Nigerian spam from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 07 Feb 2024 08:30:03 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rXjrm-00000000CYQ-2SPS
for dave@doctor.nl2k.ab.ca;
Wed, 07 Feb 2024 08:29:38 -0700
Resent-From: The Doctor
Resent-Date: Wed, 7 Feb 2024 08:29:38 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ej1-f41.google.com ([209.85.218.41]:43275)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rXdMi-000000002O0-0Nuy
for doctor@doctor.nl2k.ab.ca;
Wed, 07 Feb 2024 01:33:11 -0700
Received: by mail-ej1-f41.google.com with SMTP id a640c23a62f3a-a388c5542e9so14708666b.1
for; Wed, 07 Feb 2024 00:31:12 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1707294666; x=1707899466; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=9NyuQNsOn2ZUWyepylfST4NcpLQeqb59GfhuWcmdo0g=;
b=QkEVY33mQC/417BL12wVvH3KymNbmj0E/2DIOeZKwegecFHL8aYbyAy81m/roMANq4
tr4bJZsJQfubfEtii7YjO+vfPMr6Lwhio086agugjOxX9deQp+Owm4S9jfPrsi0tUeUB
pbDTdHiv3NrVmKdEe/+8tgUFgAiTe0ENf5+DO9ddnhapAB3078R312bJ1c493u7x94B5
oYz53LuJn4rjPr6Tl9hfeeqRbAzcT342ac5GRFE6KbKz+XSlC4EYF7/APLBScfGAMo8m
8edwwgmn0c8dZ2uu0R31O429cYo6Wai4hNkx3wzhMsCp5T0yaUofW9bDvxI3hchyVqUo
dCpQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1707294666; x=1707899466;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=9NyuQNsOn2ZUWyepylfST4NcpLQeqb59GfhuWcmdo0g=;
b=xLs8zG7q7aSwNFFpU6Yu00lkkFq7CLXg6sNqdHNze4bmtpMDW0g4xNk4KJ4iK27GPx
cdC9CsS9Puzk6Ju0pi6y5+KkKuLAl11EyxrJp4raBPsKmZLwA2sezk02vX++7EJ+zNBB
81pA7d8DXAXS6n/CDQ+kfFzX66iiJkcscu5NjuiSQmqhuFiB7K9T5qk13E84xmCYVd7b
dhmKzU2H4HfuCKOV4Rvz5BGR4Nwy0sgiWAmHTMhcCi60eCNYCb5fukIkUFRknK1XQkKe
SXt16vPPsACTzWv1R4hwjh/scamm7wI7jZmqs1ix8kQq2fFIKwXAVYO91qQ3VPAkm8gq
XPrQ==
X-Gm-Message-State: AOJu0Yy2+nFSAs09oOilLlRNdfoS1urWdGDp6EWDPyQ9bYM1iIebbdnc
1Sm+ZHr+sBBiYkCJjxcCB6EbkUnGsfoBriDMftPCjMn/dOFlGKhl4nGwuWUnqepkhFAnq7XPdw4
o0YCTkUVlTHd20Hqg4Lgn29tACeeNfA3qI0VJ3A==
X-Google-Smtp-Source: AGHT+IG0bKdFz3mPJfopz2hWkNAHt+qe76xGANWTYfZDN6VbEIpzGE9OjtrRUSDzZTW24i2iztpOdA6FFthUIXz6bGA=
X-Received: by 2002:a05:6512:5d7:b0:511:3bce:9157 with SMTP id
o23-20020a05651205d700b005113bce9157mr1611394lfo.9.1707288574981; Tue, 06 Feb
2024 22:49:34 -0800 (PST)
MIME-Version: 1.0
Reply-To: dhlofficceline@outlook.com
From: Albert Dattia
Date: Wed, 7 Feb 2024 07:49:08 +0100
Message-ID:
Subject: Information
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000000a7c1a0610c51940"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 11.0
X-Spam_score_int: 110
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Information Kindly contact DHL courier manager Mr. Mark Adjovi
for delivery of your compensation ATM bank card worth the sum of $1,500,000.00
dollars reach him via email (dhlfastcourierbe@outlook.com) for more in [...]
Content analysis details: (11.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[djivoantoine78(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[djivoantoine78(at)gmail.com]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.218.41 listed in list.dnswl.org]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.218.41 listed in wl.mailspike.net]
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
1.5 HK_SCAM_N8 BODY: No description available.
0.0 HTML_MESSAGE BODY: HTML included in message
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.0 HK_SCAM No description available.
0.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Information
X-Antivirus: AVG (VPS 240207-4, 2/7/2024), Inbound message
X-Antivirus-Status: Clean
--0000000000000a7c1a0610c51940
Content-Type: text/plain; charset="UTF-8"
Information
Kindly contact DHL courier manager Mr. Mark Adjovi for delivery of your
compensation ATM bank card worth the sum of $1,500,000.00 dollars reach him
via email (dhlfastcourierbe@outlook.com) for more information on how to
receive it.
Albert Dattia
--0000000000000a7c1a0610c51940
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--0000000000000a7c1a0610c51940--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 07 Feb 2024 08:30:03 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rXjrm-00000000CYQ-2SPS
for dave@doctor.nl2k.ab.ca;
Wed, 07 Feb 2024 08:29:38 -0700
Resent-From: The Doctor
Resent-Date: Wed, 7 Feb 2024 08:29:38 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ej1-f41.google.com ([209.85.218.41]:43275)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rXdMi-000000002O0-0Nuy
for doctor@doctor.nl2k.ab.ca;
Wed, 07 Feb 2024 01:33:11 -0700
Received: by mail-ej1-f41.google.com with SMTP id a640c23a62f3a-a388c5542e9so14708666b.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1707294666; x=1707899466; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=9NyuQNsOn2ZUWyepylfST4NcpLQeqb59GfhuWcmdo0g=;
b=QkEVY33mQC/417BL12wVvH3KymNbmj0E/2DIOeZKwegecFHL8aYbyAy81m/roMANq4
tr4bJZsJQfubfEtii7YjO+vfPMr6Lwhio086agugjOxX9deQp+Owm4S9jfPrsi0tUeUB
pbDTdHiv3NrVmKdEe/+8tgUFgAiTe0ENf5+DO9ddnhapAB3078R312bJ1c493u7x94B5
oYz53LuJn4rjPr6Tl9hfeeqRbAzcT342ac5GRFE6KbKz+XSlC4EYF7/APLBScfGAMo8m
8edwwgmn0c8dZ2uu0R31O429cYo6Wai4hNkx3wzhMsCp5T0yaUofW9bDvxI3hchyVqUo
dCpQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1707294666; x=1707899466;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=9NyuQNsOn2ZUWyepylfST4NcpLQeqb59GfhuWcmdo0g=;
b=xLs8zG7q7aSwNFFpU6Yu00lkkFq7CLXg6sNqdHNze4bmtpMDW0g4xNk4KJ4iK27GPx
cdC9CsS9Puzk6Ju0pi6y5+KkKuLAl11EyxrJp4raBPsKmZLwA2sezk02vX++7EJ+zNBB
81pA7d8DXAXS6n/CDQ+kfFzX66iiJkcscu5NjuiSQmqhuFiB7K9T5qk13E84xmCYVd7b
dhmKzU2H4HfuCKOV4Rvz5BGR4Nwy0sgiWAmHTMhcCi60eCNYCb5fukIkUFRknK1XQkKe
SXt16vPPsACTzWv1R4hwjh/scamm7wI7jZmqs1ix8kQq2fFIKwXAVYO91qQ3VPAkm8gq
XPrQ==
X-Gm-Message-State: AOJu0Yy2+nFSAs09oOilLlRNdfoS1urWdGDp6EWDPyQ9bYM1iIebbdnc
1Sm+ZHr+sBBiYkCJjxcCB6EbkUnGsfoBriDMftPCjMn/dOFlGKhl4nGwuWUnqepkhFAnq7XPdw4
o0YCTkUVlTHd20Hqg4Lgn29tACeeNfA3qI0VJ3A==
X-Google-Smtp-Source: AGHT+IG0bKdFz3mPJfopz2hWkNAHt+qe76xGANWTYfZDN6VbEIpzGE9OjtrRUSDzZTW24i2iztpOdA6FFthUIXz6bGA=
X-Received: by 2002:a05:6512:5d7:b0:511:3bce:9157 with SMTP id
o23-20020a05651205d700b005113bce9157mr1611394lfo.9.1707288574981; Tue, 06 Feb
2024 22:49:34 -0800 (PST)
MIME-Version: 1.0
Reply-To: dhlofficceline@outlook.com
From: Albert Dattia
Date: Wed, 7 Feb 2024 07:49:08 +0100
Message-ID:
Subject: Information
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000000a7c1a0610c51940"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 11.0
X-Spam_score_int: 110
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Information Kindly contact DHL courier manager Mr. Mark Adjovi
for delivery of your compensation ATM bank card worth the sum of $1,500,000.00
dollars reach him via email (dhlfastcourierbe@outlook.com) for more in [...]
Content analysis details: (11.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[djivoantoine78(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[djivoantoine78(at)gmail.com]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.218.41 listed in list.dnswl.org]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.218.41 listed in wl.mailspike.net]
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
1.5 HK_SCAM_N8 BODY: No description available.
0.0 HTML_MESSAGE BODY: HTML included in message
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.0 HK_SCAM No description available.
0.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Information
X-Antivirus: AVG (VPS 240207-4, 2/7/2024), Inbound message
X-Antivirus-Status: Clean
--0000000000000a7c1a0610c51940
Content-Type: text/plain; charset="UTF-8"
Information
Kindly contact DHL courier manager Mr. Mark Adjovi for delivery of your
compensation ATM bank card worth the sum of $1,500,000.00 dollars reach him
via email (dhlfastcourierbe@outlook.com) for more information on how to
receive it.
Albert Dattia
--0000000000000a7c1a0610c51940
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Information
Kindly contact DHL courier manager Mr. =
Mark Adjovi for delivery of your compensation ATM bank card worth the sum o=
f $1,500,000.00 dollars reach him via email (
erbe@outlook.com">dhlfastcourierbe@outlook.com) for more information on=
how to receive it.
Albert Dattia
Kindly contact DHL courier manager Mr. =
Mark Adjovi for delivery of your compensation ATM bank card worth the sum o=
f $1,500,000.00 dollars reach him via email (
erbe@outlook.com">dhlfastcourierbe@outlook.com) for more information on=
how to receive it.
Albert Dattia
--0000000000000a7c1a0610c51940--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments