Nigerian Gmail spam
Posted by Dave Yadallee on
Return-path:
Envelope-to: dae@doctor.nl2k.ab.ca
Delivery-date: Tue, 07 Mar 2023 11:22:03 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pZCqU-000IrW-14
for dae@doctor.nl2k.ab.ca;
Mon, 06 Mar 2023 08:33:50 -0700
Resent-From: The Doctor
Resent-Date: Mon, 6 Mar 2023 08:33:50 -0700
Resent-Message-ID:
Resent-To: dae@doctor.nl2k.ab.ca
Received: from mail-vs1-f54.google.com ([209.85.217.54]:41483)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from)
id 1pZAJm-000MG0-0X
for doctor@nl2k.ab.ca;
Mon, 06 Mar 2023 05:51:57 -0700
Received: by mail-vs1-f54.google.com with SMTP id o2so8961688vss.8
for; Mon, 06 Mar 2023 04:49:55 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1678106989;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=wDYZqyCgVGIdf8Rw6Ap5bqVqMAiqYlBxx11x616Lm1c=;
b=Z0IEfoBVBODwxMnVfjGwTKbKQKU3PRYSN0PZ9cMEjzHUbCGQL5oOBDZYaZycoQbla+
sx+CT1PQHdOJXiVkOiPJQsQ1EXhmjytok7M3NuQjOgwlbTjde9yLffl88xv/rt5Za6FU
IcYAVc2rYNOjxV3RMTCT0Ii7Ly0mrIUNrZy+HI0s1/Nf1Mf2sJ52C2Ql0PZSgo8Jlq13
vMmiisbhU6QkAg/f4GPJY9vwdrJ8SQGW/rTjY/FjIEo1T06d4coDWQpYkpVhBoeFu3Iw
bn9s0Uo3FtYW5s/fIfJReTsejXeGmAnroC8KnohHGUmzMGqpXrdoWjFGUyQQ9yrBuU1B
MseA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1678106989;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=wDYZqyCgVGIdf8Rw6Ap5bqVqMAiqYlBxx11x616Lm1c=;
b=mcPH4rDDCM0iefHCG6wbEaQq4mBWKlFNpdnvdkYW0iZD6yn7R0SUZDw2cPjKzOdS2k
itk7QlW6RoIOKWERa+6Qj7KNO40AXq0JSHY9Y7QmSEzzGfKSV9zXjxmTsdqj1f5tErvT
lDGxWm2S+Jv/k3l00nVki9/cOHjUXChmel5FCctaTwIZ7JduI9ph7xChRSZzt/ZHe4L5
rj0UbYUr44WId8v0627f6NTubCHa9NLgHWzLRiDN+uThZhikspp3ZG2vEP2QgOzAYBJY
UXjBebFx8SZtBH7RMeC8GkeQdqR2DFAVMxIrifj6lb6jUvwEZrYQ7G0/5iXXfjzrN6dr
m1Eg==
X-Gm-Message-State: AO0yUKV15j96wbLuyiPjIAKfF6pCOw1vcs5JEgKZCT4VHset0p8Og1n4
l6WaZjYd9h2zvA4OtWQAKMSYxOhw2bMV5ctynm4=
X-Google-Smtp-Source: AK7set+Bjszo8trllHYUyfvZ9InbdR7Hr1gcAUl1KKGjFO2yYOGcTrsLcMADnXfqiIfvO9CVngJ3asrIChDr2zOoImA=
X-Received: by 2002:a67:ec4f:0:b0:402:9b84:1be4 with SMTP id
z15-20020a67ec4f000000b004029b841be4mr7020959vso.6.1678106989354; Mon, 06 Mar
2023 04:49:49 -0800 (PST)
MIME-Version: 1.0
Reply-To: davidmoonass@gmail.com
From: "Mr.David Moon"
Date: Mon, 6 Mar 2023 12:49:36 +0000
Message-ID:
Subject: Dear Friend,
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000fee3d705f63aba4d"
Bcc: doctor@nl2k.ab.ca
X-Spam_score: 19.4
X-Spam_score_int: 194
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Friend, I know this means of communication may not be
morally right to you as a person but I also have had a great thought about
it and I have come to this conclusion which I am about to share with you.
Content analysis details: (19.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[davidmoonass1(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[davidmoonass1(at)gmail.com]
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.217.54 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.217.54 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_HK_NAME_FM_MR_MRS No description available.
1.5 HK_NAME_FM_MR_MRS No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 T_MONEY_PERCENT X% of a lot of money for you
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Dear Friend,
--000000000000fee3d705f63aba4d
Content-Type: text/plain; charset="UTF-8"
Dear Friend,
I know this means of communication may not be morally right to you as
a person but I also have had a great thought about it and I have come
to this conclusion which I am about to share with you.
I am Mr. David Moon, the auditing director of International Bank
Burkina Faso. I hope you will cooperate with me as a partner in a
project of transferring an abandoned fund of a late customer of the
bank worth $18,000,000 (Eighteen Million Dollars only).
This will be disbursed or shared between the both of us in these
percentages, 55% for me and 45% for you. Contact me immediately if
that is alright for you so that we can enter into an agreement before
we start processing for the transfer of the funds. If you are
satisfied with this proposal, please provide the below details for the
Mutual Confidentiality Agreement
1. Full Name and Address
2. Occupation and Country of Origin
3. Telephone Number
I wait for your response so that we can commence on this project as
soon as possible.
Regards,
Mr. David Moon
--000000000000fee3d705f63aba4d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--000000000000fee3d705f63aba4d--
Envelope-to: dae@doctor.nl2k.ab.ca
Delivery-date: Tue, 07 Mar 2023 11:22:03 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pZCqU-000IrW-14
for dae@doctor.nl2k.ab.ca;
Mon, 06 Mar 2023 08:33:50 -0700
Resent-From: The Doctor
Resent-Date: Mon, 6 Mar 2023 08:33:50 -0700
Resent-Message-ID:
Resent-To: dae@doctor.nl2k.ab.ca
Received: from mail-vs1-f54.google.com ([209.85.217.54]:41483)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from
id 1pZAJm-000MG0-0X
for doctor@nl2k.ab.ca;
Mon, 06 Mar 2023 05:51:57 -0700
Received: by mail-vs1-f54.google.com with SMTP id o2so8961688vss.8
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1678106989;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=wDYZqyCgVGIdf8Rw6Ap5bqVqMAiqYlBxx11x616Lm1c=;
b=Z0IEfoBVBODwxMnVfjGwTKbKQKU3PRYSN0PZ9cMEjzHUbCGQL5oOBDZYaZycoQbla+
sx+CT1PQHdOJXiVkOiPJQsQ1EXhmjytok7M3NuQjOgwlbTjde9yLffl88xv/rt5Za6FU
IcYAVc2rYNOjxV3RMTCT0Ii7Ly0mrIUNrZy+HI0s1/Nf1Mf2sJ52C2Ql0PZSgo8Jlq13
vMmiisbhU6QkAg/f4GPJY9vwdrJ8SQGW/rTjY/FjIEo1T06d4coDWQpYkpVhBoeFu3Iw
bn9s0Uo3FtYW5s/fIfJReTsejXeGmAnroC8KnohHGUmzMGqpXrdoWjFGUyQQ9yrBuU1B
MseA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1678106989;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=wDYZqyCgVGIdf8Rw6Ap5bqVqMAiqYlBxx11x616Lm1c=;
b=mcPH4rDDCM0iefHCG6wbEaQq4mBWKlFNpdnvdkYW0iZD6yn7R0SUZDw2cPjKzOdS2k
itk7QlW6RoIOKWERa+6Qj7KNO40AXq0JSHY9Y7QmSEzzGfKSV9zXjxmTsdqj1f5tErvT
lDGxWm2S+Jv/k3l00nVki9/cOHjUXChmel5FCctaTwIZ7JduI9ph7xChRSZzt/ZHe4L5
rj0UbYUr44WId8v0627f6NTubCHa9NLgHWzLRiDN+uThZhikspp3ZG2vEP2QgOzAYBJY
UXjBebFx8SZtBH7RMeC8GkeQdqR2DFAVMxIrifj6lb6jUvwEZrYQ7G0/5iXXfjzrN6dr
m1Eg==
X-Gm-Message-State: AO0yUKV15j96wbLuyiPjIAKfF6pCOw1vcs5JEgKZCT4VHset0p8Og1n4
l6WaZjYd9h2zvA4OtWQAKMSYxOhw2bMV5ctynm4=
X-Google-Smtp-Source: AK7set+Bjszo8trllHYUyfvZ9InbdR7Hr1gcAUl1KKGjFO2yYOGcTrsLcMADnXfqiIfvO9CVngJ3asrIChDr2zOoImA=
X-Received: by 2002:a67:ec4f:0:b0:402:9b84:1be4 with SMTP id
z15-20020a67ec4f000000b004029b841be4mr7020959vso.6.1678106989354; Mon, 06 Mar
2023 04:49:49 -0800 (PST)
MIME-Version: 1.0
Reply-To: davidmoonass@gmail.com
From: "Mr.David Moon"
Date: Mon, 6 Mar 2023 12:49:36 +0000
Message-ID:
Subject: Dear Friend,
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000fee3d705f63aba4d"
Bcc: doctor@nl2k.ab.ca
X-Spam_score: 19.4
X-Spam_score_int: 194
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Friend, I know this means of communication may not be
morally right to you as a person but I also have had a great thought about
it and I have come to this conclusion which I am about to share with you.
Content analysis details: (19.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[davidmoonass1(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[davidmoonass1(at)gmail.com]
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.217.54 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.217.54 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_HK_NAME_FM_MR_MRS No description available.
1.5 HK_NAME_FM_MR_MRS No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 T_MONEY_PERCENT X% of a lot of money for you
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Dear Friend,
--000000000000fee3d705f63aba4d
Content-Type: text/plain; charset="UTF-8"
Dear Friend,
I know this means of communication may not be morally right to you as
a person but I also have had a great thought about it and I have come
to this conclusion which I am about to share with you.
I am Mr. David Moon, the auditing director of International Bank
Burkina Faso. I hope you will cooperate with me as a partner in a
project of transferring an abandoned fund of a late customer of the
bank worth $18,000,000 (Eighteen Million Dollars only).
This will be disbursed or shared between the both of us in these
percentages, 55% for me and 45% for you. Contact me immediately if
that is alright for you so that we can enter into an agreement before
we start processing for the transfer of the funds. If you are
satisfied with this proposal, please provide the below details for the
Mutual Confidentiality Agreement
1. Full Name and Address
2. Occupation and Country of Origin
3. Telephone Number
I wait for your response so that we can commence on this project as
soon as possible.
Regards,
Mr. David Moon
--000000000000fee3d705f63aba4d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
=C2=A0Dear Friend,
I know this means of communicati=
on may not be morally right to you as
a person but I also have had a gre=
at thought about it and I have come
to this conclusion which I am about =
to share with you.
I am Mr. David Moon, the auditing director of Int=
ernational Bank
Burkina Faso. I hope you will cooperate with me as a par=
tner in a
project of transferring an abandoned fund of a late customer o=
f the
bank worth $18,000,000 (Eighteen Million Dollars only).
Thi=
s will be disbursed or shared between the both of us in these
percentage=
s, 55% for me and 45% for you. Contact me immediately if
that is alright=
for you so that we can enter into an agreement before
we start processi=
ng for the transfer of the funds. If you are
satisfied with this proposa=
l, please provide the below details for the
Mutual Confidentiality Agree=
ment
1. Full Name and Address
2. Occupation and Country of Origin=
3. Telephone Number
I wait for your response so that we can comm=
ence on this project as
soon as possible.
Regards,
Mr. David M=
oon=C2=A0=C2=A0
r>
I know this means of communicati=
on may not be morally right to you as
a person but I also have had a gre=
at thought about it and I have come
to this conclusion which I am about =
to share with you.
I am Mr. David Moon, the auditing director of Int=
ernational Bank
Burkina Faso. I hope you will cooperate with me as a par=
tner in a
project of transferring an abandoned fund of a late customer o=
f the
bank worth $18,000,000 (Eighteen Million Dollars only).
Thi=
s will be disbursed or shared between the both of us in these
percentage=
s, 55% for me and 45% for you. Contact me immediately if
that is alright=
for you so that we can enter into an agreement before
we start processi=
ng for the transfer of the funds. If you are
satisfied with this proposa=
l, please provide the below details for the
Mutual Confidentiality Agree=
ment
1. Full Name and Address
2. Occupation and Country of Origin=
3. Telephone Number
I wait for your response so that we can comm=
ence on this project as
soon as possible.
Regards,
Mr. David M=
oon=C2=A0=C2=A0
r>
--000000000000fee3d705f63aba4d--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments