Lottery Nigerian Spam from Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 24 Mar 2023 07:29:03 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pfhSK-000B9D-2F
for dave@doctor.nl2k.ab.ca;
Fri, 24 Mar 2023 07:27:44 -0600
Resent-From: The Doctor
Resent-Date: Fri, 24 Mar 2023 07:27:44 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vs1-f65.google.com ([209.85.217.65]:36803)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from)
id 1pfgoo-0001LO-2I
for usenet@nl2k.ab.ca;
Fri, 24 Mar 2023 06:47:00 -0600
Received: by mail-vs1-f65.google.com with SMTP id dc30so911910vsb.3
for; Fri, 24 Mar 2023 05:44:55 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1679661889;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=Rwc6O1Jn74oa4WZwWNPwdihCtXHBq/bfxxtwThCzldY=;
b=k5D4ruBr9AdKL+YkRavajhq0qGdDpJ3df6y6jbmZDDH9nSFAonD0ADcOP9B15TD7vV
3uAK/N85QHQDGx/yUn5JbKrARaLGWP3M8wQy2/CE8j0J/5yoCdAuz3bIHWzFvthX1Ipj
853N3Awbpk5lOkU6xP8nCxlZWslk8bodbksz+rB3c/7OeRIfTFFlb7+g1jYuyGKH/cdC
P0CiFv4JhkDR77dVidUhHslSO1X4kasGnbZ7E/17caTE+3iHrKr+3NdAYu6Jb4SRtzvZ
lZLRgivNBgXkVDxqRUQwooMQvSpe9UXqdhK0ia5i8oUDejQ1s8IkqPXkmqEamu6fvi7s
pB2Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1679661889;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=Rwc6O1Jn74oa4WZwWNPwdihCtXHBq/bfxxtwThCzldY=;
b=vcofGt8YoDYmaz7+zTBMzPT+SIQhPdPBwWFMsrHHidEz0p3hXYi4q6KXaxfMb/+ULg
I/ACvO4YAhFP8qsEvUo+swg7Mq5O6twgBOMBbiGdQV6orTTlxNdPOiUavaSqRgP0JmpB
xqGnWl4QjyK7YnALXB5j8KzglJp4Y6ZJ0WxZibeTZXcBOh+QpWpLDiSsfOoPAHERIVN/
bjtsgLpun4njOtlTvvlV9mIBu/O6Zt7BIIv93c9BqhlST3BVMWngGKOcVY4mHhM9LgfE
3gwdC97ukw3+MPjkyLVQm6q3WXAA9+IVHAMUy05bA8ZDx+yGSVUJpes4ouzouTEXmxuv
154g==
X-Gm-Message-State: AAQBX9cR1VX/qr3MptpZOwm9/hO6jBdp3DSoXNU0CC254d3wMAgfNiXc
bihqcO5Rjez3IKAIyjaUwcFHfrY5xts0QvxZ5vA=
X-Google-Smtp-Source: AKy350bfZhJqifhWpRKG9ViEstRwcdu6Ns//eWlKzI6YwTCQpwP3K4u7tzlJOq6gVyiLA8X1YW4bTso+kUJstl9tJBI=
X-Received: by 2002:a67:c283:0:b0:425:e5e6:d1d9 with SMTP id
k3-20020a67c283000000b00425e5e6d1d9mr1472828vsj.2.1679661889717; Fri, 24 Mar
2023 05:44:49 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a59:d84c:0:b0:38c:4029:680c with HTTP; Fri, 24 Mar 2023
05:44:49 -0700 (PDT)
Reply-To: lopowerball1@gmail.com
From: Powerball Promo
Date: Fri, 24 Mar 2023 05:44:49 -0700
Message-ID:
Subject:
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: usenet@nl2k.ab.ca
X-Spam_score: 11.3
X-Spam_score_int: 113
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Your E-mail-ID was selected from an online Powerball promo.
