Nigerian spam
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 20 Aug 2026 13:19:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wx8Hy-00000000AFM-1wzv
for dave@doctor.nl2k.ab.ca;
Thu, 20 Aug 2026 13:18:58 -0600
Resent-From: The Doctor
Resent-Date: Thu, 20 Aug 2026 13:18:58 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [190.153.103.99] (port=16205 helo=CORFIN-EX2019.corfinmp.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wx6Jd-00000000FUe-3RIQ
for doctor@doctor.nl2k.ab.ca;
Thu, 20 Aug 2026 11:12:43 -0600
Received: from CORFIN-EX2019.corfinmp.com (193.193.1.3) by
CORFIN-EX2019.corfinmp.com (193.193.1.3) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.2.1544.36; Thu, 20 Aug 2026 13:11:12 -0400
Received: from [172.94.9.39] (193.193.1.29) by CORFIN-EX2019.corfinmp.com
(193.193.1.3) with Microsoft SMTP Server id 15.2.1544.36 via Frontend
Transport; Thu, 20 Aug 2026 13:11:08 -0400
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Good News
To: Recipients
From: =?utf-8?q?Fran=C3=A7ois_Masse_=3Cadmin=40corfinmp=2Ecom=3E?=@doctor.nl2k.ab.ca
Date: Thu, 20 Aug 2026 10:11:28 -0700
Reply-To:
Message-ID:
X-Spam_score: 12.5
X-Spam_score_int: 125
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: I am François Masse, a retiree from Hawkesbury, Ontario,
and the fortunate winner of a $55 million LOTTO MAX jackpot from the January
9, 2026 draw. I have decided to donate the sum of $3,000,000 each [...]
Content analysis details: (12.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[193.193.1.29 listed in will-spam-for-food.eu.org]
[193.193.1.29 listed in will-spam-for-food.eu.org]
[193.193.1.29 listed in will-spam-for-food.eu.org]
[193.193.1.29 listed in will-spam-for-food.eu.org]
[193.193.1.29 listed in will-spam-for-food.eu.org]
[193.193.1.29 listed in will-spam-for-food.eu.org]
[193.193.1.29 listed in will-spam-for-food.eu.org]
[193.193.1.29 listed in will-spam-for-food.eu.org]
[193.193.1.3 listed in will-spam-for-food.eu.org]
[193.193.1.3 listed in will-spam-for-food.eu.org]
[193.193.1.3 listed in will-spam-for-food.eu.org]
[193.193.1.3 listed in will-spam-for-food.eu.org]
[193.193.1.3 listed in will-spam-for-food.eu.org]
[193.193.1.3 listed in will-spam-for-food.eu.org]
[193.193.1.3 listed in will-spam-for-food.eu.org]
[193.193.1.3 listed in will-spam-for-food.eu.org]
[190.153.103.99 listed in will-spam-for-food.eu.org]
[190.153.103.99 listed in will-spam-for-food.eu.org]
[190.153.103.99 listed in will-spam-for-food.eu.org]
[190.153.103.99 listed in will-spam-for-food.eu.org]
[190.153.103.99 listed in will-spam-for-food.eu.org]
[190.153.103.99 listed in will-spam-for-food.eu.org]
[190.153.103.99 listed in will-spam-for-food.eu.org]
[190.153.103.99 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[190.153.103.99 listed in dnsbl.ahbl.org]
[190.153.103.99 listed in dnsbl.ahbl.org]
[190.153.103.99 listed in dnsbl.ahbl.org]
[190.153.103.99 listed in dnsbl.ahbl.org]
[193.193.1.29 listed in dnsbl.ahbl.org]
[193.193.1.29 listed in dnsbl.ahbl.org]
[193.193.1.29 listed in dnsbl.ahbl.org]
[193.193.1.29 listed in dnsbl.ahbl.org]
[193.193.1.3 listed in dnsbl.ahbl.org]
[193.193.1.3 listed in dnsbl.ahbl.org]
[193.193.1.3 listed in dnsbl.ahbl.org]
[193.193.1.3 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[190.153.103.99 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[190.153.103.99 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[190.153.103.99 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[190.153.103.99 listed in dnsbl.ahbl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[francoismass449(at)gmail.com]
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[190.153.103.99 listed in bl.score.senderscore.com]
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 LOTS_OF_MONEY Huge... sums of money
2.0 MONEY_NOHTML Lots of money in plain text
0.2 XFER_LOTSA_MONEY Transfer a lot of money
0.2 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
Subject: {SPAM?} Good News
I am Fran=E7ois Masse, a retiree from Hawkesbury, Ontario, and the fortunat=
e winner of a $55 million LOTTO MAX jackpot from the January 9, 2026 draw. =
I have decided to donate the sum of $3,000,000 each to five person kindly c=
ontact me now for more information=20