Nigerian investment phish from Thailand
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 23 Jul 2026 12:46:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wmyPz-00000000GV3-34YX
for dave@doctor.nl2k.ab.ca;
Thu, 23 Jul 2026 12:45:15 -0600
Resent-From: The Doctor
Resent-Date: Thu, 23 Jul 2026 12:45:15 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from ns1.suksangroup.com ([103.13.31.55]:60544)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wmxy2-00000000E0K-2NRK
for sales@nk.ca;
Thu, 23 Jul 2026 12:16:33 -0600
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=suksangroup.co.th; s=default; h=Content-Transfer-Encoding:Content-Type:
MIME-Version:Message-ID:Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=iFpLixXuK86AMKxGQL1HQ5PbJ1YZwy4FghoV6vZyNOI=; b=t2eDCsBYN2GIRKBLYu+xl/YT0B
dvJy/OUCGMbLZscuW7xH66hSPQ/OsWt38APHPCstLPN3nMdaLfdPJ5WedcJX4ArgNd8AWNjlmc5n3
GYWYBNcGFH5a67zp4xyi5nmiqt22/ZEoSVdrjZC9Ul/DAaMvpmP0gaPISz5y4IybpMwCnMjIFmkXR
oPU6hicDfAXjeOZLMAMd3uNSNoWs9G5ZtL4qIHTQZNhgjZyj+ESKAmqxOeSLmLaFLfAYisHReAWTX
sWrQ+5y7sokW1R9WpreQK+HAGp2Yg4FY7uTrSMr4BATR4QV7nneNDwaMPUHLWRgZjpCZOHLze36OT
dd+hdWyw==;
Received: from [87.192.104.194] (port=36213)
by ns1.suksangroup.com with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.4)
(envelope-from)
id 1wmxxC-0000000G97T-15jB
for sales@nk.ca;
Fri, 24 Jul 2026 01:15:30 +0700
Reply-To: hanns.schofield@lexcapitalgrowth.com
From: Andrews Harry Schofied/
To: sales@nk.ca
Subject: Dear sales, ROI
Date: 23 Jul 2026 19:15:28 +0100
Message-ID: <20260723191528.A94AB322ED65090D@vetanymall.com>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - ns1.suksangroup.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - vetanymall.com
X-Get-Message-Sender-Via: ns1.suksangroup.com: authenticated_id: smtp@suksangroup.co.th
X-Authenticated-Sender: ns1.suksangroup.com: smtp@suksangroup.co.th
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 10.7
X-Spam_score_int: 107
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear sales I represent a consortium of high-net-worth investors
and policymakers with access to over US$5 billion (Five Billion United States
Dollars) in investment capital.
Content analysis details: (10.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[103.13.31.55 listed in dnsbl.ahbl.org]
[103.13.31.55 listed in dnsbl.ahbl.org]
[103.13.31.55 listed in dnsbl.ahbl.org]
[103.13.31.55 listed in dnsbl.ahbl.org]
[87.192.104.194 listed in dnsbl.ahbl.org]
[87.192.104.194 listed in dnsbl.ahbl.org]
[87.192.104.194 listed in dnsbl.ahbl.org]
[87.192.104.194 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[103.13.31.55 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[103.13.31.55 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[103.13.31.55 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[103.13.31.55 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[87.192.104.194 listed in will-spam-for-food.eu.org]
[87.192.104.194 listed in will-spam-for-food.eu.org]
[87.192.104.194 listed in will-spam-for-food.eu.org]
[87.192.104.194 listed in will-spam-for-food.eu.org]
[87.192.104.194 listed in will-spam-for-food.eu.org]
[87.192.104.194 listed in will-spam-for-food.eu.org]
[87.192.104.194 listed in will-spam-for-food.eu.org]
[87.192.104.194 listed in will-spam-for-food.eu.org]
[103.13.31.55 listed in will-spam-for-food.eu.org]
[103.13.31.55 listed in will-spam-for-food.eu.org]
[103.13.31.55 listed in will-spam-for-food.eu.org]
[103.13.31.55 listed in will-spam-for-food.eu.org]
[103.13.31.55 listed in will-spam-for-food.eu.org]
[103.13.31.55 listed in will-spam-for-food.eu.org]
[103.13.31.55 listed in will-spam-for-food.eu.org]
[103.13.31.55 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[87.192.104.194 listed in sbl-xbl.spamhaus.org]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[103.13.31.55 listed in bb.barracudacentral.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[103.13.31.55 listed in bl.score.senderscore.com]
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
Subject: {SPAM?} Dear sales, ROI
-html oneComWebmail-mail">
ace: pre-wrap;">Dear sales
e-space: pre-wrap;">I represent a consortium of high-net-worth investors an=
d policymakers with access to over US$5 billion (Five Billion United=
States Dollars) in investment capital.
style=3D"white-space: pre-wrap;">We are actively seeking opportunities to e=
xpand and relocate our business interests internationally across various se=
ctors, including:
pre-wrap;">If you have a solid background, proven expertise, and a well dev=
eloped business idea capable of delivering strong returns in any of the abo=
ve sectors or in any other profitable and legitimate business venture=
in your country I would like to explore a potential collaboration.
p>
e=3D"white-space: pre-wrap;">I am confident this proposal will be of intere=
st to you. I am available at your earliest convenience to discuss the detai=
ls and answer any questions you may have. Upon receipt of your positive res=
ponse, I will promptly forward comprehensive information regarding this inv=
estment opportunity.
e: pre-wrap;">I look forward to your prompt reply and the possibility of es=
tablishing a mutually beneficial partnership.
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 23 Jul 2026 12:46:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wmyPz-00000000GV3-34YX
for dave@doctor.nl2k.ab.ca;
Thu, 23 Jul 2026 12:45:15 -0600
Resent-From: The Doctor
Resent-Date: Thu, 23 Jul 2026 12:45:15 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from ns1.suksangroup.com ([103.13.31.55]:60544)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wmxy2-00000000E0K-2NRK
for sales@nk.ca;
Thu, 23 Jul 2026 12:16:33 -0600
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=suksangroup.co.th; s=default; h=Content-Transfer-Encoding:Content-Type:
MIME-Version:Message-ID:Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=iFpLixXuK86AMKxGQL1HQ5PbJ1YZwy4FghoV6vZyNOI=; b=t2eDCsBYN2GIRKBLYu+xl/YT0B
dvJy/OUCGMbLZscuW7xH66hSPQ/OsWt38APHPCstLPN3nMdaLfdPJ5WedcJX4ArgNd8AWNjlmc5n3
GYWYBNcGFH5a67zp4xyi5nmiqt22/ZEoSVdrjZC9Ul/DAaMvpmP0gaPISz5y4IybpMwCnMjIFmkXR
oPU6hicDfAXjeOZLMAMd3uNSNoWs9G5ZtL4qIHTQZNhgjZyj+ESKAmqxOeSLmLaFLfAYisHReAWTX
sWrQ+5y7sokW1R9WpreQK+HAGp2Yg4FY7uTrSMr4BATR4QV7nneNDwaMPUHLWRgZjpCZOHLze36OT
dd+hdWyw==;
Received: from [87.192.104.194] (port=36213)
by ns1.suksangroup.com with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.4)
(envelope-from
id 1wmxxC-0000000G97T-15jB
for sales@nk.ca;
Fri, 24 Jul 2026 01:15:30 +0700
Reply-To: hanns.schofield@lexcapitalgrowth.com
From: Andrews Harry Schofied/
To: sales@nk.ca
Subject: Dear sales, ROI
Date: 23 Jul 2026 19:15:28 +0100
Message-ID: <20260723191528.A94AB322ED65090D@vetanymall.com>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - ns1.suksangroup.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - vetanymall.com
X-Get-Message-Sender-Via: ns1.suksangroup.com: authenticated_id: smtp@suksangroup.co.th
X-Authenticated-Sender: ns1.suksangroup.com: smtp@suksangroup.co.th
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 10.7
X-Spam_score_int: 107
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear sales I represent a consortium of high-net-worth investors
and policymakers with access to over US$5 billion (Five Billion United States
Dollars) in investment capital.
Content analysis details: (10.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[103.13.31.55 listed in dnsbl.ahbl.org]
[103.13.31.55 listed in dnsbl.ahbl.org]
[103.13.31.55 listed in dnsbl.ahbl.org]
[103.13.31.55 listed in dnsbl.ahbl.org]
[87.192.104.194 listed in dnsbl.ahbl.org]
[87.192.104.194 listed in dnsbl.ahbl.org]
[87.192.104.194 listed in dnsbl.ahbl.org]
[87.192.104.194 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[103.13.31.55 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[103.13.31.55 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[103.13.31.55 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[103.13.31.55 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[87.192.104.194 listed in will-spam-for-food.eu.org]
[87.192.104.194 listed in will-spam-for-food.eu.org]
[87.192.104.194 listed in will-spam-for-food.eu.org]
[87.192.104.194 listed in will-spam-for-food.eu.org]
[87.192.104.194 listed in will-spam-for-food.eu.org]
[87.192.104.194 listed in will-spam-for-food.eu.org]
[87.192.104.194 listed in will-spam-for-food.eu.org]
[87.192.104.194 listed in will-spam-for-food.eu.org]
[103.13.31.55 listed in will-spam-for-food.eu.org]
[103.13.31.55 listed in will-spam-for-food.eu.org]
[103.13.31.55 listed in will-spam-for-food.eu.org]
[103.13.31.55 listed in will-spam-for-food.eu.org]
[103.13.31.55 listed in will-spam-for-food.eu.org]
[103.13.31.55 listed in will-spam-for-food.eu.org]
[103.13.31.55 listed in will-spam-for-food.eu.org]
[103.13.31.55 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[87.192.104.194 listed in sbl-xbl.spamhaus.org]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[103.13.31.55 listed in bb.barracudacentral.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[103.13.31.55 listed in bl.score.senderscore.com]
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
Subject: {SPAM?} Dear sales, ROI
-html oneComWebmail-mail">
ace: pre-wrap;">Dear sales
e-space: pre-wrap;">I represent a consortium of high-net-worth investors an=
d policymakers with access to over US$5 billion (Five Billion United=
States Dollars) in investment capital.
style=3D"white-space: pre-wrap;">We are actively seeking opportunities to e=
xpand and relocate our business interests internationally across various se=
ctors, including:
pre-wrap;">If you have a solid background, proven expertise, and a well dev=
eloped business idea capable of delivering strong returns in any of the abo=
ve sectors or in any other profitable and legitimate business venture=
in your country I would like to explore a potential collaboration.
p>
We are p=
repared to provide full funding and operational support for viable projects=
that can generate a minimum of 10% annual return on investment (AROI)
b>. We are open to Joint Venture partnerships as well as structured =
loan financing arrangements.
e=3D"white-space: pre-wrap;">I am confident this proposal will be of intere=
st to you. I am available at your earliest convenience to discuss the detai=
ls and answer any questions you may have. Upon receipt of your positive res=
ponse, I will promptly forward comprehensive information regarding this inv=
estment opportunity.
e: pre-wrap;">I look forward to your prompt reply and the possibility of es=
tablishing a mutually beneficial partnership.
Andrews Harry S=
chofied
chofied