Nigerian charity gmail phish
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 07 Apr 2023 02:15:05 -0600
Received: from mail-oa1-f47.google.com ([209.85.160.47]:36780)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from)
id 1pkhFC-000NQq-0e
for dave@doctor.nl2k.ab.ca;
Fri, 07 Apr 2023 02:14:54 -0600
Received: by mail-oa1-f47.google.com with SMTP id 586e51a60fabf-1841c57c221so83094fac.3
for; Fri, 07 Apr 2023 01:12:51 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1680855166; x=1683447166;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=Ik0tmtXzanQZpYuJAExFY8Rc9k4WCVEO5UEz+ve9z/c=;
b=YpOd7uPBa5cAmqQUTj1o5hIdsEYE2twFk8u/8kdhRSqeF67IXLlfXa14ckHMZv68yB
G8xa19vnkXjcXpoA2g+ZARAAiEDjBkKeutbng1/bzJ9cGvLKiFwiq0LUg8JAPLRkB156
PR94davNuo0eD92bg0imamwvQx4cM9dIVo0+jjjmu7xY8/HXOhoFUzXrh6fqWR7ZPQRc
JXWJlmtHW9Q3b5sJppzBSbVKDJfgmaqoc54jopUI+u4ihgwLJaQxThfWspTKAROhXDvd
vQUh7mh+eS7YlehIxqFZG7Qe+4EVkpWZeMmIwejYu9uODEsQ+KoOnJ+x9qLNqIbwWGZ8
b4Tg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1680855166; x=1683447166;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=Ik0tmtXzanQZpYuJAExFY8Rc9k4WCVEO5UEz+ve9z/c=;
b=7AvvTKI1oVZGl0UnsQaTfrsM9koeCdnksKvw8bw2sLbW7PBtIE8x/3Av1IdzA2EYCd
2dunv0YUBw93FNr37FUhYbMJeMsFGaQChQ1EnNagKU6933nzOmUlCLxaiERZICOM3s56
caNiFMexRc38E8guXPNoUqV9uEiUJJBxdUABmxJ28BvJ+Irbgl+L73QzfFPmbhTaWlO1
03Giu5njKYSTSNo3ZS+z2brc2jnNPr5gkUEBTqQP7PJ44x2btJ37YDTgRzrK2SlGfPRt
fgrSAc6prtiQhZLX5D589gn6lduf7lRlPkD52HH6e3vQ9RgEYNp5LPmvEBS1+jhWDaWG
lgxg==
X-Gm-Message-State: AAQBX9dHuiHm/QB8Ej8L5Q17pUwaYY2TRnkEDnkJkVapIpYKuOLKATta
5vIlilnQHSvaBd4qItnC0px0BN9bnRdWVbI9bEo=
X-Google-Smtp-Source: AKy350ae1C9rh4XwObAqN9WW/1Au9OrhdVv1RzJfBgmOLc0Sbm/9pktQimekDjy9Q/ThdgquJ/nYawrHZWX7fjJE6zQ=
X-Received: by 2002:a05:6870:1217:b0:177:b992:fee7 with SMTP id
23-20020a056870121700b00177b992fee7mr946803oan.3.1680855165612; Fri, 07 Apr
2023 01:12:45 -0700 (PDT)
MIME-Version: 1.0
Reply-To: carolejosiah25@gmail.com
From: Carole Josiah
Date: Fri, 7 Apr 2023 08:12:28 +0000
Message-ID:
Subject: My vow to support
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="00000000000010ba3105f8ba979e"
Bcc: dave@doctor.nl2k.ab.ca
X-Spam_score: 12.8
X-Spam_score_int: 128
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: I am Mrs. Carole Josiah, wife of the late Mr. Josiah. Before
he died, we deposited a sum of $4.6 million in one of the banks here. I'm
diagnosed so I decided to donate these funds. Could you please he [...]
Content analysis details: (12.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[carolejosiah25(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ginamichaelhebert(at)gmail.com]
2.7 HK_SCAM_N1 BODY: No description available.
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.160.47 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 XFER_LOTSA_MONEY Transfer a lot of money
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} My vow to support
--00000000000010ba3105f8ba979e
Content-Type: text/plain; charset="UTF-8"
I am Mrs. Carole Josiah, wife of the late Mr. Josiah. Before he died, we
deposited a sum of $4.6 million in one of the banks here. I'm diagnosed so
I decided to donate these funds. Could you please help me donate to the
underprivileged? 80% are for the underprivileged. The remaining 20% is
dedicated to your efforts. I want to support the underprivileged and
fulfill my vow to my late husband. I'll give you the details as soon as I
hear from you.
Greeting,
Mrs Carole Josiah
--00000000000010ba3105f8ba979e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
nature" data-smartmail=3D"gmail_signature">
v>
--00000000000010ba3105f8ba979e--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 07 Apr 2023 02:15:05 -0600
Received: from mail-oa1-f47.google.com ([209.85.160.47]:36780)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96)
(envelope-from
id 1pkhFC-000NQq-0e
for dave@doctor.nl2k.ab.ca;
Fri, 07 Apr 2023 02:14:54 -0600
Received: by mail-oa1-f47.google.com with SMTP id 586e51a60fabf-1841c57c221so83094fac.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112; t=1680855166; x=1683447166;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=Ik0tmtXzanQZpYuJAExFY8Rc9k4WCVEO5UEz+ve9z/c=;
b=YpOd7uPBa5cAmqQUTj1o5hIdsEYE2twFk8u/8kdhRSqeF67IXLlfXa14ckHMZv68yB
G8xa19vnkXjcXpoA2g+ZARAAiEDjBkKeutbng1/bzJ9cGvLKiFwiq0LUg8JAPLRkB156
PR94davNuo0eD92bg0imamwvQx4cM9dIVo0+jjjmu7xY8/HXOhoFUzXrh6fqWR7ZPQRc
JXWJlmtHW9Q3b5sJppzBSbVKDJfgmaqoc54jopUI+u4ihgwLJaQxThfWspTKAROhXDvd
vQUh7mh+eS7YlehIxqFZG7Qe+4EVkpWZeMmIwejYu9uODEsQ+KoOnJ+x9qLNqIbwWGZ8
b4Tg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112; t=1680855166; x=1683447166;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=Ik0tmtXzanQZpYuJAExFY8Rc9k4WCVEO5UEz+ve9z/c=;
b=7AvvTKI1oVZGl0UnsQaTfrsM9koeCdnksKvw8bw2sLbW7PBtIE8x/3Av1IdzA2EYCd
2dunv0YUBw93FNr37FUhYbMJeMsFGaQChQ1EnNagKU6933nzOmUlCLxaiERZICOM3s56
caNiFMexRc38E8guXPNoUqV9uEiUJJBxdUABmxJ28BvJ+Irbgl+L73QzfFPmbhTaWlO1
03Giu5njKYSTSNo3ZS+z2brc2jnNPr5gkUEBTqQP7PJ44x2btJ37YDTgRzrK2SlGfPRt
fgrSAc6prtiQhZLX5D589gn6lduf7lRlPkD52HH6e3vQ9RgEYNp5LPmvEBS1+jhWDaWG
lgxg==
X-Gm-Message-State: AAQBX9dHuiHm/QB8Ej8L5Q17pUwaYY2TRnkEDnkJkVapIpYKuOLKATta
5vIlilnQHSvaBd4qItnC0px0BN9bnRdWVbI9bEo=
X-Google-Smtp-Source: AKy350ae1C9rh4XwObAqN9WW/1Au9OrhdVv1RzJfBgmOLc0Sbm/9pktQimekDjy9Q/ThdgquJ/nYawrHZWX7fjJE6zQ=
X-Received: by 2002:a05:6870:1217:b0:177:b992:fee7 with SMTP id
23-20020a056870121700b00177b992fee7mr946803oan.3.1680855165612; Fri, 07 Apr
2023 01:12:45 -0700 (PDT)
MIME-Version: 1.0
Reply-To: carolejosiah25@gmail.com
From: Carole Josiah
Date: Fri, 7 Apr 2023 08:12:28 +0000
Message-ID:
Subject: My vow to support
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="00000000000010ba3105f8ba979e"
Bcc: dave@doctor.nl2k.ab.ca
X-Spam_score: 12.8
X-Spam_score_int: 128
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: I am Mrs. Carole Josiah, wife of the late Mr. Josiah. Before
he died, we deposited a sum of $4.6 million in one of the banks here. I'm
diagnosed so I decided to donate these funds. Could you please he [...]
Content analysis details: (12.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[carolejosiah25(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ginamichaelhebert(at)gmail.com]
2.7 HK_SCAM_N1 BODY: No description available.
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.160.47 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 XFER_LOTSA_MONEY Transfer a lot of money
3.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} My vow to support
--00000000000010ba3105f8ba979e
Content-Type: text/plain; charset="UTF-8"
I am Mrs. Carole Josiah, wife of the late Mr. Josiah. Before he died, we
deposited a sum of $4.6 million in one of the banks here. I'm diagnosed so
I decided to donate these funds. Could you please help me donate to the
underprivileged? 80% are for the underprivileged. The remaining 20% is
dedicated to your efforts. I want to support the underprivileged and
fulfill my vow to my late husband. I'll give you the details as soon as I
hear from you.
Greeting,
Mrs Carole Josiah
--00000000000010ba3105f8ba979e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
nature" data-smartmail=3D"gmail_signature">
I am Mrs. =
Carole Josiah, wife of the late Mr. Josiah. Before he died, we deposited a =
sum of $4.6 million in one of the banks here. I'm diagnosed so I decide=
d to donate these funds. Could you please help me donate to the underprivil=
eged? 80% are for the underprivileged. The remaining 20% is dedicated to yo=
ur efforts. I want to support the underprivileged and fulfill my vow to my =
late husband. I'll give you the details as soon as I hear from you.
v>
Carole Josiah, wife of the late Mr. Josiah. Before he died, we deposited a =
sum of $4.6 million in one of the banks here. I'm diagnosed so I decide=
d to donate these funds. Could you please help me donate to the underprivil=
eged? 80% are for the underprivileged. The remaining 20% is dedicated to yo=
ur efforts. I want to support the underprivileged and fulfill my vow to my =
late husband. I'll give you the details as soon as I hear from you.
v>
Greeting,
Mrs Carole Josiah
v>
--00000000000010ba3105f8ba979e--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments