Nigerian Gmail spam
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 05 Aug 2022 06:35:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oJwX0-000H6p-1v
for dave@doctor.nl2k.ab.ca;
Fri, 05 Aug 2022 06:34:22 -0600
Resent-From: The Doctor
Resent-Date: Fri, 5 Aug 2022 06:34:21 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pg1-f179.google.com ([209.85.215.179]:37430)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1oJrex-0001Ss-LU
for doctor@doctor.nl2k.ab.ca;
Fri, 05 Aug 2022 01:22:20 -0600
Received: by mail-pg1-f179.google.com with SMTP id bh13so1989452pgb.4
for; Fri, 05 Aug 2022 00:21:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=content-transfer-encoding:to:subject:message-id:date:from:reply-to
:mime-version:from:to:cc;
bh=fwXc0OJnNRCwuTBqyoYTqhr98uaAzxJ37q1I2vExlb0=;
b=IF20+UcrGa2iLbPPHMWzprpvOj4olMjvseYtndomHiCQ7mxDNEX2cLg+9pOiH/nvlp
jiCgW5wOPa+sf8j+ouL7HlLFgZHyQwFBmHtfzHGsXBfOuPTSBVzaGxvlCb9lKycql4wK
vCabvnIIG2zNLOX0oTjUKsltq7iSLxU8PwI+icUbJpkuss+0avh5BoJFocg9lZ/yIYbd
Pvl2OVb0zJqCDxGHpmW11t9vnnsMNz6s2v0rbIcvCHMcR0uR1gyNbIK7xHvGwnA/nsqt
T3/vnmQRrCSYEFsAoXfORiLNErBzUb+kMq9og73DBQEmxJNwj2rCg5S39v7MLQpCjkVa
5Q/w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=content-transfer-encoding:to:subject:message-id:date:from:reply-to
:mime-version:x-gm-message-state:from:to:cc;
bh=fwXc0OJnNRCwuTBqyoYTqhr98uaAzxJ37q1I2vExlb0=;
b=rME6T+aLREES5qI8wjuym3FJq0uuF2nCBobH3LSgnYQLRytvR5byzDj4Io2kOBPwrG
eKRYMX/UXDH4gUXZuJ8DNtTcdwVB6daYDnDPD063l98V+w3XH/Swy27XCvq3I9LX1WXe
61ekM88RAD1r1sbPEU0oRWVnLEoudizEmpnCe2vef140FE0J/KRe/899ZevpoC1FKAx4
s9GI/yHuPHJ0Yp4IUX2ANOHb5GOOODsaegFmY9VEjg/6sGfIGkm5iTWBWRleoni5pzEY
dj/2E90nqNuYrAsTXwhDFgiNlQySqW+HCIhFgpMif9SweZzvLW1E2Eq4kM4zHNkID4xW
30SQ==
X-Gm-Message-State: ACgBeo2UbOaKx1f32FNVY10rAr63ybrsGDk579l4HBhjp0iKja4YoEWj
Cj3b0JAJf8NUdyQZdqn6VvNpIjQhruHszJXG6nI=
X-Google-Smtp-Source: AA6agR7Dxl/Xzw6jS4bmbhdTnBpqwzgCF7L0nc+Z2Aw622u9rMpiQqLDqPh8Z8TuWY7qzzFaRvpbU1U3vw+Dnsmli+g=
X-Received: by 2002:a63:4608:0:b0:41a:617f:e194 with SMTP id
t8-20020a634608000000b0041a617fe194mr4918498pga.152.1659684112256; Fri, 05
Aug 2022 00:21:52 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6a21:3292:b0:8d:630b:494 with HTTP; Fri, 5 Aug 2022
00:21:51 -0700 (PDT)
Reply-To: cliffordrufus55@gmail.com
From: Clifford Rufus
Date: Fri, 5 Aug 2022 07:21:51 +0000
Message-ID:
Subject: Greetings ,
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 23.0
X-Spam_score_int: 230
X-Spam_bar: +++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Friend, I am Mr. Clifford Rufus and I have emailed you
earlier a few weeks ago without any response from you. I am sending you this
second Email in respect of my late client that bears the same last name with
[...]
Content analysis details: (23.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.215.179 listed in wl.mailspike.net]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[cliffordrufus55[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[paul.koffi60[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[paul.koffi60[at]gmail.com]
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
2.5 HK_SCAM_N2 BODY: No description available.
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
2.0 HK_SCAM No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.1 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Greetings ,
Dear Friend,
I am Mr. Clifford Rufus and I have emailed you earlier a few weeks ago
without any response from you. I am sending you this second Email in
respect of my late client that bears the same last name with you, an
Independent Contractor in the Republic of Ivory Coast. On the 1st of
December 2012, my client, his wife and only daughter were involved in
fatal road crash while visiting a neighboring country on vacation; am
compelled to do this because I would not want the bank to push my
client=E2=80=99s funds into the bank treasury as unclaimed inheritance and =
the
amount involved is US$13,700,000.00 Million.
He died together with his next of kin and as such the funds now have
an open beneficiary mandate. Fortunately both of you have the same
last name so it will be very easy to make you his official next of kin
and the money will released to you and we share according to our
agreed sharing ratio. If you are interested kindly get back to me so
that i can give you Comprehensive details,
Yours faithfully,
Clifford Rufus
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 05 Aug 2022 06:35:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oJwX0-000H6p-1v
for dave@doctor.nl2k.ab.ca;
Fri, 05 Aug 2022 06:34:22 -0600
Resent-From: The Doctor
Resent-Date: Fri, 5 Aug 2022 06:34:21 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pg1-f179.google.com ([209.85.215.179]:37430)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1oJrex-0001Ss-LU
for doctor@doctor.nl2k.ab.ca;
Fri, 05 Aug 2022 01:22:20 -0600
Received: by mail-pg1-f179.google.com with SMTP id bh13so1989452pgb.4
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=content-transfer-encoding:to:subject:message-id:date:from:reply-to
:mime-version:from:to:cc;
bh=fwXc0OJnNRCwuTBqyoYTqhr98uaAzxJ37q1I2vExlb0=;
b=IF20+UcrGa2iLbPPHMWzprpvOj4olMjvseYtndomHiCQ7mxDNEX2cLg+9pOiH/nvlp
jiCgW5wOPa+sf8j+ouL7HlLFgZHyQwFBmHtfzHGsXBfOuPTSBVzaGxvlCb9lKycql4wK
vCabvnIIG2zNLOX0oTjUKsltq7iSLxU8PwI+icUbJpkuss+0avh5BoJFocg9lZ/yIYbd
Pvl2OVb0zJqCDxGHpmW11t9vnnsMNz6s2v0rbIcvCHMcR0uR1gyNbIK7xHvGwnA/nsqt
T3/vnmQRrCSYEFsAoXfORiLNErBzUb+kMq9og73DBQEmxJNwj2rCg5S39v7MLQpCjkVa
5Q/w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=content-transfer-encoding:to:subject:message-id:date:from:reply-to
:mime-version:x-gm-message-state:from:to:cc;
bh=fwXc0OJnNRCwuTBqyoYTqhr98uaAzxJ37q1I2vExlb0=;
b=rME6T+aLREES5qI8wjuym3FJq0uuF2nCBobH3LSgnYQLRytvR5byzDj4Io2kOBPwrG
eKRYMX/UXDH4gUXZuJ8DNtTcdwVB6daYDnDPD063l98V+w3XH/Swy27XCvq3I9LX1WXe
61ekM88RAD1r1sbPEU0oRWVnLEoudizEmpnCe2vef140FE0J/KRe/899ZevpoC1FKAx4
s9GI/yHuPHJ0Yp4IUX2ANOHb5GOOODsaegFmY9VEjg/6sGfIGkm5iTWBWRleoni5pzEY
dj/2E90nqNuYrAsTXwhDFgiNlQySqW+HCIhFgpMif9SweZzvLW1E2Eq4kM4zHNkID4xW
30SQ==
X-Gm-Message-State: ACgBeo2UbOaKx1f32FNVY10rAr63ybrsGDk579l4HBhjp0iKja4YoEWj
Cj3b0JAJf8NUdyQZdqn6VvNpIjQhruHszJXG6nI=
X-Google-Smtp-Source: AA6agR7Dxl/Xzw6jS4bmbhdTnBpqwzgCF7L0nc+Z2Aw622u9rMpiQqLDqPh8Z8TuWY7qzzFaRvpbU1U3vw+Dnsmli+g=
X-Received: by 2002:a63:4608:0:b0:41a:617f:e194 with SMTP id
t8-20020a634608000000b0041a617fe194mr4918498pga.152.1659684112256; Fri, 05
Aug 2022 00:21:52 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a05:6a21:3292:b0:8d:630b:494 with HTTP; Fri, 5 Aug 2022
00:21:51 -0700 (PDT)
Reply-To: cliffordrufus55@gmail.com
From: Clifford Rufus
Date: Fri, 5 Aug 2022 07:21:51 +0000
Message-ID:
Subject: Greetings ,
To: undisclosed-recipients:;
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 23.0
X-Spam_score_int: 230
X-Spam_bar: +++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Friend, I am Mr. Clifford Rufus and I have emailed you
earlier a few weeks ago without any response from you. I am sending you this
second Email in respect of my late client that bears the same last name with
[...]
Content analysis details: (23.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.215.179 listed in wl.mailspike.net]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[cliffordrufus55[at]gmail.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
in digit
[paul.koffi60[at]gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[paul.koffi60[at]gmail.com]
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
2.5 HK_SCAM_N2 BODY: No description available.
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
2.0 HK_SCAM No description available.
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
3.1 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Greetings ,
Dear Friend,
I am Mr. Clifford Rufus and I have emailed you earlier a few weeks ago
without any response from you. I am sending you this second Email in
respect of my late client that bears the same last name with you, an
Independent Contractor in the Republic of Ivory Coast. On the 1st of
December 2012, my client, his wife and only daughter were involved in
fatal road crash while visiting a neighboring country on vacation; am
compelled to do this because I would not want the bank to push my
client=E2=80=99s funds into the bank treasury as unclaimed inheritance and =
the
amount involved is US$13,700,000.00 Million.
He died together with his next of kin and as such the funds now have
an open beneficiary mandate. Fortunately both of you have the same
last name so it will be very easy to make you his official next of kin
and the money will released to you and we share according to our
agreed sharing ratio. If you are interested kindly get back to me so
that i can give you Comprehensive details,
Yours faithfully,
Clifford Rufus
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments