Nigerian spam from Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 27 May 2023 17:50:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from)
id 1q33fS-000O2u-2w
for dave@doctor.nl2k.ab.ca;
Sat, 27 May 2023 17:49:50 -0600
Resent-From: The Doctor
Resent-Date: Sat, 27 May 2023 17:49:50 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ej1-f68.google.com ([209.85.218.68]:62607)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from)
id 1q2znG-0000E0-2V
for doctor@doctor.nl2k.ab.ca;
Sat, 27 May 2023 13:41:41 -0600
Received: by mail-ej1-f68.google.com with SMTP id a640c23a62f3a-95fde138693so592069266b.0
for; Sat, 27 May 2023 12:39:39 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1685216373; x=1687808373;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=T8FG+7z201arRkSYdboixj3ymHlZZAey1hFVs1DAcTE=;
b=S3tzgaG/nd6x9/Rm58NB0WWFDG5922dOqf9ItfB4V4sLn/jft8fNaxX6VQZ67rZE6X
snk+6bLrxYIRM7082UR2RXY+L3nBJ8LLX3LBp/1VI1M6eW57HloYxAhMq17bQ/gFxARh
FDiS3uitM17PaKWkDf3teiycBPUIRoqn8BUgNxU4jFBKwdT+Dz5jd3vUNG1unl0VTIUC
/IWwdHV56Yu48r+aUpuXVPt2UFyMH29mRu9ujChYOf5GuaxAYJU22HfRkrG92shwyqkM
r0Kb42zWX+5ghfrXcnAgNVfBrWi0bFzmJA2Xggyo00kOsEPMf43fHJobEgwLL8vQufOA
UP9w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1685216373; x=1687808373;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=T8FG+7z201arRkSYdboixj3ymHlZZAey1hFVs1DAcTE=;
b=kze/BTrrsMw6VL9u94LABzh/TTkMf1DqYRoZ/3OH1D/85sftksi+UBtmZbjOiDMK33
pYgRw9ivYXsPgiLThATxDFZqVmE7G0sj2QJjNJb0s6n1AaZM845q72UkudW8SSbRmIK/
Dt6HqmWkhXt9WgClM6JR84IjY/D+hPGLcoB4WPEdCY5OBhmDBOHy10534FpEnlrQQpA4
PDr4MkP5WBLQCHNT7vZnOe3tGcOwICsP4e5V87n48lWlX9QCV0OjIsfIsVT1bbvSYtGc
Xsq5g7tmlRiGZ2vtPxJe33ntXm8KNtxgZYHRYQmn4DqvGTsUs5oQcSTGh7YSlWa8PosS
9+rA==
X-Gm-Message-State: AC+VfDzuJDcMju4VrDkiU8i2PS6tQprHX1Rmz3FnW2d/J7680RJAjdy2
GMtxRdmWvG/tIj7SBxq12YQm2bBEpCTssqCtLFI=
X-Google-Smtp-Source: ACHHUZ61RhHGy57124dd6cU0EgdKQnyxoQTUUkfQwzrlTvpm6L/gVvBD7uBxZwjjDeg1oki5mA8l2aaNkkUvjBAnVok=
X-Received: by 2002:aa7:c251:0:b0:514:224b:a48c with SMTP id
y17-20020aa7c251000000b00514224ba48cmr3069192edo.0.1685216372487; Sat, 27 May
2023 12:39:32 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6402:386:b0:50b:8864:5f17 with HTTP; Sat, 27 May 2023
12:39:31 -0700 (PDT)
Reply-To: anitharsaliba75@gmail.com
From: Anithar Saliba
Date: Sat, 27 May 2023 19:39:31 +0000
Message-ID:
Subject: HELLOO..
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 21.2
X-Spam_score_int: 212
X-Spam_bar: +++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- My name is Madam Anithar Saliba. I am working with one
of the prime banks here in Burkina Faso. Here in this bank existed a dormant
account for many years, which belong to one of our late foreign c [...]
Content analysis details: (21.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.218.68 listed in list.dnswl.org]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[anitharsaliba(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[anitharsaliba75(at)gmail.com]
2.6 HK_SCAM_N13 BODY: No description available.
2.5 HK_SCAM_N2 BODY: No description available.
1.1 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.218.68 listed in wl.mailspike.net]
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
2.0 HK_SCAM No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 XFER_LOTSA_MONEY Transfer a lot of money
3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} HELLOO..
X-Antivirus: AVG (VPS 230527-6, 5/27/2023), Inbound message
X-Antivirus-Status: Clean
--
My name is Madam Anithar Saliba. I am working with one of the prime banks
here in Burkina Faso. Here in this bank existed a dormant account for
many years, which belong to one of our late foreign customer Mr.
Moises Saba Masri from Mexico.
When I discovered that there had been neither deposits nor withdrawals
from this account for this long period, I decided to carry out a
system investigation and discovered that none of the family member or
relations of the late person are aware of this account, which means
nobody will come to take it.
The amount in this account stands at $18,300, 000.00 (Eighteen Million
Three Hundred Thousand USA Dollars). I want a foreign account where
the bank will transfer this fund, I will front you in the bank as the
Next of Kin to the late customer and back you up with relevant
information.
What the bank need is proof and information about the late customer
which I will assist you on. his is a genuine, risk free and legal
business transaction, All details shall be sent to you once I hear
from you.
The information as contained herein be accorded the necessary
attention, urgency as well as the secrecy it deserves.
If you are really sure of your integrity, trustworthy and
confidentiality reply back to me urgently through my private email
here: ( anitharsaliba75@gmail.com ).
Best regards,
Madam Anithar Saliba.
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 27 May 2023 17:50:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from
id 1q33fS-000O2u-2w
for dave@doctor.nl2k.ab.ca;
Sat, 27 May 2023 17:49:50 -0600
Resent-From: The Doctor
Resent-Date: Sat, 27 May 2023 17:49:50 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ej1-f68.google.com ([209.85.218.68]:62607)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from
id 1q2znG-0000E0-2V
for doctor@doctor.nl2k.ab.ca;
Sat, 27 May 2023 13:41:41 -0600
Received: by mail-ej1-f68.google.com with SMTP id a640c23a62f3a-95fde138693so592069266b.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1685216373; x=1687808373;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=T8FG+7z201arRkSYdboixj3ymHlZZAey1hFVs1DAcTE=;
b=S3tzgaG/nd6x9/Rm58NB0WWFDG5922dOqf9ItfB4V4sLn/jft8fNaxX6VQZ67rZE6X
snk+6bLrxYIRM7082UR2RXY+L3nBJ8LLX3LBp/1VI1M6eW57HloYxAhMq17bQ/gFxARh
FDiS3uitM17PaKWkDf3teiycBPUIRoqn8BUgNxU4jFBKwdT+Dz5jd3vUNG1unl0VTIUC
/IWwdHV56Yu48r+aUpuXVPt2UFyMH29mRu9ujChYOf5GuaxAYJU22HfRkrG92shwyqkM
r0Kb42zWX+5ghfrXcnAgNVfBrWi0bFzmJA2Xggyo00kOsEPMf43fHJobEgwLL8vQufOA
UP9w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1685216373; x=1687808373;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=T8FG+7z201arRkSYdboixj3ymHlZZAey1hFVs1DAcTE=;
b=kze/BTrrsMw6VL9u94LABzh/TTkMf1DqYRoZ/3OH1D/85sftksi+UBtmZbjOiDMK33
pYgRw9ivYXsPgiLThATxDFZqVmE7G0sj2QJjNJb0s6n1AaZM845q72UkudW8SSbRmIK/
Dt6HqmWkhXt9WgClM6JR84IjY/D+hPGLcoB4WPEdCY5OBhmDBOHy10534FpEnlrQQpA4
PDr4MkP5WBLQCHNT7vZnOe3tGcOwICsP4e5V87n48lWlX9QCV0OjIsfIsVT1bbvSYtGc
Xsq5g7tmlRiGZ2vtPxJe33ntXm8KNtxgZYHRYQmn4DqvGTsUs5oQcSTGh7YSlWa8PosS
9+rA==
X-Gm-Message-State: AC+VfDzuJDcMju4VrDkiU8i2PS6tQprHX1Rmz3FnW2d/J7680RJAjdy2
GMtxRdmWvG/tIj7SBxq12YQm2bBEpCTssqCtLFI=
X-Google-Smtp-Source: ACHHUZ61RhHGy57124dd6cU0EgdKQnyxoQTUUkfQwzrlTvpm6L/gVvBD7uBxZwjjDeg1oki5mA8l2aaNkkUvjBAnVok=
X-Received: by 2002:aa7:c251:0:b0:514:224b:a48c with SMTP id
y17-20020aa7c251000000b00514224ba48cmr3069192edo.0.1685216372487; Sat, 27 May
2023 12:39:32 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6402:386:b0:50b:8864:5f17 with HTTP; Sat, 27 May 2023
12:39:31 -0700 (PDT)
Reply-To: anitharsaliba75@gmail.com
From: Anithar Saliba
Date: Sat, 27 May 2023 19:39:31 +0000
Message-ID:
Subject: HELLOO..
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 21.2
X-Spam_score_int: 212
X-Spam_bar: +++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- My name is Madam Anithar Saliba. I am working with one
of the prime banks here in Burkina Faso. Here in this bank existed a dormant
account for many years, which belong to one of our late foreign c [...]
Content analysis details: (21.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.218.68 listed in list.dnswl.org]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[anitharsaliba(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[anitharsaliba75(at)gmail.com]
2.6 HK_SCAM_N13 BODY: No description available.
2.5 HK_SCAM_N2 BODY: No description available.
1.1 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.218.68 listed in wl.mailspike.net]
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
2.0 HK_SCAM No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 XFER_LOTSA_MONEY Transfer a lot of money
3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} HELLOO..
X-Antivirus: AVG (VPS 230527-6, 5/27/2023), Inbound message
X-Antivirus-Status: Clean
--
My name is Madam Anithar Saliba. I am working with one of the prime banks
here in Burkina Faso. Here in this bank existed a dormant account for
many years, which belong to one of our late foreign customer Mr.
Moises Saba Masri from Mexico.
When I discovered that there had been neither deposits nor withdrawals
from this account for this long period, I decided to carry out a
system investigation and discovered that none of the family member or
relations of the late person are aware of this account, which means
nobody will come to take it.
The amount in this account stands at $18,300, 000.00 (Eighteen Million
Three Hundred Thousand USA Dollars). I want a foreign account where
the bank will transfer this fund, I will front you in the bank as the
Next of Kin to the late customer and back you up with relevant
information.
What the bank need is proof and information about the late customer
which I will assist you on. his is a genuine, risk free and legal
business transaction, All details shall be sent to you once I hear
from you.
The information as contained herein be accorded the necessary
attention, urgency as well as the secrecy it deserves.
If you are really sure of your integrity, trustworthy and
confidentiality reply back to me urgently through my private email
here: ( anitharsaliba75@gmail.com ).
Best regards,
Madam Anithar Saliba.
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments