loan spam from gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 24 Apr 2023 17:20:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1pr5SE-000JY9-LF

for dave@doctor.nl2k.ab.ca;

Mon, 24 Apr 2023 17:18:42 -0600

Resent-From: The Doctor

Resent-Date: Mon, 24 Apr 2023 17:18:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f67.google.com ([209.85.218.67]:49157)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1pr58k-000Lrt-OX

for doctor@doctor.nl2k.ab.ca;

Mon, 24 Apr 2023 16:58:38 -0600

Received: by mail-ej1-f67.google.com with SMTP id a640c23a62f3a-94f6c285d22so922019266b.2

for ; Mon, 24 Apr 2023 15:56:36 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20221208; t=1682376990; x=1684968990;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=rNA9Qc9nRkfR+h+XVk5wz3kmsvm5jxc5U+VlhkeaGwA=;

b=nnEJCYxdU4v5mlQxrqcRUGBR13QUYtsWUgsThDKZGbvYw6R777CsEYsnZzEEV9qD3a

bm1wDml+YwprCeKikfhk9TQNTWv4BXc5Q4UhL6HzUo8n1zX5KtrHbgmBszn55F6sdqQE

KvvWggNE3HW+EBBWHzUPOEYFJWTBTd8avhbSPhoEnUwUrvVg/CYGsw+r4ucee2/GQruu

FtXopak/8015xOoftG2P3POv642wV3cEI81F2pNTktB5BJJz0hriVuLqRkZFCqDkVlgC

4Y9jg2fEQLF96mUGutgeT3EWHd9RMyFqEHPUMuSChYyBjhrrm+O7HZmqILJrCMEvNLDa

wUBw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20221208; t=1682376990; x=1684968990;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=rNA9Qc9nRkfR+h+XVk5wz3kmsvm5jxc5U+VlhkeaGwA=;

b=Pu2aCPRpF2E88cXVAV8cHuVJpASvBRPuNb1680Tjvw699Pin96zxRqijwRKvvpatWJ

+oxlXd95gyt2Q0qMLoDrHnCSpmqr7VOz8QFSz25MOdV8bRVsesJpTGVhC7RLAuOjPTIA

KFI+KVCpVzzfuovdnuT5zNzB90vGPHI+uLJd+kSkJXqOc0iY7c+rN82Nu5QUIlB9XUWg

PXvlZx/wA3E9ZAwxx5xSCPtsX48VINA2z49DcqHWAhPqT12uiPJcwyXVbzuoMkfhD6Rt

QXRKE+xUlOh0OIadlyh7qrzz6HHrTrTlhKDb5GdqP1mGcBFrkcWmYto5ZtcCXGCR6SNr

GBRQ==

X-Gm-Message-State: AAQBX9cqsM6Vxi9lsvVISL+46pYe2cQxsaX1mMA8DL1nDSebLCErnIDr

o6q60QNUxfHq44rx9lS7/P/sRo/Zt839Wc2qdBY=

X-Google-Smtp-Source: AKy350aWPBP5TTgt2rsGDItJKZvU/VTA4+CtOldjWc7Rh8D/sNUot+cFFYdAxLMWtI0f8DCtoPNYWM2o5coM7oGkwjY=

X-Received: by 2002:a17:906:697:b0:94e:d84e:d4d0 with SMTP id

u23-20020a170906069700b0094ed84ed4d0mr10695572ejb.18.1682376989998; Mon, 24

Apr 2023 15:56:29 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:ab4:a50b:0:b0:206:e771:b0d0 with HTTP; Mon, 24 Apr 2023

15:56:29 -0700 (PDT)

From: "ZACK81@ROGERS.COM"

Date: Mon, 24 Apr 2023 22:56:29 +0000

Message-ID:

Subject: LOAN OFFER @2% INTEREST RATE

To: c degagne , doctor ,

elizabethp , firdosh ,

hedgehogstitchery ,

hummingbirdcottage , intennsive

Content-Type: text/plain; charset="UTF-8"

X-Spam_score: 10.4

X-Spam_score_int: 104

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: https://bit.ly/3UUolIF



Content analysis details: (10.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 SPF_PASS SPF: sender matches SPF record

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[djmaster9493493(at)gmail.com]

2.5 SORTED_RECIPS Recipient list is sorted by address

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[djmaster9493493(at)gmail.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.218.67 listed in list.dnswl.org]

0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.7 PDS_FROM_2_EMAILS No description available.

1.0 FROM_2_EMAILS_SHORT Short body and From looks like 2 different emails

2.8 POSSIBLE_GMAIL_PHISHER Apparent phishing email sent from a gmail

account

1.2 BODY_SINGLE_URI Message body is only a URI

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.218.67 listed in wl.mailspike.net]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} LOAN OFFER @2% INTEREST RATE



https://bit.ly/3UUolIF

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA