Nigerian Spam from Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 26 Jun 2023 08:41:12 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from)
id 1qDnMz-00061J-38
for dave@doctor.nl2k.ab.ca;
Mon, 26 Jun 2023 08:39:09 -0600
Resent-From: The Doctor
Resent-Date: Mon, 26 Jun 2023 08:39:09 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from vps.promotelecoms.com ([209.140.22.121]:52308)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96 (FreeBSD))
(envelope-from)
id 1qDj3z-0002FU-1U
for info@nk.ca;
Mon, 26 Jun 2023 04:03:24 -0600
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=somahe-sarl.com; s=default; h=Content-Transfer-Encoding:Content-Type:
MIME-Version:Date:Subject:From:Reply-To:Sender:Message-ID:To:Cc:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=yAaUtGwsEt7ojFYS70eOPgBif95yi+CV0JIONXhafN8=; b=x+dF8L0CiqHmtZq9GG6RPl2ANI
x6GiuUlFQdjAALSXQZUKdJiAtCANIi2cRgZvQr2iTo9cMjFHR3KDvDCKpL9WbGOL9Fk884r2CLoQo
gV3KvkBwRhycxe3yMQRU/Y+sPcjpB1675K+wGSOAvkpX4NMpZyf7Pn1Z4e9hlPTk9PxoU8B0F3zYr
OZN8HAggIQhe6ny8Hgn2S6Tx0GnMrCg0LGizi230yy34ZpAVmSlWy1ioLE3E43JakN+cl6cx/b9AU
ibzwStbU3Dpyety0O9FT4Q9DppbWXuZwFYm/leFl88kXHUqEIxl1V8VjeLdNBpVKJuiLlj0b+LUR7
ObKPGhBw==;
Received: from [107.178.78.138] (port=57000 helo=User)
by vps.promotelecoms.com with esmtpa (Exim 4.93)
(envelope-from)
id 1qDj1i-0004JK-18; Mon, 26 Jun 2023 10:00:54 +0000
Reply-To:
From: "Andrey"
Subject: Can I trust you on this?
Date: Mon, 26 Jun 2023 03:00:52 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - vps.promotelecoms.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - gmail.com
X-Get-Message-Sender-Via: vps.promotelecoms.com: authenticated_id: director@somahe-sarl.com
X-Authenticated-Sender: vps.promotelecoms.com: director@somahe-sarl.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 17.1
X-Spam_score_int: 171
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attention please, I am a banker from Ukraine. We have some
profiled amounts of money which have been difficult to locate the rightful
foreign owners. Please get back to me so that I can tell you more details.
I am very [...]
Content analysis details: (17.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.1 MISSING_MID Missing Message-Id: header
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
2.5 NSL_RCVD_HELO_USER Received from HELO User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers
1.2 MISSING_HEADERS Missing To: header
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[ab.andy8891(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ab.andy8891(at)gmail.com]
1.9 REPLYTO_WITHOUT_TO_CC No description available.
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
1.4 MALFORMED_FREEMAIL Bad headers on message from free email service
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
2.5 TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool
0.0 SPOOFED_FREEMAIL No description available.
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
Subject: {SPAM?} Can I trust you on this?
Attention please,
I am a banker from Ukraine. We have some profiled amounts of money which have been difficult to locate the rightful foreign owners. Please get back to me so that I can tell you more details. I am very serious about this. I need a very trusted hand who can handle such amounts and who will not betray me.
Please reply me here: oschaadd@gmail.com
Regards,
Andrey.
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 26 Jun 2023 08:41:12 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from
id 1qDnMz-00061J-38
for dave@doctor.nl2k.ab.ca;
Mon, 26 Jun 2023 08:39:09 -0600
Resent-From: The Doctor
Resent-Date: Mon, 26 Jun 2023 08:39:09 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from vps.promotelecoms.com ([209.140.22.121]:52308)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96 (FreeBSD))
(envelope-from
id 1qDj3z-0002FU-1U
for info@nk.ca;
Mon, 26 Jun 2023 04:03:24 -0600
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=somahe-sarl.com; s=default; h=Content-Transfer-Encoding:Content-Type:
MIME-Version:Date:Subject:From:Reply-To:Sender:Message-ID:To:Cc:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=yAaUtGwsEt7ojFYS70eOPgBif95yi+CV0JIONXhafN8=; b=x+dF8L0CiqHmtZq9GG6RPl2ANI
x6GiuUlFQdjAALSXQZUKdJiAtCANIi2cRgZvQr2iTo9cMjFHR3KDvDCKpL9WbGOL9Fk884r2CLoQo
gV3KvkBwRhycxe3yMQRU/Y+sPcjpB1675K+wGSOAvkpX4NMpZyf7Pn1Z4e9hlPTk9PxoU8B0F3zYr
OZN8HAggIQhe6ny8Hgn2S6Tx0GnMrCg0LGizi230yy34ZpAVmSlWy1ioLE3E43JakN+cl6cx/b9AU
ibzwStbU3Dpyety0O9FT4Q9DppbWXuZwFYm/leFl88kXHUqEIxl1V8VjeLdNBpVKJuiLlj0b+LUR7
ObKPGhBw==;
Received: from [107.178.78.138] (port=57000 helo=User)
by vps.promotelecoms.com with esmtpa (Exim 4.93)
(envelope-from
id 1qDj1i-0004JK-18; Mon, 26 Jun 2023 10:00:54 +0000
Reply-To:
From: "Andrey"
Subject: Can I trust you on this?
Date: Mon, 26 Jun 2023 03:00:52 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - vps.promotelecoms.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - gmail.com
X-Get-Message-Sender-Via: vps.promotelecoms.com: authenticated_id: director@somahe-sarl.com
X-Authenticated-Sender: vps.promotelecoms.com: director@somahe-sarl.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 17.1
X-Spam_score_int: 171
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attention please, I am a banker from Ukraine. We have some
profiled amounts of money which have been difficult to locate the rightful
foreign owners. Please get back to me so that I can tell you more details.
I am very [...]
Content analysis details: (17.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.1 MISSING_MID Missing Message-Id: header
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
2.5 NSL_RCVD_HELO_USER Received from HELO User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers
1.2 MISSING_HEADERS Missing To: header
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[ab.andy8891(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ab.andy8891(at)gmail.com]
1.9 REPLYTO_WITHOUT_TO_CC No description available.
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
1.4 MALFORMED_FREEMAIL Bad headers on message from free email service
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
2.5 TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool
0.0 SPOOFED_FREEMAIL No description available.
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
Subject: {SPAM?} Can I trust you on this?
Attention please,
I am a banker from Ukraine. We have some profiled amounts of money which have been difficult to locate the rightful foreign owners. Please get back to me so that I can tell you more details. I am very serious about this. I need a very trusted hand who can handle such amounts and who will not betray me.
Please reply me here: oschaadd@gmail.com
Regards,
Andrey.
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments