Donation spam from gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Mar 2023 05:09:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1paF4b-000Jcl-1P
for dave@doctor.nl2k.ab.ca;
Thu, 09 Mar 2023 05:08:41 -0700
Resent-From: The Doctor
Resent-Date: Thu, 9 Mar 2023 05:08:41 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vs1-f66.google.com ([209.85.217.66]:36524)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from)
id 1pa7qx-000FVu-1q
for sales@nk.ca;
Wed, 08 Mar 2023 21:26:14 -0700
Received: by mail-vs1-f66.google.com with SMTP id by13so543347vsb.3
for; Wed, 08 Mar 2023 20:24:09 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1678335843;
h=content-transfer-encoding:to:subject:message-id:date:from:reply-to
:mime-version:from:to:cc:subject:date:message-id:reply-to;
bh=nYQwpPwceaCmWKtuw/AFT4LOokbCGQJeexzC5UoPQWE=;
b=NE9kdYG9FtxF18HXIF95me9Tm74dxCZ6X91psMfFftZcnfFYgg1rz/ZvgWZ9hl7Zby
aePFc4RFOxgI/Ve/+IXCBE8TBaxLQB55We0cW/836FP6Jz84FfgSPyv31tASMkDq1pAU
5G+vN80f7U5zccWy/tHuplsxXzjkRKPyIy7AvAVfqD6pCQnBXJa/w9OSsZbWjLqP3mAB
xjDNZmYCtHl5YzqsCPYOo9IcunhowkVWZYOdcMSvRmp8IaZF/YFA6auCaBiUuXFu1jnX
/lpcXtKFQLK2pdbOMVih+TSVMx3KwfPVhzFVBWYOEqKnTj37jD3fbNPe/UO879ec1tAc
1lNg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1678335843;
h=content-transfer-encoding:to:subject:message-id:date:from:reply-to
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=nYQwpPwceaCmWKtuw/AFT4LOokbCGQJeexzC5UoPQWE=;
b=OkkDu1vP5Sv3Wfw/zdZ4B2STV1k/JvpExoMiM01TdNRwfNrUNnuAhZGlc9gU9LnaGp
Vp5u0wMDuLfZT+6g3Oahx1T1CA7o26cPU8hF4CGOI07u0vPQIryC4juA2X/DMNtMEH4C
8++83Ro8khIKtF962K6RNA8miqOhEatpvpGoj3OwxkmZ4d3KOPhDGwPWiy89132dr/ki
5hTOpkqB5BSgrUkPAUCnixp6GIVG4AqGYquK6NNp2l/ghd0PwIrQNxT//GS8RJimq7YQ
2i3a0xLuYeo1kkzIyOQpCOFnfomGobE4HRae5K3p18xR4etYs6iaR1rj+B5+2FuxnpEl
wK8A==
X-Gm-Message-State: AO0yUKWQR9aRGsYwxHOTowxwYjsjzzPTPSNBjOyWWA0jydGr1FmdcrNh
AUNRdu++7pLxJ8vTWWUoQfit3Jj3g9//l9fZRVU=
X-Google-Smtp-Source: AK7set+z4c4WRQhCTGsq5cw9qGS3K5tb26fv69b30HRXokXgxvDq8riiMJzJ6BdggpgLv6/U4V2ELbDTFDiuJAYfp5Q=
X-Received: by 2002:a05:6102:5599:b0:421:c4a3:b607 with SMTP id
dc25-20020a056102559900b00421c4a3b607mr14773827vsb.3.1678335843348; Wed, 08
Mar 2023 20:24:03 -0800 (PST)
MIME-Version: 1.0
Received: by 2002:ab0:3151:0:0:0:0:0 with HTTP; Wed, 8 Mar 2023 20:24:03 -0800 (PST)
Reply-To: richardwahl1031@gmail.com
From: Richard Wahl
Date: Wed, 8 Mar 2023 20:24:03 -0800
Message-ID:
Subject: DID YOU RECEIVE MY MESSAGE?
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Bcc: sales@nk.ca
X-Spam_score: 10.2
X-Spam_score_int: 102
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Hello, I have sent you more than 3 emails regarding your
donation of €1,200,000.00. Did you get my message I sent you? Your email
won a donation, so I'm sending you messages. Do not ignore this m [...]
Content analysis details: (10.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.217.66 listed in list.dnswl.org]
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[songdavid717(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[richardwahl1031(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[songdavid717(at)gmail.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.217.66 listed in wl.mailspike.net]
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.0 REPTO_419_FRAUD_GM_LOOSE Ends-in-digits Reply-To is similar to known
advance fee fraud collector mailbox
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} DID YOU RECEIVE MY MESSAGE?
--=20
Hello,
I have sent you more than 3 emails regarding your donation of
=E2=82=AC1,200,000.00. Did you get my message I sent you? Your email won a
donation, so I'm sending you messages. Do not ignore this message as
this is not a scam. Please reply me urgently for more information
Your name:
Your country:
WhatsApp number:
Your answer is required.
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Mar 2023 05:09:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1paF4b-000Jcl-1P
for dave@doctor.nl2k.ab.ca;
Thu, 09 Mar 2023 05:08:41 -0700
Resent-From: The Doctor
Resent-Date: Thu, 9 Mar 2023 05:08:41 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vs1-f66.google.com ([209.85.217.66]:36524)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from
id 1pa7qx-000FVu-1q
for sales@nk.ca;
Wed, 08 Mar 2023 21:26:14 -0700
Received: by mail-vs1-f66.google.com with SMTP id by13so543347vsb.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1678335843;
h=content-transfer-encoding:to:subject:message-id:date:from:reply-to
:mime-version:from:to:cc:subject:date:message-id:reply-to;
bh=nYQwpPwceaCmWKtuw/AFT4LOokbCGQJeexzC5UoPQWE=;
b=NE9kdYG9FtxF18HXIF95me9Tm74dxCZ6X91psMfFftZcnfFYgg1rz/ZvgWZ9hl7Zby
aePFc4RFOxgI/Ve/+IXCBE8TBaxLQB55We0cW/836FP6Jz84FfgSPyv31tASMkDq1pAU
5G+vN80f7U5zccWy/tHuplsxXzjkRKPyIy7AvAVfqD6pCQnBXJa/w9OSsZbWjLqP3mAB
xjDNZmYCtHl5YzqsCPYOo9IcunhowkVWZYOdcMSvRmp8IaZF/YFA6auCaBiUuXFu1jnX
/lpcXtKFQLK2pdbOMVih+TSVMx3KwfPVhzFVBWYOEqKnTj37jD3fbNPe/UO879ec1tAc
1lNg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1678335843;
h=content-transfer-encoding:to:subject:message-id:date:from:reply-to
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=nYQwpPwceaCmWKtuw/AFT4LOokbCGQJeexzC5UoPQWE=;
b=OkkDu1vP5Sv3Wfw/zdZ4B2STV1k/JvpExoMiM01TdNRwfNrUNnuAhZGlc9gU9LnaGp
Vp5u0wMDuLfZT+6g3Oahx1T1CA7o26cPU8hF4CGOI07u0vPQIryC4juA2X/DMNtMEH4C
8++83Ro8khIKtF962K6RNA8miqOhEatpvpGoj3OwxkmZ4d3KOPhDGwPWiy89132dr/ki
5hTOpkqB5BSgrUkPAUCnixp6GIVG4AqGYquK6NNp2l/ghd0PwIrQNxT//GS8RJimq7YQ
2i3a0xLuYeo1kkzIyOQpCOFnfomGobE4HRae5K3p18xR4etYs6iaR1rj+B5+2FuxnpEl
wK8A==
X-Gm-Message-State: AO0yUKWQR9aRGsYwxHOTowxwYjsjzzPTPSNBjOyWWA0jydGr1FmdcrNh
AUNRdu++7pLxJ8vTWWUoQfit3Jj3g9//l9fZRVU=
X-Google-Smtp-Source: AK7set+z4c4WRQhCTGsq5cw9qGS3K5tb26fv69b30HRXokXgxvDq8riiMJzJ6BdggpgLv6/U4V2ELbDTFDiuJAYfp5Q=
X-Received: by 2002:a05:6102:5599:b0:421:c4a3:b607 with SMTP id
dc25-20020a056102559900b00421c4a3b607mr14773827vsb.3.1678335843348; Wed, 08
Mar 2023 20:24:03 -0800 (PST)
MIME-Version: 1.0
Received: by 2002:ab0:3151:0:0:0:0:0 with HTTP; Wed, 8 Mar 2023 20:24:03 -0800 (PST)
Reply-To: richardwahl1031@gmail.com
From: Richard Wahl
Date: Wed, 8 Mar 2023 20:24:03 -0800
Message-ID:
Subject: DID YOU RECEIVE MY MESSAGE?
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Bcc: sales@nk.ca
X-Spam_score: 10.2
X-Spam_score_int: 102
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Hello, I have sent you more than 3 emails regarding your
donation of €1,200,000.00. Did you get my message I sent you? Your email
won a donation, so I'm sending you messages. Do not ignore this m [...]
Content analysis details: (10.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.217.66 listed in list.dnswl.org]
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[songdavid717(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[richardwahl1031(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[songdavid717(at)gmail.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.217.66 listed in wl.mailspike.net]
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.0 REPTO_419_FRAUD_GM_LOOSE Ends-in-digits Reply-To is similar to known
advance fee fraud collector mailbox
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} DID YOU RECEIVE MY MESSAGE?
--=20
Hello,
I have sent you more than 3 emails regarding your donation of
=E2=82=AC1,200,000.00. Did you get my message I sent you? Your email won a
donation, so I'm sending you messages. Do not ignore this message as
this is not a scam. Please reply me urgently for more information
Your name:
Your country:
WhatsApp number:
Your answer is required.
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments