Urgent Nigerian banking spam from Google

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 19 Apr 2023 06:16:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1pp6iY-000Ol1-Tr

for dave@doctor.nl2k.ab.ca;

Wed, 19 Apr 2023 06:15:22 -0600

Resent-From: The Doctor

Resent-Date: Wed, 19 Apr 2023 06:15:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f68.google.com ([209.85.218.68]:43705)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1pp5tP-000NkN-U7

for doctor@nl2k.ab.ca;

Wed, 19 Apr 2023 05:22:38 -0600

Received: by mail-ej1-f68.google.com with SMTP id vc20so25757192ejc.10

for ; Wed, 19 Apr 2023 04:20:33 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20221208; t=1681903226; x=1684495226;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=0gxRp1IK2bQ1NlBG/J2p7uttpAEyuwcriyLYnAYDMxU=;

b=M7LGBRSRlFCFmMDLxKWlfna9mqBRts5qoFM5nXleqrN/x5PUUKq8yWDzylu9U5y2bM

adCc1OikpeSw7WS2HJIlwEUPLj2R0AH1xhCeC10cfzJ3xHb0uY9Kvj6CQBt1TD+Ls62I

kGE6NItk3u4FY+gO/o0ZYjoDz1fCMXVX4QMUSg/E7OInAzaLXdb0XCYW796Gp4YM+F6l

YTRpi0Ts/ilWjAKWS73IaZlnYPivjozCggbfuPbCkjgQtqADx5kfYSORJrjJALAZeErf

i5zQiCfH0B9wf48rhGDSZd62o0SkMrAdHZN2IRYX5oV0syZXyYp07p0orVAUlFEcb2nc

XnuQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20221208; t=1681903226; x=1684495226;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=0gxRp1IK2bQ1NlBG/J2p7uttpAEyuwcriyLYnAYDMxU=;

b=Aed/C8iG+0zfbvBbXHH0URAe/kLiMv7mWV/6x7eJKyEvxwTfLkfkRVLv4IGA8WAk4u

285J4klIkBMlxPuiQwPcdwoDy+nMdqQvkfewSz7KffM9K3HQJsHcwwSBtsmSWxWs9fHy

iB516nWM11/HE4yQN5WG3O/TaOnbbmjnZBQbDwCSuE0BbtuNJyXCripcX296I4ZLmaDq

9Mcdv458BEIPG3VrGgW5ZpthddqNAuDrdSYdcHPJQclgk8Hcv62BdyKXqSxhxDcoU6KD

MM2jjLgmx7pPD3wR18eSq+FmeSjobysb3sKJDDRNgnYlSQsNFnOD4xACdoOv0rls89Lb

p7Bw==

X-Gm-Message-State: AAQBX9d7M+slCHLKdzzu00uqFlK4Q3TZQYKNV84Wo+s48Bv/UdLDWXuI

b340KOWR3H5uzaXWOibFfjKhMWSaENJMeOBzENo=

X-Google-Smtp-Source: AKy350ZBOVGUauT5RfgyZ+QvzeF1YZ6x5fDYcQfsUlly5jnvSOh4HbhKaMoFOBqgoqUc6gwvYWX3el0lCIGI7jpLRQs=

X-Received: by 2002:a17:906:c78f:b0:878:711d:9310 with SMTP id

cw15-20020a170906c78f00b00878711d9310mr14197519ejb.1.1681903226487; Wed, 19

Apr 2023 04:20:26 -0700 (PDT)

MIME-Version: 1.0

Reply-To: rahmimetin8@gmail.com

From: "MR. RAHMI METIN"

Date: Wed, 19 Apr 2023 04:19:52 -0700

Message-ID:

Subject: VERY URGENT

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000005c872605f9ae9c88"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 24.6

X-Spam_score_int: 246

X-Spam_bar: ++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Friend, My Name is Mr. Rahmi Metin, a personal Accountant/Executive

board Member of Directors working with ILBANK of Turkey. A late investor

who bears the same last name with you has left {Nineteen Million Th [...]



Content analysis details: (24.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.218.68 listed in list.dnswl.org]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[walterpeter05(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[rahmimetin8(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[walterpeter05(at)gmail.com]

2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!

2.5 MILLION_USD BODY: Talks about millions of dollars

2.5 HK_SCAM_N2 BODY: No description available.

1.1 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.218.68 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.5 HK_NAME_FM_MR_MRS No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_HK_NAME_FM_MR_MRS No description available.

2.0 HK_SCAM No description available.

3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} VERY URGENT



--0000000000005c872605f9ae9c88

Content-Type: text/plain; charset="UTF-8"



Dear Friend,



My Name is Mr. Rahmi Metin, a personal Accountant/Executive board Member of

Directors working with ILBANK of Turkey. A late investor who bears the

same last name with you has left {Nineteen Million Three Hundred and Forty

Thousand United States Dollars} with Our Bank for some years and no Next

of kin has come forward all these years for claim.



Please get back to me as soon as possible for more details if you are

interested in my proposal,



Best Regards,



Mr. Rahmi Metin

Executive Member Board Directors



--0000000000005c872605f9ae9c88

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




font-size:16px;margin:0px;padding:0px;border:0px;font-stretch:inherit;line-=

height:inherit;vertical-align:baseline">Dear Friend,

ont-family:georgia,serif;color:rgb(0,0,0);font-size:16px;margin:0px;padding=

:0px;border:0px;font-stretch:inherit;line-height:inherit;vertical-align:bas=

eline">=C2=A0


erif;color:rgb(0,0,0);font-size:16px">

f;color:rgb(0,0,0);font-size:16px">
;color:rgb(0,0,0);font-size:16px;margin:0px;padding:0px;border:0px;font-str=

etch:inherit;line-height:inherit;vertical-align:baseline">My Name is Mr.=C2=

=A0Rahmi Metin

,0);font-size:16px;margin:0px;padding:0px;border:0px;font-stretch:inherit;l=

ine-height:inherit;vertical-align:baseline">, a personal Accountant/Executi=

ve board Member of Directors=C2=A0 =C2=A0working with=C2=A0

le=3D"font-family:georgia,serif;font-size:16px;margin:0px;padding:0px;borde=

r:0px;font-stretch:inherit;line-height:inherit;vertical-align:baseline">
an style=3D"font-family:inherit;margin:0px;padding:0px;border:0px;font-styl=

e:inherit;font-weight:inherit;font-stretch:inherit;font-size:10pt;line-heig=

ht:inherit;vertical-align:baseline;color:inherit">ILBANK

=3D"font-family:inherit;margin:0px;padding:0px;border:0px;font-style:inheri=

t;font-weight:inherit;font-stretch:inherit;font-size:inherit;line-height:in=

herit;vertical-align:baseline;color:inherit">=C2=A0
of Turkey<=

span style=3D"font-family:georgia,serif;color:rgb(0,0,0);font-size:16px;mar=

gin:0px;padding:0px;border:0px;font-stretch:inherit;line-height:inherit;ver=

tical-align:baseline">.=C2=A0
f;color:rgb(0,0,0);font-size:16px;margin:0px;padding:0px;border:0px;font-st=

retch:inherit;line-height:inherit;vertical-align:baseline">
ont-family:inherit;margin:0px;padding:0px;border:0px;font-style:inherit;fon=

t-weight:inherit;font-stretch:inherit;font-size:inherit;line-height:inherit=

;vertical-align:baseline;color:inherit">=C2=A0
A late investor who be=

ars the same last name with you has left {Nineteen Million Three Hundred an=

d Forty=C2=A0 =C2=A0Thousand United States Dollars} with Our Bank for some =

years and no Next of kin has come forward all these years for claim.
=



style=3D"font-family:georgia,serif;color:rgb(0,0,0);font-size:16px">
style=3D"font-family:georgia,serif;color:rgb(0,0,0);font-size:16px;margin:0=

px;padding:0px;border:0px;font-stretch:inherit;line-height:inherit;vertical=

-align:baseline">Please get back to me

rgia,serif;font-size:16px;margin:0px;padding:0px;border:0px;font-stretch:in=

herit;line-height:inherit;vertical-align:baseline;color:rgb(0,0,128)">=C2=

=A0

ze:16px;margin:0px;padding:0px;border:0px;font-stretch:inherit;line-height:=

inherit;vertical-align:baseline">as soon as possible for more details if yo=

u are interested in my proposal,


if;color:rgb(0,0,0);font-size:16px">

color:rgb(0,0,0);font-size:16px">
olor:rgb(0,0,0);font-size:16px;margin:0px;padding:0px;border:0px;font-stret=

ch:inherit;line-height:inherit;vertical-align:baseline">Best Regards,
>

r style=3D"font-family:georgia,serif;color:rgb(0,0,0);font-size:16px">
style=3D"font-family:georgia,serif;color:rgb(0,0,0);font-size:16px;margin:=

0px;padding:0px;border:0px;font-stretch:inherit;line-height:inherit;vertica=

l-align:baseline">Mr.=C2=A0Rahmi Metin


ia,serif;color:rgb(0,0,0);font-size:16px">
a,serif;color:rgb(0,0,0);font-size:16px;margin:0px;padding:0px;border:0px;f=

ont-stretch:inherit;line-height:inherit;vertical-align:baseline">Executive =

Member Board Directors





--0000000000005c872605f9ae9c88--

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA