Nigerian Investment proposal spam from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 15 Jul 2024 16:51:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from)
id 1sTUWp-00000000NpE-0T5N
for dave@doctor.nl2k.ab.ca;
Mon, 15 Jul 2024 16:50:43 -0600
Resent-From: The Doctor
Resent-Date: Mon, 15 Jul 2024 16:50:42 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ot1-f50.google.com ([209.85.210.50]:59493)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98 (FreeBSD))
(envelope-from)
id 1sTSlu-000000006xZ-325p
for doctor@doctor.nl2k.ab.ca;
Mon, 15 Jul 2024 14:58:14 -0600
Received: by mail-ot1-f50.google.com with SMTP id 46e09a7af769-703ba2477bdso2361435a34.2
for; Mon, 15 Jul 2024 13:56:16 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1721076970; x=1721681770; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=smMyCr4ojLoEVJpCJjIrmPtuTmP7PICl8uIFJXfBvK0=;
b=S7OG1OUjo6Q0OiEirPxLT9NjXuurw+oEdP5f5uRKN7HAr3W8WjRm8CWomh0UrF0XyL
hJkXXPc+ovJnFi3BQqE8aI4g1fy8PDeFDbKLTmJ0soPPm2THHelEb6jqkCM5ecTeH0l3
PCx1SYYtcgUSeR6NbHf8lo7UH2Lta/B6KsaBuZfPMWnC/UZKuJbltZN5ezTVT0lDaL2X
x6Or1oG6V3gBnxA6PFVDdXbS4aHtgKTg3cz3tDJYScuSlFPGA/gt7i7/kM9utEfNvM56
KpnnRGL+RtrHQbZdl6ib/bXbh2MgfHomD1ewu38Mrv/UEm6skZ3qdK3tBxJ+1Nt+tdjt
2v5w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1721076970; x=1721681770;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=smMyCr4ojLoEVJpCJjIrmPtuTmP7PICl8uIFJXfBvK0=;
b=QPNO09MOXQxMz88Rn+Y3dA7MMKG42MosZ8XLV4rOILT08J2Iu3/k/1xPlhOJbvFHcY
K0f15YPd460OG/mbxQcuJLkvDSMXc4ht2V+7vuTIc3cvdr5/uXi6Z0lmXlJKgSSYvj3m
JnOcmb8xgv0eZ60KPVe6kP+9ra2kMjvTeB8fFcHIQG5QJ8afMgMHF/XIYt047klYRQpw
R1qOMYuCR13PT/7KnhGhsMvgsIaZww/0r7T/21MVLQHaTscfFxw7ZgbHlsUXyGzlysMi
OStnelxmWed5DvGnO687l9duLrKAkfg+m+cqrMwKYxgNqEX35iVFKX6/lhuQUmQ2co+P
uhyg==
X-Forwarded-Encrypted: i=1; AJvYcCXCYzQBlGFqrjvBbdbX+Ggh00o9SJJbBOL8eT5cw86a3GHwY+45kk+AYg5Ho6gHlwEa+6aAKL900JyEtW7FAalIBj3ORbU0Pnc=
X-Gm-Message-State: AOJu0YwMKYXUjxi44aCX/sbcpW1fkERAW5xn+KUaTEuaivkh1uEHg18x
/Vw5TlPbkTXs+wRw8ud+jHtS9PueB3JWU+JFEUxUagaJqQBlsqzzMR/OYFM9uPq8khwrE0Lvtke
eBj6MIVSHJ8L9Jcg6zbkVh0a8qck=
X-Google-Smtp-Source: AGHT+IG5OeiK1Ht4LYXOKLyvG2geyIK9OnBRHjtvtC5nztXA1cOt2VtnaKalf43unCZ+P9pG3uEKgWHWfEfPCyakuHg=
X-Received: by 2002:a05:6870:1644:b0:229:f022:ef83 with SMTP id
586e51a60fabf-25eaec1596amr18815803fac.43.1721076970240; Mon, 15 Jul 2024
13:56:10 -0700 (PDT)
MIME-Version: 1.0
Reply-To: marjanigatluak@yahoo.com
From: Marjani
Date: Mon, 15 Jul 2024 21:55:59 +0100
Message-ID:
Subject: Investment proposal.
