Abandoned fund spam from gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Mar 2023 05:12:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1paF6s-000JoE-2G
for dave@doctor.nl2k.ab.ca;
Thu, 09 Mar 2023 05:11:02 -0700
Resent-From: The Doctor
Resent-Date: Thu, 9 Mar 2023 05:11:02 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pf1-f181.google.com ([209.85.210.181]:37450)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from)
id 1paDYN-0007ot-0C
for sales@nk.ca;
Thu, 09 Mar 2023 03:31:23 -0700
Received: by mail-pf1-f181.google.com with SMTP id z11so1164139pfh.4
for; Thu, 09 Mar 2023 02:29:20 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1678357754;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=nE+i8K/vDNvH13o2fSnMLx7ZDm4jlaxHNlkGXw+1/Hc=;
b=LIAr2VOJ5TaJkuIFC0QTC37MSyqHLLgxRHkILbZso2oZ03BrDywcpjaJ3kOskwowhV
GF6Z1qctSYUgy7cVBQSvE9SK9x9B4rPHBfCco3dLqB9eAGqDUBcMPjgNgaDsYs5yKxh4
0QTqXI2M9qKr52PCP3s9DdyJ2/AjDU4V9V0m/O0vfoGzBZWZKX28Spj7Bxk3piXkrDBM
HmVoDh18TPg6ISZyRW1EHWmmConCalxMZINYv5vCvxOjWD0w3TYu8NaHHhRBxu5zvnIB
41HLPJRJUPlKKC+ScaDZebwZO2pphkmjCJ4mGHfUK4C/bF4OgAnHqPjlEw7NbE4VJA8q
uEMA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1678357754;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=nE+i8K/vDNvH13o2fSnMLx7ZDm4jlaxHNlkGXw+1/Hc=;
b=42ceb+nxpeRo/a5h/t3ulvkbkuSTBtSrR1MQuApml/kt+5UJVhJdxH2yv7uZmy44oi
2XBTzR/kG4SnAqVqVX2LzUukHm/ChbygSgblfQOmP+Ytz6YgrvF35iGjw+f0EqHdTiz+
o9U175PV96Eqp9VBBvwCjjuSchIcDSpBsCWOcciy1OXpEZiSvZf/hNDY+xj3cv/jNPQu
JJEOFj59pQuxtVQh4n00JyEG6jdaO1Ll5TmgAafT6nd2uz/qj1G1FeRXvef7Ipq1fu66
ryRi2qqsDQ1A+8JuVF9q6sE6B8gWwAIIR6F+jIspLJvwNg/dEJ5OYZvtzUM53g1hpu5F
lE+w==
X-Gm-Message-State: AO0yUKW9yofKfk9Sr4zPybaKNJa5JgrH6XjU31rIdwxGhDs2Lmr1olLM
7YVovzTXx6N9hYdNmA+9n0NefXeT7qnMWD1ZjWs=
X-Google-Smtp-Source: AK7set8kG5DeaUuRC+JWWKooWuX5uqnMV0Mc3SkG1O7LuKaHcql5J8R0at7Ifiew33y1nEQEC+guSsq8zUIqhOzeNC8=
X-Received: by 2002:a62:8645:0:b0:5d9:27a5:619e with SMTP id
x66-20020a628645000000b005d927a5619emr8917678pfd.4.1678357754487; Thu, 09 Mar
2023 02:29:14 -0800 (PST)
MIME-Version: 1.0
Reply-To: davidmoonass@gmail.com
From: "Mr. David Moon"
Date: Thu, 9 Mar 2023 10:28:54 +0000
Message-ID:
Subject: Dear Friend,
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000c329df05f6751dac"
Bcc: sales@nk.ca
X-Spam_score: 19.4
X-Spam_score_int: 194
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Friend, I know this means of communication may not be
morally right to you as a person but I also have had a great thought about
it and I have come to this conclusion which I am about to share with you.
Content analysis details: (19.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[mrdavidmoondm(at)gmail.com]
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.210.181 listed in list.dnswl.org]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.210.181 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 T_MONEY_PERCENT X% of a lot of money for you
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
Subject: {SPAM?} Dear Friend,
--000000000000c329df05f6751dac
Content-Type: text/plain; charset="UTF-8"
Dear Friend,
I know this means of communication may not be morally right to you as
a person but I also have had a great thought about it and I have come
to this conclusion which I am about to share with you.
I am Mr.David Moon, the auditing director of International Bank
Burkina Faso. I hope you will cooperate with me as a partner in a
project of transferring an abandoned fund of a late customer of the
bank worth $18,000,000 (Eighteen Million Dollars only).
This will be disbursed or shared between the both of us in these
percentages, 55% for me and 45% for you. Contact me immediately if
that is alright for you so that we can enter into an agreement before
we start processing for the transfer of the funds. If you are
satisfied with this proposal, please provide the below details for the
Mutual Confidentiality Agreement
1. Full Name and Address
2. Occupation and Country of Origin
3. Telephone Number
I wait for your response so that we can commence on this project as
soon as possible.
Regards,
Mr. David Moon
--000000000000c329df05f6751dac
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--000000000000c329df05f6751dac--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Mar 2023 05:12:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1paF6s-000JoE-2G
for dave@doctor.nl2k.ab.ca;
Thu, 09 Mar 2023 05:11:02 -0700
Resent-From: The Doctor
Resent-Date: Thu, 9 Mar 2023 05:11:02 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pf1-f181.google.com ([209.85.210.181]:37450)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from
id 1paDYN-0007ot-0C
for sales@nk.ca;
Thu, 09 Mar 2023 03:31:23 -0700
Received: by mail-pf1-f181.google.com with SMTP id z11so1164139pfh.4
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1678357754;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=nE+i8K/vDNvH13o2fSnMLx7ZDm4jlaxHNlkGXw+1/Hc=;
b=LIAr2VOJ5TaJkuIFC0QTC37MSyqHLLgxRHkILbZso2oZ03BrDywcpjaJ3kOskwowhV
GF6Z1qctSYUgy7cVBQSvE9SK9x9B4rPHBfCco3dLqB9eAGqDUBcMPjgNgaDsYs5yKxh4
0QTqXI2M9qKr52PCP3s9DdyJ2/AjDU4V9V0m/O0vfoGzBZWZKX28Spj7Bxk3piXkrDBM
HmVoDh18TPg6ISZyRW1EHWmmConCalxMZINYv5vCvxOjWD0w3TYu8NaHHhRBxu5zvnIB
41HLPJRJUPlKKC+ScaDZebwZO2pphkmjCJ4mGHfUK4C/bF4OgAnHqPjlEw7NbE4VJA8q
uEMA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1678357754;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=nE+i8K/vDNvH13o2fSnMLx7ZDm4jlaxHNlkGXw+1/Hc=;
b=42ceb+nxpeRo/a5h/t3ulvkbkuSTBtSrR1MQuApml/kt+5UJVhJdxH2yv7uZmy44oi
2XBTzR/kG4SnAqVqVX2LzUukHm/ChbygSgblfQOmP+Ytz6YgrvF35iGjw+f0EqHdTiz+
o9U175PV96Eqp9VBBvwCjjuSchIcDSpBsCWOcciy1OXpEZiSvZf/hNDY+xj3cv/jNPQu
JJEOFj59pQuxtVQh4n00JyEG6jdaO1Ll5TmgAafT6nd2uz/qj1G1FeRXvef7Ipq1fu66
ryRi2qqsDQ1A+8JuVF9q6sE6B8gWwAIIR6F+jIspLJvwNg/dEJ5OYZvtzUM53g1hpu5F
lE+w==
X-Gm-Message-State: AO0yUKW9yofKfk9Sr4zPybaKNJa5JgrH6XjU31rIdwxGhDs2Lmr1olLM
7YVovzTXx6N9hYdNmA+9n0NefXeT7qnMWD1ZjWs=
X-Google-Smtp-Source: AK7set8kG5DeaUuRC+JWWKooWuX5uqnMV0Mc3SkG1O7LuKaHcql5J8R0at7Ifiew33y1nEQEC+guSsq8zUIqhOzeNC8=
X-Received: by 2002:a62:8645:0:b0:5d9:27a5:619e with SMTP id
x66-20020a628645000000b005d927a5619emr8917678pfd.4.1678357754487; Thu, 09 Mar
2023 02:29:14 -0800 (PST)
MIME-Version: 1.0
Reply-To: davidmoonass@gmail.com
From: "Mr. David Moon"
Date: Thu, 9 Mar 2023 10:28:54 +0000
Message-ID:
Subject: Dear Friend,
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000c329df05f6751dac"
Bcc: sales@nk.ca
X-Spam_score: 19.4
X-Spam_score_int: 194
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Friend, I know this means of communication may not be
morally right to you as a person but I also have had a great thought about
it and I have come to this conclusion which I am about to share with you.
Content analysis details: (19.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[mrdavidmoondm(at)gmail.com]
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.210.181 listed in list.dnswl.org]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.210.181 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.5 HK_NAME_FM_MR_MRS No description available.
0.0 T_HK_NAME_FM_MR_MRS No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 T_MONEY_PERCENT X% of a lot of money for you
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
Subject: {SPAM?} Dear Friend,
--000000000000c329df05f6751dac
Content-Type: text/plain; charset="UTF-8"
Dear Friend,
I know this means of communication may not be morally right to you as
a person but I also have had a great thought about it and I have come
to this conclusion which I am about to share with you.
I am Mr.David Moon, the auditing director of International Bank
Burkina Faso. I hope you will cooperate with me as a partner in a
project of transferring an abandoned fund of a late customer of the
bank worth $18,000,000 (Eighteen Million Dollars only).
This will be disbursed or shared between the both of us in these
percentages, 55% for me and 45% for you. Contact me immediately if
that is alright for you so that we can enter into an agreement before
we start processing for the transfer of the funds. If you are
satisfied with this proposal, please provide the below details for the
Mutual Confidentiality Agreement
1. Full Name and Address
2. Occupation and Country of Origin
3. Telephone Number
I wait for your response so that we can commence on this project as
soon as possible.
Regards,
Mr. David Moon
--000000000000c329df05f6751dac
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
=C2=A0 =C2=A0 =C2=A0 Dear Friend,
I know this means=
of communication may not be morally right to you as
a person but I also=
have had a great thought about it and I have come
to this conclusion wh=
ich I am about to share with you.
I am Mr.David Moon, the auditing d=
irector of International Bank
Burkina Faso. I hope you will cooperate wi=
th me as a partner in a
project of transferring an abandoned fund of a l=
ate customer of the
bank worth $18,000,000 (Eighteen Million Dollars onl=
y).
This will be disbursed or shared between the both of us in these=
percentages, 55% for me and 45% for you. Contact me immediately if
t=
hat is alright for you so that we can enter into an agreement before
we =
start processing for the transfer of the funds. If you are
satisfied wit=
h this proposal, please provide the below details for the
Mutual Confide=
ntiality Agreement
1. Full Name and Address
2. Occupation and Cou=
ntry of Origin
3. Telephone Number
I wait for your response so th=
at we can commence on this project as
soon as possible.
Regards,<=
br>Mr. David Moon=C2=A0 =C2=A0 =C2=A0=C2=A0
I know this means=
of communication may not be morally right to you as
a person but I also=
have had a great thought about it and I have come
to this conclusion wh=
ich I am about to share with you.
I am Mr.David Moon, the auditing d=
irector of International Bank
Burkina Faso. I hope you will cooperate wi=
th me as a partner in a
project of transferring an abandoned fund of a l=
ate customer of the
bank worth $18,000,000 (Eighteen Million Dollars onl=
y).
This will be disbursed or shared between the both of us in these=
percentages, 55% for me and 45% for you. Contact me immediately if
t=
hat is alright for you so that we can enter into an agreement before
we =
start processing for the transfer of the funds. If you are
satisfied wit=
h this proposal, please provide the below details for the
Mutual Confide=
ntiality Agreement
1. Full Name and Address
2. Occupation and Cou=
ntry of Origin
3. Telephone Number
I wait for your response so th=
at we can commence on this project as
soon as possible.
Regards,<=
br>Mr. David Moon=C2=A0 =C2=A0 =C2=A0=C2=A0
--000000000000c329df05f6751dac--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments