Nigerian spam
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 19 Aug 2026 14:19:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wwmkD-000000008ol-19Xy
for dave@doctor.nl2k.ab.ca;
Wed, 19 Aug 2026 14:18:41 -0600
Resent-From: The Doctor
Resent-Date: Wed, 19 Aug 2026 14:18:41 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from smtp152-cast-mx.amscloud.co.id ([103.234.208.152]:48924)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wwl47-00000000Dvs-0xn6
for postmaster@nl2k.ab.ca;
Wed, 19 Aug 2026 12:31:21 -0600
Received: from localhost (localhost [127.0.0.1])
by mx0.amscloud.co.id (Postfix) with ESMTP id 9B06A81138
for
X-Virus-Scanned: amavis at mx0.amscloud.co.id
Received: from mx0.amscloud.co.id ([127.0.0.1])
by localhost (mx0.amscloud.co.id [127.0.0.1]) (amavis, port 10024) with ESMTP
id UiurVeLRSxkO for
Thu, 20 Aug 2026 01:29:29 +0700 (WIB)
Received: from mail.trimitraswadaya.com (mail.trimitraswadaya.com [103.234.210.218])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256)
(No client certificate requested)
by mx0.amscloud.co.id (Postfix) with ESMTPS id 4A3A378A78
for
Received: from localhost (localhost [127.0.0.1])
by mail.trimitraswadaya.com (Postfix) with ESMTP id 8C6894B187C45
for
Received: from mail.trimitraswadaya.com ([127.0.0.1])
by localhost (mail.trimitraswadaya.com [127.0.0.1]) (amavisd-new, port 10032)
with ESMTP id HAzdT6IPyeF2 for
Thu, 20 Aug 2026 01:06:27 +0700 (WIB)
Received: from localhost (localhost [127.0.0.1])
by mail.trimitraswadaya.com (Postfix) with ESMTP id A819845FDC9FE
for
DKIM-Filter: OpenDKIM Filter v2.10.3 mail.trimitraswadaya.com A819845FDC9FE
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trimitraswadaya.com;
s=4434A248-C2D4-11EA-9DCA-C1A572C2DF1E; t=1787162580;
bh=rqsfSmDVd1jPiFCIzW7DqikTfxW0NOdXrEiIPS+QKts=;
h=From:To:MIME-Version:Date:Message-Id;
b=fmAfa8//qFclZGdjzWaCftCYnwLO364XmsDqcqmhbrLsbWl9MMh+peramq+68EKOh
wwANhmh3+p4Xx9xQNNXrQVShJv4N9mOq3cCCE4p4Dd8SK61ouxEgtr0nyzgSJA4s1g
Yf79qkO5bHHhphtUE5NHjkZLLvf1dH5uigXotVFtA90FuQhgtYw4r7F3R+zpOGEmci
uPmxB2WtwPbxM44D7RA/IMO5NxRTTDiXPglJcpsVzb+B9sTNsRLQdzKN3wPDCdxdoM
E5dy4kguRLLEZWR+iVpr3mxMn6GgX/BMDbUhpkVIeJ64A57V2xVLsfSi/QhPuY8o1v
TdBCOnYBqc4Og==
X-Virus-Scanned: amavisd-new at mail.trimitraswadaya.com
Received: from mail.trimitraswadaya.com ([127.0.0.1])
by localhost (mail.trimitraswadaya.com [127.0.0.1]) (amavisd-new, port 10026)
with ESMTP id 2xx97N5zCm0g for
Thu, 20 Aug 2026 01:03:00 +0700 (WIB)
Received: from Dell (unknown [197.185.180.236])
by mail.trimitraswadaya.com (Postfix) with ESMTPSA id 84AE64B0299C3
for
From: "Mr. Alex Kortig"
Subject: HI: Is your email still active?
To:
Content-Type: multipart/alternative; boundary="fJrp111XHP8TVoTCbRXB9=_3RthZxt3B5w"
MIME-Version: 1.0
Reply-To:
Date: Wed, 19 Aug 2026 17:01:47 -0300
Message-Id: <20261908170146A1E8DD19D4-84E8D5D28E@trimitraswadaya.com>
X-Spam_score: 9.8
X-Spam_score_int: 98
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: My Name is Alex Kortig I am writing to discuss a confidential
and important matter concerning unclaimed inheritance funds that are reportedly
associated with your name. Kindly respond to my private email address at
Content analysis details: (9.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[103.234.208.152 listed in dnsbl.ahbl.org]
[103.234.208.152 listed in dnsbl.ahbl.org]
[103.234.208.152 listed in dnsbl.ahbl.org]
[103.234.208.152 listed in dnsbl.ahbl.org]
[103.234.210.218 listed in dnsbl.ahbl.org]
[103.234.210.218 listed in dnsbl.ahbl.org]
[103.234.210.218 listed in dnsbl.ahbl.org]
[103.234.210.218 listed in dnsbl.ahbl.org]
[197.185.180.236 listed in dnsbl.ahbl.org]
[197.185.180.236 listed in dnsbl.ahbl.org]
[197.185.180.236 listed in dnsbl.ahbl.org]
[197.185.180.236 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[103.234.208.152 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[103.234.208.152 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[103.234.208.152 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[103.234.208.152 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[197.185.180.236 listed in sbl-xbl.spamhaus.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[103.234.208.152 listed in bl.score.senderscore.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[alexkortig648(at)gmail.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 NO_RDNS2 Sending MTA has no reverse DNS
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 HK_NAME_MR_MRS No description available.
2.0 MIXED_HREF_CASE Has href in mixed case
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
Subject: {SPAM?} HI: Is your email still active?
This is a multi-part message in MIME format
--fJrp111XHP8TVoTCbRXB9=_3RthZxt3B5w
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
My Name is Alex Kortig
I am writing to discuss a confidential and important matter concerning=
unclaimed inheritance funds that are reportedly associated with your =
name.
Kindly respond to my private email address at=20
alexkortig648@gmail.com mailto:alexkortig648@gmail.com
at your earliest convenience so that I may provide you with the releva=
nt details and discuss the matter further.
Thank you for your prompt attention, I look forward to hearing from yo=
u.
Yours Sincerly
Mr. Alex Kortig
--fJrp111XHP8TVoTCbRXB9=_3RthZxt3B5w
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
8859-1">
le=3D1"> <=
title>HI: Is your email still active?
My Na=
me is Alex Kortig
I am writing to discuss a confidential and imp=
ortant matter concerning unclaimed inheritance funds that are reported=
ly associated with your name.
Kindly respond to my private email=
address at alexkortig648@g=
mail.com at your earliest convenience so that I may provide you wi=
th the relevant details and discuss the matter further.
Thank you f=
or your prompt attention, I look forward to hearing from you.
Yo=
urs Sincerly
Mr. Alex Kortig
--fJrp111XHP8TVoTCbRXB9=_3RthZxt3B5w--