German language spam from Google Gmail
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 03 Aug 2026 10:42:00 -0600
Received: from mail-pf1-f172.google.com ([209.85.210.172]:59513)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.5 (FreeBSD))
(envelope-from)
id 1wqvjE-00000000HmT-3Vq5
for dave@doctor.nl2k.ab.ca;
Mon, 03 Aug 2026 10:41:38 -0600
Received: by mail-pf1-f172.google.com with SMTP id d2e1a72fcca58-84e04df8c46so3314333b3a.2
for; Mon, 03 Aug 2026 09:40:40 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1785775235; cv=none;
d=google.com; s=arc-20260327;
b=WuNN6VWp4fTR52Be91jTWnd5FrcwclF9ffUeI0cAdrrbmBsV+a584ZPvF+bpW78SEM
oW7dzZnAGgsH9GSrAvj1xghhb+wH3UZVG95/dGZy2oHVCHBFG17XYp33mFuSs0LBi47Y
n6H+daUSOGWR1mSM4YRXBx5FIxDIWvWB+ylUOXJK/iwTkrm2TnUjlYxcxImp5EVGrc3x
3g3qFxPYptv9tJ3W3rgAiFafk2XjwkfwcPMfTQCnuvjF5wGPjbyDvp6Y76aouJdRFLdj
LmIy6M2rbj/AviJ4pTiFladvMi10pBvDA0dqiaKzVm1gFJvXY0Ctwm9JAJ/hE3FeOi/1
ENtg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;
h=to:subject:message-id:date:from:reply-to:mime-version
:dkim-signature;
bh=rjGoZaAlABbpQ7wXO4qAJp1zblP9OoU0UgfCsC5VTUs=;
fh=6JX89cyJAGdaiqhOgmTUldhv+FDEGFMPT1BvPin2SW4=;
b=WIxRRNkKPpMSp6OY5GmylP5XjnTJ9Yy8CADMUlJvcdgMR0VnGDzdjjHJGr2qEu17R6
9YaF1hRtn6gv0fgOSb+s1FIHjhOeIJb8w5T0yhQVbe3QNstwUQD404Ik1qqVZuqTgdNU
5aeSOA+WBwucMoSuKRjc+d0rX+0zD8ufmGbzgbXkwm9eKEGrMo80SZYhmn5pHqC+xwNe
0YKXlc9Uvfa2F2FOY/WRQVbfryIRYPteU3HqRdQrUVZKH3TtIbOvjmZ0QapwkT/rZ/zd
ym64/fMG7PptS2ExObRyFmBSuoh3Cy7YK4s1xVnSJ1YYslAC9J+xd0IpZ1c8wTomIE3v
f8Bg==;
darn=doctor.nl2k.ab.ca
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20251104; t=1785775235; x=1786380035; darn=doctor.nl2k.ab.ca;
h=content-type:to:subject:message-id:date:from:reply-to:mime-version
:from:to:cc:subject:date:message-id:reply-to:content-type;
bh=rjGoZaAlABbpQ7wXO4qAJp1zblP9OoU0UgfCsC5VTUs=;
b=m79M3Y+Z6+YB018nQib8B1cmU1gWz+NxL0vRCzixdFk2wR+5rNb+SWMvGHoAFWgdAe
rTw5NU7iz3Hjc7NhOvHK1hdMR2fvoYn/D72+ZzaDON5UCB/ZysTIvt6+YBGHIygM7tTV
HGMZR1I/7ctER/BWlpYVOfzlcg/sEP8Ty7Ym54BgnXFK41luu7BZ1bTUjV9gAyr7/5y7
c/42tkk2n5rekfHGl1NuW+BEAE4LhI7oJ8FIsHBXSluGl5jp7UwCLBR3mLNforluc2Ju
EexdGbSnLZflm59nHOQIxIpe7cILifaSPVxFRTjM1ZU5FfAcu8vR5Hx4e6Q7M5QwoSCQ
CT0A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1785775235; x=1786380035;
h=content-type:to:subject:message-id:date:from:reply-to:mime-version
:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to:content-type;
bh=rjGoZaAlABbpQ7wXO4qAJp1zblP9OoU0UgfCsC5VTUs=;
b=sUs1SQLegfwiMe3TBnd4fvCP6ZmLm+nlF4urB8Zz18voN8b7XIMRD/drP+ZnZCftuw
g1mz0MNSu/UgcY7J72B6kiKTzL4zpHronKxjnw9HiN6MwBkqSrmCXE1z0L/WwonDnulq
ttxMmZaAL+FNl4xJB6+YuGYLFOm9RKZFSLHz1cCVFE9VOxjG3GiQ1eT85UIXzKNlv1Vu
0RbQ5iPSCPwUxcTLlnOJOm29Esq3NlqvF4TSK7bbWhg7WN6Qi23hDCnUUoQ2e1gYx2K3
9rd4v9BSdT2+cj5ZqCQD/6TC6HEbIYQhNga7Iq5awSxpym2XGHSoEuYQoYcUmx7eZhRc
B6RQ==
X-Forwarded-Encrypted: i=1; AHgh+Roby1Vlpnbpv1VpRlfg8orCZAHlx03kYUHRjaKQiqZd7rdx4mw80JWbehRusAQD9w1KLco8@doctor.nl2k.ab.ca
X-Gm-Message-State: AOJu0YyWk6NNvHdnJNBbTGGchc8zRcNGMle9+U2InpoeXiUiIbce4ysl
QrerdCVtbLTDnHIuPP+mg4AqdXXH/p1xNtjQWEBlBOr22n5yUG1XmYq/MmqhhseAOmDk3Zxls/L
Ewy08nZ7JsloiiMlyOwfwQkkzZAmNwQQ=
X-Gm-Gg: AR+sD10vNb1BLrx8ZpUuCRifslJktJuEwsM1M5cR0nKmwH/vjG1M7XEGeuGpBYlqSxa
10aXvz6dFYROrc4gLB6cDaNFvfQvg9TsvB69BFhoJOKV49jOAthJx9CW7luT6z3iD+WSeSm00AT
iWGXTdfFLhUnQI6bcjLRcfk8u7/XkoaDw5ZQqwQ02/SU1mdzq9nbJb4yyPKqoaZzP72UDWhBori
J9MU0JepOquR+ap0iuCBPv5LwPR3XODEJfldDgRChtF4IVILFRS9NPjiYJ3Q18k5t+ESj8jnjdq
mBLKNZUZc6eTT+3BjtBoyneaCAhzF0qVSOLrJTPfq+VOhRUvIFA3KF67VH2D3snfzcB2gK8xd86
UGF7697JYoZIhnznt0vLZooLTQYKqC2Qyg/2lxGU0Ct1TCHJD47UmkoWlaS0=
X-Received: by 2002:a05:6a20:d0b0:b0:3c0:9c1b:d0b4 with SMTP id
adf61e73a8af0-3c92a908862mr10414666637.63.1785775234775; Mon, 03 Aug 2026
09:40:34 -0700 (PDT)
MIME-Version: 1.0
Reply-To: citbanswift@outlook.com
From: David Knott
Date: Mon, 3 Aug 2026 17:40:23 +0100
X-Gm-Features: AUfX_myOI2EFE1UeFqBRwt2yIFs306zsgm5UJTbnfd5JrCnlvnu1zbEK5gAe6B4
Message-ID:
Subject: =?UTF-8?B?R3LDvMOfZQ==?=
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="00000000000084808d06582732c6"
Bcc: dave@doctor.nl2k.ab.ca
X-Spam_score: 9.9
X-Spam_score_int: 99
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Achtung: E-Mail-Inhaber Wir gratulieren Ihnen herzlich zu
Ihrem Gewinn bei unserer kürzlich abgeschlossenen nationalen Gratis-Lotterie
2025. Wir sind überzeugt, dass Sie mit Ihrem Gewinn weiterhin Google und
seine Dienste aktiv nutzen werden. Google ist die größte Suchmaschine der
Welt, und um sicherzustellen, dass dies auch so bleibt, [...]
Content analysis details: (9.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.210.172 listed in will-spam-for-food.eu.org]
[209.85.210.172 listed in will-spam-for-food.eu.org]
[209.85.210.172 listed in will-spam-for-food.eu.org]
[209.85.210.172 listed in will-spam-for-food.eu.org]
[209.85.210.172 listed in will-spam-for-food.eu.org]
[209.85.210.172 listed in will-spam-for-food.eu.org]
[209.85.210.172 listed in will-spam-for-food.eu.org]
[209.85.210.172 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.210.172 listed in dnsbl.ahbl.org]
[209.85.210.172 listed in dnsbl.ahbl.org]
[209.85.210.172 listed in dnsbl.ahbl.org]
[209.85.210.172 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.210.172 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.210.172 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.210.172 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.210.172 listed in dnsbl.ahbl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-0.0 SPF_PASS SPF: sender matches SPF record
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[danielokafor257(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[danielokafor257(at)gmail.com]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.210.172 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.210.172 listed in wl.mailspike.net]
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
0.8 HK_LOTTO No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.210.172 listed in bl.score.senderscore.com]
Subject: {SPAM?} =?UTF-8?B?R3LDvMOfZQ==?=
--00000000000084808d06582732c6
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Achtung: E-Mail-Inhaber
Wir gratulieren Ihnen herzlich zu Ihrem Gewinn bei unserer k=C3=BCrzlich
abgeschlossenen nationalen Gratis-Lotterie 2025.
Wir sind =C3=BCberzeugt, dass Sie mit Ihrem Gewinn weiterhin Google und sei=
ne
Dienste aktiv nutzen werden. Google ist die gr=C3=B6=C3=9Fte Suchmaschine d=
er Welt,
und um sicherzustellen, dass dies auch so bleibt, haben wir ein
webbasiertes E-Mail-Beta-Gewinnspiel veranstaltet, bei dem Ihre
E-Mail-Adresse drei Millionen US-Dollar (3.000.000 USD) gewonnen hat.
Wir best=C3=A4tigen Ihnen hiermit offiziell, dass Sie alle Anforderungen,
rechtlichen Verpflichtungen, Best=C3=A4tigungen, Genehmigungen und den posi=
tiven
Bericht erfolgreich bestanden haben. Der Test wurde f=C3=BCr alle
Online-Gewinner durchgef=C3=BChrt. Die Details finden Sie unten.
GEWINNZAHL: (8-27-37-40-41-43)
Datum: Mittwoch, 8. Oktober 2025
Betrag: 3 Millionen USD
G=C3=BCltig bis: Ende 2026
Wir m=C3=B6chten Sie dar=C3=BCber informieren, dass wir eine Vereinbarung z=
ur
=C3=9Cberweisung Ihres Gewinns per SWIFT-=C3=9Cberweisung auf Ihr lokales B=
ankkonto
getroffen haben. Die Gutschrift und Aktivierung erfolgt durch unsere
Rechtsabteilung (Telex).
Bitte kontaktieren Sie Ihre Bank:
{citbanswift@outlook.com}
Name: Jane Fraser
CEO
Citibank of London
Wir garantieren Ihnen besten Service.
Mit freundlichen Gr=C3=BC=C3=9Fen
Unterschrift: David Knott, CEO
National Lottery Fund
--00000000000084808d06582732c6
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
eight:115%;font-size:11pt;font-family:Calibri,"sans-serif"">
style=3D"font-size:12pt;line-height:115%;font-family:"Bookman Old Sty=
le","serif"">Achtung: E-Mail-Inhaber
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Wir gratulieren Ihnen herzlich zu Ihrem Gewinn bei
unserer k=C3=BCrzlich abgeschlossenen nationalen Gratis-Lotterie 2025.
n>
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Wir sind =C3=BCberzeugt, dass Sie mit Ihrem Gewinn
weiterhin Google und seine Dienste aktiv nutzen werden. Google ist die gr=
=C3=B6=C3=9Fte
Suchmaschine der Welt, und um sicherzustellen, dass dies auch so bleibt, ha=
ben
wir ein webbasiertes E-Mail-Beta-Gewinnspiel veranstaltet, bei dem Ihre E-M=
ail-Adresse
drei Millionen US-Dollar (3.000.000 USD) gewonnen hat.
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Wir best=C3=A4tigen Ihnen hiermit offiziell, dass Sie
alle Anforderungen, rechtlichen Verpflichtungen, Best=C3=A4tigungen, Genehm=
igungen
und den positiven Bericht erfolgreich bestanden haben. Der Test wurde f=C3=
=BCr alle
Online-Gewinner durchgef=C3=BChrt. Die Details finden Sie unten.
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">GEWINNZAHL: (8-27-37-40-41-43)
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Datum: Mittwoch, 8. Oktober 2025
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Betrag: 3 Millionen USD
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">G=C3=BCltig bis: Ende 2026
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Wir m=C3=B6chten Sie dar=C3=BCber informieren, dass wir eine
Vereinbarung zur =C3=9Cberweisung Ihres Gewinns per SWIFT-=C3=9Cberweisung =
auf Ihr
lokales Bankkonto getroffen haben. Die Gutschrift und Aktivierung erfolgt d=
urch
unsere Rechtsabteilung (Telex).
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Bitte kontaktieren Sie Ihre Bank:
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">{citbanswift@outlook.=
com}
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Name: Jane Fraser
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">CEO
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Citibank of London
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Wir garantieren Ihnen besten Service.
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Mit freundlichen Gr=C3=BC=C3=9Fen
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Unterschrift: David Knott, CEO
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">National Lottery Fund
--00000000000084808d06582732c6--
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 03 Aug 2026 10:42:00 -0600
Received: from mail-pf1-f172.google.com ([209.85.210.172]:59513)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wqvjE-00000000HmT-3Vq5
for dave@doctor.nl2k.ab.ca;
Mon, 03 Aug 2026 10:41:38 -0600
Received: by mail-pf1-f172.google.com with SMTP id d2e1a72fcca58-84e04df8c46so3314333b3a.2
for
ARC-Seal: i=1; a=rsa-sha256; t=1785775235; cv=none;
d=google.com; s=arc-20260327;
b=WuNN6VWp4fTR52Be91jTWnd5FrcwclF9ffUeI0cAdrrbmBsV+a584ZPvF+bpW78SEM
oW7dzZnAGgsH9GSrAvj1xghhb+wH3UZVG95/dGZy2oHVCHBFG17XYp33mFuSs0LBi47Y
n6H+daUSOGWR1mSM4YRXBx5FIxDIWvWB+ylUOXJK/iwTkrm2TnUjlYxcxImp5EVGrc3x
3g3qFxPYptv9tJ3W3rgAiFafk2XjwkfwcPMfTQCnuvjF5wGPjbyDvp6Y76aouJdRFLdj
LmIy6M2rbj/AviJ4pTiFladvMi10pBvDA0dqiaKzVm1gFJvXY0Ctwm9JAJ/hE3FeOi/1
ENtg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;
h=to:subject:message-id:date:from:reply-to:mime-version
:dkim-signature;
bh=rjGoZaAlABbpQ7wXO4qAJp1zblP9OoU0UgfCsC5VTUs=;
fh=6JX89cyJAGdaiqhOgmTUldhv+FDEGFMPT1BvPin2SW4=;
b=WIxRRNkKPpMSp6OY5GmylP5XjnTJ9Yy8CADMUlJvcdgMR0VnGDzdjjHJGr2qEu17R6
9YaF1hRtn6gv0fgOSb+s1FIHjhOeIJb8w5T0yhQVbe3QNstwUQD404Ik1qqVZuqTgdNU
5aeSOA+WBwucMoSuKRjc+d0rX+0zD8ufmGbzgbXkwm9eKEGrMo80SZYhmn5pHqC+xwNe
0YKXlc9Uvfa2F2FOY/WRQVbfryIRYPteU3HqRdQrUVZKH3TtIbOvjmZ0QapwkT/rZ/zd
ym64/fMG7PptS2ExObRyFmBSuoh3Cy7YK4s1xVnSJ1YYslAC9J+xd0IpZ1c8wTomIE3v
f8Bg==;
darn=doctor.nl2k.ab.ca
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20251104; t=1785775235; x=1786380035; darn=doctor.nl2k.ab.ca;
h=content-type:to:subject:message-id:date:from:reply-to:mime-version
:from:to:cc:subject:date:message-id:reply-to:content-type;
bh=rjGoZaAlABbpQ7wXO4qAJp1zblP9OoU0UgfCsC5VTUs=;
b=m79M3Y+Z6+YB018nQib8B1cmU1gWz+NxL0vRCzixdFk2wR+5rNb+SWMvGHoAFWgdAe
rTw5NU7iz3Hjc7NhOvHK1hdMR2fvoYn/D72+ZzaDON5UCB/ZysTIvt6+YBGHIygM7tTV
HGMZR1I/7ctER/BWlpYVOfzlcg/sEP8Ty7Ym54BgnXFK41luu7BZ1bTUjV9gAyr7/5y7
c/42tkk2n5rekfHGl1NuW+BEAE4LhI7oJ8FIsHBXSluGl5jp7UwCLBR3mLNforluc2Ju
EexdGbSnLZflm59nHOQIxIpe7cILifaSPVxFRTjM1ZU5FfAcu8vR5Hx4e6Q7M5QwoSCQ
CT0A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1785775235; x=1786380035;
h=content-type:to:subject:message-id:date:from:reply-to:mime-version
:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to:content-type;
bh=rjGoZaAlABbpQ7wXO4qAJp1zblP9OoU0UgfCsC5VTUs=;
b=sUs1SQLegfwiMe3TBnd4fvCP6ZmLm+nlF4urB8Zz18voN8b7XIMRD/drP+ZnZCftuw
g1mz0MNSu/UgcY7J72B6kiKTzL4zpHronKxjnw9HiN6MwBkqSrmCXE1z0L/WwonDnulq
ttxMmZaAL+FNl4xJB6+YuGYLFOm9RKZFSLHz1cCVFE9VOxjG3GiQ1eT85UIXzKNlv1Vu
0RbQ5iPSCPwUxcTLlnOJOm29Esq3NlqvF4TSK7bbWhg7WN6Qi23hDCnUUoQ2e1gYx2K3
9rd4v9BSdT2+cj5ZqCQD/6TC6HEbIYQhNga7Iq5awSxpym2XGHSoEuYQoYcUmx7eZhRc
B6RQ==
X-Forwarded-Encrypted: i=1; AHgh+Roby1Vlpnbpv1VpRlfg8orCZAHlx03kYUHRjaKQiqZd7rdx4mw80JWbehRusAQD9w1KLco8@doctor.nl2k.ab.ca
X-Gm-Message-State: AOJu0YyWk6NNvHdnJNBbTGGchc8zRcNGMle9+U2InpoeXiUiIbce4ysl
QrerdCVtbLTDnHIuPP+mg4AqdXXH/p1xNtjQWEBlBOr22n5yUG1XmYq/MmqhhseAOmDk3Zxls/L
Ewy08nZ7JsloiiMlyOwfwQkkzZAmNwQQ=
X-Gm-Gg: AR+sD10vNb1BLrx8ZpUuCRifslJktJuEwsM1M5cR0nKmwH/vjG1M7XEGeuGpBYlqSxa
10aXvz6dFYROrc4gLB6cDaNFvfQvg9TsvB69BFhoJOKV49jOAthJx9CW7luT6z3iD+WSeSm00AT
iWGXTdfFLhUnQI6bcjLRcfk8u7/XkoaDw5ZQqwQ02/SU1mdzq9nbJb4yyPKqoaZzP72UDWhBori
J9MU0JepOquR+ap0iuCBPv5LwPR3XODEJfldDgRChtF4IVILFRS9NPjiYJ3Q18k5t+ESj8jnjdq
mBLKNZUZc6eTT+3BjtBoyneaCAhzF0qVSOLrJTPfq+VOhRUvIFA3KF67VH2D3snfzcB2gK8xd86
UGF7697JYoZIhnznt0vLZooLTQYKqC2Qyg/2lxGU0Ct1TCHJD47UmkoWlaS0=
X-Received: by 2002:a05:6a20:d0b0:b0:3c0:9c1b:d0b4 with SMTP id
adf61e73a8af0-3c92a908862mr10414666637.63.1785775234775; Mon, 03 Aug 2026
09:40:34 -0700 (PDT)
MIME-Version: 1.0
Reply-To: citbanswift@outlook.com
From: David Knott
Date: Mon, 3 Aug 2026 17:40:23 +0100
X-Gm-Features: AUfX_myOI2EFE1UeFqBRwt2yIFs306zsgm5UJTbnfd5JrCnlvnu1zbEK5gAe6B4
Message-ID:
Subject: =?UTF-8?B?R3LDvMOfZQ==?=
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="00000000000084808d06582732c6"
Bcc: dave@doctor.nl2k.ab.ca
X-Spam_score: 9.9
X-Spam_score_int: 99
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Achtung: E-Mail-Inhaber Wir gratulieren Ihnen herzlich zu
Ihrem Gewinn bei unserer kürzlich abgeschlossenen nationalen Gratis-Lotterie
2025. Wir sind überzeugt, dass Sie mit Ihrem Gewinn weiterhin Google und
seine Dienste aktiv nutzen werden. Google ist die größte Suchmaschine der
Welt, und um sicherzustellen, dass dies auch so bleibt, [...]
Content analysis details: (9.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.210.172 listed in will-spam-for-food.eu.org]
[209.85.210.172 listed in will-spam-for-food.eu.org]
[209.85.210.172 listed in will-spam-for-food.eu.org]
[209.85.210.172 listed in will-spam-for-food.eu.org]
[209.85.210.172 listed in will-spam-for-food.eu.org]
[209.85.210.172 listed in will-spam-for-food.eu.org]
[209.85.210.172 listed in will-spam-for-food.eu.org]
[209.85.210.172 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.210.172 listed in dnsbl.ahbl.org]
[209.85.210.172 listed in dnsbl.ahbl.org]
[209.85.210.172 listed in dnsbl.ahbl.org]
[209.85.210.172 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.210.172 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.210.172 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.210.172 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.210.172 listed in dnsbl.ahbl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-0.0 SPF_PASS SPF: sender matches SPF record
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[danielokafor257(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[danielokafor257(at)gmail.com]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.210.172 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.210.172 listed in wl.mailspike.net]
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
0.8 HK_LOTTO No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.210.172 listed in bl.score.senderscore.com]
Subject: {SPAM?} =?UTF-8?B?R3LDvMOfZQ==?=
--00000000000084808d06582732c6
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Achtung: E-Mail-Inhaber
Wir gratulieren Ihnen herzlich zu Ihrem Gewinn bei unserer k=C3=BCrzlich
abgeschlossenen nationalen Gratis-Lotterie 2025.
Wir sind =C3=BCberzeugt, dass Sie mit Ihrem Gewinn weiterhin Google und sei=
ne
Dienste aktiv nutzen werden. Google ist die gr=C3=B6=C3=9Fte Suchmaschine d=
er Welt,
und um sicherzustellen, dass dies auch so bleibt, haben wir ein
webbasiertes E-Mail-Beta-Gewinnspiel veranstaltet, bei dem Ihre
E-Mail-Adresse drei Millionen US-Dollar (3.000.000 USD) gewonnen hat.
Wir best=C3=A4tigen Ihnen hiermit offiziell, dass Sie alle Anforderungen,
rechtlichen Verpflichtungen, Best=C3=A4tigungen, Genehmigungen und den posi=
tiven
Bericht erfolgreich bestanden haben. Der Test wurde f=C3=BCr alle
Online-Gewinner durchgef=C3=BChrt. Die Details finden Sie unten.
GEWINNZAHL: (8-27-37-40-41-43)
Datum: Mittwoch, 8. Oktober 2025
Betrag: 3 Millionen USD
G=C3=BCltig bis: Ende 2026
Wir m=C3=B6chten Sie dar=C3=BCber informieren, dass wir eine Vereinbarung z=
ur
=C3=9Cberweisung Ihres Gewinns per SWIFT-=C3=9Cberweisung auf Ihr lokales B=
ankkonto
getroffen haben. Die Gutschrift und Aktivierung erfolgt durch unsere
Rechtsabteilung (Telex).
Bitte kontaktieren Sie Ihre Bank:
{citbanswift@outlook.com}
Name: Jane Fraser
CEO
Citibank of London
Wir garantieren Ihnen besten Service.
Mit freundlichen Gr=C3=BC=C3=9Fen
Unterschrift: David Knott, CEO
National Lottery Fund
--00000000000084808d06582732c6
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
eight:115%;font-size:11pt;font-family:Calibri,"sans-serif"">
style=3D"font-size:12pt;line-height:115%;font-family:"Bookman Old Sty=
le","serif"">Achtung: E-Mail-Inhaber
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Wir gratulieren Ihnen herzlich zu Ihrem Gewinn bei
unserer k=C3=BCrzlich abgeschlossenen nationalen Gratis-Lotterie 2025.
n>
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Wir sind =C3=BCberzeugt, dass Sie mit Ihrem Gewinn
weiterhin Google und seine Dienste aktiv nutzen werden. Google ist die gr=
=C3=B6=C3=9Fte
Suchmaschine der Welt, und um sicherzustellen, dass dies auch so bleibt, ha=
ben
wir ein webbasiertes E-Mail-Beta-Gewinnspiel veranstaltet, bei dem Ihre E-M=
ail-Adresse
drei Millionen US-Dollar (3.000.000 USD) gewonnen hat.
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Wir best=C3=A4tigen Ihnen hiermit offiziell, dass Sie
alle Anforderungen, rechtlichen Verpflichtungen, Best=C3=A4tigungen, Genehm=
igungen
und den positiven Bericht erfolgreich bestanden haben. Der Test wurde f=C3=
=BCr alle
Online-Gewinner durchgef=C3=BChrt. Die Details finden Sie unten.
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">GEWINNZAHL: (8-27-37-40-41-43)
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Datum: Mittwoch, 8. Oktober 2025
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Betrag: 3 Millionen USD
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">G=C3=BCltig bis: Ende 2026
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Wir m=C3=B6chten Sie dar=C3=BCber informieren, dass wir eine
Vereinbarung zur =C3=9Cberweisung Ihres Gewinns per SWIFT-=C3=9Cberweisung =
auf Ihr
lokales Bankkonto getroffen haben. Die Gutschrift und Aktivierung erfolgt d=
urch
unsere Rechtsabteilung (Telex).
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Bitte kontaktieren Sie Ihre Bank:
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">{citbanswift@outlook.=
com}
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Name: Jane Fraser
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">CEO
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Citibank of London
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Wir garantieren Ihnen besten Service.
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Mit freundlichen Gr=C3=BC=C3=9Fen
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">Unterschrift: David Knott, CEO
ize:11pt;font-family:Calibri,"sans-serif"">
ze:12pt;line-height:115%;font-family:"Bookman Old Style","se=
rif"">National Lottery Fund
--00000000000084808d06582732c6--