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000714750061d4f75c6"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 20.2
X-Spam_score_int: 202
X-Spam_bar: ++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello, Please excuse my intrusion. I am Mrs. Marjani Gatluak
Gai, wife of the former commander Gatluak Gai of Sudan. He was one of the
commanders of the militia and was killed in a firefight with the opposition
in Sudan. Sudan is curre [...]
Content analysis details: (20.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.210.50 listed in dnsbl.ahbl.org]
[209.85.210.50 listed in dnsbl.ahbl.org]
[209.85.210.50 listed in dnsbl.ahbl.org]
[209.85.210.50 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.210.50 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.210.50 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.210.50 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.210.50 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.210.50 listed in list.dnswl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.210.50 listed in will-spam-for-food.eu.org]
[209.85.210.50 listed in will-spam-for-food.eu.org]
[209.85.210.50 listed in will-spam-for-food.eu.org]
[209.85.210.50 listed in will-spam-for-food.eu.org]
[209.85.210.50 listed in will-spam-for-food.eu.org]
[209.85.210.50 listed in will-spam-for-food.eu.org]
[209.85.210.50 listed in will-spam-for-food.eu.org]
[209.85.210.50 listed in will-spam-for-food.eu.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.210.50 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[fatwat42(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[fatwat42(at)gmail.com]
3.6 NA_DOLLARS BODY: Talks about a million North American dollars
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.1 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 T_MONEY_PERCENT X% of a lot of money for you
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
0.7 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Investment proposal.
--000000000000714750061d4f75c6
Content-Type: text/plain; charset="UTF-8"
Hello,
Please excuse my intrusion.
I am Mrs. Marjani Gatluak Gai, wife of the former commander Gatluak Gai of
Sudan. He was one of the commanders of the militia and was killed in a
firefight with the opposition in Sudan. Sudan is currently in serious
chaos, my life and my daughter's life is not safe, so we have moved to one
of the West African countries (Ivory Coast) to seek refuge.
The reason I am contacting you is to help me move the funds left by my late
husband (thirty-five million US dollars) in one of his offshore accounts to
your country or any of the tax haven countries where we can invest the
funds wisely.
If you agree to cooperate with me, after the successful execution of this
transaction, we will share the money in a 60/40 percentage. 60% for me,
while 40% for you. I assure you that this transaction is 100% risk free,
you don't have to fear anything.
Note: I need a serious and capable person only.
If you are interested, kindly reply so that I can confidently explain to
you more.
I look forward to your reply.
Yours sincerely,
Mrs. Marjani G. Gai.
Nb: if you can come to Ivory Coast so that we can meet in person and
discuss how to transfer the funds will be greatly appreciated.
