Nigerian spam from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 08 Oct 2024 09:40:00 -0600
Received: from mail-il1-f173.google.com ([209.85.166.173]:49268)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98 (FreeBSD))
(envelope-from)
id 1syCIh-00000000BNg-0XYd
for dave@doctor.nl2k.ab.ca;
Tue, 08 Oct 2024 09:39:08 -0600
Received: by mail-il1-f173.google.com with SMTP id e9e14a558f8ab-3a3636ddad6so20483315ab.2
for; Tue, 08 Oct 2024 08:37:09 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1728401823; x=1729006623; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=04Mk9QZq7WK9CpwwgUOptYa6v9VVQnk+nOVMrKQfyD8=;
b=F9CArlX+/gaZEnmAR1dlNLhqmKWKYJVxz4xNlSlwq7T5VG9eFK1INVBs4UUUwfCUjg
f/fgtIK3d7bQevlrBM2Qf6cd1AAMth8waM/H9AuWqucZPvXYfxwYvbWryzgpEr7c0sGk
tvgtoZU88Yj5glFhpvwgPZ0aJRrU7QDR5Z0FnNT2Y3XalcKoa6QcuFM0sHH7XdbOtfVR
adSFPDxcDoIMoleh8vuTsk0fVWTbXM4A4JLqRPMMD4G/QydJ9ckNNCUXllh9sdgz39Qn
7Mt82K/pjEg2vqRwtzMQIL8Q0zquu9MKB9qXBQUSP2CmMp4o8TW3+4jKtnKI52ICec2n
QgpQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1728401823; x=1729006623;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=04Mk9QZq7WK9CpwwgUOptYa6v9VVQnk+nOVMrKQfyD8=;
b=B7K5ZTdRei1TbpG9H3ROQl6U7JnbYb41mvYuu9MJR5qN2v2WZyMwY/1b4vo/oHwliB
tayK7sKJNtsLJ8UXCS+vRrFmddmsv1B48ULl2MKKmYCM8+EEbPbSqxAlH11+WqcKVJjK
mC3R1/S3lNXZWaVhnk1f/EXZy1Xf6G7LX+M8HoOHkWzNbvIllAmOWJIcHjAcSa16oFnO
qs8qUMouqrkJMHExuE5BAEjQ/cqfwY7Eq1wDyvXDlilhD38NAolU4mpUoaK+WNE3Cp+p
FDdmjngBbdoUwUnXBTOdryyJrNFpox++ztaTNTrPEz1dV9lsWNEbgIEMtGd29Ouuf+rn
uTgg==
X-Forwarded-Encrypted: i=1; AJvYcCUjMy64mynLMPwjhfFf4NMBti4+eO7Uz/p+6vhiEDk8AG2EPp4mRRvt0pZ0Sg24HyxsG9OT@doctor.nl2k.ab.ca
X-Gm-Message-State: AOJu0YyKsFiu9npo2OEtPvWf2EFpfzhzk0mo/ZnlpfyRApN5asFZJcrP
pPuyN7WiTLSDFALm+4d0uzzs8GqJ3Qw82hdl7zMxO/Lff+P0nBsQCjdvZ1Y5ZMJnV2PgAaYnpCq
Zl0eY+tIJGHcbpWvDiz4WX6w6HPI=
X-Google-Smtp-Source: AGHT+IF1o7rJ6pmpCOd54+Y4zxzdEmH3iN6Gl+iqF7MLJUsWTKR85ZJ7VCY+4mrWIj3pM7o01OKecU/tgmaLL2yd6CE=
X-Received: by 2002:a05:6e02:1fc8:b0:3a0:aa15:3497 with SMTP id
e9e14a558f8ab-3a375976e55mr150239215ab.1.1728401822251; Tue, 08 Oct 2024
08:37:02 -0700 (PDT)
MIME-Version: 1.0
Reply-To: mariarodrigues33yt@gmail.com
From: "Mrs.Maria Rodrigues"
Date: Tue, 8 Oct 2024 15:36:49 +0000
Message-ID:
Subject:
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000a50af30623f8e866"
Bcc: dave@doctor.nl2k.ab.ca
X-Spam_score: 20.2
X-Spam_score_int: 202
X-Spam_bar: ++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings beloved, I know this message might meet you in utmost
surprise. However, it's just my urgent need for a foreign partner. I would
like to know if this proposal will be worthwhile for your acceptance. I need
you [...]
Content analysis details: (20.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.166.173 listed in will-spam-for-food.eu.org]
[209.85.166.173 listed in will-spam-for-food.eu.org]
[209.85.166.173 listed in will-spam-for-food.eu.org]
[209.85.166.173 listed in will-spam-for-food.eu.org]
[209.85.166.173 listed in will-spam-for-food.eu.org]
[209.85.166.173 listed in will-spam-for-food.eu.org]
[209.85.166.173 listed in will-spam-for-food.eu.org]
[209.85.166.173 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.166.173 listed in dnsbl.ahbl.org]
[209.85.166.173 listed in dnsbl.ahbl.org]
[209.85.166.173 listed in dnsbl.ahbl.org]
[209.85.166.173 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.166.173 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.166.173 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.166.173 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.166.173 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.166.173 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.166.173 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[loglokokou(at)gmail.com]
0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
2.5 MILLION_USD BODY: Talks about millions of dollars
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
1.5 HK_NAME_FM_MR_MRS No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.5 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 XFER_LOTSA_MONEY Transfer a lot of money
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.6 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
Subject: {SPAM?}
--000000000000a50af30623f8e866
Content-Type: text/plain; charset="UTF-8"
Greetings beloved,
I know this message might meet you in utmost surprise. However, it's just
my urgent need for a foreign partner. I would like to know if this proposal
will be worthwhile for your acceptance. I need your honest assistance to
actualize my humanitarian project. Sadly, I am critically down with
terminal sickness and on the verge of death. I want you to utilize my
inheritance funds, Three million one hundred and Fifty thousand united
states dollars ($3,150,000.00) for a charity purpose in your country as
soon as you receive these funds. It will be my greatest joy to conclude
this project with you before I die. Further details shall be provided to
you upon your response to my proposal.
Your positive response shall be appreciated. Contact my private email
address below for more details on (mariarodrigues33yt@gmail.com).
Your sister,
Mrs. Maria Rodrigues
--000000000000a50af30623f8e866
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--000000000000a50af30623f8e866--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 08 Oct 2024 09:40:00 -0600
Received: from mail-il1-f173.google.com ([209.85.166.173]:49268)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98 (FreeBSD))
(envelope-from
id 1syCIh-00000000BNg-0XYd
for dave@doctor.nl2k.ab.ca;
Tue, 08 Oct 2024 09:39:08 -0600
Received: by mail-il1-f173.google.com with SMTP id e9e14a558f8ab-3a3636ddad6so20483315ab.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1728401823; x=1729006623; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=04Mk9QZq7WK9CpwwgUOptYa6v9VVQnk+nOVMrKQfyD8=;
b=F9CArlX+/gaZEnmAR1dlNLhqmKWKYJVxz4xNlSlwq7T5VG9eFK1INVBs4UUUwfCUjg
f/fgtIK3d7bQevlrBM2Qf6cd1AAMth8waM/H9AuWqucZPvXYfxwYvbWryzgpEr7c0sGk
tvgtoZU88Yj5glFhpvwgPZ0aJRrU7QDR5Z0FnNT2Y3XalcKoa6QcuFM0sHH7XdbOtfVR
adSFPDxcDoIMoleh8vuTsk0fVWTbXM4A4JLqRPMMD4G/QydJ9ckNNCUXllh9sdgz39Qn
7Mt82K/pjEg2vqRwtzMQIL8Q0zquu9MKB9qXBQUSP2CmMp4o8TW3+4jKtnKI52ICec2n
QgpQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1728401823; x=1729006623;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=04Mk9QZq7WK9CpwwgUOptYa6v9VVQnk+nOVMrKQfyD8=;
b=B7K5ZTdRei1TbpG9H3ROQl6U7JnbYb41mvYuu9MJR5qN2v2WZyMwY/1b4vo/oHwliB
tayK7sKJNtsLJ8UXCS+vRrFmddmsv1B48ULl2MKKmYCM8+EEbPbSqxAlH11+WqcKVJjK
mC3R1/S3lNXZWaVhnk1f/EXZy1Xf6G7LX+M8HoOHkWzNbvIllAmOWJIcHjAcSa16oFnO
qs8qUMouqrkJMHExuE5BAEjQ/cqfwY7Eq1wDyvXDlilhD38NAolU4mpUoaK+WNE3Cp+p
FDdmjngBbdoUwUnXBTOdryyJrNFpox++ztaTNTrPEz1dV9lsWNEbgIEMtGd29Ouuf+rn
uTgg==
X-Forwarded-Encrypted: i=1; AJvYcCUjMy64mynLMPwjhfFf4NMBti4+eO7Uz/p+6vhiEDk8AG2EPp4mRRvt0pZ0Sg24HyxsG9OT@doctor.nl2k.ab.ca
X-Gm-Message-State: AOJu0YyKsFiu9npo2OEtPvWf2EFpfzhzk0mo/ZnlpfyRApN5asFZJcrP
pPuyN7WiTLSDFALm+4d0uzzs8GqJ3Qw82hdl7zMxO/Lff+P0nBsQCjdvZ1Y5ZMJnV2PgAaYnpCq
Zl0eY+tIJGHcbpWvDiz4WX6w6HPI=
X-Google-Smtp-Source: AGHT+IF1o7rJ6pmpCOd54+Y4zxzdEmH3iN6Gl+iqF7MLJUsWTKR85ZJ7VCY+4mrWIj3pM7o01OKecU/tgmaLL2yd6CE=
X-Received: by 2002:a05:6e02:1fc8:b0:3a0:aa15:3497 with SMTP id
e9e14a558f8ab-3a375976e55mr150239215ab.1.1728401822251; Tue, 08 Oct 2024
08:37:02 -0700 (PDT)
MIME-Version: 1.0
Reply-To: mariarodrigues33yt@gmail.com
From: "Mrs.Maria Rodrigues"
Date: Tue, 8 Oct 2024 15:36:49 +0000
Message-ID:
Subject:
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000a50af30623f8e866"
Bcc: dave@doctor.nl2k.ab.ca
X-Spam_score: 20.2
X-Spam_score_int: 202
X-Spam_bar: ++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings beloved, I know this message might meet you in utmost
surprise. However, it's just my urgent need for a foreign partner. I would
like to know if this proposal will be worthwhile for your acceptance. I need
you [...]
Content analysis details: (20.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.166.173 listed in will-spam-for-food.eu.org]
[209.85.166.173 listed in will-spam-for-food.eu.org]
[209.85.166.173 listed in will-spam-for-food.eu.org]
[209.85.166.173 listed in will-spam-for-food.eu.org]
[209.85.166.173 listed in will-spam-for-food.eu.org]
[209.85.166.173 listed in will-spam-for-food.eu.org]
[209.85.166.173 listed in will-spam-for-food.eu.org]
[209.85.166.173 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.166.173 listed in dnsbl.ahbl.org]
[209.85.166.173 listed in dnsbl.ahbl.org]
[209.85.166.173 listed in dnsbl.ahbl.org]
[209.85.166.173 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.166.173 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.166.173 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.166.173 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.166.173 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.166.173 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.166.173 listed in wl.mailspike.net]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[loglokokou(at)gmail.com]
0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
2.5 MILLION_USD BODY: Talks about millions of dollars
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
1.5 HK_NAME_FM_MR_MRS No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.5 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 XFER_LOTSA_MONEY Transfer a lot of money
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.6 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
Subject: {SPAM?}
--000000000000a50af30623f8e866
Content-Type: text/plain; charset="UTF-8"
Greetings beloved,
I know this message might meet you in utmost surprise. However, it's just
my urgent need for a foreign partner. I would like to know if this proposal
will be worthwhile for your acceptance. I need your honest assistance to
actualize my humanitarian project. Sadly, I am critically down with
terminal sickness and on the verge of death. I want you to utilize my
inheritance funds, Three million one hundred and Fifty thousand united
states dollars ($3,150,000.00) for a charity purpose in your country as
soon as you receive these funds. It will be my greatest joy to conclude
this project with you before I die. Further details shall be provided to
you upon your response to my proposal.
Your positive response shall be appreciated. Contact my private email
address below for more details on (mariarodrigues33yt@gmail.com).
Your sister,
Mrs. Maria Rodrigues
--000000000000a50af30623f8e866
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Greetings beloved,
I know this message might meet y=
ou in utmost surprise. However, it's just my urgent need for a foreign =
partner. I would like to know if this proposal will be worthwhile for your =
acceptance. I need your honest assistance to actualize my humanitarian proj=
ect. Sadly, I am critically down with terminal sickness and on the verge of=
death. I want you to utilize my inheritance funds, Three million one hundr=
ed and Fifty thousand united states dollars ($3,150,000.00) for a charity p=
urpose in your country as soon as you receive these funds. It will be my gr=
eatest joy to conclude this project with you before I die. Further details =
shall be provided to you upon your response to my proposal.
Your pos=
itive response shall be appreciated. Contact my private email address below=
for more details on (maria=
rodrigues33yt@gmail.com).
=C2=A0Your sister,
Mrs. Maria R=
odrigues
I know this message might meet y=
ou in utmost surprise. However, it's just my urgent need for a foreign =
partner. I would like to know if this proposal will be worthwhile for your =
acceptance. I need your honest assistance to actualize my humanitarian proj=
ect. Sadly, I am critically down with terminal sickness and on the verge of=
death. I want you to utilize my inheritance funds, Three million one hundr=
ed and Fifty thousand united states dollars ($3,150,000.00) for a charity p=
urpose in your country as soon as you receive these funds. It will be my gr=
eatest joy to conclude this project with you before I die. Further details =
shall be provided to you upon your response to my proposal.
Your pos=
itive response shall be appreciated. Contact my private email address below=
for more details on (maria=
rodrigues33yt@gmail.com).
=C2=A0Your sister,
Mrs. Maria R=
odrigues
--000000000000a50af30623f8e866--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments