Funds spam from Google

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 28 Jan 2023 08:09:04 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pLmow-000IFK-04

for dave@doctor.nl2k.ab.ca;

Sat, 28 Jan 2023 08:08:46 -0700

Resent-From: The Doctor

Resent-Date: Sat, 28 Jan 2023 08:08:46 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f169.google.com ([209.85.208.169]:33618)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pLjQt-0003Ux-2R

for doctor@mail.nl2k.ab.ca;

Sat, 28 Jan 2023 04:31:47 -0700

Received: by mail-lj1-f169.google.com with SMTP id a37so8214131ljq.0

for ; Sat, 28 Jan 2023 03:29:44 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=IO1Ax5Q/UX0v2nvWW8kBvLAsjMgcbGsWEoygKBReL4I=;

b=jSjoVEJIQJmBJIdWlo+BdG82UO44kEYKT52AjZN/G6xTeLY2VWdbrMUHw8F5g8QWuY

L5iagq72i8Bytq/ufa2HpXBLmLA0tOxh/M9bBTabtqbWi2TPiCcNOYuiJRA5CE0o55Q2

fouMJlvRkzE2wnra1NukOVvPE9cCPv5Peqe8v9M6yi1NLDQe/2RfQ5gKtr7GyHzthjhJ

XDCmBxDaPoLNThwpCyqoMcz662IKozPuNIxwci3MstZY+KW3u2e2z1Wy35vRuI70KAin

AGh0cARA4uIQqlJj7hbUhNoHDERgf3GnDGmjZZSWCjh7ZwkmPlvv0SJkWgU0L5fHrHGS

sh8g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=IO1Ax5Q/UX0v2nvWW8kBvLAsjMgcbGsWEoygKBReL4I=;

b=5JskUbqLJ7HIO8/1XjHYoEQMlhTWrhvriE9op7Kdd/IJnNG05utXUDNR78qaOoWSHg

Xuzor8aGAXkcz/tsztd2JeUh7fo8z8WJnAE4HEQoXRcln6f3RScWP08mqVH3vu2OZaeZ

YxcLbjgUtJ2/mHG7IXAqPeZ6qRzt1NJG136VDX4P+3enwFlFeDoToglxS16+y2CdKcG0

ueu3aKQT416rWiZ0FA1t0UZySYI/sBsbPq/IZbbZQSI9fCT3dsjZbeVl3cmNDG1kfplM

A4bp0qjFyyNCZu66N1cYK3NDg5y1z4cpM6wSXzvI4SLtgzgLLN88MU3+eHkL6vJBj1AU

dGOw==

X-Gm-Message-State: AO0yUKUul4dwDpdDSDxoy+du4DMMH9Xu/ZrX0aP2Cbl2Fq8nQCbLuIrA

pl/GYTj7AHnaX3lnGqfzveejwsgO9Nxl/Ns07y0=

X-Google-Smtp-Source: AK7set/uALgLzGrhQ3V34Peuy4SkP1B30YQrvKu7laKJc38IvJ9anpNdnKB3zXeOiOtyCfaZTceGvjueWxdcPb8deGQ=

X-Received: by 2002:a2e:804b:0:b0:28d:c987:3e5b with SMTP id

p11-20020a2e804b000000b0028dc9873e5bmr1239314ljg.264.1674905377406; Sat, 28

Jan 2023 03:29:37 -0800 (PST)

MIME-Version: 1.0

Received: by 2002:a2e:a915:0:0:0:0:0 with HTTP; Sat, 28 Jan 2023 03:29:36

-0800 (PST)

Reply-To: anndla1967@gmail.com

From: PostNet

Date: Sat, 28 Jan 2023 13:29:36 +0200

Message-ID:

Subject: GREETINGS

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@mail.nl2k.ab.ca

X-Spam_score: 18.5

X-Spam_score_int: 185

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, I am aware that this letter had come to you as a surprise

as we had not met before or handled any business deal in the past. Nevertheless,

I have contacted you with genuine intentions, and I hope I ca [...]



Content analysis details: (18.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.169 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[anndla1967(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[intomowh24(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[intomowh24(at)gmail.com]

2.5 MILLION_USD BODY: Talks about millions of dollars

2.5 HK_SCAM_N2 BODY: No description available.

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.169 listed in wl.mailspike.net]

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 HK_SCAM No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases

3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} GREETINGS



Hello,



I am aware that this letter had come to you as a surprise as we had

not met before or handled any business deal in the past. Nevertheless,

I have contacted you with genuine intentions, and I hope I can trust

you with this Inheritance opportunity which I explain below.



My name is Mr. Larry Anderson, an account manager with a reputable

bank here in South Africa. I retrieved your contact address in my

search for the next of kin to a deceased customer of our bank, a

citizen of your country, lived and died in South Africa from Cardiac

Arrest in 2016. Unfortunately, this customer died intestate, leaving

his bank account with an open beneficiary status. All efforts made by

our bank to locate his relatives have been unsuccessful, so I decided

to write to you as I have monitored this account in the bank for

almost ten years now and no one has come forth with any claim. I want

to present you to our bank as his next of kin to claim this dormant

account worth USD$30 Million (Thirty Million United States Dollars

Only).



You will apply to the bank as an extended relative to the deceased

customer while I work from the inside to ensure all needed information

and evidence is provided to you to back up your claim. The account has

an open beneficiary status, which is why I have contacted you to come

forth and claim the funds as the next of kin and beneficiary. Since he

is from your country, it is easy for you to become his official next

of kin. If we do not claim the funds now, the funds would be reverted

to the system as unclaimed estate at the expiration of a 10-year

dormancy period.



I assure you that this transaction will be handled under due

inheritance procedures, and every necessary legitimate arrangement

will be put in place to make you the real beneficiary of the

inheritance funds. It also requires all confidentiality at this stage,

and I believe you are ready to keep this discreet until you can claim

the funds from the bank here in South Africa. Once the funds are

released to you, they will be shared between the two of us.



Send your response indicating readiness to proceed with this

transaction. Thereafter I will give you more details, and we shall

have an in-depth discussion regarding the successful completion of

this transaction.



I await your immediate response to my direct email account below



Sincerely Yours,

Larry Anderson (Mr)

Email: anderla833@gmail.com

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA