Lottery Nigerian Spam from Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 08 Mar 2023 08:32:58 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pZvmL-000AjT-1p
for dave@doctor.nl2k.ab.ca;
Wed, 08 Mar 2023 08:32:33 -0700
Resent-From: The Doctor
Resent-Date: Wed, 8 Mar 2023 08:32:33 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-wm1-f46.google.com ([209.85.128.46]:42678)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from)
id 1pZs6R-0000m7-2P
for doctor@doctor.nl2k.ab.ca;
Wed, 08 Mar 2023 04:37:10 -0700
Received: by mail-wm1-f46.google.com with SMTP id o11-20020a05600c4fcb00b003eb33ea29a8so946491wmq.1
for; Wed, 08 Mar 2023 03:35:04 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1678275298;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=jH2hkEuRupvdPY12utUCJE5BtJ2joRVDuL3k/yWQFik=;
b=SZYVnJgSgV9nTiZ+QxRB7G66GJC0mLiSJO8GvuAnOhOSIN0zDlNFQBf6BI29vPdPHY
JAbsbEjXTC41sQkLU0bAWh+xXNNtw/kuSFgnlW8Kc+y5hLfvDB8DQe4wamWwVCyHLfzA
0YK4+NcE9lWHbh5pkloFNR/g7nfbT4zOKtBT2zTutRVPVq8vJcIkY9vvNqvQ+OfjUL8i
lVBsakvEWYNJ86N+To7duyqdtAEOTwTrgd2BHk8E675GNJqzA456cm/t0gA2zM7fjj/1
lITk5nmFrEchCqbksR/ryTtcVZmLyogm5bmeZjWPDJ8vz6EysM5zFSe9Z6pzlSRkejL2
dzFw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1678275298;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=jH2hkEuRupvdPY12utUCJE5BtJ2joRVDuL3k/yWQFik=;
b=Q3Q+UJL+3+BzUsinHrjfRMDBQvXxGJOWTgXV4S+ipGD9E/kW47ujWciX8p99RKbmj9
MELmMw1bOWpCuHR9g6jnqo+9plYGeQy7cM2K7Ms/WgVSgrXtL9hhwI179lkn4mSsj4oA
EBQIbh1fvB8x0eexUygUWLkrH9nXjhcBpNOg8OhbwspVHhp7zhxsUo1BipyLY8olO3ve
agcU6JQuUX89DR2ugVqAjUklnmuGJ3zYJo4bgm+hOQwvI1EFT1Zb/pUjQMFZAnNZgTwT
c0OJKcW9JTTPEG/yVnSF0yUTS7ACrjJOQgvp6YRmfr8qmsPuhRQL0y5yTU2Ehxm/o9s7
rt1A==
X-Gm-Message-State: AO0yUKXJA0s/ZlBIZ76OBThWM+IG+RWcmM20VXgkRPbjBWRRkuUnmAqz
WAfNMA4elh/ZR6zFAjVR26HHwIKn5OgpODS5sOo=
X-Google-Smtp-Source: AK7set/SLxqYDXc5S2Ky9ZrWmJ+GoY3SOg1HD6ooN9Z1hpqwHzwUWBwCjcDT7vFUqnzsLYUziRLquZCslrM4bs2YzsI=
X-Received: by 2002:a05:600c:5123:b0:3e2:db9:6fa9 with SMTP id
o35-20020a05600c512300b003e20db96fa9mr8181281wms.4.1678275298197; Wed, 08 Mar
2023 03:34:58 -0800 (PST)
MIME-Version: 1.0
From: COVID-19 CHARITY DONATION
Date: Wed, 8 Mar 2023 13:05:37 -0800
Message-ID:
Subject: info
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000fc080005f661ea0d"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 11.5
X-Spam_score_int: 115
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: LOTTERY WINNING CLAIM Attention: Beneficiary. Global Internet
Network is pleased to announce that you are one of the 80 lucky winners of
the ongoing COVID-19 award that your email address has been selected among
our lucky winners to receive €4, [...]
Content analysis details: (11.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[info.dsileser(at)gmail.com]
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.2 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.128.46 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.128.46 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLY From and body contain different freemails
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} info
--000000000000fc080005f661ea0d
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
LOTTERY WINNING CLAIM
Attention: Beneficiary.
Global Internet Network is pleased to announce that you are one of the 80
lucky winners of the ongoing COVID-19 award
that your email address has been selected among our lucky winners to
receive =E2=82=AC4,800,000.00
(FOUR MILLION EIGHT HUNDRED THOUSAND EUROS) in cash to the lucky number
file 13-85-22-88-25-50.
Your winning money will now be deposited with Spanish multinational
financial services bank Santander Group, based in Madrid.
We therefore recommend that you contact Mr. Sanchez Martini, Director of
Santander Bank Group, with the details below.
Email =3D sanchezmartini@europe.com
so that he can inform you how to receive your winning prize.
congratulations in advance
Best regards.
Mrs. Patricia Leon Fern=C3=A1ndez.
--000000000000fc080005f661ea0d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 08 Mar 2023 08:32:58 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pZvmL-000AjT-1p
for dave@doctor.nl2k.ab.ca;
Wed, 08 Mar 2023 08:32:33 -0700
Resent-From: The Doctor
Resent-Date: Wed, 8 Mar 2023 08:32:33 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-wm1-f46.google.com ([209.85.128.46]:42678)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from
id 1pZs6R-0000m7-2P
for doctor@doctor.nl2k.ab.ca;
Wed, 08 Mar 2023 04:37:10 -0700
Received: by mail-wm1-f46.google.com with SMTP id o11-20020a05600c4fcb00b003eb33ea29a8so946491wmq.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1678275298;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=jH2hkEuRupvdPY12utUCJE5BtJ2joRVDuL3k/yWQFik=;
b=SZYVnJgSgV9nTiZ+QxRB7G66GJC0mLiSJO8GvuAnOhOSIN0zDlNFQBf6BI29vPdPHY
JAbsbEjXTC41sQkLU0bAWh+xXNNtw/kuSFgnlW8Kc+y5hLfvDB8DQe4wamWwVCyHLfzA
0YK4+NcE9lWHbh5pkloFNR/g7nfbT4zOKtBT2zTutRVPVq8vJcIkY9vvNqvQ+OfjUL8i
lVBsakvEWYNJ86N+To7duyqdtAEOTwTrgd2BHk8E675GNJqzA456cm/t0gA2zM7fjj/1
lITk5nmFrEchCqbksR/ryTtcVZmLyogm5bmeZjWPDJ8vz6EysM5zFSe9Z6pzlSRkejL2
dzFw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1678275298;
h=to:subject:message-id:date:from:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=jH2hkEuRupvdPY12utUCJE5BtJ2joRVDuL3k/yWQFik=;
b=Q3Q+UJL+3+BzUsinHrjfRMDBQvXxGJOWTgXV4S+ipGD9E/kW47ujWciX8p99RKbmj9
MELmMw1bOWpCuHR9g6jnqo+9plYGeQy7cM2K7Ms/WgVSgrXtL9hhwI179lkn4mSsj4oA
EBQIbh1fvB8x0eexUygUWLkrH9nXjhcBpNOg8OhbwspVHhp7zhxsUo1BipyLY8olO3ve
agcU6JQuUX89DR2ugVqAjUklnmuGJ3zYJo4bgm+hOQwvI1EFT1Zb/pUjQMFZAnNZgTwT
c0OJKcW9JTTPEG/yVnSF0yUTS7ACrjJOQgvp6YRmfr8qmsPuhRQL0y5yTU2Ehxm/o9s7
rt1A==
X-Gm-Message-State: AO0yUKXJA0s/ZlBIZ76OBThWM+IG+RWcmM20VXgkRPbjBWRRkuUnmAqz
WAfNMA4elh/ZR6zFAjVR26HHwIKn5OgpODS5sOo=
X-Google-Smtp-Source: AK7set/SLxqYDXc5S2Ky9ZrWmJ+GoY3SOg1HD6ooN9Z1hpqwHzwUWBwCjcDT7vFUqnzsLYUziRLquZCslrM4bs2YzsI=
X-Received: by 2002:a05:600c:5123:b0:3e2:db9:6fa9 with SMTP id
o35-20020a05600c512300b003e20db96fa9mr8181281wms.4.1678275298197; Wed, 08 Mar
2023 03:34:58 -0800 (PST)
MIME-Version: 1.0
From: COVID-19 CHARITY DONATION
Date: Wed, 8 Mar 2023 13:05:37 -0800
Message-ID:
Subject: info
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000fc080005f661ea0d"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 11.5
X-Spam_score_int: 115
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: LOTTERY WINNING CLAIM Attention: Beneficiary. Global Internet
Network is pleased to announce that you are one of the 80 lucky winners of
the ongoing COVID-19 award that your email address has been selected among
our lucky winners to receive €4, [...]
Content analysis details: (11.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[info.dsileser(at)gmail.com]
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.2 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.128.46 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.128.46 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLY From and body contain different freemails
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} info
--000000000000fc080005f661ea0d
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
LOTTERY WINNING CLAIM
Attention: Beneficiary.
Global Internet Network is pleased to announce that you are one of the 80
lucky winners of the ongoing COVID-19 award
that your email address has been selected among our lucky winners to
receive =E2=82=AC4,800,000.00
(FOUR MILLION EIGHT HUNDRED THOUSAND EUROS) in cash to the lucky number
file 13-85-22-88-25-50.
Your winning money will now be deposited with Spanish multinational
financial services bank Santander Group, based in Madrid.
We therefore recommend that you contact Mr. Sanchez Martini, Director of
Santander Bank Group, with the details below.
Email =3D sanchezmartini@europe.com
so that he can inform you how to receive your winning prize.
congratulations in advance
Best regards.
Mrs. Patricia Leon Fern=C3=A1ndez.
--000000000000fc080005f661ea0d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
LOTTERY WINNING CLAIM
Attention: Beneficiary.
r>Global Internet Network is pleased to announce that you are one of the 80=
lucky winners of the ongoing COVID-19 award
that your email address has=
been selected among our lucky winners to receive =E2=82=AC4,800,000.00
=
(FOUR MILLION EIGHT HUNDRED THOUSAND EUROS) in cash to the lucky number fil=
e 13-85-22-88-25-50.
Your winning money will now be deposited with Spani=
sh multinational financial services bank Santander Group, based in Madrid.<=
br>We therefore recommend that you contact Mr. Sanchez Martini, Director of=
Santander Bank Group, with the details below.
Email =3D
mailto:sanchezmartini@europe.com">sanchezmartini@europe.com
so t=
hat he can inform you how to receive your winning prize.
congratulations=
in advance
Best regards.
Mrs. Patricia Leon Fern=C3=A1ndez.
>
--000000000000fc080005f661ea0d--
Attention: Beneficiary.
r>Global Internet Network is pleased to announce that you are one of the 80=
lucky winners of the ongoing COVID-19 award
that your email address has=
been selected among our lucky winners to receive =E2=82=AC4,800,000.00
=
(FOUR MILLION EIGHT HUNDRED THOUSAND EUROS) in cash to the lucky number fil=
e 13-85-22-88-25-50.
Your winning money will now be deposited with Spani=
sh multinational financial services bank Santander Group, based in Madrid.<=
br>We therefore recommend that you contact Mr. Sanchez Martini, Director of=
Santander Bank Group, with the details below.
Email =3D
mailto:sanchezmartini@europe.com">sanchezmartini@europe.com
so t=
hat he can inform you how to receive your winning prize.
congratulations=
in advance
Best regards.
Mrs. Patricia Leon Fern=C3=A1ndez.
>
--000000000000fc080005f661ea0d--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments