NIgerian spam from Google Gmail
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 21 Oct 2026 07:14:59 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xJW9h-00000000IvO-19Th
for dave@doctor.nl2k.ab.ca;
Wed, 21 Oct 2026 07:14:57 -0600
Resent-From: The Doctor
Resent-Date: Wed, 21 Oct 2026 07:14:57 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yx1-f48.google.com ([74.125.224.48]:44317)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xJSnd-0000000023C-2Njb
for Mailer-Daemon@doctor.nl2k.ab.ca;
Wed, 21 Oct 2026 03:40:07 -0600
Received: by mail-yx1-f48.google.com with SMTP id 956f58d0204a3-67999045530so406136d50.1
for
ARC-Seal: i=1; a=rsa-sha256; t=1792575544; cv=none;
d=google.com; s=arc-20260327;
b=C3wTNgmwGdP5bfwp7OTchy2AIpx6ATPsga4ORCPAE0dK24QXuMzJdBk8cOykNCKwZp
wvrF01EhKoCC6znRDQEhG5WAeKZxj/Psy1nMoNa2+7WIxjL7vYgX6W8OK/zb/nHThzbE
2LQsMa65/wjKUN7sDUlLiG+SHX0lNx+SdImCkE2BOHDvsW+OJnQLzd84PajDSmYkKh98
dyh8mQPIotjmi6iIi8C6cprVhCIOt/d9Y9uf5KqxbKV0VO6ETaPXtVSjhpibV8xO5ViQ
qCwcVy6JlmF2OcUmDRqv9xqKKKyVxzonuw65DReTTrRMNKitBLtLxUTK3YMCrI9o9MIW
F8fA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;
h=to:subject:message-id:date:from:mime-version:dkim-signature;
bh=2SlJP1qkVKprcPZ6fVTz6pU0d8jlZrxM2L1s+n2svVs=;
fh=ASQMSj08Ib3fFP9w1fQ/PMbItD9O4kOo73Wq1j06uoU=;
b=qE6cvav8066edMw3TjuD2KWh+gAIeosvGQU+PPIGl8svGFpHalO75iSoG7AY6QDyD3
0SnGNfJbK9GShPGhuqRt23FXR5nxX+eipCMmh8IeuP5pqoJuMouTI9IbtzESkJSfokHs
6J7DysXoMOKu8+6TnJmd40KHScIVcRdfFV+Rq3orjEeLsZ7pHC7mSCeja8idh+xa24Sn
e73eFvAMfgYpQQ3dPTpAOpOEDT1ErTlOunXLm1S7k4fUCXnjMYcLj9pCxWQARNNrWpts
Tk0Kow8DtJsjSqSD+hZI6OIsI7AbrhU+0Eq1LnpW1wf2Uniph2QzCvxI7z/VgUlOryJp
clWQ==;
darn=doctor.nl2k.ab.ca
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20251104; t=1792575544; x=1793180344; darn=doctor.nl2k.ab.ca;
h=content-type:to:subject:message-id:date:from:mime-version:from:to
:cc:subject:date:message-id:reply-to:content-type;
bh=2SlJP1qkVKprcPZ6fVTz6pU0d8jlZrxM2L1s+n2svVs=;
b=Z8HB/B6dsJJGBWhjQ7hzEvEiN8llMpyrUYw84XAQLXeVfHFOy6kPr4ZqQLkEEEHllZ
MeWnwP2wBWzwSJsgmx++UC8OWomFZ6Gz3p/Zyzc7ETkNndX6TpU8lIAJEcBp84iX5LK9
zYrQI5iDWs6furqPJPvGPwWYaPDUOa5b8wMQ6tug2CktVKDA+sXhci+XFV33ETNnb0bU
W3m0ukHzx855PMSED+Cuac1SeDKW8AIUap9IBp5qT1qL1nGQ35Bl6HD4aTCwyFMFZtmT
+sjOn1T7dqDlBwG7D2S7FXUTa5tWGZje4rMU9qEcc910BnAE0ShI+Y887MMHtKAKTvf9
kxAg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20260707; t=1792575544; x=1793180344;
h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=2SlJP1qkVKprcPZ6fVTz6pU0d8jlZrxM2L1s+n2svVs=;
b=Z0cPUA9KlVhgUaAtyJxMbtnfTp3HORjfeuvzDnAqdHUaWQx/89BLXN38GQEUs/fa6p
42WDRYe3bGJzGscz6LTlghVB3OXFIKtERFbaIach6d2elRtu5kxFJZCyxdX5HF70Z8eo
S06DGO+lLBM39e77+ZtZl832caVE54HjOWgtUHCO/atuurYbFMsPaUVljBgn63hu8uim
b6EetuqFOqM5xEFuHPFS1aGQImChnAkUNnfHOhh9jpZ26LYsPiutaUbXogaDWmPDWTaG
KwAeFGbikzBHpgW1+Rqw7KsAvAMjRijfeHwPY4mB1m34e3ok8EI8szxWTDiaPbuZCrQ0
dqLw==
X-Forwarded-Encrypted: i=1; AKwUvBxj0PBvmOhZm1ndxiDJpjhUeb4bmHQCgC7Y3rjm1Ko/eEyZ1abqVHWenR3sqUuDTXCwsVZnUdXJOhB8z11f@doctor.nl2k.ab.ca
X-Gm-Message-State: AFq9FYIG72uF8XPJbsXo1Ihj5RgWqk6uI0zN9ZEgQTh22ExY0hcOp2iW
eTjBA+P+z1irWRKya/UKJvYHJeP3oJ3Tld9tB+8GCtstmOkyEJYmOdD3ca31IFP+InUi9yFnoAD
ER1PJdGVatPCSDAwGtI0BIhLoekJCVf8=
X-Gm-Gg: AYBFou2SQL8i0SH1e82+wEu8JU8IUwwfx+u5huZrgnDrScWFIGUp27x5yeKT+uZwXn/
wZrUeXB4+uoSq/NDFRUIL1bUYCygt+dKfA+/c4HHFNxEiA5E/X9zeAsiV7R/jUGnl8ei3lGMjY3
VedApr8CiwhYGUnQQ4L5Qq9VPA5UmeaDFC7iiCEskgJy06asH15uOB5YNTXzHTdJ5Uw3QPgm6xr
jLdOI1QUltgfDQRclJnjqwN2pavJ2nv7007usV0BN1mMdjgJKvtUTMRB/k+uyQfJHDwwG4vBWbm
/JyC3LxFYx4hP8ZCwBiqdS+FiO9lg9w+/ZX5OIyRYcQ7XmzO2uL2aG/7c9doPoua6y951ZeR8ga
bLfQV8Cjw8m5f6Tv9QgUcIiRbJLautDbRupSL3LJxcHsnXoChDbtCAVxyJ9Gk9VyDkH02Boer0g
==
X-Received: by 2002:a05:690e:43d9:b0:679:ba6e:4d87 with SMTP id
956f58d0204a3-67a0e4b6766mr540828d50.31.1792575543803; Wed, 21 Oct 2026
02:39:03 -0700 (PDT)
MIME-Version: 1.0
From: "relieffunde@outlook.com"
Date: Wed, 21 Oct 2026 15:08:52 +0530
X-Gm-Features: AclHuK8-qIy9txI3a7HfPerM5xJK0om4mA2gvKag1PPpce_lhG1wpHG-JBIlDfw
Message-ID:
Subject: UN HUMANITARIAN AID PROGRAM 2026
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000858316065e56847c"
Bcc: Mailer-Daemon@doctor.nl2k.ab.ca
X-Spam_score: 22.6
X-Spam_score_int: 226
X-Spam_bar: ++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: DEAR SIR/ MADAM, YOUR EMAIL HAS BEEN ELECTRICAL SELECTED FOR
UN HUMANITARIAN AID PROGRAM, TO CLAIM YOUR WINNING PRIZE, EMAIL US. relieffunde@outlook.com
YOUR FULL NAME: ADDRESS: NATIONALITY: MOBILE NUMBER: AGE: GENDER: OCCUPATION:
Content analysis details: (22.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[74.125.224.48 listed in will-spam-for-food.eu.org]
[74.125.224.48 listed in will-spam-for-food.eu.org]
[74.125.224.48 listed in will-spam-for-food.eu.org]
[74.125.224.48 listed in will-spam-for-food.eu.org]
[74.125.224.48 listed in will-spam-for-food.eu.org]
[74.125.224.48 listed in will-spam-for-food.eu.org]
[74.125.224.48 listed in will-spam-for-food.eu.org]
[74.125.224.48 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[74.125.224.48 listed in dnsbl.ahbl.org]
[74.125.224.48 listed in dnsbl.ahbl.org]
[74.125.224.48 listed in dnsbl.ahbl.org]
[74.125.224.48 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[74.125.224.48 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[74.125.224.48 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[74.125.224.48 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[74.125.224.48 listed in dnsbl.ahbl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[billcole483(at)gmail.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[billcole483(at)gmail.com]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[74.125.224.48 listed in list.dnswl.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[74.125.224.48 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[74.125.224.48 listed in bl.score.senderscore.com]
1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
1.2 UPPERCASE_75_100 message body is 75-100% uppercase
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address
1.0 FREEMAIL_REPLY From and body contain different freemails
3.6 POSSIBLE_GMAIL_PHISHER Apparent phishing email sent from a gmail
account
0.0 T_FILL_THIS_FORM_LONG Fill in a form with personal information
0.7 PDS_FROM_2_EMAILS From header has multiple different addresses
2.0 FILL_THIS_FORM_LONG Fill in a form with personal information
0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)
0.0 FILL_THIS_FORM Fill in a form with personal information
2.2 FILL_THIS_FORM_LOAN Answer loan question(s)
1.0 ADVANCE_FEE_4_NEW_FORM Advance Fee fraud and a form
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} UN HUMANITARIAN AID PROGRAM 2026
X-Antivirus: AVG (VPS 261020-6, 10/20/2026), Inbound message
X-Antivirus-Status: Clean
--000000000000858316065e56847c
Content-Type: text/plain; charset="UTF-8"
DEAR SIR/ MADAM,
YOUR EMAIL HAS BEEN ELECTRICAL SELECTED FOR UN HUMANITARIAN AID PROGRAM, TO
CLAIM YOUR WINNING PRIZE, EMAIL US. relieffunde@outlook.com
YOUR FULL NAME:
ADDRESS:
NATIONALITY:
MOBILE NUMBER:
AGE:
GENDER:
OCCUPATION:
--000000000000858316065e56847c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
_signature" data-smartmail=3D"gmail_signature">
=3D"color:rgb(32,33,36);font-family:Arial,Helvetica,sans-serif;font-size:sm=
all;font-style:normal;font-weight:400;letter-spacing:normal;text-align:star=
t;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;b=
ackground-color:rgb(255,255,255)">=C2=A0=C2=A0
YOUR EMAIL HAS BEEN ELECT=
RICAL SELECTED FOR UN HUMANITARIAN AID PROGRAM, TO CLAIM YOUR WINNING PRIZE=
, EMAIL US. re=
lieffunde@outlook.com
YOUR FULL NAME:
ADDRESS:
NATIONALITY=
:
MOBILE NUMBER:
AGE:
GENDER:
OCCUPATION:=C2=A0
--000000000000858316065e56847c--