Nigerian spam
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 30 Oct 2026 02:12:59 -0600
Received: from mta-sp-w02.biglobe.ne.jp ([222.227.84.50]:15296)
by doctor.nl2k.ab.ca with esmtp (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xMhj2-00000000CnX-3VxL
for dave@doctor.nl2k.ab.ca;
Fri, 30 Oct 2026 02:12:41 -0600
Received: from mta-snd-w10.biglobe.ne.jp by mta-sp-w02.biglobe.ne.jp
with ESMTP
id <20261030081138412.OKNP.5834.mta-snd-w10.biglobe.ne.jp@biglobe.ne.jp>;
Fri, 30 Oct 2026 17:11:38 +0900
Received: from airoskbg00uxweb002 by mta-snd-w10.biglobe.ne.jp with ESMTP
id <20261030081135201.FGJD.35871.airoskbg00uxweb002@biglobe.ne.jp>;
Fri, 30 Oct 2026 17:11:35 +0900
Received: from [185.135.77.63]
by wms.sso.biglobe.ne.jp with HTTP; Fri, 30 Oct 2026 17:11:35 +0900
Message-ID: <22374110.2f1e1.1a18bdd3f36.Webtop.180@kcf.biglobe.ne.jp>
Subject: URGENT
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_2728336_1209493412.1793347895076"
User-Agent: OWM Mail 3
X-SID: 180
X-Originating-IP: [185.135.77.63]
From: "msg@kcf.biglobe.ne.jp"
Date: Fri, 30 Oct 2026 17:11:35 +0900 (JST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kcf.biglobe.ne.jp; s=default-1th84yt82rvi; t=1793347895;
bh=D+ZFsJUBFHG4HZdIt2T9mReTFZ/0ZdHeOBh6leo1RHA=;
h=Subject:From:Date;
b=DbIx1DcQWZMruRKm24InST4oDRAvTPabLO0SHavrsaLW4RzBte9LyaLhzUEGXG5I0u/V+rEG
yjMZaDuhcJI1t8QbrztHr1CCsRs08RtbJOfEbv0DvriUwg7RfOQdiu1Zz52LIoKKZ7MyJs/IrG
RHsw5vhzWpLu5WqnBzNo0hVH6A8FlMgClVIbJjHK0/UPTp/UMJcLWEg+ECPFwixDH7Use8omyt
9Igx+6cp9PtF7fonpeBGCR95JB+dfs9ncmLiKHgI5xjAvVlQNBKzMrP/L32hdX1IXZ1TVk3PR4
qBZGLGj5XiwAERuxW+aTzJPMudSJKN8ldt9zsV2NcUzdMzug==
X-Spam_score: 11.1
X-Spam_score_int: 111
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: You've earned ( $ 1,500,000.00 USD ) aid benefit funds from
Helping Hand Ministry Foundation.For claims contact: EMAIL:info@helpinghnds-int.org
1.FULL NAMES: 2.ADDRESS: 3.Country: 4.SEX: 5.AGE: 6.OCCU [...]
Content analysis details: (11.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[185.135.77.63 listed in will-spam-for-food.eu.org]
[185.135.77.63 listed in will-spam-for-food.eu.org]
[185.135.77.63 listed in will-spam-for-food.eu.org]
[185.135.77.63 listed in will-spam-for-food.eu.org]
[185.135.77.63 listed in will-spam-for-food.eu.org]
[185.135.77.63 listed in will-spam-for-food.eu.org]
[185.135.77.63 listed in will-spam-for-food.eu.org]
[185.135.77.63 listed in will-spam-for-food.eu.org]
[222.227.84.50 listed in will-spam-for-food.eu.org]
[222.227.84.50 listed in will-spam-for-food.eu.org]
[222.227.84.50 listed in will-spam-for-food.eu.org]
[222.227.84.50 listed in will-spam-for-food.eu.org]
[222.227.84.50 listed in will-spam-for-food.eu.org]
[222.227.84.50 listed in will-spam-for-food.eu.org]
[222.227.84.50 listed in will-spam-for-food.eu.org]
[222.227.84.50 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[222.227.84.50 listed in dnsbl.ahbl.org]
[222.227.84.50 listed in dnsbl.ahbl.org]
[222.227.84.50 listed in dnsbl.ahbl.org]
[222.227.84.50 listed in dnsbl.ahbl.org]
[185.135.77.63 listed in dnsbl.ahbl.org]
[185.135.77.63 listed in dnsbl.ahbl.org]
[185.135.77.63 listed in dnsbl.ahbl.org]
[185.135.77.63 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[222.227.84.50 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[222.227.84.50 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[222.227.84.50 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[222.227.84.50 listed in dnsbl.ahbl.org]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[222.227.84.50 listed in bb.barracudacentral.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[222.227.84.50 listed in bl.score.senderscore.com]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.2 MISSING_HEADERS Missing To: header
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 T_FILL_THIS_FORM_LONG Fill in a form with personal information
2.2 FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 MONEY_FORM Lots of money if you fill out a form
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
Subject: {SPAM?} URGENT
------=_Part_2728336_1209493412.1793347895076
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
You've earned ( $ 1,500,000.00 USD ) aid benefit funds from Helping Hand
Ministry Foundation.For claims contact:
EMAIL:info@helpinghnds-int.org
1.FULL NAMES:
2.ADDRESS:
3.Country:
4.SEX:
5.AGE:
6.OCCUPATION:
------=_Part_2728336_1209493412.1793347895076
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
EMAIL:info@helpinghnds-int.org
1.FULL NAMES:
2.ADDRESS:
3.Country:
4.SEX:
5.AGE:
6.OCCUPATION:
------=_Part_2728336_1209493412.1793347895076--