Nigerian spam from Google Gmail
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 14 Jan 2026 06:28:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vg0tx-00000000254-0zEQ
for dave@doctor.nl2k.ab.ca;
Wed, 14 Jan 2026 06:27:09 -0700
Resent-From: The Doctor
Resent-Date: Wed, 14 Jan 2026 06:27:09 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yw1-f195.google.com ([209.85.128.195]:52638)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vfyET-00000000KUP-46bG
for root@nk.ca;
Wed, 14 Jan 2026 03:36:19 -0700
Received: by mail-yw1-f195.google.com with SMTP id 00721157ae682-792768a0cd3so36920807b3.1
for; Wed, 14 Jan 2026 02:35:22 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1768386916; x=1768991716; darn=nk.ca;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=aYkRQ5ShMCIRac5O5Q4UCU9mIi400dQsZ9RIdrRQjss=;
b=KpbCZ/8fnvnRrMdkHECnOYRQAdT/jgcAyHz3Uouc+6WyOIWgEeEnUrQiGpKpNeoOI4
rIiKristpYOHa6hqxJLPY70bw/G49TRDwVSW+063gWyR8utLq8cvEFi0Yt+IGBp+AVEL
DFqMEg9eWQoqEjdrqAJvab9Sgwac7/F5zybqxKIOoX2hMaU32Rzpkv1Lg+9NZI84HSbb
P6De38loFT6zQol2Omthmvb6VZM9W4gqdHECY7zR2RNpxpkthoXb6CTH0+X5p/49LZDU
2qQuSN5MnZ53IplXmbwO1jKRS8IxsRV9iOe6sF9mELc0Puq99ydL6UfYow/c2RE5JUvS
omTQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1768386916; x=1768991716;
h=to:subject:message-id:date:from:mime-version:x-gm-gg
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=aYkRQ5ShMCIRac5O5Q4UCU9mIi400dQsZ9RIdrRQjss=;
b=o6pyA8tWkzrgEjrgBnj8D74i0NA6RNNulFDCwDAe9szgEIu94Ny6bN0CJ35eh5RoXB
EHjft2V3n7xBle+f3yjK2TfYx4PKgMLQRi4+XxkuY9zcemMQrO/s3N/GVqhLuCu8WLwe
ywVEraN/8RNK6dfHjrhxTysUlLz0HuF1YBGE1rROXhK9VWZwtoTm0DQvuRXxapFpDsyi
Yujztc5m7r+guDiHdHuHz8jjahJ7FFnXNDbUKmcanGOABBvnMv45DJypIczxk2a+9l0v
Oshh+ndI+wJ+AbELbvdntVK8EmpB6Zgp1JzmIIEhJwR/6f2vd2qvc9b1PDRQ9R9LZz5d
XIVQ==
X-Forwarded-Encrypted: i=1; AJvYcCVn6ffaRem3lZzCocQok3uQMEJxjwySFTfWzAgCcraK3NtqAcxCA8psh7wNGuWdWhEJrRbG@nk.ca
X-Gm-Message-State: AOJu0YwNIlXU0jrN1C7VKdAPy3yhxTgyPuPK8ClqzGRuBNr0hDpULQtQ
kZe8JwMIX8OkPLSonZhz2AL/1iHq1HOm0rj1GTejr1rq3DJWTP14mNBuKrsxmT84Oc5is4zjHUR
06OZIXIZ/EkRZZwX1iRLeYIeXGl58Yyg=
X-Gm-Gg: AY/fxX5klAZkcsYtmupI74psQt/q+4fxR5r0EL3ysL6DPmn9N3CcIJKm5WTvdxPiSAi
61giJPtKZtDrNfhED7waJpE02EQL7CGPKUvZKNA/rfdI2ToAaMj5CQxjzlRyqxfjEnCms6kteJB
U5frj1xZVs6Dx7Niiuap56JuWVzu0MpUI0Bty7znelohSeNwrwABbaruZsAN9saMsabiKlu483W
lVZra1/WDFCYBTtkhgem4vUHDDsnKCz+CvO8oxESyUcwEAgsRajsZeiAt7Dx03Z5G74g0TwqKLh
X-Received: by 2002:a05:690e:1917:b0:63f:baef:c4f with SMTP id
956f58d0204a3-64901b0675dmr1826857d50.63.1768386915658; Wed, 14 Jan 2026
02:35:15 -0800 (PST)
MIME-Version: 1.0
From: Aisha Al-Gaddaf
Date: Wed, 14 Jan 2026 02:35:03 -0800
X-Gm-Features: AZwV_Qi_ouhB67gzpQYbAQdx1E2TwsDXSfIedP7j32_6CwSbVmyal0uv7uE4h08
Message-ID:
Subject: Hi
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000eeeec9064856a97f"
Bcc: root@nk.ca
X-Spam_score: 6.4
X-Spam_score_int: 64
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hi, my name is Aisha Al-Gaddafi, I came across your email
address on LinkedIn. Is your email address valid? Please, your attention is
needed. I have something very important to share with you. Regards Aisha
Content analysis details: (6.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.128.195 listed in dnsbl.ahbl.org]
[209.85.128.195 listed in dnsbl.ahbl.org]
[209.85.128.195 listed in dnsbl.ahbl.org]
[209.85.128.195 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.128.195 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.128.195 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.128.195 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.128.195 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.128.195 listed in will-spam-for-food.eu.org]
[209.85.128.195 listed in will-spam-for-food.eu.org]
[209.85.128.195 listed in will-spam-for-food.eu.org]
[209.85.128.195 listed in will-spam-for-food.eu.org]
[209.85.128.195 listed in will-spam-for-food.eu.org]
[209.85.128.195 listed in will-spam-for-food.eu.org]
[209.85.128.195 listed in will-spam-for-food.eu.org]
[209.85.128.195 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.128.195 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[okechiobasi92(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[alqaddafiaisha7(at)gmail.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.128.195 listed in wl.mailspike.net]
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
Subject: {SPAM?} Hi
--000000000000eeeec9064856a97f
Content-Type: text/plain; charset="UTF-8"
Hi, my name is Aisha Al-Gaddafi, I came across your email address on
LinkedIn. Is your email address valid? Please, your attention is needed. I
have something very important to share with you.
Regards
Aisha
--000000000000eeeec9064856a97f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--000000000000eeeec9064856a97f--
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 14 Jan 2026 06:28:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vg0tx-00000000254-0zEQ
for dave@doctor.nl2k.ab.ca;
Wed, 14 Jan 2026 06:27:09 -0700
Resent-From: The Doctor
Resent-Date: Wed, 14 Jan 2026 06:27:09 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yw1-f195.google.com ([209.85.128.195]:52638)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vfyET-00000000KUP-46bG
for root@nk.ca;
Wed, 14 Jan 2026 03:36:19 -0700
Received: by mail-yw1-f195.google.com with SMTP id 00721157ae682-792768a0cd3so36920807b3.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1768386916; x=1768991716; darn=nk.ca;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=aYkRQ5ShMCIRac5O5Q4UCU9mIi400dQsZ9RIdrRQjss=;
b=KpbCZ/8fnvnRrMdkHECnOYRQAdT/jgcAyHz3Uouc+6WyOIWgEeEnUrQiGpKpNeoOI4
rIiKristpYOHa6hqxJLPY70bw/G49TRDwVSW+063gWyR8utLq8cvEFi0Yt+IGBp+AVEL
DFqMEg9eWQoqEjdrqAJvab9Sgwac7/F5zybqxKIOoX2hMaU32Rzpkv1Lg+9NZI84HSbb
P6De38loFT6zQol2Omthmvb6VZM9W4gqdHECY7zR2RNpxpkthoXb6CTH0+X5p/49LZDU
2qQuSN5MnZ53IplXmbwO1jKRS8IxsRV9iOe6sF9mELc0Puq99ydL6UfYow/c2RE5JUvS
omTQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1768386916; x=1768991716;
h=to:subject:message-id:date:from:mime-version:x-gm-gg
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=aYkRQ5ShMCIRac5O5Q4UCU9mIi400dQsZ9RIdrRQjss=;
b=o6pyA8tWkzrgEjrgBnj8D74i0NA6RNNulFDCwDAe9szgEIu94Ny6bN0CJ35eh5RoXB
EHjft2V3n7xBle+f3yjK2TfYx4PKgMLQRi4+XxkuY9zcemMQrO/s3N/GVqhLuCu8WLwe
ywVEraN/8RNK6dfHjrhxTysUlLz0HuF1YBGE1rROXhK9VWZwtoTm0DQvuRXxapFpDsyi
Yujztc5m7r+guDiHdHuHz8jjahJ7FFnXNDbUKmcanGOABBvnMv45DJypIczxk2a+9l0v
Oshh+ndI+wJ+AbELbvdntVK8EmpB6Zgp1JzmIIEhJwR/6f2vd2qvc9b1PDRQ9R9LZz5d
XIVQ==
X-Forwarded-Encrypted: i=1; AJvYcCVn6ffaRem3lZzCocQok3uQMEJxjwySFTfWzAgCcraK3NtqAcxCA8psh7wNGuWdWhEJrRbG@nk.ca
X-Gm-Message-State: AOJu0YwNIlXU0jrN1C7VKdAPy3yhxTgyPuPK8ClqzGRuBNr0hDpULQtQ
kZe8JwMIX8OkPLSonZhz2AL/1iHq1HOm0rj1GTejr1rq3DJWTP14mNBuKrsxmT84Oc5is4zjHUR
06OZIXIZ/EkRZZwX1iRLeYIeXGl58Yyg=
X-Gm-Gg: AY/fxX5klAZkcsYtmupI74psQt/q+4fxR5r0EL3ysL6DPmn9N3CcIJKm5WTvdxPiSAi
61giJPtKZtDrNfhED7waJpE02EQL7CGPKUvZKNA/rfdI2ToAaMj5CQxjzlRyqxfjEnCms6kteJB
U5frj1xZVs6Dx7Niiuap56JuWVzu0MpUI0Bty7znelohSeNwrwABbaruZsAN9saMsabiKlu483W
lVZra1/WDFCYBTtkhgem4vUHDDsnKCz+CvO8oxESyUcwEAgsRajsZeiAt7Dx03Z5G74g0TwqKLh
X-Received: by 2002:a05:690e:1917:b0:63f:baef:c4f with SMTP id
956f58d0204a3-64901b0675dmr1826857d50.63.1768386915658; Wed, 14 Jan 2026
02:35:15 -0800 (PST)
MIME-Version: 1.0
From: Aisha Al-Gaddaf
Date: Wed, 14 Jan 2026 02:35:03 -0800
X-Gm-Features: AZwV_Qi_ouhB67gzpQYbAQdx1E2TwsDXSfIedP7j32_6CwSbVmyal0uv7uE4h08
Message-ID:
Subject: Hi
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000eeeec9064856a97f"
Bcc: root@nk.ca
X-Spam_score: 6.4
X-Spam_score_int: 64
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hi, my name is Aisha Al-Gaddafi, I came across your email
address on LinkedIn. Is your email address valid? Please, your attention is
needed. I have something very important to share with you. Regards Aisha
Content analysis details: (6.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.128.195 listed in dnsbl.ahbl.org]
[209.85.128.195 listed in dnsbl.ahbl.org]
[209.85.128.195 listed in dnsbl.ahbl.org]
[209.85.128.195 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.128.195 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.128.195 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.128.195 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.128.195 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.128.195 listed in will-spam-for-food.eu.org]
[209.85.128.195 listed in will-spam-for-food.eu.org]
[209.85.128.195 listed in will-spam-for-food.eu.org]
[209.85.128.195 listed in will-spam-for-food.eu.org]
[209.85.128.195 listed in will-spam-for-food.eu.org]
[209.85.128.195 listed in will-spam-for-food.eu.org]
[209.85.128.195 listed in will-spam-for-food.eu.org]
[209.85.128.195 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.128.195 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[okechiobasi92(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[alqaddafiaisha7(at)gmail.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.128.195 listed in wl.mailspike.net]
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
Subject: {SPAM?} Hi
--000000000000eeeec9064856a97f
Content-Type: text/plain; charset="UTF-8"
Hi, my name is Aisha Al-Gaddafi, I came across your email address on
LinkedIn. Is your email address valid? Please, your attention is needed. I
have something very important to share with you.
Regards
Aisha
--000000000000eeeec9064856a97f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Hi, my name is=C2=A0 Aisha Al-Gaddafi, I =
came across your email address on LinkedIn. Is your email address valid? Pl=
ease, your attention is needed. I have something very important to share wi=
th you.=C2=A0
came across your email address on LinkedIn. Is your email address valid? Pl=
ease, your attention is needed. I have something very important to share wi=
th you.=C2=A0
Regards
8888">
8">
Aisha=C2=A0 =C2=A0
8888">
8">
Aisha=C2=A0 =C2=A0
--000000000000eeeec9064856a97f--