Business proposal spam from Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 30 Nov 2022 08:45:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1p0PGM-0008F5-O3
for dave@doctor.nl2k.ab.ca;
Wed, 30 Nov 2022 08:44:42 -0700
Resent-From: The Doctor
Resent-Date: Wed, 30 Nov 2022 08:44:42 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-wr1-f65.google.com ([209.85.221.65]:37379)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1p0OvH-0006FI-9f
for doctor@doctor.nl2k.ab.ca;
Wed, 30 Nov 2022 08:22:59 -0700
Received: by mail-wr1-f65.google.com with SMTP id bs21so27605202wrb.4
for; Wed, 30 Nov 2022 07:20:26 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=c8jbT9XDYVPzazR1wJPPDilxb0UNLGKg8ouR2+avEHc=;
b=gDoK9WRtsL4Y35bi5gS5VMgucqntV9tp937Mf5HwoAphQrMBtEFzK8KY42jQBkPX67
HGIAOP19PQGpoRGGR6m/xqS1dGbQhaGg4KEcXg/mfTPsbS6VJGi5quvCsSaejiGDKsW9
q8ASJA5O6UbN0cldyT4WAWbJY1y+ZK47erVYIBx113d7l1bXxYIo4NLs1PrON7LPHtpu
nre1it7x00tuaF6ofiZhOs0iNet22jJjrPEPqqQI2Z+8CElPSm/pJctYqF8QxQbuh6fa
MHTQ120y2upIgKJ9uXsXC7BCcx6ltCHgOsqcrkae0MgXCzTpeLpnhEUJzsLFwyj7Bis5
0hhQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=c8jbT9XDYVPzazR1wJPPDilxb0UNLGKg8ouR2+avEHc=;
b=2ZmaKVJ8Cc/uqAKTkrbEkuXRD4xIUTGPR5Aabc6HteRq9thEtExEFTOQegraMZRAQU
+ynrTNUtPB++35a/42Tp564x6NVP/a+bE8OiUYdW9Ph6/g6MtS+o1hJ+OXKVR9xIN4tU
EYcLXGFX9CW6rMWCa1/R5CscSj104lFvldU+/WmCOupQ0h9+FiHD+GVwEq4aplgDcvUl
e5VnpYsKsGnqpLBjMq0S+BpjV5YKZn5Z6OjMPiemVgzveFY3t9O8BmLInGCt1Jl130z0
IyrFzTamdPwhbVMTkBMbz5l+wXFOWLDwiu23UqknK10+dsNQgv5magbk/QiVPdMxoEd7
xUQg==
X-Gm-Message-State: ANoB5pnmogWki8qVJoCtUxOX+LeGpRkd680peacK9HW3oEsvHHqEMA0/
whhZmTrnJKs1In4gWGjHap3LJM9qGsg+Ptlp1B0=
X-Google-Smtp-Source: AA0mqf5o+jJCYp74lrr4ANLIXTvEpttjN4i3x9CvruF0mk+DYBo4N2ZP02gCc/SC2leZjbGTq3v+b+kbz5L/6X4zRhY=
X-Received: by 2002:a5d:674d:0:b0:22e:2ecc:663d with SMTP id
l13-20020a5d674d000000b0022e2ecc663dmr39731163wrw.633.1669821620399; Wed, 30
Nov 2022 07:20:20 -0800 (PST)
MIME-Version: 1.0
Received: by 2002:a05:6000:1b81:0:0:0:0 with HTTP; Wed, 30 Nov 2022 07:20:19
-0800 (PST)
Reply-To: damojustin17@gmail.com
From: Damo Justin
Date: Wed, 30 Nov 2022 15:20:19 +0000
Message-ID:
Subject: URGENT REPLY
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 10.0
X-Spam_score_int: 100
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello, we are currently looking for ways to expand and relocate
business interests in the following sectors: - Real estate, agriculture,
forestry, fishing, oil/gas, hotels, transport, communication services, [...]
Content analysis details: (10.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/,
no trust
[209.85.221.65 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[ki4924651[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[ki4924651[at]gmail.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[damojustin17[at]gmail.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.221.65 listed in wl.mailspike.net]
0.9 URG_BIZ BODY: Contains urgent matter
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} URGENT REPLY
Hello,
we are currently looking for ways to expand and relocate business
interests in the following sectors: - Real estate, agriculture,
forestry, fishing, oil/gas, hotels, transport, communication services,
stock market speculation, mining, trade, construction, solar
inventory and many other investments that could be favorable and
lucrative to the current situation of Dubai economy.
Note you can also Get back to me with your good plans for projects
requiring financing or expanding an existing business for review, for
security reasons I will disclose myself to you on my next massage
after am sure we agreed to work together as partner
I am looking forward to hearing from you.
Regards
Damo
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 30 Nov 2022 08:45:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1p0PGM-0008F5-O3
for dave@doctor.nl2k.ab.ca;
Wed, 30 Nov 2022 08:44:42 -0700
Resent-From: The Doctor
Resent-Date: Wed, 30 Nov 2022 08:44:42 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-wr1-f65.google.com ([209.85.221.65]:37379)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1p0OvH-0006FI-9f
for doctor@doctor.nl2k.ab.ca;
Wed, 30 Nov 2022 08:22:59 -0700
Received: by mail-wr1-f65.google.com with SMTP id bs21so27605202wrb.4
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=c8jbT9XDYVPzazR1wJPPDilxb0UNLGKg8ouR2+avEHc=;
b=gDoK9WRtsL4Y35bi5gS5VMgucqntV9tp937Mf5HwoAphQrMBtEFzK8KY42jQBkPX67
HGIAOP19PQGpoRGGR6m/xqS1dGbQhaGg4KEcXg/mfTPsbS6VJGi5quvCsSaejiGDKsW9
q8ASJA5O6UbN0cldyT4WAWbJY1y+ZK47erVYIBx113d7l1bXxYIo4NLs1PrON7LPHtpu
nre1it7x00tuaF6ofiZhOs0iNet22jJjrPEPqqQI2Z+8CElPSm/pJctYqF8QxQbuh6fa
MHTQ120y2upIgKJ9uXsXC7BCcx6ltCHgOsqcrkae0MgXCzTpeLpnhEUJzsLFwyj7Bis5
0hhQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=c8jbT9XDYVPzazR1wJPPDilxb0UNLGKg8ouR2+avEHc=;
b=2ZmaKVJ8Cc/uqAKTkrbEkuXRD4xIUTGPR5Aabc6HteRq9thEtExEFTOQegraMZRAQU
+ynrTNUtPB++35a/42Tp564x6NVP/a+bE8OiUYdW9Ph6/g6MtS+o1hJ+OXKVR9xIN4tU
EYcLXGFX9CW6rMWCa1/R5CscSj104lFvldU+/WmCOupQ0h9+FiHD+GVwEq4aplgDcvUl
e5VnpYsKsGnqpLBjMq0S+BpjV5YKZn5Z6OjMPiemVgzveFY3t9O8BmLInGCt1Jl130z0
IyrFzTamdPwhbVMTkBMbz5l+wXFOWLDwiu23UqknK10+dsNQgv5magbk/QiVPdMxoEd7
xUQg==
X-Gm-Message-State: ANoB5pnmogWki8qVJoCtUxOX+LeGpRkd680peacK9HW3oEsvHHqEMA0/
whhZmTrnJKs1In4gWGjHap3LJM9qGsg+Ptlp1B0=
X-Google-Smtp-Source: AA0mqf5o+jJCYp74lrr4ANLIXTvEpttjN4i3x9CvruF0mk+DYBo4N2ZP02gCc/SC2leZjbGTq3v+b+kbz5L/6X4zRhY=
X-Received: by 2002:a5d:674d:0:b0:22e:2ecc:663d with SMTP id
l13-20020a5d674d000000b0022e2ecc663dmr39731163wrw.633.1669821620399; Wed, 30
Nov 2022 07:20:20 -0800 (PST)
MIME-Version: 1.0
Received: by 2002:a05:6000:1b81:0:0:0:0 with HTTP; Wed, 30 Nov 2022 07:20:19
-0800 (PST)
Reply-To: damojustin17@gmail.com
From: Damo Justin
Date: Wed, 30 Nov 2022 15:20:19 +0000
Message-ID:
Subject: URGENT REPLY
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 10.0
X-Spam_score_int: 100
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello, we are currently looking for ways to expand and relocate
business interests in the following sectors: - Real estate, agriculture,
forestry, fishing, oil/gas, hotels, transport, communication services, [...]
Content analysis details: (10.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/,
no trust
[209.85.221.65 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[ki4924651[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[ki4924651[at]gmail.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[damojustin17[at]gmail.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.221.65 listed in wl.mailspike.net]
0.9 URG_BIZ BODY: Contains urgent matter
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} URGENT REPLY
Hello,
we are currently looking for ways to expand and relocate business
interests in the following sectors: - Real estate, agriculture,
forestry, fishing, oil/gas, hotels, transport, communication services,
stock market speculation, mining, trade, construction, solar
inventory and many other investments that could be favorable and
lucrative to the current situation of Dubai economy.
Note you can also Get back to me with your good plans for projects
requiring financing or expanding an existing business for review, for
security reasons I will disclose myself to you on my next massage
after am sure we agreed to work together as partner
I am looking forward to hearing from you.
Regards
Damo
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments