Nigerian spam from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 30 Jul 2023 05:40:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from)
id 1qQ4dy-000AFJ-04
for dave@doctor.nl2k.ab.ca;
Sun, 30 Jul 2023 05:31:26 -0600
Resent-From: The Doctor
Resent-Date: Sun, 30 Jul 2023 05:31:25 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yb1-f181.google.com ([209.85.219.181]:60906)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from)
id 1qQ2BD-000DdZ-2a
for root@nk.ca;
Sun, 30 Jul 2023 02:53:38 -0600
Received: by mail-yb1-f181.google.com with SMTP id 3f1490d57ef6-ca4a6e11f55so2840108276.1
for; Sun, 30 Jul 2023 01:51:35 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1690707090; x=1691311890;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=zyVZDYpLQqeSEOHfvAEV6RNOvYQGjzH4CAo6PUhTsxQ=;
b=WOqiyvtkFmLzvEvOa3cBzFXyiR9qt9bOgrkq5MzbB2G8TQ0ELdvR2nWBTNTZyr+t/i
i3J6LpNQD29H9e7YYFNsuIsr/bdM3uump+Z3WlNBs+4PkDd7fQwk5RKsw6A88a1adZwi
FxQeUrVFNe8sOZ7HIpfvcDgOMaohDNI847X59mzLMQrrAiXQUxWIgT1yA0cm7LIFEV0s
t3By3DZn7lG+Td8RAjQcwhyJtQJWCxoDhW0HFjI/vgmjn3aGbue4Ido+ZaNRgugsx/B9
9M3c1IMn0W8g1+Z2ya0DMuus9FHSXokzGMCPhUhMaL6P1JMhO+hwa4M7MfSC8BIbvfOX
qMNg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1690707090; x=1691311890;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=zyVZDYpLQqeSEOHfvAEV6RNOvYQGjzH4CAo6PUhTsxQ=;
b=d3xLsTGYbzXXS5b8cxLZC6S0P0LPRvd7owZwQRZdsTESyruMku6YQFMio9dPr2pzkI
uMYaJeYtCThPwP7xhqgkHehKNgAVWeykCAQ/YHOu81PuiCilRMt7Qw/vObBgQKKjlF8I
1Pq6SRqaVbRxYxFIcTO6/5E3f+B0CA59P8ZPqJzDzZ+OwCzPgQyVeG4ZSnd0mI5GJksG
4uoVOV/gwfGcupPRvm+OmmymG6GC27iEnbdfvSZtJlocCW8FAP8qrkwAKHtn3Zpj1b6x
NSNFoaSoN6cgaPXnahGmPasnfZASVDVMlpz+hPGJBQ67X47AQUJetxB1ih/gFv9CyKcz
c0QA==
X-Gm-Message-State: ABy/qLZmi0nybIZuQ3XC9Arj63W5w3ZRE4ACyHYykwRfZdzHU5/DaWou
ohvJTNmHMaV7M7cYmUEeNrLpD00NNJlXa5JFXn0=
X-Google-Smtp-Source: APBJJlGF4ZFhUdHwJNxg+p3Wx91nSameCAVk8OG1ObbJezQQBaBMpk2TbLfFVw8DlUSCXkR1vsQgpu7gc8QprEMKCo0=
X-Received: by 2002:a81:8ac7:0:b0:54f:9cd0:990 with SMTP id
a190-20020a818ac7000000b0054f9cd00990mr5175039ywg.18.1690707089866; Sun, 30
Jul 2023 01:51:29 -0700 (PDT)
MIME-Version: 1.0
Reply-To: sun.hor13@gmail.com
From: Sun hor
Date: Sun, 30 Jul 2023 15:51:19 +0700
Message-ID:
Subject: LET US WORK TOGETHER TO HAVE THIS FUNDS,
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="00000000000082c1aa0601b06b5c"
Bcc: root@nk.ca
X-Spam_score: 13.6
X-Spam_score_int: 136
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Good Day Friend, I am Chief Accountant/Executive with Foreign
Trade Bank of (FTB) . I want to present to you as a beneficiary of $32,640,000
here in my bank. Get back to me for more details. Best Regards, Mr. SUN HOR
Account Manager
Content analysis details: (13.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[sun.hor13(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[cimaokey2(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[cimaokey2(at)gmail.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.219.181 listed in list.dnswl.org]
0.0 HTML_MESSAGE BODY: HTML included in message
1.0 REPTO_419_FRAUD_GM_LOOSE Ends-in-digits Reply-To is similar to known
advance fee fraud collector mailbox
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.2 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.219.181 listed in wl.mailspike.net]
Subject: {SPAM?} LET US WORK TOGETHER TO HAVE THIS FUNDS,
X-Antivirus: AVG (VPS 230729-18, 7/29/2023), Inbound message
X-Antivirus-Status: Clean
--00000000000082c1aa0601b06b5c
Content-Type: text/plain; charset="UTF-8"
Good Day Friend,
I am Chief Accountant/Executive with Foreign Trade Bank of (FTB) . I want
to present to you as a beneficiary of $32,640,000 here in my bank. Get back
to me for more details.
Best Regards,
Mr. SUN HOR
Account Manager
--00000000000082c1aa0601b06b5c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--00000000000082c1aa0601b06b5c--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 30 Jul 2023 05:40:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from
id 1qQ4dy-000AFJ-04
for dave@doctor.nl2k.ab.ca;
Sun, 30 Jul 2023 05:31:26 -0600
Resent-From: The Doctor
Resent-Date: Sun, 30 Jul 2023 05:31:25 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yb1-f181.google.com ([209.85.219.181]:60906)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from
id 1qQ2BD-000DdZ-2a
for root@nk.ca;
Sun, 30 Jul 2023 02:53:38 -0600
Received: by mail-yb1-f181.google.com with SMTP id 3f1490d57ef6-ca4a6e11f55so2840108276.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1690707090; x=1691311890;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=zyVZDYpLQqeSEOHfvAEV6RNOvYQGjzH4CAo6PUhTsxQ=;
b=WOqiyvtkFmLzvEvOa3cBzFXyiR9qt9bOgrkq5MzbB2G8TQ0ELdvR2nWBTNTZyr+t/i
i3J6LpNQD29H9e7YYFNsuIsr/bdM3uump+Z3WlNBs+4PkDd7fQwk5RKsw6A88a1adZwi
FxQeUrVFNe8sOZ7HIpfvcDgOMaohDNI847X59mzLMQrrAiXQUxWIgT1yA0cm7LIFEV0s
t3By3DZn7lG+Td8RAjQcwhyJtQJWCxoDhW0HFjI/vgmjn3aGbue4Ido+ZaNRgugsx/B9
9M3c1IMn0W8g1+Z2ya0DMuus9FHSXokzGMCPhUhMaL6P1JMhO+hwa4M7MfSC8BIbvfOX
qMNg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1690707090; x=1691311890;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=zyVZDYpLQqeSEOHfvAEV6RNOvYQGjzH4CAo6PUhTsxQ=;
b=d3xLsTGYbzXXS5b8cxLZC6S0P0LPRvd7owZwQRZdsTESyruMku6YQFMio9dPr2pzkI
uMYaJeYtCThPwP7xhqgkHehKNgAVWeykCAQ/YHOu81PuiCilRMt7Qw/vObBgQKKjlF8I
1Pq6SRqaVbRxYxFIcTO6/5E3f+B0CA59P8ZPqJzDzZ+OwCzPgQyVeG4ZSnd0mI5GJksG
4uoVOV/gwfGcupPRvm+OmmymG6GC27iEnbdfvSZtJlocCW8FAP8qrkwAKHtn3Zpj1b6x
NSNFoaSoN6cgaPXnahGmPasnfZASVDVMlpz+hPGJBQ67X47AQUJetxB1ih/gFv9CyKcz
c0QA==
X-Gm-Message-State: ABy/qLZmi0nybIZuQ3XC9Arj63W5w3ZRE4ACyHYykwRfZdzHU5/DaWou
ohvJTNmHMaV7M7cYmUEeNrLpD00NNJlXa5JFXn0=
X-Google-Smtp-Source: APBJJlGF4ZFhUdHwJNxg+p3Wx91nSameCAVk8OG1ObbJezQQBaBMpk2TbLfFVw8DlUSCXkR1vsQgpu7gc8QprEMKCo0=
X-Received: by 2002:a81:8ac7:0:b0:54f:9cd0:990 with SMTP id
a190-20020a818ac7000000b0054f9cd00990mr5175039ywg.18.1690707089866; Sun, 30
Jul 2023 01:51:29 -0700 (PDT)
MIME-Version: 1.0
Reply-To: sun.hor13@gmail.com
From: Sun hor
Date: Sun, 30 Jul 2023 15:51:19 +0700
Message-ID:
Subject: LET US WORK TOGETHER TO HAVE THIS FUNDS,
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="00000000000082c1aa0601b06b5c"
Bcc: root@nk.ca
X-Spam_score: 13.6
X-Spam_score_int: 136
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Good Day Friend, I am Chief Accountant/Executive with Foreign
Trade Bank of (FTB) . I want to present to you as a beneficiary of $32,640,000
here in my bank. Get back to me for more details. Best Regards, Mr. SUN HOR
Account Manager
Content analysis details: (13.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[sun.hor13(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[cimaokey2(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[cimaokey2(at)gmail.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.219.181 listed in list.dnswl.org]
0.0 HTML_MESSAGE BODY: HTML included in message
1.0 REPTO_419_FRAUD_GM_LOOSE Ends-in-digits Reply-To is similar to known
advance fee fraud collector mailbox
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.2 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.219.181 listed in wl.mailspike.net]
Subject: {SPAM?} LET US WORK TOGETHER TO HAVE THIS FUNDS,
X-Antivirus: AVG (VPS 230729-18, 7/29/2023), Inbound message
X-Antivirus-Status: Clean
--00000000000082c1aa0601b06b5c
Content-Type: text/plain; charset="UTF-8"
Good Day Friend,
I am Chief Accountant/Executive with Foreign Trade Bank of (FTB) . I want
to present to you as a beneficiary of $32,640,000 here in my bank. Get back
to me for more details.
Best Regards,
Mr. SUN HOR
Account Manager
--00000000000082c1aa0601b06b5c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Good Day Friend,
I am Chief Accountant/Executive wi=
th Foreign Trade Bank of (FTB) . I want to present to you as a beneficiary =
of $32,640,000 here in my bank. Get back to me for more details.
Bes=
t Regards,
Mr. SUN HOR
Account Manager
I am Chief Accountant/Executive wi=
th Foreign Trade Bank of (FTB) . I want to present to you as a beneficiary =
of $32,640,000 here in my bank. Get back to me for more details.
Bes=
t Regards,
Mr. SUN HOR
Account Manager
--00000000000082c1aa0601b06b5c--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments