Nigerian spam
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 15 Sep 2026 07:13:13 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))
(envelope-from
id 1x6SyF-00000000BF2-2BH5
for dave@doctor.nl2k.ab.ca;
Tue, 15 Sep 2026 07:13:11 -0600
Resent-From: The Doctor
Resent-Date: Tue, 15 Sep 2026 07:13:11 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail.mtgas.gov.mz ([197.249.243.177]:50358 helo=mitrab.mtgas.gov.mz)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.100 (FreeBSD))
(envelope-from
id 1x6QWQ-00000000J1D-0Cnt
for sales@nk.ca;
Tue, 15 Sep 2026 04:36:27 -0600
X-Virus-Scanned: Debian amavisd-new at mtgas.gov.mz
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mtgas.gov.mz;
s=mail; t=1789439746;
bh=Lb2rx/aKRsanb1qx8SAbHLFXx6yvmlISUC4JpUn+eAc=;
h=Subject:To:From:Date:Reply-To:From;
b=Hqyw5oEbLXSLu8HgFJhHqSQOq5gjLpCLaHAcNfvqScBJ6ZcS6rYCafl7KRNWZDOz/
hCo9va6kWAfwoaNTlpT89lH6na0hwcvSh6sSLyowb77j/OYc0MIQc9PLxHqjuZq+QZ
5qkb85kXeJk/sh16SzcNj/sq03tFmvzOQrtTmO+nsVVj7b1RmWyH8LPR1yEZBdd50b
lrSUodYpz4Iu7Jj0LtwE+PtqPxEnaFS5MrkaUvnEiMJ3uJOequtqEMRBw1EptkYqHh
Nzc92LYUU0B5YBAo/scNEEg6ZtgT36I4p1MSEF3qcKqeqzeB0sfMURQqKjs+1Fk3+h
xBkf++xldJiyw==
Received: from [141.98.9.12] (unknown [192.168.0.62])
by mitrab.mtgas.gov.mz (Postfix) with ESMTP id 4hkR2Y5gKrzSLn5;
Tue, 15 Sep 2026 04:35:33 +0200 (CAT)
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Hello Dear,
To: Recipients
From: "Zahra Fatmeh"
Date: Mon, 14 Sep 2026 19:35:18 -0700
Reply-To: info6157@yandex.com
X-Spam_score: 7.9
X-Spam_score_int: 79
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello Dear, I am writing regarding my late husband’s estate
and a significant family asset secured in a private European vault, which
we need assistance transferring and managing. If you are willing [...]
Content analysis details: (7.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.1 MISSING_MID Missing Message-Id: header
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[197.249.243.177 listed in will-spam-for-food.eu.org]
[197.249.243.177 listed in will-spam-for-food.eu.org]
[197.249.243.177 listed in will-spam-for-food.eu.org]
[197.249.243.177 listed in will-spam-for-food.eu.org]
[197.249.243.177 listed in will-spam-for-food.eu.org]
[197.249.243.177 listed in will-spam-for-food.eu.org]
[197.249.243.177 listed in will-spam-for-food.eu.org]
[197.249.243.177 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[197.249.243.177 listed in dnsbl.ahbl.org]
[197.249.243.177 listed in dnsbl.ahbl.org]
[197.249.243.177 listed in dnsbl.ahbl.org]
[197.249.243.177 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[197.249.243.177 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[197.249.243.177 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[197.249.243.177 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[197.249.243.177 listed in dnsbl.ahbl.org]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[197.249.243.177 listed in bb.barracudacentral.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[197.249.243.177 listed in bl.score.senderscore.com]
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[info6157(at)yandex.com]
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
Subject: {SPAM?} Hello Dear,
Hello Dear,
I am writing regarding my late husband=E2=80=99s estate and a significant f=
amily asset secured in a private European vault, which we need assistance t=
ransferring and managing.
If you are willing to assist, we would be pleased to discuss the details, r=
elocation arrangements, and appropriate compensation.
Zahra Fatmeh
Email: info6157@yandex.com