Donation spam
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 01 Aug 2026 14:26:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wqGHM-000000008y5-3I8m
for dave@doctor.nl2k.ab.ca;
Sat, 01 Aug 2026 14:25:56 -0600
Resent-From: The Doctor
Resent-Date: Sat, 1 Aug 2026 14:25:56 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from hermes.cta.br ([161.24.235.5]:46252)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wqG1f-000000005kl-3jhk
for doctor@nl2k.ab.ca;
Sat, 01 Aug 2026 14:09:51 -0600
Received: from localhost (localhost [127.0.0.1])
by hermes.cta.br (Postfix) with ESMTP id CF06A3624AD4
for
Received: from hermes.cta.br ([127.0.0.1])
by localhost (hermes.cta.br [127.0.0.1]) (amavis, port 10032) with ESMTP
id rVKhAs6kzHS6 for
Sat, 1 Aug 2026 16:41:52 -0300 (-03)
Received: from localhost (localhost [127.0.0.1])
by hermes.cta.br (Postfix) with ESMTP id 212293638EBC
for
DKIM-Filter: OpenDKIM Filter v2.10.3 hermes.cta.br 212293638EBC
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cta.br;
s=F1C2E4D6-58B5-11EE-8A03-0892AE68C4E7; t=1785613312;
bh=umzi/9vOsWqDHnJQd4zf3JDXTHQOnolShq6yz2ocso0=;
h=From:To:MIME-Version:Date:Message-Id;
b=cNt45/8eGrEMaRT2uxmqOB5t0o6xzccYwZB9l7eYkDkonpIssR3Ogrm0eCwaLYRPX
uoxyM+IJPnKfYPded8dsBQl3Oq6ay0D/p585miYPuAlzC4ZpRYlJ4c8F64RPp4KZkZ
yCCiOfTnYR1OTXTQmpmAVxr4yZz7HOYNCJ/SqfLRfxqF47iimIwCkIEuV8TA56YecH
sMNkUODITF394O1rg1dw/PIXb6RmVjZ8qOPKSPsaBJs0KncVuNBZm0gS+1c0ZoDCdv
1KvkfB4HoNSbwBZ1EdnMCM3nywmodcPBZLYv5/2l55SwIQHdGGlXbMSiLD4bmTs+iL
urXK6V//OaMFw==
X-Virus-Scanned: amavis at cta.br
Received: from hermes.cta.br ([127.0.0.1])
by localhost (hermes.cta.br [127.0.0.1]) (amavis, port 10026) with ESMTP
id TSVghr_pnpLF for
Sat, 1 Aug 2026 16:41:52 -0300 (-03)
Received: from Dell (unknown [197.185.162.62])
by hermes.cta.br (Postfix) with ESMTPSA id 30EF53638EB8
for
From: "Mr. Andreas Von Bechtolsheim"
Subject: Donation Fund
To:
Content-Type: multipart/alternative; boundary="cJy=_AWOlN9wpuenD9Pxwtx8FNhUjtiIQV"
MIME-Version: 1.0
Reply-To:
Date: Sat, 1 Aug 2026 18:43:17 -0300
Message-Id: <20260108184316A266960858$152E13325C@cta.br>
X-Antivirus: AVG (VPS 260801-4, 8/1/2026), Outbound message
X-Antivirus-Status: Clean
X-Spam_score: 15.2
X-Spam_score_int: 152
X-Spam_bar: +++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: My name is Andreas Von Bechtolsheim, a German entrepreneur
and investor, and the co-founder of Sun Microsystems in 1982, where I served
as the chief hardware designer. Throughout my life, I have always wanted
to use my wealth to help others. I have now decided to personally donate the
sum of ?5,000,000.00 to individuals, all participants were selected through
a Comp [...]
Content analysis details: (15.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[161.24.235.5 listed in wl.mailspike.net]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[197.185.162.62 listed in sbl-xbl.spamhaus.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[197.185.162.62 listed in will-spam-for-food.eu.org]
[197.185.162.62 listed in will-spam-for-food.eu.org]
[197.185.162.62 listed in will-spam-for-food.eu.org]
[197.185.162.62 listed in will-spam-for-food.eu.org]
[197.185.162.62 listed in will-spam-for-food.eu.org]
[197.185.162.62 listed in will-spam-for-food.eu.org]
[197.185.162.62 listed in will-spam-for-food.eu.org]
[197.185.162.62 listed in will-spam-for-food.eu.org]
[161.24.235.5 listed in will-spam-for-food.eu.org]
[161.24.235.5 listed in will-spam-for-food.eu.org]
[161.24.235.5 listed in will-spam-for-food.eu.org]
[161.24.235.5 listed in will-spam-for-food.eu.org]
[161.24.235.5 listed in will-spam-for-food.eu.org]
[161.24.235.5 listed in will-spam-for-food.eu.org]
[161.24.235.5 listed in will-spam-for-food.eu.org]
[161.24.235.5 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[197.185.162.62 listed in dnsbl.ahbl.org]
[197.185.162.62 listed in dnsbl.ahbl.org]
[197.185.162.62 listed in dnsbl.ahbl.org]
[197.185.162.62 listed in dnsbl.ahbl.org]
[161.24.235.5 listed in dnsbl.ahbl.org]
[161.24.235.5 listed in dnsbl.ahbl.org]
[161.24.235.5 listed in dnsbl.ahbl.org]
[161.24.235.5 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[197.185.162.62 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[197.185.162.62 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[197.185.162.62 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[197.185.162.62 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[andreasvonbechtolsheim927(at)gmail.com]
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[161.24.235.5 listed in bl.score.senderscore.com]
0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
3.0 BIGNUM_EMAILS Lots of email addresses/leads
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.8 HK_LOTTO No description available.
0.0 HK_NAME_MR_MRS No description available.
0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)
0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.3 BIGNUM_EMAILS_FREEM Lots of email addresses/leads, free email account
0.0 T_REMOTE_IMAGE Message contains an external image
Subject: {SPAM?} Donation Fund
This is a multi-part message in MIME format
--cJy=_AWOlN9wpuenD9Pxwtx8FNhUjtiIQV
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
My name is Andreas Von Bechtolsheim, a German entrepreneur and investor, an=
d the co-founder of Sun Microsystems in 1982, where I served as the chief h=
ardware designer.
Throughout my life, I have always wanted to use my wealth to help others. I=
have now decided to personally donate the sum of ?5,000,000.00 to individu=
als, all participants were selected through a Computer Ballot system drawn =
from 25,000 Names and E-mail addresses.
THIS IS YOUR DONATION CODE: MW207143
Reply with the DONATION CODE to this email:
andreasvonbechtolsheim927@gmail.com mailto:andreasvonbechtolsheim927@gmail.=
com
?
?Sincerely,
?Andreas Von Bechtolsheim
--
This email has been checked for viruses by AVG antivirus software.
www.avg.com
--cJy=_AWOlN9wpuenD9Pxwtx8FNhUjtiIQV
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
1">
1">
tion Fund
My name is=
Andreas Von Bechtolsheim, a German entrepreneur and investor, and the co-f=
ounder of Sun Microsystems in 1982, where I served as the chief hardware de=
signer.
Throughout my life, I have always wanted to use my wealth to =
help others. I have now decided to personally donate the sum of &euro=
;5,000,000.00 to individuals, all participants were selected through =
a Computer Ballot system drawn from 25,000 Names and E-mail addresses=
=2E
THIS IS YOUR DONATION CODE: MW207143
Reply with the =
DONATION CODE to this email:
927@gmail.com">andreasvonbechtolsheim927@gmail.com
=
;Sincerely,
Andreas Von Bechtolsheim
40BB-A1B8-4E2AA1F9FDF2">
;">
avg.com/email-signature?utm_medium=3Demail&utm_source=3Dlink&utm_campaign=
=3Dsig-email&utm_content=3Demailclient" target=3D"_blank">
://s-install.avcdn.net/ipm/preview/icons/icon-envelope-tick-green-avg-v1.pn=
g" alt=3D"" width=3D"46" height=3D"29" style=3D"width: 46px; height: 29px;"=
/>
nt-size: 13px; font-family: Arial, Helvetica, sans-serif; line-height: 18px=
;">Virus-free.
ail&utm_source=3Dlink&utm_campaign=3Dsig-email&utm_content=3Demailclient" t=
arget=3D"_blank" style=3D"color: #4453ea;">www.avg.com
>
>
--cJy=_AWOlN9wpuenD9Pxwtx8FNhUjtiIQV--