--000000000000714750061d4f75c6
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--000000000000714750061d4f75c6--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 15 Jul 2024 16:51:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from
id 1sTUWp-00000000NpE-0T5N
for dave@doctor.nl2k.ab.ca;
Mon, 15 Jul 2024 16:50:43 -0600
Resent-From: The Doctor
Resent-Date: Mon, 15 Jul 2024 16:50:42 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ot1-f50.google.com ([209.85.210.50]:59493)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98 (FreeBSD))
(envelope-from
id 1sTSlu-000000006xZ-325p
for doctor@doctor.nl2k.ab.ca;
Mon, 15 Jul 2024 14:58:14 -0600
Received: by mail-ot1-f50.google.com with SMTP id 46e09a7af769-703ba2477bdso2361435a34.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1721076970; x=1721681770; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=smMyCr4ojLoEVJpCJjIrmPtuTmP7PICl8uIFJXfBvK0=;
b=S7OG1OUjo6Q0OiEirPxLT9NjXuurw+oEdP5f5uRKN7HAr3W8WjRm8CWomh0UrF0XyL
hJkXXPc+ovJnFi3BQqE8aI4g1fy8PDeFDbKLTmJ0soPPm2THHelEb6jqkCM5ecTeH0l3
PCx1SYYtcgUSeR6NbHf8lo7UH2Lta/B6KsaBuZfPMWnC/UZKuJbltZN5ezTVT0lDaL2X
x6Or1oG6V3gBnxA6PFVDdXbS4aHtgKTg3cz3tDJYScuSlFPGA/gt7i7/kM9utEfNvM56
KpnnRGL+RtrHQbZdl6ib/bXbh2MgfHomD1ewu38Mrv/UEm6skZ3qdK3tBxJ+1Nt+tdjt
2v5w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1721076970; x=1721681770;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=smMyCr4ojLoEVJpCJjIrmPtuTmP7PICl8uIFJXfBvK0=;
b=QPNO09MOXQxMz88Rn+Y3dA7MMKG42MosZ8XLV4rOILT08J2Iu3/k/1xPlhOJbvFHcY
K0f15YPd460OG/mbxQcuJLkvDSMXc4ht2V+7vuTIc3cvdr5/uXi6Z0lmXlJKgSSYvj3m
JnOcmb8xgv0eZ60KPVe6kP+9ra2kMjvTeB8fFcHIQG5QJ8afMgMHF/XIYt047klYRQpw
R1qOMYuCR13PT/7KnhGhsMvgsIaZww/0r7T/21MVLQHaTscfFxw7ZgbHlsUXyGzlysMi
OStnelxmWed5DvGnO687l9duLrKAkfg+m+cqrMwKYxgNqEX35iVFKX6/lhuQUmQ2co+P
uhyg==
X-Forwarded-Encrypted: i=1; AJvYcCXCYzQBlGFqrjvBbdbX+Ggh00o9SJJbBOL8eT5cw86a3GHwY+45kk+AYg5Ho6gHlwEa+6aAKL900JyEtW7FAalIBj3ORbU0Pnc=
X-Gm-Message-State: AOJu0YwMKYXUjxi44aCX/sbcpW1fkERAW5xn+KUaTEuaivkh1uEHg18x
/Vw5TlPbkTXs+wRw8ud+jHtS9PueB3JWU+JFEUxUagaJqQBlsqzzMR/OYFM9uPq8khwrE0Lvtke
eBj6MIVSHJ8L9Jcg6zbkVh0a8qck=
X-Google-Smtp-Source: AGHT+IG5OeiK1Ht4LYXOKLyvG2geyIK9OnBRHjtvtC5nztXA1cOt2VtnaKalf43unCZ+P9pG3uEKgWHWfEfPCyakuHg=
X-Received: by 2002:a05:6870:1644:b0:229:f022:ef83 with SMTP id
586e51a60fabf-25eaec1596amr18815803fac.43.1721076970240; Mon, 15 Jul 2024
13:56:10 -0700 (PDT)
MIME-Version: 1.0
Reply-To: marjanigatluak@yahoo.com
From: Marjani
Date: Mon, 15 Jul 2024 21:55:59 +0100
Message-ID:
Subject: Investment proposal.
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000714750061d4f75c6"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 20.2
X-Spam_score_int: 202
X-Spam_bar: ++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello, Please excuse my intrusion. I am Mrs. Marjani Gatluak
Gai, wife of the former commander Gatluak Gai of Sudan. He was one of the
commanders of the militia and was killed in a firefight with the opposition
in Sudan. Sudan is curre [...]
Content analysis details: (20.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.210.50 listed in dnsbl.ahbl.org]
[209.85.210.50 listed in dnsbl.ahbl.org]
[209.85.210.50 listed in dnsbl.ahbl.org]
[209.85.210.50 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.210.50 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.210.50 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.210.50 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.210.50 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.210.50 listed in list.dnswl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.210.50 listed in will-spam-for-food.eu.org]
[209.85.210.50 listed in will-spam-for-food.eu.org]
[209.85.210.50 listed in will-spam-for-food.eu.org]
[209.85.210.50 listed in will-spam-for-food.eu.org]
[209.85.210.50 listed in will-spam-for-food.eu.org]
[209.85.210.50 listed in will-spam-for-food.eu.org]
[209.85.210.50 listed in will-spam-for-food.eu.org]
[209.85.210.50 listed in will-spam-for-food.eu.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.210.50 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[fatwat42(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[fatwat42(at)gmail.com]
3.6 NA_DOLLARS BODY: Talks about a million North American dollars
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.1 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 T_MONEY_PERCENT X% of a lot of money for you
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
0.7 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Investment proposal.
--000000000000714750061d4f75c6
Content-Type: text/plain; charset="UTF-8"
Hello,
Please excuse my intrusion.
I am Mrs. Marjani Gatluak Gai, wife of the former commander Gatluak Gai of
Sudan. He was one of the commanders of the militia and was killed in a
firefight with the opposition in Sudan. Sudan is currently in serious
chaos, my life and my daughter's life is not safe, so we have moved to one
of the West African countries (Ivory Coast) to seek refuge.
The reason I am contacting you is to help me move the funds left by my late
husband (thirty-five million US dollars) in one of his offshore accounts to
your country or any of the tax haven countries where we can invest the
funds wisely.
If you agree to cooperate with me, after the successful execution of this
transaction, we will share the money in a 60/40 percentage. 60% for me,
while 40% for you. I assure you that this transaction is 100% risk free,
you don't have to fear anything.
Note: I need a serious and capable person only.
If you are interested, kindly reply so that I can confidently explain to
you more.
I look forward to your reply.
Yours sincerely,
Mrs. Marjani G. Gai.
Nb: if you can come to Ivory Coast so that we can meet in person and
discuss how to transfer the funds will be greatly appreciated.
--000000000000714750061d4f75c6
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Hello,
Please excuse my intrusion.
I am Mrs.=
Marjani Gatluak Gai, wife of the former commander Gatluak Gai of Sudan. He=
was one of the commanders of the militia and was killed in a firefight wit=
h the opposition in Sudan. Sudan is currently in serious chaos, my life and=
my daughter's life is not safe, so we have moved to one of the West Af=
rican countries (Ivory Coast) to seek refuge.
The reason I am contac=
ting you is to help me move the funds left by my late husband (thirty-five =
million US dollars) in one of his offshore accounts to your country or any =
of the tax haven countries where we can invest the funds wisely.
If =
you agree to cooperate with me, after the successful execution of this tran=
saction, we will share the money in a 60/40 percentage. 60% for me, while 4=
0% for you. I assure you that this transaction is 100% risk free, you don&#=
39;t have to fear anything.
Note: I need a serious and capable perso=
n only.
If you are interested, kindly reply so that I can confidentl=
y explain to you more.
I look forward to your reply.
Yours si=
ncerely,
Mrs. Marjani G. Gai.
Nb: if you can come to Ivory Coast =
so that we can meet in person and discuss how to transfer the funds will be=
greatly appreciated.
Please excuse my intrusion.
I am Mrs.=
Marjani Gatluak Gai, wife of the former commander Gatluak Gai of Sudan. He=
was one of the commanders of the militia and was killed in a firefight wit=
h the opposition in Sudan. Sudan is currently in serious chaos, my life and=
my daughter's life is not safe, so we have moved to one of the West Af=
rican countries (Ivory Coast) to seek refuge.
The reason I am contac=
ting you is to help me move the funds left by my late husband (thirty-five =
million US dollars) in one of his offshore accounts to your country or any =
of the tax haven countries where we can invest the funds wisely.
If =
you agree to cooperate with me, after the successful execution of this tran=
saction, we will share the money in a 60/40 percentage. 60% for me, while 4=
0% for you. I assure you that this transaction is 100% risk free, you don&#=
39;t have to fear anything.
Note: I need a serious and capable perso=
n only.
If you are interested, kindly reply so that I can confidentl=
y explain to you more.
I look forward to your reply.
Yours si=
ncerely,
Mrs. Marjani G. Gai.
Nb: if you can come to Ivory Coast =
so that we can meet in person and discuss how to transfer the funds will be=
greatly appreciated.
--000000000000714750061d4f75c6--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments