Nigerian Google Gmail spam
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 29 Jun 2024 07:22:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1sNY13-00000000KXE-4AOK
for dave@doctor.nl2k.ab.ca;
Sat, 29 Jun 2024 07:21:21 -0600
Resent-From: The Doctor
Resent-Date: Sat, 29 Jun 2024 07:21:21 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pl1-f194.google.com ([209.85.214.194]:58709)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1sNWdv-000000008TU-21rX
for doctor@doctor.nl2k.ab.ca;
Sat, 29 Jun 2024 05:53:39 -0600
Received: by mail-pl1-f194.google.com with SMTP id d9443c01a7336-1f480624d0dso11078215ad.1
for; Sat, 29 Jun 2024 04:51:28 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1719661883; x=1720266683; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=WsnUsE3TGtOFSmXsK51dTh0lVeDnCN30hxWYQPKcTrc=;
b=FfOh2hMThLmzH8xEpPBbDsEP9KwlvJ+slqxn3opXeiXAB5JVKuWMhCHhMNFrFfwhlt
MlFYF8uWUP2qtsmthAB8+X9ODm9hhc5KgLdaMTBA5hBWfxuqakal3WvfcmIEui0iF2fs
x7Qc2ecnAF1Xh5bk1uZOM1gNFqxh7t3Z/EHIH4xvuIIo91VpJdKTNMUZD797wmdBJ1Od
d8/cz8f/WKzYWOqxwgxcNaF2hNo8xu9eAF20hY3wbMPElJDg9taORzj4Wq9cdV0VBn74
RTCcLZQFNGDmJCPw+aBUpQgVUt64uGopQznR5/hz3C9OaVGPE5L6tgcVdbgaDsZDGIRj
gNow==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1719661883; x=1720266683;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=WsnUsE3TGtOFSmXsK51dTh0lVeDnCN30hxWYQPKcTrc=;
b=sS8CxRIsiXSBqXPuBRaA0911fX5fRQM4jCPYHEQ91oYV6k4k+Od7XmKR/DL2S+W1Jr
86g2LMaVrcAuCdukeO1PP8mMLLJZeXW7bfJcLrPug0GvssURY3aKFA7oncB+Yw3uNBYp
V5SymA0fgfJ6skoJl3sVTlLQv70GiEqao7iINy7q2b6wABM65ptKzOKGsfX/1hFKyAlQ
ALG0e2ID4GyZtMtv5wmEvozG/vQKgKNBhwzJMWaS61x/WAgk8rdSohuXe1XP5rDpcYIU
2IiDbAeMbHfA4g2RqiUyYl0bCOLx425PtGJ0beI8iWjKM9+bHBajikKwIF+73zu2kSLo
f1kA==
X-Forwarded-Encrypted: i=1; AJvYcCXWCGHG4fpW25EgOSaDg8uxk/TPGii6c9eFD77gTHFPvRjXtEfbE+2RZUVVmYTneL8P+8shAuuJbPKPHRz7UqNslOsYc8Yrnr0=
X-Gm-Message-State: AOJu0YzlnmrNN+5pF8ytEyHwrIAYeB3xP61cK2gbSJ4FfD72Nrvvcw0/
GNMvr7ovd3Et58oqpM64FeObnFF3Si5ORH0SkgCkhETcchaKPyzLi1i+Lzs4ShUjN3n8keTLNYN
D9N2c5FOAGParhI9gLVM/1Q0ZTElrPiXoJMkWUQ==
X-Google-Smtp-Source: AGHT+IGDN/uw2r8LxhUR3/pKi9Li1AhGlSysItD+B5oxooAlmpV5abpTLveIxBDaU75m9wetcd0UmnoD2v0mVE3fA0o=
X-Received: by 2002:ac8:5a03:0:b0:446:4a6d:449d with SMTP id
d75a77b69052e-44662dc574fmr8496831cf.22.1719661404893; Sat, 29 Jun 2024
04:43:24 -0700 (PDT)
MIME-Version: 1.0
Reply-To: fredrickmataka1@gmail.com
From: Fredrick Mataka
Date: Sat, 29 Jun 2024 11:43:14 +0000
Message-ID:
Subject: Greetings
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000002c385e061c05dfc1"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 25.3
X-Spam_score_int: 253
X-Spam_bar: +++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings,I am a banker by profession,In my department in
the bank I discovered an abandoned sum of $11.3million us dollars that belongs
to one of our foreign customers who died with his supposed next [...]
Content analysis details: (25.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.214.194 listed in dnsbl.ahbl.org]
[209.85.214.194 listed in dnsbl.ahbl.org]
[209.85.214.194 listed in dnsbl.ahbl.org]
[209.85.214.194 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.214.194 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.214.194 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.214.194 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.214.194 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.214.194 listed in list.dnswl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.214.194 listed in will-spam-for-food.eu.org]
[209.85.214.194 listed in will-spam-for-food.eu.org]
[209.85.214.194 listed in will-spam-for-food.eu.org]
[209.85.214.194 listed in will-spam-for-food.eu.org]
[209.85.214.194 listed in will-spam-for-food.eu.org]
[209.85.214.194 listed in will-spam-for-food.eu.org]
[209.85.214.194 listed in will-spam-for-food.eu.org]
[209.85.214.194 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.214.194 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[abbassaadmahmoud0(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[fredrickmataka1(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[fredrickmataka1(at)gmail.com]
0.6 J_CHICKENPOX_102 BODY: 10alpha-pock-2alpha
2.5 HK_SCAM_N2 BODY: No description available.
2.7 UNCLAIMED_MONEY BODY: People just leave money laying around
3.6 NA_DOLLARS BODY: Talks about a million North American dollars
2.0 BANKING_LAWS BODY: Talks about banking laws
0.9 URG_BIZ BODY: Contains urgent matter
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 HK_SCAM No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_MONEY_PERCENT X% of a lot of money for you
0.6 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 XFER_LOTSA_MONEY Transfer a lot of money
0.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Greetings
--0000000000002c385e061c05dfc1
Content-Type: text/plain; charset="UTF-8"
Greetings,I am a banker by profession,In my department in the bank I
discovered an abandoned sum of $11.3million us dollars that belongs to one
of our foreign customers who died with his supposed next of kin on October
16th 2005.
I need your urgent assistance in transferring the fund into your private
bank account. The money has been lying dormant in our bank for years now
without anybody coming for the claim of it.
I want the bank to release the money to you as the beneficiary and the
nearest relative to our deceased customer. The banking laws here does not
allow such money to stay more than 20 years because the money will be
recalled to the bank treasury account as unclaimed funds.
That is the reason why I contacted you for a business deal where this money
can be shared between us in the ratio of 60% for me and 40% for you. By
indicating your interest I will send you the full details on how the
transfer will be executed.
Best regards
Mr.Fredrick
--0000000000002c385e061c05dfc1
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--0000000000002c385e061c05dfc1--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 29 Jun 2024 07:22:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1sNY13-00000000KXE-4AOK
for dave@doctor.nl2k.ab.ca;
Sat, 29 Jun 2024 07:21:21 -0600
Resent-From: The Doctor
Resent-Date: Sat, 29 Jun 2024 07:21:21 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pl1-f194.google.com ([209.85.214.194]:58709)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1sNWdv-000000008TU-21rX
for doctor@doctor.nl2k.ab.ca;
Sat, 29 Jun 2024 05:53:39 -0600
Received: by mail-pl1-f194.google.com with SMTP id d9443c01a7336-1f480624d0dso11078215ad.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1719661883; x=1720266683; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=WsnUsE3TGtOFSmXsK51dTh0lVeDnCN30hxWYQPKcTrc=;
b=FfOh2hMThLmzH8xEpPBbDsEP9KwlvJ+slqxn3opXeiXAB5JVKuWMhCHhMNFrFfwhlt
MlFYF8uWUP2qtsmthAB8+X9ODm9hhc5KgLdaMTBA5hBWfxuqakal3WvfcmIEui0iF2fs
x7Qc2ecnAF1Xh5bk1uZOM1gNFqxh7t3Z/EHIH4xvuIIo91VpJdKTNMUZD797wmdBJ1Od
d8/cz8f/WKzYWOqxwgxcNaF2hNo8xu9eAF20hY3wbMPElJDg9taORzj4Wq9cdV0VBn74
RTCcLZQFNGDmJCPw+aBUpQgVUt64uGopQznR5/hz3C9OaVGPE5L6tgcVdbgaDsZDGIRj
gNow==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1719661883; x=1720266683;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=WsnUsE3TGtOFSmXsK51dTh0lVeDnCN30hxWYQPKcTrc=;
b=sS8CxRIsiXSBqXPuBRaA0911fX5fRQM4jCPYHEQ91oYV6k4k+Od7XmKR/DL2S+W1Jr
86g2LMaVrcAuCdukeO1PP8mMLLJZeXW7bfJcLrPug0GvssURY3aKFA7oncB+Yw3uNBYp
V5SymA0fgfJ6skoJl3sVTlLQv70GiEqao7iINy7q2b6wABM65ptKzOKGsfX/1hFKyAlQ
ALG0e2ID4GyZtMtv5wmEvozG/vQKgKNBhwzJMWaS61x/WAgk8rdSohuXe1XP5rDpcYIU
2IiDbAeMbHfA4g2RqiUyYl0bCOLx425PtGJ0beI8iWjKM9+bHBajikKwIF+73zu2kSLo
f1kA==
X-Forwarded-Encrypted: i=1; AJvYcCXWCGHG4fpW25EgOSaDg8uxk/TPGii6c9eFD77gTHFPvRjXtEfbE+2RZUVVmYTneL8P+8shAuuJbPKPHRz7UqNslOsYc8Yrnr0=
X-Gm-Message-State: AOJu0YzlnmrNN+5pF8ytEyHwrIAYeB3xP61cK2gbSJ4FfD72Nrvvcw0/
GNMvr7ovd3Et58oqpM64FeObnFF3Si5ORH0SkgCkhETcchaKPyzLi1i+Lzs4ShUjN3n8keTLNYN
D9N2c5FOAGParhI9gLVM/1Q0ZTElrPiXoJMkWUQ==
X-Google-Smtp-Source: AGHT+IGDN/uw2r8LxhUR3/pKi9Li1AhGlSysItD+B5oxooAlmpV5abpTLveIxBDaU75m9wetcd0UmnoD2v0mVE3fA0o=
X-Received: by 2002:ac8:5a03:0:b0:446:4a6d:449d with SMTP id
d75a77b69052e-44662dc574fmr8496831cf.22.1719661404893; Sat, 29 Jun 2024
04:43:24 -0700 (PDT)
MIME-Version: 1.0
Reply-To: fredrickmataka1@gmail.com
From: Fredrick Mataka
Date: Sat, 29 Jun 2024 11:43:14 +0000
Message-ID:
Subject: Greetings
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000002c385e061c05dfc1"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 25.3
X-Spam_score_int: 253
X-Spam_bar: +++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings,I am a banker by profession,In my department in
the bank I discovered an abandoned sum of $11.3million us dollars that belongs
to one of our foreign customers who died with his supposed next [...]
Content analysis details: (25.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.214.194 listed in dnsbl.ahbl.org]
[209.85.214.194 listed in dnsbl.ahbl.org]
[209.85.214.194 listed in dnsbl.ahbl.org]
[209.85.214.194 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.214.194 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.214.194 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.214.194 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.214.194 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.214.194 listed in list.dnswl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.214.194 listed in will-spam-for-food.eu.org]
[209.85.214.194 listed in will-spam-for-food.eu.org]
[209.85.214.194 listed in will-spam-for-food.eu.org]
[209.85.214.194 listed in will-spam-for-food.eu.org]
[209.85.214.194 listed in will-spam-for-food.eu.org]
[209.85.214.194 listed in will-spam-for-food.eu.org]
[209.85.214.194 listed in will-spam-for-food.eu.org]
[209.85.214.194 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.214.194 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[abbassaadmahmoud0(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[fredrickmataka1(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[fredrickmataka1(at)gmail.com]
0.6 J_CHICKENPOX_102 BODY: 10alpha-pock-2alpha
2.5 HK_SCAM_N2 BODY: No description available.
2.7 UNCLAIMED_MONEY BODY: People just leave money laying around
3.6 NA_DOLLARS BODY: Talks about a million North American dollars
2.0 BANKING_LAWS BODY: Talks about banking laws
0.9 URG_BIZ BODY: Contains urgent matter
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 HK_SCAM No description available.
0.0 LOTS_OF_MONEY Huge... sums of money
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_MONEY_PERCENT X% of a lot of money for you
0.6 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 XFER_LOTSA_MONEY Transfer a lot of money
0.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Greetings
--0000000000002c385e061c05dfc1
Content-Type: text/plain; charset="UTF-8"
Greetings,I am a banker by profession,In my department in the bank I
discovered an abandoned sum of $11.3million us dollars that belongs to one
of our foreign customers who died with his supposed next of kin on October
16th 2005.
I need your urgent assistance in transferring the fund into your private
bank account. The money has been lying dormant in our bank for years now
without anybody coming for the claim of it.
I want the bank to release the money to you as the beneficiary and the
nearest relative to our deceased customer. The banking laws here does not
allow such money to stay more than 20 years because the money will be
recalled to the bank treasury account as unclaimed funds.
That is the reason why I contacted you for a business deal where this money
can be shared between us in the ratio of 60% for me and 40% for you. By
indicating your interest I will send you the full details on how the
transfer will be executed.
Best regards
Mr.Fredrick
--0000000000002c385e061c05dfc1
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Greetings,I am a banker by profession,In my department in =
the bank I discovered an abandoned sum of $11.3million us dollars that belo=
ngs to one of our foreign customers who died with his supposed next of kin =
on October 16th 2005.
I need your urgent assistance in transferring =
the fund into your private bank account. The money has been lying dormant i=
n our bank for years now without anybody coming for the claim of it.
r>I want the bank to release the money to you as the beneficiary and the ne=
arest relative to our deceased customer. The banking laws here does not all=
ow such money to stay more than 20 years because the money will be recalled=
to the bank treasury account as unclaimed funds.
That is the reaso=
n why I contacted you for a business deal where this money can be shared be=
tween us in the ratio of 60% for me and 40% for you. By indicating your int=
erest I will send you the full details on how the transfer will be executed=
.
Best regards
Mr.Fredrick
the bank I discovered an abandoned sum of $11.3million us dollars that belo=
ngs to one of our foreign customers who died with his supposed next of kin =
on October 16th 2005.
I need your urgent assistance in transferring =
the fund into your private bank account. The money has been lying dormant i=
n our bank for years now without anybody coming for the claim of it.
r>I want the bank to release the money to you as the beneficiary and the ne=
arest relative to our deceased customer. The banking laws here does not all=
ow such money to stay more than 20 years because the money will be recalled=
to the bank treasury account as unclaimed funds.
That is the reaso=
n why I contacted you for a business deal where this money can be shared be=
tween us in the ratio of 60% for me and 40% for you. By indicating your int=
erest I will send you the full details on how the transfer will be executed=
.
Best regards
Mr.Fredrick
--0000000000002c385e061c05dfc1--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments