Powerball spam from gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 22 Mar 2023 12:45:03 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pf3Rb-000JqG-0G
for dave@doctor.nl2k.ab.ca;
Wed, 22 Mar 2023 12:44:19 -0600
Resent-From: The Doctor
Resent-Date: Wed, 22 Mar 2023 12:44:19 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-qv1-f65.google.com ([209.85.219.65]:43532)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from)
id 1pf28P-0008Fl-0M
for sales@nk.ca;
Wed, 22 Mar 2023 11:20:27 -0600
Received: by mail-qv1-f65.google.com with SMTP id jl13so12597088qvb.10
for; Wed, 22 Mar 2023 10:18:26 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1679505500;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=Rwc6O1Jn74oa4WZwWNPwdihCtXHBq/bfxxtwThCzldY=;
b=EPuVGOkfNR+CbxiKyzf4xPnfb7ARfrPDbuFWhQhHhzwZIpVyZAD4h3PvR51oc7Ofjp
9yvAupfoMlh77BHjBT1W3JxPVgzHP6iwk0E/wvcnNJ8xwEi3SZ3Xn7BQzPAFTP2ur1tK
hc1iWXpVa8DYQHKi83JZtzowb5tBOhwpyLDvkU22J3l8t+G5l4qOsEBRfL91YHdVMpW4
kVF9rn2n6FMWW8M/osnFLhF7WCCYSt4b2fpDQ090rYoDf7p7mInQGAJHnxSKRNJTwUbL
Jy4PlP1mhv9aYjh1KBJxyVAD7XAlN7veyLeAqutRBRvASFpFa1/cXeEiXPbP7s2GJVr2
jjHw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1679505500;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=Rwc6O1Jn74oa4WZwWNPwdihCtXHBq/bfxxtwThCzldY=;
b=Sefath6ZQ1qQ5mKr1phHMQkSixmUobX6DD7gDi5JALJahV9TjW/qRf+vZc4c9ezZH+
/0Y0Y3i15fcUpZZ+rDdzwFfw8hdYQCufOC154KrITbEQGnaMeBkJTaZV7HH/M3CnqvCS
26U+C44fb3T03dOE0zm8auqO8J9UPjptI31JsZe7twjs9vyJeKm6C4DraweLw5warscN
1tnl3Hcyq9PqkEi5Txi6ehIMEU6a0yGKN3yiVFCFhWp+ophcrtuiekE3kX03AzZthymB
C6AMbgfKYmlu13NYAkODUm7UPGMFJicIZFIhYEA7VJk9CawDIo8E4aMCC3xqiWrCnKtL
pf7A==
X-Gm-Message-State: AO0yUKWyRzqT06/UWucmOdPTBY6hXHjV3sJFXpI08G/HTDBtpfoTNT+k
XqFVLfSgAeLmVY3La5GbdiNFkJWHFf6aZvkOzMM=
X-Google-Smtp-Source: AK7set/whb/Le4ALwwtjg55tLeEmeFXbKwc1fydA2Dx4Dkvw1qaqAj4sRFnPgTkIQ+ye0mlRGMOIxG9kJZJD3GRjs2A=
X-Received: by 2002:ad4:48c3:0:b0:5a9:5b2d:cd57 with SMTP id
v3-20020ad448c3000000b005a95b2dcd57mr868159qvx.3.1679505500354; Wed, 22 Mar
2023 10:18:20 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:ab3:eb8d:0:b0:4d2:ca47:56cf with HTTP; Wed, 22 Mar 2023
10:18:19 -0700 (PDT)
Reply-To: lopowerball1@gmail.com
From: Powerball Promo
Date: Wed, 22 Mar 2023 10:18:19 -0700
Message-ID:
Subject: Powerball promo
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: sales@nk.ca
X-Spam_score: 11.3
X-Spam_score_int: 113
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Your E-mail-ID was selected from an online Powerball promo.
