Nigerian Business deal spam from OVH
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 16 Aug 2026 12:14:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from)
id 1wvfMX-00000000Dgz-2t1b
for dave@doctor.nl2k.ab.ca;
Sun, 16 Aug 2026 12:13:37 -0600
Resent-From: The Doctor
Resent-Date: Sun, 16 Aug 2026 12:13:37 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from ip56.ip-54-37-194.eu ([54.37.194.56]:56275)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from)
id 1wvds5-00000000N6u-3kRH
for sales@nk.ca;
Sun, 16 Aug 2026 10:38:16 -0600
Message-ID: <2694b5c733f7dd4c6fc0c96296177d77431fdc7e@yahoo.com>
Reply-To: "Mr. Andrey Okhay"
From: "Mr. Andrey Okhay"
To: sales
Subject: please get back to me ASAP
Date: Sun, 16 Aug 2026 09:37:12 -0700
Organization: en
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="2b81c8630dc9e6ad8e2428c336e50464b0"
X-Spam_score: 8.8
X-Spam_score_int: 88
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greeting sales, We provide investment capital for individuals
or companies to finance their business or viable projects using our alternative
finance structure without the usual rigorous and stringent conditions expe
[...]
Content analysis details: (8.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[54.37.194.56 listed in dnsbl.ahbl.org]
[54.37.194.56 listed in dnsbl.ahbl.org]
[54.37.194.56 listed in dnsbl.ahbl.org]
[54.37.194.56 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[54.37.194.56 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[54.37.194.56 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[54.37.194.56 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[54.37.194.56 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[54.37.194.56 listed in will-spam-for-food.eu.org]
[54.37.194.56 listed in will-spam-for-food.eu.org]
[54.37.194.56 listed in will-spam-for-food.eu.org]
[54.37.194.56 listed in will-spam-for-food.eu.org]
[54.37.194.56 listed in will-spam-for-food.eu.org]
[54.37.194.56 listed in will-spam-for-food.eu.org]
[54.37.194.56 listed in will-spam-for-food.eu.org]
[54.37.194.56 listed in will-spam-for-food.eu.org]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[54.37.194.56 listed in bb.barracudacentral.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[54.37.194.56 listed in bl.score.senderscore.com]
0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[andr.eyokhay(at)yahoo.com]
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
1.5 HK_NAME_FM_MR_MRS No description available.
1.0 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
0.5 REPTO_QUOTE_YAHOO Yahoo! doesn't do quoting like this
1.4 SPOOFED_FREEMAIL No description available.
Subject: {SPAM?} please get back to me ASAP
--2b81c8630dc9e6ad8e2428c336e50464b0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Greeting sales,
We provide investment capital for individuals or companies to finance the=
ir business or viable projects using our alternative finance structure wi=
thout the usual rigorous and stringent conditions experienced in banks an=
d some other lending institutions. If you're interested and equipped with=
an investment opportunity or can handle the investment of these funds, p=
lease get back to me ASAP.
please get back :- andreyokhay@hotmail.com
Sincerely,
Mr. Andrey Okhay
--2b81c8630dc9e6ad8e2428c336e50464b0
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
or=3D"#ffffff">
erif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-=
WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS=
: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-IND=
ENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -web=
kit-text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=
ration-style: initial; text-decoration-color: initial">
T-SIZE: small; FONT-FAMILY: Arial, Helvetica, sans-serif; WHITE-SPACE: no=
rmal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; FONT-WEIGHT: =
400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; DIS=
PLAY: inline !important; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(25=
5,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-varian=
t-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness=
: initial; text-decoration-style: initial; text-decoration-color: initial=
">
erif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-=
WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2=
; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT=
: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit=
-text-stroke-width: 0px; text-decoration-thickness: initial; text-decorat=
ion-style: initial; text-decoration-color: initial"> <=
/div>
-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLO=
AT: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORP=
HANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; B=
ACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatur=
es: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; te=
xt-decoration-thickness: initial; text-decoration-style: initial; text-de=
coration-color: initial">
ibri, Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT=
-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal=
; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(25=
5,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-varian=
t-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness=
: initial; text-decoration-style: initial; text-decoration-color: initial=
">We provide investment capital for individuals or companies to finance t=
heir business or viable projects using our alternative finance structure =
without the usual rigorous and stringent conditions experienced in banks =
and some other lending institutions. If you're interested and equipped wi=
th an investment opportunity or can handle the investment of these funds,=
please get back to me ASAP.
ILY: Calibri, Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0=
px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE=
: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR=
: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; fon=
t-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-t=
hickness: initial; text-decoration-style: initial; text-decoration-color:=
initial">
; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIG=
HT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2;=
LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT:=
0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-=
text-stroke-width: 0px; text-decoration-thickness: initial; text-decorati=
on-style: initial; text-decoration-color: initial">
; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIG=
HT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2;=
LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT:=
0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-=
text-stroke-width: 0px; text-decoration-thickness: initial; text-decorati=
on-style: initial; text-decoration-color: initial">
Sincerely,
M=
r. Andrey Okhay
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 16 Aug 2026 12:14:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wvfMX-00000000Dgz-2t1b
for dave@doctor.nl2k.ab.ca;
Sun, 16 Aug 2026 12:13:37 -0600
Resent-From: The Doctor
Resent-Date: Sun, 16 Aug 2026 12:13:37 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from ip56.ip-54-37-194.eu ([54.37.194.56]:56275)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wvds5-00000000N6u-3kRH
for sales@nk.ca;
Sun, 16 Aug 2026 10:38:16 -0600
Message-ID: <2694b5c733f7dd4c6fc0c96296177d77431fdc7e@yahoo.com>
Reply-To: "Mr. Andrey Okhay"
From: "Mr. Andrey Okhay"
To: sales
Subject: please get back to me ASAP
Date: Sun, 16 Aug 2026 09:37:12 -0700
Organization: en
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="2b81c8630dc9e6ad8e2428c336e50464b0"
X-Spam_score: 8.8
X-Spam_score_int: 88
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greeting sales, We provide investment capital for individuals
or companies to finance their business or viable projects using our alternative
finance structure without the usual rigorous and stringent conditions expe
[...]
Content analysis details: (8.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[54.37.194.56 listed in dnsbl.ahbl.org]
[54.37.194.56 listed in dnsbl.ahbl.org]
[54.37.194.56 listed in dnsbl.ahbl.org]
[54.37.194.56 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[54.37.194.56 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[54.37.194.56 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[54.37.194.56 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[54.37.194.56 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[54.37.194.56 listed in will-spam-for-food.eu.org]
[54.37.194.56 listed in will-spam-for-food.eu.org]
[54.37.194.56 listed in will-spam-for-food.eu.org]
[54.37.194.56 listed in will-spam-for-food.eu.org]
[54.37.194.56 listed in will-spam-for-food.eu.org]
[54.37.194.56 listed in will-spam-for-food.eu.org]
[54.37.194.56 listed in will-spam-for-food.eu.org]
[54.37.194.56 listed in will-spam-for-food.eu.org]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[54.37.194.56 listed in bb.barracudacentral.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[54.37.194.56 listed in bl.score.senderscore.com]
0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[andr.eyokhay(at)yahoo.com]
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
1.5 HK_NAME_FM_MR_MRS No description available.
1.0 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
0.5 REPTO_QUOTE_YAHOO Yahoo! doesn't do quoting like this
1.4 SPOOFED_FREEMAIL No description available.
Subject: {SPAM?} please get back to me ASAP
--2b81c8630dc9e6ad8e2428c336e50464b0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Greeting sales,
We provide investment capital for individuals or companies to finance the=
ir business or viable projects using our alternative finance structure wi=
thout the usual rigorous and stringent conditions experienced in banks an=
d some other lending institutions. If you're interested and equipped with=
an investment opportunity or can handle the investment of these funds, p=
lease get back to me ASAP.
please get back :- andreyokhay@hotmail.com
Sincerely,
Mr. Andrey Okhay
--2b81c8630dc9e6ad8e2428c336e50464b0
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
or=3D"#ffffff">
Greeting sales,
erif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-=
WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS=
: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-IND=
ENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -web=
kit-text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=
ration-style: initial; text-decoration-color: initial">
T-SIZE: small; FONT-FAMILY: Arial, Helvetica, sans-serif; WHITE-SPACE: no=
rmal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; FONT-WEIGHT: =
400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; DIS=
PLAY: inline !important; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(25=
5,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-varian=
t-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness=
: initial; text-decoration-style: initial; text-decoration-color: initial=
">
erif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-=
WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2=
; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT=
: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit=
-text-stroke-width: 0px; text-decoration-thickness: initial; text-decorat=
ion-style: initial; text-decoration-color: initial"> <=
/div>
-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLO=
AT: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORP=
HANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; B=
ACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatur=
es: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; te=
xt-decoration-thickness: initial; text-decoration-style: initial; text-de=
coration-color: initial">
ibri, Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT=
-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal=
; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(25=
5,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-varian=
t-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness=
: initial; text-decoration-style: initial; text-decoration-color: initial=
">We provide investment capital for individuals or companies to finance t=
heir business or viable projects using our alternative finance structure =
without the usual rigorous and stringent conditions experienced in banks =
and some other lending institutions. If you're interested and equipped wi=
th an investment opportunity or can handle the investment of these funds,=
please get back to me ASAP.
ILY: Calibri, Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0=
px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE=
: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR=
: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; fon=
t-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-t=
hickness: initial; text-decoration-style: initial; text-decoration-color:=
initial">
; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIG=
HT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2;=
LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT:=
0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-=
text-stroke-width: 0px; text-decoration-thickness: initial; text-decorati=
on-style: initial; text-decoration-color: initial">
; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIG=
HT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2;=
LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT:=
0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-=
text-stroke-width: 0px; text-decoration-thickness: initial; text-decorati=
on-style: initial; text-decoration-color: initial">
please get back :- andreyokhay@hotmail.com
Sincerely,
M=
r. Andrey Okhay
--2b81c8630dc9e6ad8e2428c336e50464b0--
![](3D"https://ci3.googleusercontent.com/meips/ADKq_=<br)
![](3D"https://closeio-filepicker.s3.amazonaws.com/=<br)
![](3D"https://closeio-filepicker.s3.amazonaws.com/2026-05-14%2F1RD=<br)
![](3D"https://closeio-filepicker.s3.amazonaws.com/2026-05=<br)
![](3D"https://closeio-filepicker.s3.amazonaws.com/2026-05-14%2F1=<br)