german language gmail spam
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 26 Sep 2023 14:16:03 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from)
id 1qlESh-000FQq-2b
for dave@doctor.nl2k.ab.ca;
Tue, 26 Sep 2023 14:15:15 -0600
Resent-From: The Doctor
Resent-Date: Tue, 26 Sep 2023 14:15:15 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-lf1-f41.google.com ([209.85.167.41]:61930)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from)
id 1qlBbO-0004iP-2W
for doctor@netknow.ca;
Tue, 26 Sep 2023 11:12:16 -0600
Received: by mail-lf1-f41.google.com with SMTP id 2adb3069b0e04-5031426b626so14774697e87.3
for; Tue, 26 Sep 2023 10:10:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1695748197; x=1696352997; darn=netknow.ca;
h=content-transfer-encoding:to:subject:message-id:date:from
:references:in-reply-to:reply-to:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=Elj36swGBS45Kr3vDovtAQ183ALYa2gOkLP0O07cbRE=;
b=E/82ZC5y+vaqOi97IbFCh5qRRDTGLumvywJM0xd9dcaCPGm9ObFHK35sLCpdlrIe9u
XFaPkOPIA0d50CTcIg7gAh2RuZZtd1jlVTIQQbLcQ4rFawjHP2j7jBDGPlSKPIkOPzlo
NHCbvJ2FIXzNTsEN/DZZQnC1+pikiflPUgNgKUiZCVmzG/oy4gFNpoIGYyBS4FKOf6If
1F89c+MVAK7PYQxPi6UBv7WUIayVtUMsimkf15pmuUUP+oBEmJr+f1o+AAZpqfuyTY5p
Av56L4n6tBGIi9Vl1hl5O+HUvIMTYJ3gTWUZpTQmon/KGsLGXm/yCzm/WUlyzqHCZLmk
Dclw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1695748197; x=1696352997;
h=content-transfer-encoding:to:subject:message-id:date:from
:references:in-reply-to:reply-to:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=Elj36swGBS45Kr3vDovtAQ183ALYa2gOkLP0O07cbRE=;
b=V8SCen3aVixC6DI8fimbOGECj5C/AUYKtwemsQWdZZ5kfgKfvWT0eFWcPR1KXRudlU
Myg8/MzBpCrDsy9lnwkF5fK/WcBp4hSq1D+wAbqf0MUi6ptOpbVZAElBrNz5shWKlTZ4
H/jl0xoNLRBRBmPim6QyX3fDM4WmTiX0FQe6RCwuAwkytQ6NHkAZK0CfvT0vFraFt0mu
imOtmyKbRXAx/0QLiA9uFndNRmq62XqcHaMYbelhFCdSzKcGoSr0WLz8dKsspnYF2bcm
BOJxazN/wq7exp8SPY7QfXyrTyZid5vwCAyWyvbZRSHo4i9yt3RATd7cpenWRkMs5zue
UuaQ==
X-Gm-Message-State: AOJu0Yy7nqO5V5gRVQ20hQU1rQHdrpET389jShAXQQOb5XxaOcHOdjDN
gX1Q3PrPhRf7HRC9RlkNpgz0eo7WuOWQkO50RmM=
X-Google-Smtp-Source: AGHT+IFSGTDDsZZ1T/X8pow6oPa03AN4ZSqu0wk6SV9dGn6DwY5ASBTqNrgk5zH0SfcWjK+w2GY84dyqpLnnTsCNYAU=
X-Received: by 2002:a05:6512:328b:b0:4fb:8bab:48b6 with SMTP id
p11-20020a056512328b00b004fb8bab48b6mr7761560lfe.52.1695748196796; Tue, 26
Sep 2023 10:09:56 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6400:5aa0:b0:228:fe46:872c with HTTP; Tue, 26 Sep 2023
10:09:55 -0700 (PDT)
Reply-To: dhldeliverycompanygreece@gmail.com
In-Reply-To:
References:
From: Peter Wilson
Date: Tue, 26 Sep 2023 10:09:55 -0700
Message-ID:
Subject: =?UTF-8?Q?Lieber_gl=C3=BCcklicher_Gewinner=2E_=5C_Dear_Lucky_Winner=2E?=
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Bcc: doctor@netknow.ca
X-Spam_score: 11.7
X-Spam_score_int: 117
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Lieber glücklicher Gewinner. Mit dieser Nachricht möchten
wir Sie darüber informieren, dass Ihre E-Mail-Adresse gewonnen hat Die Summe
von 1.700.000,00 USD beträgt nur {EINE MILLION SIEBENHUNDERTTAUSEND DOLLAR}
in unserem Lott [...]
Content analysis details: (11.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.167.41 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.167.41 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ekeneomor53(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[ekeneomor53(at)gmail.com]
3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 MONEY_NOHTML Lots of money in plain text
2.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.6 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} =?UTF-8?Q?Lieber_gl=C3=BCcklicher_Gewinner=2E_=5C_Dear_Lucky_Winner=2E?=
X-Antivirus: AVG (VPS 230926-2, 9/26/2023), Inbound message
X-Antivirus-Status: Clean
Lieber gl=C3=BCcklicher Gewinner.
Mit dieser Nachricht m=C3=B6chten wir Sie dar=C3=BCber informieren, dass Ih=
re
E-Mail-Adresse gewonnen hat
Die Summe von 1.700.000,00 USD betr=C3=A4gt nur {EINE MILLION
SIEBENHUNDERTTAUSEND DOLLAR} in unserem Lotterieunternehmen MULTI
LOTTO in diesem Monat und Ihr Geld wird in eine ATM-Visa-Karte
umgewandelt, um Ihnen per Kurierdienst zugestellt zu werden.
Wir haben Ihr Visa-Card-Paket beim Kurierunternehmen hinterlegt und
weisen es an, uns bei der Zustellung Ihres Visa-Card-Pakets zu helfen,
sobald es von Ihnen h=C3=B6rt. Bitte kontaktieren Sie daher das
Zustellunternehmen =C3=BCber diese E-Mail hier {
dhldeliverycompanygreece@gmail.com } und Bitten Sie sie, Ihnen Ihre
ATM-Visa-Karte auszuh=C3=A4ndigen, die bei der Multi Lotto Lottery
Organization in der Verwahrung Ihres Unternehmens hinterlegt ist.
Aufrichtig,
Herr Peter Wilson
Direktor des Multi-Lotto-Unternehmens.
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 26 Sep 2023 14:16:03 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from
id 1qlESh-000FQq-2b
for dave@doctor.nl2k.ab.ca;
Tue, 26 Sep 2023 14:15:15 -0600
Resent-From: The Doctor
Resent-Date: Tue, 26 Sep 2023 14:15:15 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-lf1-f41.google.com ([209.85.167.41]:61930)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from
id 1qlBbO-0004iP-2W
for doctor@netknow.ca;
Tue, 26 Sep 2023 11:12:16 -0600
Received: by mail-lf1-f41.google.com with SMTP id 2adb3069b0e04-5031426b626so14774697e87.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1695748197; x=1696352997; darn=netknow.ca;
h=content-transfer-encoding:to:subject:message-id:date:from
:references:in-reply-to:reply-to:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=Elj36swGBS45Kr3vDovtAQ183ALYa2gOkLP0O07cbRE=;
b=E/82ZC5y+vaqOi97IbFCh5qRRDTGLumvywJM0xd9dcaCPGm9ObFHK35sLCpdlrIe9u
XFaPkOPIA0d50CTcIg7gAh2RuZZtd1jlVTIQQbLcQ4rFawjHP2j7jBDGPlSKPIkOPzlo
NHCbvJ2FIXzNTsEN/DZZQnC1+pikiflPUgNgKUiZCVmzG/oy4gFNpoIGYyBS4FKOf6If
1F89c+MVAK7PYQxPi6UBv7WUIayVtUMsimkf15pmuUUP+oBEmJr+f1o+AAZpqfuyTY5p
Av56L4n6tBGIi9Vl1hl5O+HUvIMTYJ3gTWUZpTQmon/KGsLGXm/yCzm/WUlyzqHCZLmk
Dclw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1695748197; x=1696352997;
h=content-transfer-encoding:to:subject:message-id:date:from
:references:in-reply-to:reply-to:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=Elj36swGBS45Kr3vDovtAQ183ALYa2gOkLP0O07cbRE=;
b=V8SCen3aVixC6DI8fimbOGECj5C/AUYKtwemsQWdZZ5kfgKfvWT0eFWcPR1KXRudlU
Myg8/MzBpCrDsy9lnwkF5fK/WcBp4hSq1D+wAbqf0MUi6ptOpbVZAElBrNz5shWKlTZ4
H/jl0xoNLRBRBmPim6QyX3fDM4WmTiX0FQe6RCwuAwkytQ6NHkAZK0CfvT0vFraFt0mu
imOtmyKbRXAx/0QLiA9uFndNRmq62XqcHaMYbelhFCdSzKcGoSr0WLz8dKsspnYF2bcm
BOJxazN/wq7exp8SPY7QfXyrTyZid5vwCAyWyvbZRSHo4i9yt3RATd7cpenWRkMs5zue
UuaQ==
X-Gm-Message-State: AOJu0Yy7nqO5V5gRVQ20hQU1rQHdrpET389jShAXQQOb5XxaOcHOdjDN
gX1Q3PrPhRf7HRC9RlkNpgz0eo7WuOWQkO50RmM=
X-Google-Smtp-Source: AGHT+IFSGTDDsZZ1T/X8pow6oPa03AN4ZSqu0wk6SV9dGn6DwY5ASBTqNrgk5zH0SfcWjK+w2GY84dyqpLnnTsCNYAU=
X-Received: by 2002:a05:6512:328b:b0:4fb:8bab:48b6 with SMTP id
p11-20020a056512328b00b004fb8bab48b6mr7761560lfe.52.1695748196796; Tue, 26
Sep 2023 10:09:56 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6400:5aa0:b0:228:fe46:872c with HTTP; Tue, 26 Sep 2023
10:09:55 -0700 (PDT)
Reply-To: dhldeliverycompanygreece@gmail.com
In-Reply-To:
References:
From: Peter Wilson
Date: Tue, 26 Sep 2023 10:09:55 -0700
Message-ID:
Subject: =?UTF-8?Q?Lieber_gl=C3=BCcklicher_Gewinner=2E_=5C_Dear_Lucky_Winner=2E?=
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Bcc: doctor@netknow.ca
X-Spam_score: 11.7
X-Spam_score_int: 117
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Lieber glücklicher Gewinner. Mit dieser Nachricht möchten
wir Sie darüber informieren, dass Ihre E-Mail-Adresse gewonnen hat Die Summe
von 1.700.000,00 USD beträgt nur {EINE MILLION SIEBENHUNDERTTAUSEND DOLLAR}
in unserem Lott [...]
Content analysis details: (11.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.167.41 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.167.41 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ekeneomor53(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[ekeneomor53(at)gmail.com]
3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 MONEY_NOHTML Lots of money in plain text
2.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.6 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} =?UTF-8?Q?Lieber_gl=C3=BCcklicher_Gewinner=2E_=5C_Dear_Lucky_Winner=2E?=
X-Antivirus: AVG (VPS 230926-2, 9/26/2023), Inbound message
X-Antivirus-Status: Clean
Lieber gl=C3=BCcklicher Gewinner.
Mit dieser Nachricht m=C3=B6chten wir Sie dar=C3=BCber informieren, dass Ih=
re
E-Mail-Adresse gewonnen hat
Die Summe von 1.700.000,00 USD betr=C3=A4gt nur {EINE MILLION
SIEBENHUNDERTTAUSEND DOLLAR} in unserem Lotterieunternehmen MULTI
LOTTO in diesem Monat und Ihr Geld wird in eine ATM-Visa-Karte
umgewandelt, um Ihnen per Kurierdienst zugestellt zu werden.
Wir haben Ihr Visa-Card-Paket beim Kurierunternehmen hinterlegt und
weisen es an, uns bei der Zustellung Ihres Visa-Card-Pakets zu helfen,
sobald es von Ihnen h=C3=B6rt. Bitte kontaktieren Sie daher das
Zustellunternehmen =C3=BCber diese E-Mail hier {
dhldeliverycompanygreece@gmail.com } und Bitten Sie sie, Ihnen Ihre
ATM-Visa-Karte auszuh=C3=A4ndigen, die bei der Multi Lotto Lottery
Organization in der Verwahrung Ihres Unternehmens hinterlegt ist.
Aufrichtig,
Herr Peter Wilson
Direktor des Multi-Lotto-Unternehmens.
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments