZoplbLZncwDbLKSUtj3ZQyuKr/UowAgrQ8WwwDT6i3y8o+mSmGNo=
X-Received: by 2002:a17:90a:ce97:b0:20a:8f71:4fc with SMTP id
g23-20020a17090ace9700b0020a8f7104fcmr8064742pju.59.1668679974478; Thu, 17
Nov 2022 02:12:54 -0800 (PST)
MIME-Version: 1.0
Received: by 2002:a05:6a10:e253:b0:358:9b0c:36a with HTTP; Thu, 17 Nov 2022
02:12:54 -0800 (PST)
From: INFO ECOWAS
Date: Thu, 17 Nov 2022 10:12:54 +0000
Message-ID:
Subject: Contact this office
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 10.8
X-Spam_score_int: 108
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: The Economic Community of West African States (ECOWAS) pays
3.5 million dollars in compensation to all scammed victims and those whose
email addresses and other personal data are being restored. Your [...]
Content analysis details: (10.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[infoecowas55[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[infoecowas55[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/,
no trust
[209.85.214.172 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.214.172 listed in wl.mailspike.net]
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLY From and body contain different freemails
1.5 MONEY_ATM_CARD Lots of money on an ATM card
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal
information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
3.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Contact this office
The Economic Community of West African States (ECOWAS) pays 3.5
million dollars in compensation to all scammed victims and those whose
email addresses and other personal data are being restored.
Your money will be sent directly to you in the form of an ATM card,
the card contains an amount of 3.500 million dollars.
Our official diplomat will take your package to your doorstep to avoid
being intercepted
The information below are required where your ATM card will be
delivered, such as;
Your receiver=E2=80=99s name:--------
Country of origin:-----------
Address:---------------------
Phone number:----------------
Thanks,
Sincerely,
I am Mr PAUL KITTO, Contact this office e-mail: for more.(ecowasinf@gmail.c=
om)
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments