Investment inquiry spam from Google Gmail
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 10 Sep 2026 06:10:59 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))
(envelope-from)
id 1x4dbh-00000000Csr-2qZ3
for dave@doctor.nl2k.ab.ca;
Thu, 10 Sep 2026 06:10:21 -0600
Resent-From: The Doctor
Resent-Date: Thu, 10 Sep 2026 06:10:21 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ej1-f44.google.com ([209.85.218.44]:57421)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100 (FreeBSD))
(envelope-from)
id 1x4cuG-000000005PF-3TJ0
for doctor@nl2k.ab.ca;
Thu, 10 Sep 2026 05:25:38 -0600
Received: by mail-ej1-f44.google.com with SMTP id a640c23a62f3a-c1c52d920b8so951899766b.2
for; Thu, 10 Sep 2026 04:24:41 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1789039474; cv=none;
d=google.com; s=arc-20260327;
b=qd+1OTOo8iAGc1ntTbg2cmmb24/K9Htd1N6VU7GQ+ba/V+8gk3oaYe3vQ4+5uCCcIh
UmIM5ppmLsOfj22wYrIdWsqA/ZHDzNqQW+6dC/xlOukjI7Wtd0hxK6m8LdTdU3bkKy2c
KYpk1YGiVeXh2yFlMJ5+gmXc8pqRc+COYfCGtzwPskALv57IPRHKQ8+9R5b2Dq29dJCi
YVz41QbeJnLJ+FoPW2pjJoXYmG1yuspLpVKVh6R3tsMZlpG3BCSmFOGKdwbAU79ycbWP
ukjnv5gPlYMKByICvJLd/cc9f/jICKac6hK6OACdcE3S/zQwf5jyxSHLIz91ewLgkx7S
k/hw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;
h=to:subject:message-id:date:from:reply-to:mime-version
:dkim-signature;
bh=y8w2sPg70c1WQOqbN4N8rSDljVSQ4dXSRqJZJ//AnVw=;
fh=4atT8ZWk/v84INkqS8Nb6Cito6AxhsQ33N+t1zi9pps=;
b=XiMIemYFxkjui9Sa+jeC7jdxQHL263MLTchgzaGiizKUxqG5wNOrE02O/x41qrMY4s
PhfK9VDd9hkHYF307DJIHBj9sPT7OOeK63qx8k3bookSrLhgesh1E5LVhvu5awEmWXtN
m5dvhaYgBVBzyMMHbi/EleMQrYFnO3u0pCtt/v3jqJQrgW6SOnooGZEZ0htG6Mvp272p
0W/iOzyzLeSd+76kPNMc0XRHIvplt1XNOm8zR6e0mHnkZFoRR4YbPF9XDeqz7PKqpJOR
NhPBmEvYGop6/fCJQqYzZrd1wpCeB6MUITo9LOgG5ZkSRPiLLJc3fJacRyOLmdejImIt
sHRA==;
darn=nl2k.ab.ca
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20251104; t=1789039474; x=1789644274; darn=nl2k.ab.ca;
h=content-type:to:subject:message-id:date:from:reply-to:mime-version
:from:to:cc:subject:date:message-id:reply-to:content-type;
bh=y8w2sPg70c1WQOqbN4N8rSDljVSQ4dXSRqJZJ//AnVw=;
b=GAQ8EIuJgU9a6vGQKbRGagVYJG15rRXHn5i6CdkQ0zKkAjc/9dMaHkYPlIBoDQcN4Q
Ec6JrlxqBWPvoJhyY2B0de4u1vISarmLEeVarPR3SjP59GHPQ8GS+0VoPfpQQuVjVydC
jloQxphlB3RKzQ2IniGvcVBHcGyU0v9Gt8BDVCVHuI4krm95yMVX8D809HLOT1r0xEAz
C2MEwK1BFlFIQJi9VlFR8lFqlKrViincmk7hW60ooyCa9JxRMhrVq4LUZA64MOcjHYai
wknqOGNWo3VFZaXewcbKrpDEt884i1DtPZgp/1AdIi0iAner11g1gDaozbfkRQOxUPlX
Qabw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1789039474; x=1789644274;
h=content-type:to:subject:message-id:date:from:reply-to:mime-version
:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to:content-type;
bh=y8w2sPg70c1WQOqbN4N8rSDljVSQ4dXSRqJZJ//AnVw=;
b=LBxeRtMSovdVL2iLlwkIoKOGccNOBqlwTQ99jjetPFhGcYe/1s2VQaPxeB4lT533Ru
lka7G1bfRieqbhSvcwOIuaqpbifRp+17ggFk+Yb4lWmOZX2c45HiA+hEI715kQpKe8cR
xWqGNXCbBL4OmFDGdtMAfn6IOJIu5gRk7qKOSZfb8o7ebkCEH6uAJUVxXsOt+4hiIRV0
1e7TcdEh//ZC7Im4L67t0nSzuI0xItlQ6OFE/aiVrZRGMshBb0CFCdvTugu5s7JeYbXJ
26dqrzKK7LhYfFNbw25jvQwn4EMI7OZoPvaw/rIbO23mtTOmfZBdeFpE1gxeFUrQ/OaG
WPHQ==
X-Forwarded-Encrypted: i=1; AKwUvBwSeVomBvevq0P023BIfLCjUesha8pLG3ARCyuWfVPHzHxK2zCvLfhAdg2aQwT4cHmkbrE3CDs=@nl2k.ab.ca
X-Gm-Message-State: AFuF++lSNbvlgrulP3tGKqm2f1DC2rKibps4/e1eWgqLvdO+zfN4ux3j
PuVI/ecDSFlrx23pgonKrn+KeFc80ska8Te+MzzJOlHj/PtRNg8KZFsikRyd9yJNbSMxOYIcqSY
FshlOcqrYGbSR71G3A2G3BXf6tzdFEmE=
X-Gm-Gg: AYBFou1ef6T8rPW1hD7vOKaY+HcOLV1F+NAG8FJKDYacLey2SbtTzzuMqdRlyQUtJiK
mPoKJAAfaIGlWr3L72zsNc17IyfmKBOwH1dbsgudptfogX7wKTVYfoK+79pAVMY3zDxko31uA9x
kwIR59gYeW2XMdMggCkhPfZ7GtLwWn1fL1OjBIg5nKyTr9uvLA7T+CokEw9pkMDcJ6xQijalKJv
5yGLp0hrzGUxqgCh7JMEGf0KZg9Gd0gGi8kH0B5sSFZqRXcN9kyH0bmu2wKTWGPzzIdhj1rWOKz
1wWQxG/4euK00l6RhZxuMHaWUd8/6kh5PtPin11yUydyv1flyYHyH6JzarF2hlNLYa5qhWFMi48
3wlBAsSTDH4fL+mTLGDcIYd4j1w9i7h+4CMx4E2z67fsX2mA15dbyopIkBfnb
X-Received: by 2002:a17:907:d9e:b0:c26:19de:9aed with SMTP id
a640c23a62f3a-c2619dea8femr1710531466b.44.1789039473509; Thu, 10 Sep 2026
04:24:33 -0700 (PDT)
MIME-Version: 1.0
Reply-To: steveford677@zohomail.com
From: Steve Ford
Date: Thu, 10 Sep 2026 13:23:40 +0200
X-Gm-Features: AcwNN1U3A05BdIEoaoa66dqObc6mMPfQRBUYq1wfu3HuOk34qQwalcYVixp1agI
Message-ID:
Subject: Investment Inquiry,
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000004ecacb065b1f364c"
Bcc: doctor@nl2k.ab.ca
X-Spam_score: 12.7
X-Spam_score_int: 127
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Investment Inquiry, Greetings. we are here with our mother
and our younger ones meanwhile we got your name in our search for a foreign
partner who will help us as we and our mother status as refugee cannot allow
us to transfer our [...]
Content analysis details: (12.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.218.44 listed in will-spam-for-food.eu.org]
[209.85.218.44 listed in will-spam-for-food.eu.org]
[209.85.218.44 listed in will-spam-for-food.eu.org]
[209.85.218.44 listed in will-spam-for-food.eu.org]
[209.85.218.44 listed in will-spam-for-food.eu.org]
[209.85.218.44 listed in will-spam-for-food.eu.org]
[209.85.218.44 listed in will-spam-for-food.eu.org]
[209.85.218.44 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.218.44 listed in dnsbl.ahbl.org]
[209.85.218.44 listed in dnsbl.ahbl.org]
[209.85.218.44 listed in dnsbl.ahbl.org]
[209.85.218.44 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.218.44 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.218.44 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.218.44 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.218.44 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.218.44 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-0.0 SPF_PASS SPF: sender matches SPF record
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[barclaysbnkheritance(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[steveford677(at)zohomail.com]
0.9 URG_BIZ BODY: Contains urgent matter
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.218.44 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.218.44 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 LOTS_OF_MONEY Huge... sums of money
2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 T_MONEY_PERCENT X% of a lot of money for you
0.2 XFER_LOTSA_MONEY Transfer a lot of money
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Investment Inquiry,
--0000000000004ecacb065b1f364c
Content-Type: text/plain; charset="UTF-8"
Investment Inquiry,
Greetings.
we are here with our mother and our younger ones meanwhile we got your
name in our search for a foreign partner who will help us as we and our
mother status as refugee cannot allow us to transfer our money. Please
accept our apology if this e-mail is embarrassing as you don't know us. Our
mother and we are in need of urgent assistance. I the son and my sisters
miss Ruth, the daughter of Sir, and Daniel Mutombo of Zimbabwe. During the
current crises against farmers in Zimbabwe and from the support of
Zimbabwean government to claim all the white owned farms in our country.
All the white farmers were ordered to surrender their farms to his party
members. Our father who was one of the best farmers in our country did not
support his idea. And so the party members invaded my father's farms and
burnt everything in the farm, and our father was beaten up by this evil man
and made away with a lot of properties in our father's farm company and the
tension was so much on him he was rushed to a SPECIALIT HOSPITAL in South
Africa along with us and our mother and our junior ones we move out of
Zimbabwe because our lives were in danger. And after much distress our
beloved father died here in South Africa. But before then, our father
handed over to our mother a proof of deposit slip/Agreement and some
documents which was made between him and A VERY RELIABLE FINANCIAL SECURITY
COMPANY here in South Africa on which he deposited the sum of $30M (THIRTY
MILLION UNITED STATES OF AMERICA DOLLAR)
This money was raised by his farmer's group for the purchasing of
farming equipment s/machineries before the land dispute Rose. So we
decided to make contact with an overseas person, who will assist us to
transfer this money out of South Africa, we want to be there in your
country. We are here as refugee and our status don't allow us to stand for
the fund for transfer, we will like you to stand as our father's
beneficiary, and with
the help of our father's financial attorney this transfer is going to be
fast and easy.
Note that for your time and help 35% of this fund is yours and 5% of the
fund is for any expenses incurred both locally and internationally in the
course of this transfer and the remaining 60% is for our family to start up
business in your country with your support.
If you're interested in assisting me, please do not hesitate to Reply to my
email address (steveford677@zohomail.com) as soon as possible.
when you reply we will tell you things you need to do.
THANKS AND GOD BLESS YOU
Mr. Steve AND Miss Ruth Mutombo
(FOR THE FAMILY)
--0000000000004ecacb065b1f364c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Investment Inquiry,
=C2=A0Greetings.
>
=C2=A0we are here with our mother and our younger ones meanwhile w=
e got your
=C2=A0name in our search for a foreign partner who will help =
us as we and our
=C2=A0mother status as refugee cannot allow us to trans=
fer our money. Please
=C2=A0accept our apology if this e-mail is embarra=
ssing as you don't know us. Our
=C2=A0mother and we are in need of u=
rgent assistance. I the son and my sisters
=C2=A0miss Ruth, the daughter=
of Sir, and Daniel Mutombo of Zimbabwe. During the current crises against =
farmers in Zimbabwe and from the support of
=C2=A0Zimbabwean government =
to claim all the white owned farms in our country.
=C2=A0All the whi=
te farmers were ordered to surrender their farms to his party
=C2=A0memb=
ers. Our father who was one of the best farmers in our country did not supp=
ort his idea. And so the party members invaded my father's farms and bu=
rnt everything in the farm, and our father was beaten up by this evil man a=
nd made away with a lot of properties in our father's farm company and =
the tension was so much on him he was rushed to a SPECIALIT HOSPITAL in Sou=
th Africa along with us and our mother and our junior ones we move out of Z=
imbabwe because our lives were in danger. And after much distress our belov=
ed father died here in South Africa. But before then, our father =C2=A0 han=
ded over to our mother a proof of deposit slip/Agreement and some documents=
which was made between him and A VERY RELIABLE FINANCIAL SECURITY COMPANY =
here in South Africa on which he deposited the sum of $30M (THIRTY MILLION =
UNITED STATES OF AMERICA DOLLAR)
=C2=A0This money was raised by his =
farmer's group for the purchasing of
=C2=A0farming equipment s/machi=
neries before the land dispute Rose. So we decided to make contact with an =
overseas person, who will assist us to transfer this money out of South Afr=
ica, we want to be there in your country. We are here as refugee and our st=
atus don't allow us to stand for the fund for transfer, we will like yo=
u to stand as our father's beneficiary, and with
=C2=A0the help of o=
ur father's financial attorney this transfer is going to be
=C2=A0fa=
st and easy.
=C2=A0Note that for your time and help 35% of this fund=
is yours and 5% of the
=C2=A0fund is for any expenses incurred both loc=
ally and internationally in the
=C2=A0course of this transfer and the re=
maining 60% is for our family to start up
=C2=A0business in your country=
with your support.
=C2=A0If you're interested in assisting me, =
please do not hesitate to Reply to my
=C2=A0email address (
ilto:steveford677@zohomail.com">steveford677@zohomail.com) as soon as p=
ossible.
=C2=A0when you reply we will tell you things you need to do=
.
=C2=A0THANKS AND GOD BLESS YOU
=C2=A0Mr. Steve AND Miss Ruth Mu=
tombo
=C2=A0(FOR THE FAMILY)
--0000000000004ecacb065b1f364c--
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 10 Sep 2026 06:10:59 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))
(envelope-from
id 1x4dbh-00000000Csr-2qZ3
for dave@doctor.nl2k.ab.ca;
Thu, 10 Sep 2026 06:10:21 -0600
Resent-From: The Doctor
Resent-Date: Thu, 10 Sep 2026 06:10:21 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ej1-f44.google.com ([209.85.218.44]:57421)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100 (FreeBSD))
(envelope-from
id 1x4cuG-000000005PF-3TJ0
for doctor@nl2k.ab.ca;
Thu, 10 Sep 2026 05:25:38 -0600
Received: by mail-ej1-f44.google.com with SMTP id a640c23a62f3a-c1c52d920b8so951899766b.2
for
ARC-Seal: i=1; a=rsa-sha256; t=1789039474; cv=none;
d=google.com; s=arc-20260327;
b=qd+1OTOo8iAGc1ntTbg2cmmb24/K9Htd1N6VU7GQ+ba/V+8gk3oaYe3vQ4+5uCCcIh
UmIM5ppmLsOfj22wYrIdWsqA/ZHDzNqQW+6dC/xlOukjI7Wtd0hxK6m8LdTdU3bkKy2c
KYpk1YGiVeXh2yFlMJ5+gmXc8pqRc+COYfCGtzwPskALv57IPRHKQ8+9R5b2Dq29dJCi
YVz41QbeJnLJ+FoPW2pjJoXYmG1yuspLpVKVh6R3tsMZlpG3BCSmFOGKdwbAU79ycbWP
ukjnv5gPlYMKByICvJLd/cc9f/jICKac6hK6OACdcE3S/zQwf5jyxSHLIz91ewLgkx7S
k/hw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;
h=to:subject:message-id:date:from:reply-to:mime-version
:dkim-signature;
bh=y8w2sPg70c1WQOqbN4N8rSDljVSQ4dXSRqJZJ//AnVw=;
fh=4atT8ZWk/v84INkqS8Nb6Cito6AxhsQ33N+t1zi9pps=;
b=XiMIemYFxkjui9Sa+jeC7jdxQHL263MLTchgzaGiizKUxqG5wNOrE02O/x41qrMY4s
PhfK9VDd9hkHYF307DJIHBj9sPT7OOeK63qx8k3bookSrLhgesh1E5LVhvu5awEmWXtN
m5dvhaYgBVBzyMMHbi/EleMQrYFnO3u0pCtt/v3jqJQrgW6SOnooGZEZ0htG6Mvp272p
0W/iOzyzLeSd+76kPNMc0XRHIvplt1XNOm8zR6e0mHnkZFoRR4YbPF9XDeqz7PKqpJOR
NhPBmEvYGop6/fCJQqYzZrd1wpCeB6MUITo9LOgG5ZkSRPiLLJc3fJacRyOLmdejImIt
sHRA==;
darn=nl2k.ab.ca
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20251104; t=1789039474; x=1789644274; darn=nl2k.ab.ca;
h=content-type:to:subject:message-id:date:from:reply-to:mime-version
:from:to:cc:subject:date:message-id:reply-to:content-type;
bh=y8w2sPg70c1WQOqbN4N8rSDljVSQ4dXSRqJZJ//AnVw=;
b=GAQ8EIuJgU9a6vGQKbRGagVYJG15rRXHn5i6CdkQ0zKkAjc/9dMaHkYPlIBoDQcN4Q
Ec6JrlxqBWPvoJhyY2B0de4u1vISarmLEeVarPR3SjP59GHPQ8GS+0VoPfpQQuVjVydC
jloQxphlB3RKzQ2IniGvcVBHcGyU0v9Gt8BDVCVHuI4krm95yMVX8D809HLOT1r0xEAz
C2MEwK1BFlFIQJi9VlFR8lFqlKrViincmk7hW60ooyCa9JxRMhrVq4LUZA64MOcjHYai
wknqOGNWo3VFZaXewcbKrpDEt884i1DtPZgp/1AdIi0iAner11g1gDaozbfkRQOxUPlX
Qabw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1789039474; x=1789644274;
h=content-type:to:subject:message-id:date:from:reply-to:mime-version
:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to:content-type;
bh=y8w2sPg70c1WQOqbN4N8rSDljVSQ4dXSRqJZJ//AnVw=;
b=LBxeRtMSovdVL2iLlwkIoKOGccNOBqlwTQ99jjetPFhGcYe/1s2VQaPxeB4lT533Ru
lka7G1bfRieqbhSvcwOIuaqpbifRp+17ggFk+Yb4lWmOZX2c45HiA+hEI715kQpKe8cR
xWqGNXCbBL4OmFDGdtMAfn6IOJIu5gRk7qKOSZfb8o7ebkCEH6uAJUVxXsOt+4hiIRV0
1e7TcdEh//ZC7Im4L67t0nSzuI0xItlQ6OFE/aiVrZRGMshBb0CFCdvTugu5s7JeYbXJ
26dqrzKK7LhYfFNbw25jvQwn4EMI7OZoPvaw/rIbO23mtTOmfZBdeFpE1gxeFUrQ/OaG
WPHQ==
X-Forwarded-Encrypted: i=1; AKwUvBwSeVomBvevq0P023BIfLCjUesha8pLG3ARCyuWfVPHzHxK2zCvLfhAdg2aQwT4cHmkbrE3CDs=@nl2k.ab.ca
X-Gm-Message-State: AFuF++lSNbvlgrulP3tGKqm2f1DC2rKibps4/e1eWgqLvdO+zfN4ux3j
PuVI/ecDSFlrx23pgonKrn+KeFc80ska8Te+MzzJOlHj/PtRNg8KZFsikRyd9yJNbSMxOYIcqSY
FshlOcqrYGbSR71G3A2G3BXf6tzdFEmE=
X-Gm-Gg: AYBFou1ef6T8rPW1hD7vOKaY+HcOLV1F+NAG8FJKDYacLey2SbtTzzuMqdRlyQUtJiK
mPoKJAAfaIGlWr3L72zsNc17IyfmKBOwH1dbsgudptfogX7wKTVYfoK+79pAVMY3zDxko31uA9x
kwIR59gYeW2XMdMggCkhPfZ7GtLwWn1fL1OjBIg5nKyTr9uvLA7T+CokEw9pkMDcJ6xQijalKJv
5yGLp0hrzGUxqgCh7JMEGf0KZg9Gd0gGi8kH0B5sSFZqRXcN9kyH0bmu2wKTWGPzzIdhj1rWOKz
1wWQxG/4euK00l6RhZxuMHaWUd8/6kh5PtPin11yUydyv1flyYHyH6JzarF2hlNLYa5qhWFMi48
3wlBAsSTDH4fL+mTLGDcIYd4j1w9i7h+4CMx4E2z67fsX2mA15dbyopIkBfnb
X-Received: by 2002:a17:907:d9e:b0:c26:19de:9aed with SMTP id
a640c23a62f3a-c2619dea8femr1710531466b.44.1789039473509; Thu, 10 Sep 2026
04:24:33 -0700 (PDT)
MIME-Version: 1.0
Reply-To: steveford677@zohomail.com
From: Steve Ford
Date: Thu, 10 Sep 2026 13:23:40 +0200
X-Gm-Features: AcwNN1U3A05BdIEoaoa66dqObc6mMPfQRBUYq1wfu3HuOk34qQwalcYVixp1agI
Message-ID:
Subject: Investment Inquiry,
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000004ecacb065b1f364c"
Bcc: doctor@nl2k.ab.ca
X-Spam_score: 12.7
X-Spam_score_int: 127
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Investment Inquiry, Greetings. we are here with our mother
and our younger ones meanwhile we got your name in our search for a foreign
partner who will help us as we and our mother status as refugee cannot allow
us to transfer our [...]
Content analysis details: (12.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.218.44 listed in will-spam-for-food.eu.org]
[209.85.218.44 listed in will-spam-for-food.eu.org]
[209.85.218.44 listed in will-spam-for-food.eu.org]
[209.85.218.44 listed in will-spam-for-food.eu.org]
[209.85.218.44 listed in will-spam-for-food.eu.org]
[209.85.218.44 listed in will-spam-for-food.eu.org]
[209.85.218.44 listed in will-spam-for-food.eu.org]
[209.85.218.44 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.218.44 listed in dnsbl.ahbl.org]
[209.85.218.44 listed in dnsbl.ahbl.org]
[209.85.218.44 listed in dnsbl.ahbl.org]
[209.85.218.44 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.218.44 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.218.44 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.218.44 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.218.44 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.218.44 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 SPF_PASS SPF: sender matches SPF record
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[barclaysbnkheritance(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[steveford677(at)zohomail.com]
0.9 URG_BIZ BODY: Contains urgent matter
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.218.44 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.218.44 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 LOTS_OF_MONEY Huge... sums of money
2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 T_MONEY_PERCENT X% of a lot of money for you
0.2 XFER_LOTSA_MONEY Transfer a lot of money
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Investment Inquiry,
--0000000000004ecacb065b1f364c
Content-Type: text/plain; charset="UTF-8"
Investment Inquiry,
Greetings.
we are here with our mother and our younger ones meanwhile we got your
name in our search for a foreign partner who will help us as we and our
mother status as refugee cannot allow us to transfer our money. Please
accept our apology if this e-mail is embarrassing as you don't know us. Our
mother and we are in need of urgent assistance. I the son and my sisters
miss Ruth, the daughter of Sir, and Daniel Mutombo of Zimbabwe. During the
current crises against farmers in Zimbabwe and from the support of
Zimbabwean government to claim all the white owned farms in our country.
All the white farmers were ordered to surrender their farms to his party
members. Our father who was one of the best farmers in our country did not
support his idea. And so the party members invaded my father's farms and
burnt everything in the farm, and our father was beaten up by this evil man
and made away with a lot of properties in our father's farm company and the
tension was so much on him he was rushed to a SPECIALIT HOSPITAL in South
Africa along with us and our mother and our junior ones we move out of
Zimbabwe because our lives were in danger. And after much distress our
beloved father died here in South Africa. But before then, our father
handed over to our mother a proof of deposit slip/Agreement and some
documents which was made between him and A VERY RELIABLE FINANCIAL SECURITY
COMPANY here in South Africa on which he deposited the sum of $30M (THIRTY
MILLION UNITED STATES OF AMERICA DOLLAR)
This money was raised by his farmer's group for the purchasing of
farming equipment s/machineries before the land dispute Rose. So we
decided to make contact with an overseas person, who will assist us to
transfer this money out of South Africa, we want to be there in your
country. We are here as refugee and our status don't allow us to stand for
the fund for transfer, we will like you to stand as our father's
beneficiary, and with
the help of our father's financial attorney this transfer is going to be
fast and easy.
Note that for your time and help 35% of this fund is yours and 5% of the
fund is for any expenses incurred both locally and internationally in the
course of this transfer and the remaining 60% is for our family to start up
business in your country with your support.
If you're interested in assisting me, please do not hesitate to Reply to my
email address (steveford677@zohomail.com) as soon as possible.
when you reply we will tell you things you need to do.
THANKS AND GOD BLESS YOU
Mr. Steve AND Miss Ruth Mutombo
(FOR THE FAMILY)
--0000000000004ecacb065b1f364c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Investment Inquiry,
=C2=A0Greetings.
>
=C2=A0we are here with our mother and our younger ones meanwhile w=
e got your
=C2=A0name in our search for a foreign partner who will help =
us as we and our
=C2=A0mother status as refugee cannot allow us to trans=
fer our money. Please
=C2=A0accept our apology if this e-mail is embarra=
ssing as you don't know us. Our
=C2=A0mother and we are in need of u=
rgent assistance. I the son and my sisters
=C2=A0miss Ruth, the daughter=
of Sir, and Daniel Mutombo of Zimbabwe. During the current crises against =
farmers in Zimbabwe and from the support of
=C2=A0Zimbabwean government =
to claim all the white owned farms in our country.
=C2=A0All the whi=
te farmers were ordered to surrender their farms to his party
=C2=A0memb=
ers. Our father who was one of the best farmers in our country did not supp=
ort his idea. And so the party members invaded my father's farms and bu=
rnt everything in the farm, and our father was beaten up by this evil man a=
nd made away with a lot of properties in our father's farm company and =
the tension was so much on him he was rushed to a SPECIALIT HOSPITAL in Sou=
th Africa along with us and our mother and our junior ones we move out of Z=
imbabwe because our lives were in danger. And after much distress our belov=
ed father died here in South Africa. But before then, our father =C2=A0 han=
ded over to our mother a proof of deposit slip/Agreement and some documents=
which was made between him and A VERY RELIABLE FINANCIAL SECURITY COMPANY =
here in South Africa on which he deposited the sum of $30M (THIRTY MILLION =
UNITED STATES OF AMERICA DOLLAR)
=C2=A0This money was raised by his =
farmer's group for the purchasing of
=C2=A0farming equipment s/machi=
neries before the land dispute Rose. So we decided to make contact with an =
overseas person, who will assist us to transfer this money out of South Afr=
ica, we want to be there in your country. We are here as refugee and our st=
atus don't allow us to stand for the fund for transfer, we will like yo=
u to stand as our father's beneficiary, and with
=C2=A0the help of o=
ur father's financial attorney this transfer is going to be
=C2=A0fa=
st and easy.
=C2=A0Note that for your time and help 35% of this fund=
is yours and 5% of the
=C2=A0fund is for any expenses incurred both loc=
ally and internationally in the
=C2=A0course of this transfer and the re=
maining 60% is for our family to start up
=C2=A0business in your country=
with your support.
=C2=A0If you're interested in assisting me, =
please do not hesitate to Reply to my
=C2=A0email address (
ilto:steveford677@zohomail.com">steveford677@zohomail.com) as soon as p=
ossible.
=C2=A0when you reply we will tell you things you need to do=
.
=C2=A0THANKS AND GOD BLESS YOU
=C2=A0Mr. Steve AND Miss Ruth Mu=
tombo
=C2=A0(FOR THE FAMILY)
--0000000000004ecacb065b1f364c--
![](3D"https://ci3.googleusercontent.com/meips/ADKq_NYWx_R1C52H8W=<br)