Your draw has a total value of $3 MILLION USD. send your info 1.Name.2.Add.3.Phone.4.Country.5.Age
Content analysis details: (11.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.219.65 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[bol153263(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[lopowerball1(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[bol153263(at)gmail.com]
2.5 MILLION_USD BODY: Talks about millions of dollars
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.219.65 listed in wl.mailspike.net]
Subject: {SPAM?} Powerball promo
--
Your E-mail-ID was selected from an online Powerball promo. Your draw
has a total value of $3 MILLION USD. send your info
1.Name.2.Add.3.Phone.4.Country.5.Age
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 22 Mar 2023 12:45:03 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pf3Rb-000JqG-0G
for dave@doctor.nl2k.ab.ca;
Wed, 22 Mar 2023 12:44:19 -0600
Resent-From: The Doctor
Resent-Date: Wed, 22 Mar 2023 12:44:19 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-qv1-f65.google.com ([209.85.219.65]:43532)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from
id 1pf28P-0008Fl-0M
for sales@nk.ca;
Wed, 22 Mar 2023 11:20:27 -0600
Received: by mail-qv1-f65.google.com with SMTP id jl13so12597088qvb.10
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1679505500;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=Rwc6O1Jn74oa4WZwWNPwdihCtXHBq/bfxxtwThCzldY=;
b=EPuVGOkfNR+CbxiKyzf4xPnfb7ARfrPDbuFWhQhHhzwZIpVyZAD4h3PvR51oc7Ofjp
9yvAupfoMlh77BHjBT1W3JxPVgzHP6iwk0E/wvcnNJ8xwEi3SZ3Xn7BQzPAFTP2ur1tK
hc1iWXpVa8DYQHKi83JZtzowb5tBOhwpyLDvkU22J3l8t+G5l4qOsEBRfL91YHdVMpW4
kVF9rn2n6FMWW8M/osnFLhF7WCCYSt4b2fpDQ090rYoDf7p7mInQGAJHnxSKRNJTwUbL
Jy4PlP1mhv9aYjh1KBJxyVAD7XAlN7veyLeAqutRBRvASFpFa1/cXeEiXPbP7s2GJVr2
jjHw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1679505500;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=Rwc6O1Jn74oa4WZwWNPwdihCtXHBq/bfxxtwThCzldY=;
b=Sefath6ZQ1qQ5mKr1phHMQkSixmUobX6DD7gDi5JALJahV9TjW/qRf+vZc4c9ezZH+
/0Y0Y3i15fcUpZZ+rDdzwFfw8hdYQCufOC154KrITbEQGnaMeBkJTaZV7HH/M3CnqvCS
26U+C44fb3T03dOE0zm8auqO8J9UPjptI31JsZe7twjs9vyJeKm6C4DraweLw5warscN
1tnl3Hcyq9PqkEi5Txi6ehIMEU6a0yGKN3yiVFCFhWp+ophcrtuiekE3kX03AzZthymB
C6AMbgfKYmlu13NYAkODUm7UPGMFJicIZFIhYEA7VJk9CawDIo8E4aMCC3xqiWrCnKtL
pf7A==
X-Gm-Message-State: AO0yUKWyRzqT06/UWucmOdPTBY6hXHjV3sJFXpI08G/HTDBtpfoTNT+k
XqFVLfSgAeLmVY3La5GbdiNFkJWHFf6aZvkOzMM=
X-Google-Smtp-Source: AK7set/whb/Le4ALwwtjg55tLeEmeFXbKwc1fydA2Dx4Dkvw1qaqAj4sRFnPgTkIQ+ye0mlRGMOIxG9kJZJD3GRjs2A=
X-Received: by 2002:ad4:48c3:0:b0:5a9:5b2d:cd57 with SMTP id
v3-20020ad448c3000000b005a95b2dcd57mr868159qvx.3.1679505500354; Wed, 22 Mar
2023 10:18:20 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:ab3:eb8d:0:b0:4d2:ca47:56cf with HTTP; Wed, 22 Mar 2023
10:18:19 -0700 (PDT)
Reply-To: lopowerball1@gmail.com
From: Powerball Promo
Date: Wed, 22 Mar 2023 10:18:19 -0700
Message-ID:
Subject: Powerball promo
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: sales@nk.ca
X-Spam_score: 11.3
X-Spam_score_int: 113
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Your E-mail-ID was selected from an online Powerball promo.
Your draw has a total value of $3 MILLION USD. send your info 1.Name.2.Add.3.Phone.4.Country.5.Age
Content analysis details: (11.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.219.65 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[bol153263(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[lopowerball1(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[bol153263(at)gmail.com]
2.5 MILLION_USD BODY: Talks about millions of dollars
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.219.65 listed in wl.mailspike.net]
Subject: {SPAM?} Powerball promo
--
Your E-mail-ID was selected from an online Powerball promo. Your draw
has a total value of $3 MILLION USD. send your info
1.Name.2.Add.3.Phone.4.Country.5.Age
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments