Nigerian spam from Google Gmail
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 05 Jul 2026 04:32:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wgK8Y-000000004zi-1E37
for dave@doctor.nl2k.ab.ca;
Sun, 05 Jul 2026 04:31:46 -0600
Resent-From: The Doctor
Resent-Date: Sun, 5 Jul 2026 04:31:46 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ed1-f43.google.com ([209.85.208.43]:53615)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wgH05-000000004Pl-2Ysq
for doctor@netknow.ca;
Sun, 05 Jul 2026 01:10:58 -0600
Received: by mail-ed1-f43.google.com with SMTP id 4fb4d7f45d1cf-691c5776f35so3004927a12.3
for
ARC-Seal: i=1; a=rsa-sha256; t=1783235396; cv=none;
d=google.com; s=arc-20260327;
b=cG+NJrP+uw8a6oJ4zsdzk6Oy5JwPwhjiZ2GljHdxjeZFPSO7iKgvdHcj9UAQlTxAZc
rcbJxFvshSH0DGZdfc5DbxR+f8gRxCgzWyMNzlFhgPco417lA59tqm8c3XF5hx9i5Adh
E2P/r0DZ5zg/ZmZnccvku6ay8AIxe41oSgBE8B9kjkZeJX2HEly2EPEAOKVksyCiRIy7
oiK5T27c9EzQRIdBop5SC6N2DvTBq2nKDowZv9Bmkz192l1N39jIYSfJz4gizg5gSpnd
RbgvQVSV22yAQc/Rw2xZejZ04ExAn5hoo9QlyBR7ornZxihlSYS7vN75iSlC9bEqq6S6
QDlw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;
h=to:subject:message-id:date:from:reply-to:mime-version
:dkim-signature;
bh=RilOKzHxuJ3dynAznrO5TOH8gTtFBj9X//9iwNf/W50=;
fh=Y7XwTk0fLrmPMOR9qrL6R8MBeExwYPlcjQ44YNrBUVY=;
b=XyQUNjZi6g4jCwdtLG1i7jLm9ltZmZK/3HE3VMcg+7Aj5ecKNtU3BWkJymg5priRxL
0WE7UnBmq1AEFImMo8UvXhqs4mY5OacOp3wr7DPWCO3LjNx/344Smrv5BnrMLKM8/Qw5
zBstV8gWPHeYNR8yNIxpAQbXQFJB/ZbutTmhLVp8vfqz/H8E20DX/SnKY1yR+KsO6HOp
vgHjF6+CHel5VeEdfOYI6OnDZ1q6R4kyWczQqxznqO1L3zp4QD8vx6WMfJKYofRcw4HZ
zdmQWwmat40GO74mtCCQhty+N4jiJLBGVe9Tzv+voaUAFOig2VuFDOGJvGrpnrwIKTJD
IZeQ==;
darn=netknow.ca
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20251104; t=1783235396; x=1783840196; darn=netknow.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=RilOKzHxuJ3dynAznrO5TOH8gTtFBj9X//9iwNf/W50=;
b=cCHQvGI/oJ3cAtiPZ97n9Kc69M8IJ0xs72B+bAiNJFmHI2EnoHgm1pJXjTYjJWyzTn
ht9v9duk14tJdMmuGnlN5jkEX4+9VkytHBS4tKsEAG96rHYOQYiU9DDlFq387ejLtuNa
FYY9r6Zh7YKU/jOnnDj0krArty7f5NERn6KBpZi7NkUTpEfcu+16uF8XuFMLNZzo1/S2
6N8uY+1+69tobr84tAo160OgYohEmhYtVcAjtsgf/PjWiywwfYbPP9AzD7bsIMw8oIvq
rVpuE7PUiEQqjS0MeOyNG4aa8EIaI/GQh6hP2RMaYain4rUn66sCNfaMYlropGjAuFQP
lEAA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783235396; x=1783840196;
h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=RilOKzHxuJ3dynAznrO5TOH8gTtFBj9X//9iwNf/W50=;
b=BkKl5BUKv7fxN/HRpkWduPZeB0adHDnA5gy9Zzj+PZ4N/RmHyU8Q/LPCtZ4HQ2wXXl
O1190UgEfEEaAwJ3YNMqo+LsoDt2CrLa5da+neGYFLw8W7PfIZKGy2qlqMltEJYoXqvJ
rNbKUDDHrjB+YBizURpsOxVG5wtUluvZHj6WxPVaE1YKJBSblF6+NeIZBMBDm7jFSVKk
tDudmkzowJfFae3GQY6bl3dwlM3Y+cSiSfhq9fkfv/KuBt4oaqNj8+ef7MUmsMebnnrH
NYuQzHh4oiFS4jGbyfJlME9Aalucnu3rebuuTHFV7B3sYDpQBhZq8jjXA0a6+c8bukzR
XKHg==
X-Forwarded-Encrypted: i=1; AHgh+Rq8JRw3R19mx6Mw869H96IntGPWcrrkB6fOrjyy97NW6H616iuNNBXqQVnyLvO1gbaKx+34BpM=@netknow.ca
X-Gm-Message-State: AOJu0YxP8D/65fY5XLf11U9bqMOuyv3rJc09ru4RWP+7z+Gx12drvR+x
93MA52Q6XkrGLe20AEKE9myWLL7XzTXHicplu1mn0zAwWzlCn5DxLp5yzNqyOBSxi1apecqg+Ae
1THk596blGISRnmOC2Fou3wJQdlM9/gs=
X-Gm-Gg: AfdE7cmx/xTyMha1X64Wyq3XFKPTF8/X7maLHQ9Ewn+zvSRA1Qvx3JFKdG2Y2zbn1V4
ThNVxP/23ZfdKDIpmNOuzqmpeD2OddwDbRZBP6XW6T6na04rklLpFx2PhHeySH+s58hthTUleEX
mf93Qw96bDQCTFNXaS6gr3aPobMDjvMvMzOFy1uUnx9Aabe5/VqsRX7E206JboG00waLdbdKq3Q
qWLcqyUiS0gIj+pcxZduuQKAeZyKPvXyATN2NEliRX/hGpyBJ1NvEmk0JX45bTJ7gtFpKrIRbY=
X-Received: by 2002:a05:6402:40cc:b0:698:48c4:361c with SMTP id
4fb4d7f45d1cf-69a1a3b14b9mr1936137a12.28.1783235395153; Sun, 05 Jul 2026
00:09:55 -0700 (PDT)
MIME-Version: 1.0
Reply-To: icegcommission@aol.com
From: I C E G COMMISSION
Date: Sun, 5 Jul 2026 00:09:41 -0700
X-Gm-Features: AVVi8CeW3_OAZOwJGoAYsGOqo5fw_12X1iG33MAGCii7SuiHRFG18a952f1w1oA
Message-ID:
Subject: RE:REMINDER PLEASE REPLY NOW
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000004774860655d7d801"
Bcc: doctor@netknow.ca
X-Spam_score: 8.0
X-Spam_score_int: 80
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello, Good day, how are you? Please be advised that your
payment has been processed; please respond as soon as possible.
Content analysis details: (8.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.208.43 listed in dnsbl.ahbl.org]
[209.85.208.43 listed in dnsbl.ahbl.org]
[209.85.208.43 listed in dnsbl.ahbl.org]
[209.85.208.43 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.208.43 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.208.43 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.208.43 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.208.43 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.208.43 listed in will-spam-for-food.eu.org]
[209.85.208.43 listed in will-spam-for-food.eu.org]
[209.85.208.43 listed in will-spam-for-food.eu.org]
[209.85.208.43 listed in will-spam-for-food.eu.org]
[209.85.208.43 listed in will-spam-for-food.eu.org]
[209.85.208.43 listed in will-spam-for-food.eu.org]
[209.85.208.43 listed in will-spam-for-food.eu.org]
[209.85.208.43 listed in will-spam-for-food.eu.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.208.43 listed in list.dnswl.org]
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[contactkevinson(at)gmail.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.208.43 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.43 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to
Subject: {SPAM?} RE:REMINDER PLEASE REPLY NOW
--0000000000004774860655d7d801
Content-Type: text/plain; charset="UTF-8"
Hello,
Good day, how are you?
Please be advised that your payment has been processed; please respond as
soon as possible.
Regards,
ICEG Office
--0000000000004774860655d7d801
Content-Type: text/html; charset="UTF-8"
Good day, how are you?
Please be advised that your payment has been processed; please respond as soon as possible.
Regards,
ICEG Office
--0000000000004774860655d7d801--