Your draw has a total value of $3 MILLION USD. send your info 1.Name.2.Add.3.Phone.4.Country.5.Age
Content analysis details: (11.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.217.65 listed in list.dnswl.org]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[whitenichole747(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[lopowerball1(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[whitenichole747(at)gmail.com]
2.5 MILLION_USD BODY: Talks about millions of dollars
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.217.65 listed in wl.mailspike.net]
Subject: {SPAM?}
--
Your E-mail-ID was selected from an online Powerball promo. Your draw
has a total value of $3 MILLION USD. send your info
1.Name.2.Add.3.Phone.4.Country.5.Age
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 24 Mar 2023 07:29:03 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pfhSK-000B9D-2F
for dave@doctor.nl2k.ab.ca;
Fri, 24 Mar 2023 07:27:44 -0600
Resent-From: The Doctor
Resent-Date: Fri, 24 Mar 2023 07:27:44 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vs1-f65.google.com ([209.85.217.65]:36803)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from
id 1pfgoo-0001LO-2I
for usenet@nl2k.ab.ca;
Fri, 24 Mar 2023 06:47:00 -0600
Received: by mail-vs1-f65.google.com with SMTP id dc30so911910vsb.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1679661889;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=Rwc6O1Jn74oa4WZwWNPwdihCtXHBq/bfxxtwThCzldY=;
b=k5D4ruBr9AdKL+YkRavajhq0qGdDpJ3df6y6jbmZDDH9nSFAonD0ADcOP9B15TD7vV
3uAK/N85QHQDGx/yUn5JbKrARaLGWP3M8wQy2/CE8j0J/5yoCdAuz3bIHWzFvthX1Ipj
853N3Awbpk5lOkU6xP8nCxlZWslk8bodbksz+rB3c/7OeRIfTFFlb7+g1jYuyGKH/cdC
P0CiFv4JhkDR77dVidUhHslSO1X4kasGnbZ7E/17caTE+3iHrKr+3NdAYu6Jb4SRtzvZ
lZLRgivNBgXkVDxqRUQwooMQvSpe9UXqdhK0ia5i8oUDejQ1s8IkqPXkmqEamu6fvi7s
pB2Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1679661889;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=Rwc6O1Jn74oa4WZwWNPwdihCtXHBq/bfxxtwThCzldY=;
b=vcofGt8YoDYmaz7+zTBMzPT+SIQhPdPBwWFMsrHHidEz0p3hXYi4q6KXaxfMb/+ULg
I/ACvO4YAhFP8qsEvUo+swg7Mq5O6twgBOMBbiGdQV6orTTlxNdPOiUavaSqRgP0JmpB
xqGnWl4QjyK7YnALXB5j8KzglJp4Y6ZJ0WxZibeTZXcBOh+QpWpLDiSsfOoPAHERIVN/
bjtsgLpun4njOtlTvvlV9mIBu/O6Zt7BIIv93c9BqhlST3BVMWngGKOcVY4mHhM9LgfE
3gwdC97ukw3+MPjkyLVQm6q3WXAA9+IVHAMUy05bA8ZDx+yGSVUJpes4ouzouTEXmxuv
154g==
X-Gm-Message-State: AAQBX9cR1VX/qr3MptpZOwm9/hO6jBdp3DSoXNU0CC254d3wMAgfNiXc
bihqcO5Rjez3IKAIyjaUwcFHfrY5xts0QvxZ5vA=
X-Google-Smtp-Source: AKy350bfZhJqifhWpRKG9ViEstRwcdu6Ns//eWlKzI6YwTCQpwP3K4u7tzlJOq6gVyiLA8X1YW4bTso+kUJstl9tJBI=
X-Received: by 2002:a67:c283:0:b0:425:e5e6:d1d9 with SMTP id
k3-20020a67c283000000b00425e5e6d1d9mr1472828vsj.2.1679661889717; Fri, 24 Mar
2023 05:44:49 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a59:d84c:0:b0:38c:4029:680c with HTTP; Fri, 24 Mar 2023
05:44:49 -0700 (PDT)
Reply-To: lopowerball1@gmail.com
From: Powerball Promo
Date: Fri, 24 Mar 2023 05:44:49 -0700
Message-ID:
Subject:
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: usenet@nl2k.ab.ca
X-Spam_score: 11.3
X-Spam_score_int: 113
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Your E-mail-ID was selected from an online Powerball promo.
Your draw has a total value of $3 MILLION USD. send your info 1.Name.2.Add.3.Phone.4.Country.5.Age
Content analysis details: (11.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.217.65 listed in list.dnswl.org]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[whitenichole747(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[lopowerball1(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[whitenichole747(at)gmail.com]
2.5 MILLION_USD BODY: Talks about millions of dollars
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.217.65 listed in wl.mailspike.net]
Subject: {SPAM?}
--
Your E-mail-ID was selected from an online Powerball promo. Your draw
has a total value of $3 MILLION USD. send your info
1.Name.2.Add.3.Phone.4.Country.5.Age
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments