NIgerian spam from Google Gmail
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 24 Sep 2026 04:27:30 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from)
id 1x9gfa-00000000DnU-3oNl
for dave@doctor.nl2k.ab.ca;
Thu, 24 Sep 2026 04:27:14 -0600
Resent-From: The Doctor
Resent-Date: Thu, 24 Sep 2026 04:27:14 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-qk2-f43.google.com ([74.125.230.235]:39751)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100.1 (FreeBSD))
(envelope-from)
id 1x9eSK-000000000FL-0pXV
for doctor@doctor.nl2k.ab.ca;
Thu, 24 Sep 2026 02:05:35 -0600
Received: by mail-qk2-f43.google.com with SMTP id d75a77b69052e-532db7db0c6so14480331cf.2
for; Thu, 24 Sep 2026 01:04:35 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1790237069; cv=none;
d=google.com; s=arc-20260327;
b=Ww9z3VhxUXiUaH/VZZWJe3pP+mRqBzNEOJJInT7CemFnAHBmqgykwKeCBGykNaGhoU
wwaDKcYtpL2DlBmV9LdbaZ76fGl9/h2HgZD86wuSgdH+LD5+mkD7WOacLwftlaJzpn5F
qG6NWlFQP19adBoSBhwwxEDe3ZNyFA8FC7q32VLZSX9rUFBndVL/f6TpxhJ8CH8dBU9V
0HUD7WzrbtPlhHwTgpgqWg7yN+Mc5xOJu5a3BnYFzsZQAR8PX5bX/18U9KMOSqv49SxR
ub+HZrYBCjVGl4rscHROzgbCujFmD3M/jmg3c/0Nx4jyP8Zaaa36mNGzg3vMZYCjMxFa
5jag==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;
h=to:subject:message-id:date:from:reply-to:mime-version
:dkim-signature;
bh=DRGOO8CthzmbPjXMzBgQVSr/d6jdkmVTVdpseUTiaAg=;
fh=CgKgmQmQOI1sZTNxDp6hCSf/fwk4O8Ffuwdc+VrtXAg=;
b=imVRcnpWBKg6aoc/kjCcCYfoRHSZP/UaE3MyA9m8tNc6qVFAKGLxxzO4GgjaYkniTt
fwZeB7x4YBPy2xYC7VEJH4QjU8By7RgMnrRE8O+6DDbmjfczOFgfB7qR0i1Y4J7kZdKz
umVy3T1Kdqif9muFi0dyzfBD3wpcop7cHiUH8oBlPk/kNdR7Z7pR3n27rMbsGpjCB7yf
VZdXfVjHDSHH/oLU0zs8oeL9zNiGMnunLqGSRO+iQylEaVuh0DRmysvwy6faZVq1hmqE
dJG4Yqb3acyjeHh8Oyt89NoGNcowGf+jdruPLRARLNcv/KlQC8ZO9RGO5s+/cL0TA10S
fJZw==;
darn=doctor.nl2k.ab.ca
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20251104; t=1790237069; x=1790841869; darn=doctor.nl2k.ab.ca;
h=content-type:to:subject:message-id:date:from:reply-to:mime-version
:from:to:cc:subject:date:message-id:reply-to:content-type;
bh=DRGOO8CthzmbPjXMzBgQVSr/d6jdkmVTVdpseUTiaAg=;
b=lPRnwe5Ft1/eC4D+MRW/uxPQ7sg1QBojWlBFC6I84FL1GPXP/6rVT2KPmi2AjKpenF
23jNvHS8soQUfqLlIGIMSfw3nKtXPrrEpvAcwpJzjZjVppWSV5Vm7kbJJgoDblizjU+E
p0AixHav5w4UK8/0UQ/ypBR+AJJBm04VMfKBq+EsnLoyNe/93qgOBdADgn8JHwTNh0Sp
Baieb1Ys2TV7By3BeDmeypjflfgAym25uEYnjM6rPmOQzbXCgMVv+eaVOYmQ+JavHK6K
KfqYqHFEBY7+0luFKMrz6u4S73BvAuky6I7Lzi3nyCcHciGuUi9unn9XlpBdUwLjMM0w
QGLA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20260707; t=1790237069; x=1790841869;
h=content-type:to:subject:message-id:date:from:reply-to:mime-version
:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to:content-type;
bh=DRGOO8CthzmbPjXMzBgQVSr/d6jdkmVTVdpseUTiaAg=;
b=gjeAU+E9QVEis9/eDyfgzs6iIY8KV3tC04hnY4elUlh6o10WaRnPqvEwvpg9fmHWYC
t9f4ySeTdGv52EPDEZAzxmRT8rlY3fb14QEd46ttSWasZq9ikxgi880vZeup8sgC5K7V
gOBSw+kJSDDOvakGcnxQvWxTU1E1hF7ZDl1w0rZqtzEzDMIRyWVgqeqNuTzPdb/Jx3Gy
75y/fSBmahJVn09riSrdv138vK8gNWGyW9M84rIGq9+cmlU8pdkMGt2/7V+TbeTQTkDK
ALoN4fSKguV8I1YG93/ShnnS8S01cP2opxa3WPw3HjQDZ7BKGLYTWhCyb7/feKKwn3JF
+UDg==
X-Forwarded-Encrypted: i=1; AKwUvBzZrlr41pmFfQRf4elshk0xTf4+aP7GD8TWHYQyMLfNRWIxebIsoRNdPrHMmWx5XDdKYlXAYBU=@doctor.nl2k.ab.ca
X-Gm-Message-State: AFuF++k+OE+ZbZ+iB5PFl/saNMVR95gwFhYFqWiEh5KR/eA8mHc7ZoiO
UvxHoTgwZ1DmcBsWhSuX4ZRrRHVtgDfxbgV0l46CA/Y4MyAUsy2SXN1/MyKxnhd2j3/MMm407Tj
RXCj+ew1lon4L7TaHTjy25OnftsiHj/o=
X-Gm-Gg: AYBFou3JmKJyRTcck6ufeL8v2lqai9092BCmWEiBVqIxwLdIcvV+UnA9qGXyc1upfWV
HsMaBYBFk59AU0X9gaKFStx9cMZti+p+VmTupMsznUtLkE5PdQVn96GiwA6ryN2o0o1OiBBrtl6
eCHXF/IoCSPd5p1dgI19TOo5bv1ybc/a+DY0ezkr3eckygLKFvKF2flIzz+P5a1oBV2dVgW33ba
BPmK6Iq1T5tkd2fcUXnKqiQ/XFk66jCkANz3aYzBqFKNOcrjwJbGvkbHNrHgMXtgZuwqolgDppu
X3TwAv05yiEZm1iFYopSlfWAf+GV/em77dcRnSzjC0Bcw8XG9GdRDpVobg==
X-Received: by 2002:a05:622a:4c18:b0:532:c82e:7481 with SMTP id
d75a77b69052e-532feb62bb1mr11619511cf.51.1790237069280; Thu, 24 Sep 2026
01:04:29 -0700 (PDT)
MIME-Version: 1.0
Reply-To: kristalina_georgieva99@outlook.com
From: Kristalina Georgieva
Date: Thu, 24 Sep 2026 01:04:17 -0700
X-Gm-Features: AclHuK8LXoOKdZL0_-c0fDQQx7eaSiP7bceqRTVflWixVavGJ1aK9BXWosN9ycs
Message-ID:
Subject: Dear Friend,
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000009409af065c360c3f"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 18.1
X-Spam_score_int: 181
X-Spam_bar: ++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: *Dear Friend,My name is Madam. Kristalina Georgieva. Managing
Director International Monetary Fund,We want to inform you that the International
Monetary Fund (IMF) have included your email address in [...]
Content analysis details: (18.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[74.125.230.235 listed in will-spam-for-food.eu.org]
[74.125.230.235 listed in will-spam-for-food.eu.org]
[74.125.230.235 listed in will-spam-for-food.eu.org]
[74.125.230.235 listed in will-spam-for-food.eu.org]
[74.125.230.235 listed in will-spam-for-food.eu.org]
[74.125.230.235 listed in will-spam-for-food.eu.org]
[74.125.230.235 listed in will-spam-for-food.eu.org]
[74.125.230.235 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[74.125.230.235 listed in dnsbl.ahbl.org]
[74.125.230.235 listed in dnsbl.ahbl.org]
[74.125.230.235 listed in dnsbl.ahbl.org]
[74.125.230.235 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[74.125.230.235 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[74.125.230.235 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[74.125.230.235 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[74.125.230.235 listed in dnsbl.ahbl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[74.125.230.235 listed in bl.score.senderscore.com]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[georgievakristalina799(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[georgievakristalina799(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[kristalina_georgieva99(at)outlook.com]
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
0.6 J_CHICKENPOX_62 BODY: 6alpha-pock-2alpha
0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[74.125.230.235 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.5 MONEY_ATM_CARD Lots of money on an ATM card
2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
2.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
Subject: {SPAM?} Dear Friend,
X-Antivirus: AVG (VPS 260923-18, 9/23/2026), Inbound message
X-Antivirus-Status: Clean
--0000000000009409af065c360c3f
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Dear Friend,My name is Madam. Kristalina Georgieva. Managing Director
International Monetary Fund,We want to inform you that the International
Monetary Fund (IMF) have included your email address in the email list that
won the sum of =E2=82=AC500.000 EURO,(FIVE HUNDRED THOUSAND EURO) for the
compensation of the Corona virus Disease (COVID-19). The payment was to be
made to you via (Automated Teller Machine) ATM.Please contact me with this
my private email address (kristalina_georgieva2026@hotmail.com
) so that I'll give you the email
contact address of our Wells Fargo customer service agent for your ATM card
.Yours in serviceMadam.Kristalina GeorgievaCOVID -19 BENEFIT FUNDS
--0000000000009409af065c360c3f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--0000000000009409af065c360c3f--
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 24 Sep 2026 04:27:30 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1x9gfa-00000000DnU-3oNl
for dave@doctor.nl2k.ab.ca;
Thu, 24 Sep 2026 04:27:14 -0600
Resent-From: The Doctor
Resent-Date: Thu, 24 Sep 2026 04:27:14 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-qk2-f43.google.com ([74.125.230.235]:39751)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100.1 (FreeBSD))
(envelope-from
id 1x9eSK-000000000FL-0pXV
for doctor@doctor.nl2k.ab.ca;
Thu, 24 Sep 2026 02:05:35 -0600
Received: by mail-qk2-f43.google.com with SMTP id d75a77b69052e-532db7db0c6so14480331cf.2
for
ARC-Seal: i=1; a=rsa-sha256; t=1790237069; cv=none;
d=google.com; s=arc-20260327;
b=Ww9z3VhxUXiUaH/VZZWJe3pP+mRqBzNEOJJInT7CemFnAHBmqgykwKeCBGykNaGhoU
wwaDKcYtpL2DlBmV9LdbaZ76fGl9/h2HgZD86wuSgdH+LD5+mkD7WOacLwftlaJzpn5F
qG6NWlFQP19adBoSBhwwxEDe3ZNyFA8FC7q32VLZSX9rUFBndVL/f6TpxhJ8CH8dBU9V
0HUD7WzrbtPlhHwTgpgqWg7yN+Mc5xOJu5a3BnYFzsZQAR8PX5bX/18U9KMOSqv49SxR
ub+HZrYBCjVGl4rscHROzgbCujFmD3M/jmg3c/0Nx4jyP8Zaaa36mNGzg3vMZYCjMxFa
5jag==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;
h=to:subject:message-id:date:from:reply-to:mime-version
:dkim-signature;
bh=DRGOO8CthzmbPjXMzBgQVSr/d6jdkmVTVdpseUTiaAg=;
fh=CgKgmQmQOI1sZTNxDp6hCSf/fwk4O8Ffuwdc+VrtXAg=;
b=imVRcnpWBKg6aoc/kjCcCYfoRHSZP/UaE3MyA9m8tNc6qVFAKGLxxzO4GgjaYkniTt
fwZeB7x4YBPy2xYC7VEJH4QjU8By7RgMnrRE8O+6DDbmjfczOFgfB7qR0i1Y4J7kZdKz
umVy3T1Kdqif9muFi0dyzfBD3wpcop7cHiUH8oBlPk/kNdR7Z7pR3n27rMbsGpjCB7yf
VZdXfVjHDSHH/oLU0zs8oeL9zNiGMnunLqGSRO+iQylEaVuh0DRmysvwy6faZVq1hmqE
dJG4Yqb3acyjeHh8Oyt89NoGNcowGf+jdruPLRARLNcv/KlQC8ZO9RGO5s+/cL0TA10S
fJZw==;
darn=doctor.nl2k.ab.ca
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20251104; t=1790237069; x=1790841869; darn=doctor.nl2k.ab.ca;
h=content-type:to:subject:message-id:date:from:reply-to:mime-version
:from:to:cc:subject:date:message-id:reply-to:content-type;
bh=DRGOO8CthzmbPjXMzBgQVSr/d6jdkmVTVdpseUTiaAg=;
b=lPRnwe5Ft1/eC4D+MRW/uxPQ7sg1QBojWlBFC6I84FL1GPXP/6rVT2KPmi2AjKpenF
23jNvHS8soQUfqLlIGIMSfw3nKtXPrrEpvAcwpJzjZjVppWSV5Vm7kbJJgoDblizjU+E
p0AixHav5w4UK8/0UQ/ypBR+AJJBm04VMfKBq+EsnLoyNe/93qgOBdADgn8JHwTNh0Sp
Baieb1Ys2TV7By3BeDmeypjflfgAym25uEYnjM6rPmOQzbXCgMVv+eaVOYmQ+JavHK6K
KfqYqHFEBY7+0luFKMrz6u4S73BvAuky6I7Lzi3nyCcHciGuUi9unn9XlpBdUwLjMM0w
QGLA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20260707; t=1790237069; x=1790841869;
h=content-type:to:subject:message-id:date:from:reply-to:mime-version
:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to:content-type;
bh=DRGOO8CthzmbPjXMzBgQVSr/d6jdkmVTVdpseUTiaAg=;
b=gjeAU+E9QVEis9/eDyfgzs6iIY8KV3tC04hnY4elUlh6o10WaRnPqvEwvpg9fmHWYC
t9f4ySeTdGv52EPDEZAzxmRT8rlY3fb14QEd46ttSWasZq9ikxgi880vZeup8sgC5K7V
gOBSw+kJSDDOvakGcnxQvWxTU1E1hF7ZDl1w0rZqtzEzDMIRyWVgqeqNuTzPdb/Jx3Gy
75y/fSBmahJVn09riSrdv138vK8gNWGyW9M84rIGq9+cmlU8pdkMGt2/7V+TbeTQTkDK
ALoN4fSKguV8I1YG93/ShnnS8S01cP2opxa3WPw3HjQDZ7BKGLYTWhCyb7/feKKwn3JF
+UDg==
X-Forwarded-Encrypted: i=1; AKwUvBzZrlr41pmFfQRf4elshk0xTf4+aP7GD8TWHYQyMLfNRWIxebIsoRNdPrHMmWx5XDdKYlXAYBU=@doctor.nl2k.ab.ca
X-Gm-Message-State: AFuF++k+OE+ZbZ+iB5PFl/saNMVR95gwFhYFqWiEh5KR/eA8mHc7ZoiO
UvxHoTgwZ1DmcBsWhSuX4ZRrRHVtgDfxbgV0l46CA/Y4MyAUsy2SXN1/MyKxnhd2j3/MMm407Tj
RXCj+ew1lon4L7TaHTjy25OnftsiHj/o=
X-Gm-Gg: AYBFou3JmKJyRTcck6ufeL8v2lqai9092BCmWEiBVqIxwLdIcvV+UnA9qGXyc1upfWV
HsMaBYBFk59AU0X9gaKFStx9cMZti+p+VmTupMsznUtLkE5PdQVn96GiwA6ryN2o0o1OiBBrtl6
eCHXF/IoCSPd5p1dgI19TOo5bv1ybc/a+DY0ezkr3eckygLKFvKF2flIzz+P5a1oBV2dVgW33ba
BPmK6Iq1T5tkd2fcUXnKqiQ/XFk66jCkANz3aYzBqFKNOcrjwJbGvkbHNrHgMXtgZuwqolgDppu
X3TwAv05yiEZm1iFYopSlfWAf+GV/em77dcRnSzjC0Bcw8XG9GdRDpVobg==
X-Received: by 2002:a05:622a:4c18:b0:532:c82e:7481 with SMTP id
d75a77b69052e-532feb62bb1mr11619511cf.51.1790237069280; Thu, 24 Sep 2026
01:04:29 -0700 (PDT)
MIME-Version: 1.0
Reply-To: kristalina_georgieva99@outlook.com
From: Kristalina Georgieva
Date: Thu, 24 Sep 2026 01:04:17 -0700
X-Gm-Features: AclHuK8LXoOKdZL0_-c0fDQQx7eaSiP7bceqRTVflWixVavGJ1aK9BXWosN9ycs
Message-ID:
Subject: Dear Friend,
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000009409af065c360c3f"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 18.1
X-Spam_score_int: 181
X-Spam_bar: ++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: *Dear Friend,My name is Madam. Kristalina Georgieva. Managing
Director International Monetary Fund,We want to inform you that the International
Monetary Fund (IMF) have included your email address in [...]
Content analysis details: (18.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[74.125.230.235 listed in will-spam-for-food.eu.org]
[74.125.230.235 listed in will-spam-for-food.eu.org]
[74.125.230.235 listed in will-spam-for-food.eu.org]
[74.125.230.235 listed in will-spam-for-food.eu.org]
[74.125.230.235 listed in will-spam-for-food.eu.org]
[74.125.230.235 listed in will-spam-for-food.eu.org]
[74.125.230.235 listed in will-spam-for-food.eu.org]
[74.125.230.235 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[74.125.230.235 listed in dnsbl.ahbl.org]
[74.125.230.235 listed in dnsbl.ahbl.org]
[74.125.230.235 listed in dnsbl.ahbl.org]
[74.125.230.235 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[74.125.230.235 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[74.125.230.235 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[74.125.230.235 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[74.125.230.235 listed in dnsbl.ahbl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[74.125.230.235 listed in bl.score.senderscore.com]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[georgievakristalina799(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[georgievakristalina799(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[kristalina_georgieva99(at)outlook.com]
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
0.6 J_CHICKENPOX_62 BODY: 6alpha-pock-2alpha
0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[74.125.230.235 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
1.5 MONEY_ATM_CARD Lots of money on an ATM card
2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
2.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
Subject: {SPAM?} Dear Friend,
X-Antivirus: AVG (VPS 260923-18, 9/23/2026), Inbound message
X-Antivirus-Status: Clean
--0000000000009409af065c360c3f
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Dear Friend,My name is Madam. Kristalina Georgieva. Managing Director
International Monetary Fund,We want to inform you that the International
Monetary Fund (IMF) have included your email address in the email list that
won the sum of =E2=82=AC500.000 EURO,(FIVE HUNDRED THOUSAND EURO) for the
compensation of the Corona virus Disease (COVID-19). The payment was to be
made to you via (Automated Teller Machine) ATM.Please contact me with this
my private email address (kristalina_georgieva2026@hotmail.com
contact address of our Wells Fargo customer service agent for your ATM card
.Yours in serviceMadam.Kristalina GeorgievaCOVID -19 BENEFIT FUNDS
--0000000000009409af065c360c3f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Dear Friend,
My name is Madam. Kristalina Georgi=
eva. Managing Director International Monetary Fund,
We want to infor=
m you that the International Monetary Fund (IMF) have included your email a=
ddress in the email list that won the sum of =E2=82=AC500.000 EURO,(FIVE HU=
NDRED THOUSAND EURO) for the compensation of the Corona virus Disease (COVI=
D-19). The payment was to be made to you via (Automated Teller Machine) ATM=
.
Please contact me with this my private email address (
ailto:kristalina_georgieva2026@hotmail.com">kristalina_georgieva2026@hotmai=
l.com) so that I'll give you the email contact address of our Wells=
Fargo customer service agent for your ATM card .
Yours in service
r>Madam.Kristalina Georgieva
COVID -19 BENEFIT FUNDS
My name is Madam. Kristalina Georgi=
eva. Managing Director International Monetary Fund,
We want to infor=
m you that the International Monetary Fund (IMF) have included your email a=
ddress in the email list that won the sum of =E2=82=AC500.000 EURO,(FIVE HU=
NDRED THOUSAND EURO) for the compensation of the Corona virus Disease (COVI=
D-19). The payment was to be made to you via (Automated Teller Machine) ATM=
.
Please contact me with this my private email address (
ailto:kristalina_georgieva2026@hotmail.com">kristalina_georgieva2026@hotmai=
l.com) so that I'll give you the email contact address of our Wells=
Fargo customer service agent for your ATM card .
Yours in service
r>Madam.Kristalina Georgieva
COVID -19 BENEFIT FUNDS
--0000000000009409af065c360c3f--