Investment spam from gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 30 Jan 2023 08:01:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pMVeB-000CI5-1J
for dave@doctor.nl2k.ab.ca;
Mon, 30 Jan 2023 08:00:39 -0700
Resent-From: The Doctor
Resent-Date: Mon, 30 Jan 2023 08:00:39 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-qt1-f178.google.com ([209.85.160.178]:39550)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from)
id 1pMSgf-000Jlq-18
for doctor@doctor.nl2k.ab.ca;
Mon, 30 Jan 2023 04:51:04 -0700
Received: by mail-qt1-f178.google.com with SMTP id s4so9671753qtx.6
for; Mon, 30 Jan 2023 03:49:03 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=DXlFlG/VqsFtQ935sPgGIGs5R80IzEmws1yQEm/BXG4=;
b=L2RPSth5tJp3u87wJdKQKbu1STCBFfR4Uug1Tz0ySbA7d3bb/kfXKQ9afDelya+GLK
0qa84j6R+J6oY0gz3tIt1qmX8q17A3nZtIPKsFHWaqqOIXHb9lEeCJMpOtNjWN7nDWSh
4QEErZlTabiDw9OUlrDrvsbCkE3ZlohI6J5XlwfCJtMyhI5aM1eC0GiTdbnZJxLscnoP
d7Ch9wDbvzAEauJisRLAvufaRgCNZbkPTES3bJMlenQNznZ47safJ679hpLDGFjjT5mU
Y2MMnflAVt83wmcyBaY9mbVlPY7hFw8+6zsb0Jw5mWWprOT+WaQ7akBOp6acFYlgERvt
m/EQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=DXlFlG/VqsFtQ935sPgGIGs5R80IzEmws1yQEm/BXG4=;
b=kr1GmYW5JP09TRRB6MxZizSnPGfHYN/MUFn0Y0GMiOGyozD5vkOo64qsvLaor/uYB8
znXt1v+RioJ8GKVTozTGMlaXh/N3O3eXYtJBUb6fxGf7lB5XihPDFOT+oOnij7DxqQIN
S5qLdz7cQq8sfzV0Ecbr3/Q1sdcEKDdZ+CdIQA5ssaRNky7Rjo8AW1CpJqxdPZgoioiQ
YMB2AG4VIL33GhPh5DxzT5j8B01OIUv7DXARbyt2UobG9Ss7QFrbjtB77P/LamOFPX7g
J4QtqCU73qMqcUlAjp6fRr86IAth5s/gNqVjUtgO8yWetpaR9eW1Lf8Kmr01b7aE5hhJ
g00g==
X-Gm-Message-State: AFqh2kogTZJ4On8x7yKYQuA0bLp8bCSiK0ZI14maISScXcwGV1bcM9/t
/D5DHMnODaOm/2+TqmvDAYODCO/yruDDDDYSQHs=
X-Google-Smtp-Source: AMrXdXsyuitjOxv2X/vDHja3DMpuSd88f0614hDiTA148QBgrBMTdQImifOZkMsB3X08pSuICvnuj+Zc2pXHtdwOLA4=
X-Received: by 2002:ac8:1346:0:b0:3a6:a5c3:fd3c with SMTP id
f6-20020ac81346000000b003a6a5c3fd3cmr1180670qtj.36.1675079337177; Mon, 30 Jan
2023 03:48:57 -0800 (PST)
MIME-Version: 1.0
Reply-To: mrsaishagadafi1976@gmail.com
From: AISHA GADDAFI
Date: Mon, 30 Jan 2023 12:48:44 +0100
Message-ID:
Subject: An Investment proposal (reply for more detail)
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000dcf84205f379ccbe"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 21.5
X-Spam_score_int: 215
X-Spam_bar: +++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dearest, I seek your indulgence to read this investment offer.
I am pleased to use this medium to open a mutual communication with you and
to ask for your permission and acceptance to partner with you to invest in
your country.
Content analysis details: (21.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.160.178 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[mrsaishagadafi1976(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[kaborenimmatou111(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[kaborenimmatou111(at)gmail.com]
2.5 MILLION_USD BODY: Talks about millions of dollars
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
2.7 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
2.7 HK_SCAM_N1 BODY: No description available.
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.160.178 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} An Investment proposal (reply for more detail)
--000000000000dcf84205f379ccbe
Content-Type: text/plain; charset="UTF-8"
Dearest,
I seek your indulgence to read this investment offer.
I am pleased to use this medium to open a mutual communication with you and
to ask for your permission and acceptance to partner with you to invest in
your country.
My name is Aisha Gaddafi , I am a widow and a single mother with three
children, the only biological daughter of the late Libyan President,
Colonel Muammar Gaddafi of Libya. I am currently under political asylum
protection by the Omani government.
I have funds worth $27.500.000.00 US Dollars "Twenty Seven Million Five
Hundred Thousand United State Dollars" which I want to entrust to you for
investment project assistance in your country..
Kindly reply for more details at mrsaishagaddafi1976@gmail.com
Thanks
Yours sincerely Aisha
--000000000000dcf84205f379ccbe
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 30 Jan 2023 08:01:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pMVeB-000CI5-1J
for dave@doctor.nl2k.ab.ca;
Mon, 30 Jan 2023 08:00:39 -0700
Resent-From: The Doctor
Resent-Date: Mon, 30 Jan 2023 08:00:39 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-qt1-f178.google.com ([209.85.160.178]:39550)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from
id 1pMSgf-000Jlq-18
for doctor@doctor.nl2k.ab.ca;
Mon, 30 Jan 2023 04:51:04 -0700
Received: by mail-qt1-f178.google.com with SMTP id s4so9671753qtx.6
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=DXlFlG/VqsFtQ935sPgGIGs5R80IzEmws1yQEm/BXG4=;
b=L2RPSth5tJp3u87wJdKQKbu1STCBFfR4Uug1Tz0ySbA7d3bb/kfXKQ9afDelya+GLK
0qa84j6R+J6oY0gz3tIt1qmX8q17A3nZtIPKsFHWaqqOIXHb9lEeCJMpOtNjWN7nDWSh
4QEErZlTabiDw9OUlrDrvsbCkE3ZlohI6J5XlwfCJtMyhI5aM1eC0GiTdbnZJxLscnoP
d7Ch9wDbvzAEauJisRLAvufaRgCNZbkPTES3bJMlenQNznZ47safJ679hpLDGFjjT5mU
Y2MMnflAVt83wmcyBaY9mbVlPY7hFw8+6zsb0Jw5mWWprOT+WaQ7akBOp6acFYlgERvt
m/EQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=DXlFlG/VqsFtQ935sPgGIGs5R80IzEmws1yQEm/BXG4=;
b=kr1GmYW5JP09TRRB6MxZizSnPGfHYN/MUFn0Y0GMiOGyozD5vkOo64qsvLaor/uYB8
znXt1v+RioJ8GKVTozTGMlaXh/N3O3eXYtJBUb6fxGf7lB5XihPDFOT+oOnij7DxqQIN
S5qLdz7cQq8sfzV0Ecbr3/Q1sdcEKDdZ+CdIQA5ssaRNky7Rjo8AW1CpJqxdPZgoioiQ
YMB2AG4VIL33GhPh5DxzT5j8B01OIUv7DXARbyt2UobG9Ss7QFrbjtB77P/LamOFPX7g
J4QtqCU73qMqcUlAjp6fRr86IAth5s/gNqVjUtgO8yWetpaR9eW1Lf8Kmr01b7aE5hhJ
g00g==
X-Gm-Message-State: AFqh2kogTZJ4On8x7yKYQuA0bLp8bCSiK0ZI14maISScXcwGV1bcM9/t
/D5DHMnODaOm/2+TqmvDAYODCO/yruDDDDYSQHs=
X-Google-Smtp-Source: AMrXdXsyuitjOxv2X/vDHja3DMpuSd88f0614hDiTA148QBgrBMTdQImifOZkMsB3X08pSuICvnuj+Zc2pXHtdwOLA4=
X-Received: by 2002:ac8:1346:0:b0:3a6:a5c3:fd3c with SMTP id
f6-20020ac81346000000b003a6a5c3fd3cmr1180670qtj.36.1675079337177; Mon, 30 Jan
2023 03:48:57 -0800 (PST)
MIME-Version: 1.0
Reply-To: mrsaishagadafi1976@gmail.com
From: AISHA GADDAFI
Date: Mon, 30 Jan 2023 12:48:44 +0100
Message-ID:
Subject: An Investment proposal (reply for more detail)
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000dcf84205f379ccbe"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 21.5
X-Spam_score_int: 215
X-Spam_bar: +++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dearest, I seek your indulgence to read this investment offer.
I am pleased to use this medium to open a mutual communication with you and
to ask for your permission and acceptance to partner with you to invest in
your country.
Content analysis details: (21.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.160.178 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[mrsaishagadafi1976(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[kaborenimmatou111(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[kaborenimmatou111(at)gmail.com]
2.5 MILLION_USD BODY: Talks about millions of dollars
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
2.7 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
2.7 HK_SCAM_N1 BODY: No description available.
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.160.178 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} An Investment proposal (reply for more detail)
--000000000000dcf84205f379ccbe
Content-Type: text/plain; charset="UTF-8"
Dearest,
I seek your indulgence to read this investment offer.
I am pleased to use this medium to open a mutual communication with you and
to ask for your permission and acceptance to partner with you to invest in
your country.
My name is Aisha Gaddafi , I am a widow and a single mother with three
children, the only biological daughter of the late Libyan President,
Colonel Muammar Gaddafi of Libya. I am currently under political asylum
protection by the Omani government.
I have funds worth $27.500.000.00 US Dollars "Twenty Seven Million Five
Hundred Thousand United State Dollars" which I want to entrust to you for
investment project assistance in your country..
Kindly reply for more details at mrsaishagaddafi1976@gmail.com
Thanks
Yours sincerely Aisha
--000000000000dcf84205f379ccbe
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Dearest,
I seek your indulgence to read this invest=
ment offer.
I am pleased to use this medium to open a mutual communi=
cation with you and to ask for your permission and acceptance to partner wi=
th you to invest in your country.
My name is Aisha Gaddafi , I am a =
widow and a single mother with three children, the only biological daughter=
of the late Libyan President, Colonel Muammar Gaddafi of Libya. I am curre=
ntly under political asylum protection by the Omani government.
I ha=
ve funds worth $27.500.000.00 US Dollars "Twenty Seven Million Five Hu=
ndred Thousand United State Dollars" which I want to entrust to you fo=
r investment project assistance in your country..
Kindly reply for m=
ore details at =C2=A0mrsai=
shagaddafi1976@gmail.com
Thanks
Yours sincerely Aisha
v>
--000000000000dcf84205f379ccbe--
I seek your indulgence to read this invest=
ment offer.
I am pleased to use this medium to open a mutual communi=
cation with you and to ask for your permission and acceptance to partner wi=
th you to invest in your country.
My name is Aisha Gaddafi , I am a =
widow and a single mother with three children, the only biological daughter=
of the late Libyan President, Colonel Muammar Gaddafi of Libya. I am curre=
ntly under political asylum protection by the Omani government.
I ha=
ve funds worth $27.500.000.00 US Dollars "Twenty Seven Million Five Hu=
ndred Thousand United State Dollars" which I want to entrust to you fo=
r investment project assistance in your country..
Kindly reply for m=
ore details at =C2=A0mrsai=
shagaddafi1976@gmail.com
Thanks
Yours sincerely Aisha
v>
--000000000000dcf84205f379ccbe--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments