Nigerian spam from Mailgun
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 15 Feb 2026 14:18:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vrjUc-000000001mO-07Sb
for dave@doctor.nl2k.ab.ca;
Sun, 15 Feb 2026 14:17:26 -0700
Resent-From: The Doctor
Resent-Date: Sun, 15 Feb 2026 14:17:25 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from v512.v51e342bd.use4.send.mailgun.net ([69.72.42.12]:51716)
by doctor.nl2k.ab.ca with utf8esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vrjF1-000000006tt-3pjQ
for root@nl2k.ab.ca;
Sun, 15 Feb 2026 14:01:29 -0700
DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=mg.opsguardiq.com; q=dns/txt; s=mailo; t=1771189220; x=1771196420;
h=Content-Type: Mime-Version: Message-ID: List-Unsubscribe: Date: Subject: Subject: To: To: Reply-To: From: From: Sender: Sender;
bh=hUpAvWOLchBgNm8c0qF/dMbMh56nFegP6WqmUidMv9E=;
b=Zer0pxOdzj08gj/r8hL4aeDIZ+RCuCABKMJuTfuSKlf0MeOj77DN/ipjlPATzgMvpshHunTotuUwv9mjLTg1CDfyCtnGpFWnQ5oT9TqfF4a33hdQSzM5YUu8gd+f+xO8sAO5KQGKg1obwt0sS0PgUJWaKePnQ91ALbs3e5xftcDDpcAJVLBz3/h+w/1FjKXFUcnNtAp57AOeTJq1dlAZwZ31V8jPbhlzM908gwwYWrSUUCI3JtcqtfgckDnDsfOJ+EvqOor5NgoaWYijoLF3+jN6h8DR5Y+JxymVyP4qWlO23NA7r15gXDrEfeWMmrkFIom6rmtyEl2Onm0xCvc4kw==
X-Mailgun-Sid: WyI0NjUzNyIsInJvb3RAbmwyay5hYi5jYSIsImNhOTFiNSJd
Received: from mail.opsguardiq.com (static.59.109.161.5.clients.your-server.de
[5.161.109.59]) by
fdef9915b78e139534200e195c2c4f6cc6ab6f628356f72396c1c64224a07b14 with SMTP id
699233e45561252d4950da1e (version=TLS1.3, cipher=TLS_AES_128_GCM_SHA256);
Sun, 15 Feb 2026 21:00:20 GMT
X-Mailgun-Sending-Ip: 69.72.42.12
Sender: alxx199946685=inbox.opsguardiq.com@mg.opsguardiq.com
Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id B87C69F5A8
for; Sun, 15 Feb 2026 16:00:19 -0500 (EST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=inbox.opsguardiq.com;
s=dkim; t=1771189219;
h=from:reply-to:subject:date:message-id:to:mime-version:content-type:
list-unsubscribe; bh=hUpAvWOLchBgNm8c0qF/dMbMh56nFegP6WqmUidMv9E=;
b=TOnBM/MuFNZuBwYLeDmjDiAy0e8MbAWyxLndMTH4c6Lb53s0kucy85Ip2Jyp8GQa5ek5KR
Lnh/ozP373D3k5pTgY9r6b2r3j7fdiG14WUtC1OyD4M0RmVRJpIEwcz/s1jHNg63mc+aap
x4puoqDTgwPXTGi/GQQ9+x8i3MvKM41PbdVdFmZYxId00Py1MLZcec3qPQLQvv5LYn3j+s
5A/bm/cmtj/wvREgey7Roxyjd2OVeyoxr66UOLPtn8i/ihlJt0pyFZHYf5Nbl3EuQAlrMa
Sq4rDt1g+uH8I3+aeGGGKi/h7Biq3hzHk7rAgwEikUx/A3u3fAAnb8UYMkP8gw==
From: =?utf-8?B?QUs=?=
Reply-To: businessbroker1010@gmail.com
To: root@nl2k.ab.ca
Subject: =?utf-8?B?QnVzaW5lc3MgT3Bwb3J0dW5pdHkgZm9yOiByb290QG5sMmsuYWIuY2E=?=
Date: Sun, 15 Feb 2026 22:00:21 +0100
List-Unsubscribe:
X-Priority: 3
Message-ID: <1C04A0970A7F4F49977C26CF6354FF00@inbox.opsguardiq.com>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="F21D9AC10B794908969CAA021B80F56B"
X-Last-TLS-Session-Version: TLSv1.3
X-Spam_score: 16.8
X-Spam_score_int: 168
X-Spam_bar: ++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings. I am looking to engage you in profit oriented
ventures, I have the directive of SHK Mubarak from Qatar to look for a foreigner
that is capable of managing 200,000,000 U.S.D held abroad. If you are interested,
kindly get back to me for further discussion.
Content analysis details: (16.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[69.72.42.12 listed in dnsbl.ahbl.org]
[69.72.42.12 listed in dnsbl.ahbl.org]
[69.72.42.12 listed in dnsbl.ahbl.org]
[69.72.42.12 listed in dnsbl.ahbl.org]
[5.161.109.59 listed in dnsbl.ahbl.org]
[5.161.109.59 listed in dnsbl.ahbl.org]
[5.161.109.59 listed in dnsbl.ahbl.org]
[5.161.109.59 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[69.72.42.12 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[69.72.42.12 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[69.72.42.12 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[69.72.42.12 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[5.161.109.59 listed in will-spam-for-food.eu.org]
[5.161.109.59 listed in will-spam-for-food.eu.org]
[5.161.109.59 listed in will-spam-for-food.eu.org]
[5.161.109.59 listed in will-spam-for-food.eu.org]
[5.161.109.59 listed in will-spam-for-food.eu.org]
[5.161.109.59 listed in will-spam-for-food.eu.org]
[5.161.109.59 listed in will-spam-for-food.eu.org]
[5.161.109.59 listed in will-spam-for-food.eu.org]
[69.72.42.12 listed in will-spam-for-food.eu.org]
[69.72.42.12 listed in will-spam-for-food.eu.org]
[69.72.42.12 listed in will-spam-for-food.eu.org]
[69.72.42.12 listed in will-spam-for-food.eu.org]
[69.72.42.12 listed in will-spam-for-food.eu.org]
[69.72.42.12 listed in will-spam-for-food.eu.org]
[69.72.42.12 listed in will-spam-for-food.eu.org]
[69.72.42.12 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[69.72.42.12 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
4.0 GR_DOMAIN_YOUSER1 Received contains spam friendly ISP (youser)
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[69.72.42.12 listed in wl.mailspike.net]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[businessbroker1010(at)gmail.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.0 XPRIO Has X-Priority header
0.1 TO_IN_SUBJ To address is in Subject
1.8 COMBO_IMAGEONLY1 Appears to be an image only message
Subject: {SPAM?} =?utf-8?B?QnVzaW5lc3MgT3Bwb3J0dW5pdHkgZm9yOiByb290QG5sMmsuYWIuY2E=?=
--F21D9AC10B794908969CAA021B80F56B
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
=0D=0A
quiv=3DContent-type>=0D=0A=0D=0A=0D=0A
=3D"MSHTML=2011.00.9600.21615">=0D=0A=0D=0A =0D=0A =0D=0A
=0D=0A
=0D=0A=0D=0A=0D=0A
--F21D9AC10B794908969CAA021B80F56B--
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 15 Feb 2026 14:18:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vrjUc-000000001mO-07Sb
for dave@doctor.nl2k.ab.ca;
Sun, 15 Feb 2026 14:17:26 -0700
Resent-From: The Doctor
Resent-Date: Sun, 15 Feb 2026 14:17:25 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from v512.v51e342bd.use4.send.mailgun.net ([69.72.42.12]:51716)
by doctor.nl2k.ab.ca with utf8esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vrjF1-000000006tt-3pjQ
for root@nl2k.ab.ca;
Sun, 15 Feb 2026 14:01:29 -0700
DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=mg.opsguardiq.com; q=dns/txt; s=mailo; t=1771189220; x=1771196420;
h=Content-Type: Mime-Version: Message-ID: List-Unsubscribe: Date: Subject: Subject: To: To: Reply-To: From: From: Sender: Sender;
bh=hUpAvWOLchBgNm8c0qF/dMbMh56nFegP6WqmUidMv9E=;
b=Zer0pxOdzj08gj/r8hL4aeDIZ+RCuCABKMJuTfuSKlf0MeOj77DN/ipjlPATzgMvpshHunTotuUwv9mjLTg1CDfyCtnGpFWnQ5oT9TqfF4a33hdQSzM5YUu8gd+f+xO8sAO5KQGKg1obwt0sS0PgUJWaKePnQ91ALbs3e5xftcDDpcAJVLBz3/h+w/1FjKXFUcnNtAp57AOeTJq1dlAZwZ31V8jPbhlzM908gwwYWrSUUCI3JtcqtfgckDnDsfOJ+EvqOor5NgoaWYijoLF3+jN6h8DR5Y+JxymVyP4qWlO23NA7r15gXDrEfeWMmrkFIom6rmtyEl2Onm0xCvc4kw==
X-Mailgun-Sid: WyI0NjUzNyIsInJvb3RAbmwyay5hYi5jYSIsImNhOTFiNSJd
Received: from mail.opsguardiq.com (static.59.109.161.5.clients.your-server.de
[5.161.109.59]) by
fdef9915b78e139534200e195c2c4f6cc6ab6f628356f72396c1c64224a07b14 with SMTP id
699233e45561252d4950da1e (version=TLS1.3, cipher=TLS_AES_128_GCM_SHA256);
Sun, 15 Feb 2026 21:00:20 GMT
X-Mailgun-Sending-Ip: 69.72.42.12
Sender: alxx199946685=inbox.opsguardiq.com@mg.opsguardiq.com
Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id B87C69F5A8
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=inbox.opsguardiq.com;
s=dkim; t=1771189219;
h=from:reply-to:subject:date:message-id:to:mime-version:content-type:
list-unsubscribe; bh=hUpAvWOLchBgNm8c0qF/dMbMh56nFegP6WqmUidMv9E=;
b=TOnBM/MuFNZuBwYLeDmjDiAy0e8MbAWyxLndMTH4c6Lb53s0kucy85Ip2Jyp8GQa5ek5KR
Lnh/ozP373D3k5pTgY9r6b2r3j7fdiG14WUtC1OyD4M0RmVRJpIEwcz/s1jHNg63mc+aap
x4puoqDTgwPXTGi/GQQ9+x8i3MvKM41PbdVdFmZYxId00Py1MLZcec3qPQLQvv5LYn3j+s
5A/bm/cmtj/wvREgey7Roxyjd2OVeyoxr66UOLPtn8i/ihlJt0pyFZHYf5Nbl3EuQAlrMa
Sq4rDt1g+uH8I3+aeGGGKi/h7Biq3hzHk7rAgwEikUx/A3u3fAAnb8UYMkP8gw==
From: =?utf-8?B?QUs=?=
Reply-To: businessbroker1010@gmail.com
To: root@nl2k.ab.ca
Subject: =?utf-8?B?QnVzaW5lc3MgT3Bwb3J0dW5pdHkgZm9yOiByb290QG5sMmsuYWIuY2E=?=
Date: Sun, 15 Feb 2026 22:00:21 +0100
List-Unsubscribe:
X-Priority: 3
Message-ID: <1C04A0970A7F4F49977C26CF6354FF00@inbox.opsguardiq.com>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="F21D9AC10B794908969CAA021B80F56B"
X-Last-TLS-Session-Version: TLSv1.3
X-Spam_score: 16.8
X-Spam_score_int: 168
X-Spam_bar: ++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings. I am looking to engage you in profit oriented
ventures, I have the directive of SHK Mubarak from Qatar to look for a foreigner
that is capable of managing 200,000,000 U.S.D held abroad. If you are interested,
kindly get back to me for further discussion.
Content analysis details: (16.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[69.72.42.12 listed in dnsbl.ahbl.org]
[69.72.42.12 listed in dnsbl.ahbl.org]
[69.72.42.12 listed in dnsbl.ahbl.org]
[69.72.42.12 listed in dnsbl.ahbl.org]
[5.161.109.59 listed in dnsbl.ahbl.org]
[5.161.109.59 listed in dnsbl.ahbl.org]
[5.161.109.59 listed in dnsbl.ahbl.org]
[5.161.109.59 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[69.72.42.12 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[69.72.42.12 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[69.72.42.12 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[69.72.42.12 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[5.161.109.59 listed in will-spam-for-food.eu.org]
[5.161.109.59 listed in will-spam-for-food.eu.org]
[5.161.109.59 listed in will-spam-for-food.eu.org]
[5.161.109.59 listed in will-spam-for-food.eu.org]
[5.161.109.59 listed in will-spam-for-food.eu.org]
[5.161.109.59 listed in will-spam-for-food.eu.org]
[5.161.109.59 listed in will-spam-for-food.eu.org]
[5.161.109.59 listed in will-spam-for-food.eu.org]
[69.72.42.12 listed in will-spam-for-food.eu.org]
[69.72.42.12 listed in will-spam-for-food.eu.org]
[69.72.42.12 listed in will-spam-for-food.eu.org]
[69.72.42.12 listed in will-spam-for-food.eu.org]
[69.72.42.12 listed in will-spam-for-food.eu.org]
[69.72.42.12 listed in will-spam-for-food.eu.org]
[69.72.42.12 listed in will-spam-for-food.eu.org]
[69.72.42.12 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[69.72.42.12 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
4.0 GR_DOMAIN_YOUSER1 Received contains spam friendly ISP (youser)
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[69.72.42.12 listed in wl.mailspike.net]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[businessbroker1010(at)gmail.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.0 XPRIO Has X-Priority header
0.1 TO_IN_SUBJ To address is in Subject
1.8 COMBO_IMAGEONLY1 Appears to be an image only message
Subject: {SPAM?} =?utf-8?B?QnVzaW5lc3MgT3Bwb3J0dW5pdHkgZm9yOiByb290QG5sMmsuYWIuY2E=?=
--F21D9AC10B794908969CAA021B80F56B
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
=0D=0A
quiv=3DContent-type>=0D=0A=0D=0A=0D=0A
=3D"MSHTML=2011.00.9600.21615">=0D=0A=0D=0A
Greetings.
=
I=20am=20looking=20to=20engage=20you=20in=20profit=20oriented=20ventures,=20=
I=20have=20the=20directive=20of=20SHK=20Mubarak=20from=20Qatar=20to=20look=20=
for=20a=20foreigner=20that=20is=20capable=20of=20managing=20200,000,000=20U=
.S.D=20held=20abroad.
=0D=0A=
I=20am=20looking=20to=20engage=20you=20in=20profit=20oriented=20ventures,=20=
I=20have=20the=20directive=20of=20SHK=20Mubarak=20from=20Qatar=20to=20look=20=
for=20a=20foreigner=20that=20is=20capable=20of=20managing=20200,000,000=20U=
.S.D=20held=20abroad.
If=20you=20are=
=20interested,=20kindly=20get=20back=20to=20me=20for=20further=20discussion=
.
=0D=0A=20interested,=20kindly=20get=20back=20to=20me=20for=20further=20discussion=
.
Best=20regards,
AK.
=0D=0A=AK.
=0D=0A
=0D=0A=0D=0A=0D=0A
02/15/2026<=
/P>=0D=0A
=0D=0A
--F21D9AC10B794908969CAA021B80F56B--