Nigerian spam from Google Gmail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 30 Apr 2024 05:30:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1s1lfg-000000008z8-42NX
for dave@doctor.nl2k.ab.ca;
Tue, 30 Apr 2024 05:29:16 -0600
Resent-From: The Doctor
Resent-Date: Tue, 30 Apr 2024 05:29:16 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ed1-f66.google.com ([209.85.208.66]:45181)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1s1hSm-00000000H2K-3HCI
for doctor@doctor.nl2k.ab.ca;
Tue, 30 Apr 2024 00:59:44 -0600
Received: by mail-ed1-f66.google.com with SMTP id 4fb4d7f45d1cf-57255e89facso4546822a12.2
for; Mon, 29 Apr 2024 23:57:46 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1714460260; x=1715065060; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=n/hvRSuw1Oz/kwF/vIb9F99gtyb4FS6d+4tpTZjUIwg=;
b=Z8bplJtddw1S0iyJUZebMGQXVPNfK1vUw7WVtXqn0tPofI1X/C5zbKXkyq6xglQKwb
xUOrgV1DVEiULJ6QLP34IjvY5dTizQEljbZHicoFyZ1vn12nZpSu0Y+RrMp/9rYVUWMb
EjvgCOFh3V6Xf7Fa731wguVdkOdBaFIkvrmw4YtGbN+xZ3pohcwG1APKIJF+HcWNDBsk
QF6ECGjL9FKvRhzAUbfR9yABEtN9iwbqwJwlGKsdEqhsS7Fpz09pLiF/vrteBZ5Zn6cx
+lYgiYi0mVLzQfq6JS0ner2EtcJ0A1DtWie31gFw/EuN5a1+2lpg9tKqxLdMRaQDL112
XpOQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1714460260; x=1715065060;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=n/hvRSuw1Oz/kwF/vIb9F99gtyb4FS6d+4tpTZjUIwg=;
b=ie+I/9Z3CsykCzmEgRa1r/UoT87SaqTabJaEvLDimvI25ZGCP/PSwQhU5l1pN0+u18
My4rRO6RGc0CFqhNZGz0j9NmrB9hl1zCt369YEstwNjJhHAgl3NNuuGIH9GZVoYoF8vG
lCo8aPmeyf3iPD6MoGrcIz5L5Zb6jwW0HCtxVAfPm1aaTMD6+RRi1PnzEE6AJ7uuxUOw
STrZXBzq9DEjKUzG/Fmq8y3P7H74DH6YUUha9Kio8rPYoP60N7n5IOHzn/VfcwjH2l3M
n0R4NN7PNpwDtqCgKFivPXZkqwyMQ0wn/puDsUrS4H2icLYQoIDM/Qdj1a0/SoBih1+G
x7VA==
X-Forwarded-Encrypted: i=1; AJvYcCVqJm3WBOfYBIaAhHmDTpwwj3aPZkbeks6f8nKJGplp2cHCAe09vAgEgtS7YJ8xb3CcYq58Rp6RD93iCaM604flmnt3mH5Cqoc=
X-Gm-Message-State: AOJu0YxAmOga2XAdGcBav+gRcTKO0kzDIBCE9feXxFe0EDqXyXaK4MgP
eCwLISpSUOxcikxiG2SrH42kklTkdjVOFo0LF0gdVMJbJBIK3aAF3fPizTPqMXuMmfuMyEqCbkt
TOyjL2VE8t8BRh743mumLnGnLUbg=
X-Google-Smtp-Source: AGHT+IHrgrjGlvVLuks0JJ01opCvl+Dcsl6VBC4d+dZ2ZGBLK01jv6TLqUq51diEibxcHLqofBJvKyCUFinURVdaAfc=
X-Received: by 2002:a17:907:724a:b0:a58:ec3c:d2fa with SMTP id
ds10-20020a170907724a00b00a58ec3cd2famr6725478ejc.57.1714458929721; Mon, 29
Apr 2024 23:35:29 -0700 (PDT)
MIME-Version: 1.0
Reply-To: mariarodrigues33yt@gmail.com
From: "Mrs. Maria Rodrigues"
Date: Tue, 30 Apr 2024 06:35:13 +0000
Message-ID:
Subject:
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000007cf8aa06174a9317"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 24.2
X-Spam_score_int: 242
X-Spam_bar: ++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings beloved, I know this message might meet you in utmost
surprise. However, it's just my urgent need for a foreign partner. I would
like to know if this proposal will be worthwhile for your acceptance. I need
you [...]
Content analysis details: (24.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.208.66 listed in dnsbl.ahbl.org]
[209.85.208.66 listed in dnsbl.ahbl.org]
[209.85.208.66 listed in dnsbl.ahbl.org]
[209.85.208.66 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.208.66 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.208.66 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.208.66 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.208.66 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.208.66 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.208.66 listed in will-spam-for-food.eu.org]
[209.85.208.66 listed in will-spam-for-food.eu.org]
[209.85.208.66 listed in will-spam-for-food.eu.org]
[209.85.208.66 listed in will-spam-for-food.eu.org]
[209.85.208.66 listed in will-spam-for-food.eu.org]
[209.85.208.66 listed in will-spam-for-food.eu.org]
[209.85.208.66 listed in will-spam-for-food.eu.org]
[209.85.208.66 listed in will-spam-for-food.eu.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.66 listed in wl.mailspike.net]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[devidedward876(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[devidedward876(at)gmail.com]
1.4 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
2.5 MILLION_USD BODY: Talks about millions of dollars
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
1.5 HK_NAME_FM_MR_MRS No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 XFER_LOTSA_MONEY Transfer a lot of money
3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
Subject: {SPAM?}
X-Antivirus: AVG (VPS 240429-8, 4/29/2024), Inbound message
X-Antivirus-Status: Clean
--0000000000007cf8aa06174a9317
Content-Type: text/plain; charset="UTF-8"
Greetings beloved,
I know this message might meet you in utmost surprise. However, it's just
my urgent need for a foreign partner. I would like to know if this proposal
will be worthwhile for your acceptance. I need your honest assistance to
actualize my humanitarian project. Sadly, I am critically down with
terminal sickness and on the verge of death. I want you to utilize my
inheritance funds, Three million one hundred and Fifty thousand united
states dollars ($3,150,000.00) for a charity purpose in your country as
soon as you receive these funds. It will be my greatest joy to conclude
this project with you before I die. Further details shall be provided to
you upon your response to my proposal.
Your positive response shall be appreciated. Contact my private email
address below for more details on (mariarodrigues33yt@gmail.com).
Your sister,
Mrs. Maria Rodrigues
--0000000000007cf8aa06174a9317
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--0000000000007cf8aa06174a9317--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 30 Apr 2024 05:30:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1s1lfg-000000008z8-42NX
for dave@doctor.nl2k.ab.ca;
Tue, 30 Apr 2024 05:29:16 -0600
Resent-From: The Doctor
Resent-Date: Tue, 30 Apr 2024 05:29:16 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ed1-f66.google.com ([209.85.208.66]:45181)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1s1hSm-00000000H2K-3HCI
for doctor@doctor.nl2k.ab.ca;
Tue, 30 Apr 2024 00:59:44 -0600
Received: by mail-ed1-f66.google.com with SMTP id 4fb4d7f45d1cf-57255e89facso4546822a12.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1714460260; x=1715065060; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=n/hvRSuw1Oz/kwF/vIb9F99gtyb4FS6d+4tpTZjUIwg=;
b=Z8bplJtddw1S0iyJUZebMGQXVPNfK1vUw7WVtXqn0tPofI1X/C5zbKXkyq6xglQKwb
xUOrgV1DVEiULJ6QLP34IjvY5dTizQEljbZHicoFyZ1vn12nZpSu0Y+RrMp/9rYVUWMb
EjvgCOFh3V6Xf7Fa731wguVdkOdBaFIkvrmw4YtGbN+xZ3pohcwG1APKIJF+HcWNDBsk
QF6ECGjL9FKvRhzAUbfR9yABEtN9iwbqwJwlGKsdEqhsS7Fpz09pLiF/vrteBZ5Zn6cx
+lYgiYi0mVLzQfq6JS0ner2EtcJ0A1DtWie31gFw/EuN5a1+2lpg9tKqxLdMRaQDL112
XpOQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1714460260; x=1715065060;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=n/hvRSuw1Oz/kwF/vIb9F99gtyb4FS6d+4tpTZjUIwg=;
b=ie+I/9Z3CsykCzmEgRa1r/UoT87SaqTabJaEvLDimvI25ZGCP/PSwQhU5l1pN0+u18
My4rRO6RGc0CFqhNZGz0j9NmrB9hl1zCt369YEstwNjJhHAgl3NNuuGIH9GZVoYoF8vG
lCo8aPmeyf3iPD6MoGrcIz5L5Zb6jwW0HCtxVAfPm1aaTMD6+RRi1PnzEE6AJ7uuxUOw
STrZXBzq9DEjKUzG/Fmq8y3P7H74DH6YUUha9Kio8rPYoP60N7n5IOHzn/VfcwjH2l3M
n0R4NN7PNpwDtqCgKFivPXZkqwyMQ0wn/puDsUrS4H2icLYQoIDM/Qdj1a0/SoBih1+G
x7VA==
X-Forwarded-Encrypted: i=1; AJvYcCVqJm3WBOfYBIaAhHmDTpwwj3aPZkbeks6f8nKJGplp2cHCAe09vAgEgtS7YJ8xb3CcYq58Rp6RD93iCaM604flmnt3mH5Cqoc=
X-Gm-Message-State: AOJu0YxAmOga2XAdGcBav+gRcTKO0kzDIBCE9feXxFe0EDqXyXaK4MgP
eCwLISpSUOxcikxiG2SrH42kklTkdjVOFo0LF0gdVMJbJBIK3aAF3fPizTPqMXuMmfuMyEqCbkt
TOyjL2VE8t8BRh743mumLnGnLUbg=
X-Google-Smtp-Source: AGHT+IHrgrjGlvVLuks0JJ01opCvl+Dcsl6VBC4d+dZ2ZGBLK01jv6TLqUq51diEibxcHLqofBJvKyCUFinURVdaAfc=
X-Received: by 2002:a17:907:724a:b0:a58:ec3c:d2fa with SMTP id
ds10-20020a170907724a00b00a58ec3cd2famr6725478ejc.57.1714458929721; Mon, 29
Apr 2024 23:35:29 -0700 (PDT)
MIME-Version: 1.0
Reply-To: mariarodrigues33yt@gmail.com
From: "Mrs. Maria Rodrigues"
Date: Tue, 30 Apr 2024 06:35:13 +0000
Message-ID:
Subject:
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000007cf8aa06174a9317"
Bcc: doctor@doctor.nl2k.ab.ca
X-Spam_score: 24.2
X-Spam_score_int: 242
X-Spam_bar: ++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings beloved, I know this message might meet you in utmost
surprise. However, it's just my urgent need for a foreign partner. I would
like to know if this proposal will be worthwhile for your acceptance. I need
you [...]
Content analysis details: (24.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.208.66 listed in dnsbl.ahbl.org]
[209.85.208.66 listed in dnsbl.ahbl.org]
[209.85.208.66 listed in dnsbl.ahbl.org]
[209.85.208.66 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.208.66 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.208.66 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.208.66 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.208.66 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.208.66 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.208.66 listed in will-spam-for-food.eu.org]
[209.85.208.66 listed in will-spam-for-food.eu.org]
[209.85.208.66 listed in will-spam-for-food.eu.org]
[209.85.208.66 listed in will-spam-for-food.eu.org]
[209.85.208.66 listed in will-spam-for-food.eu.org]
[209.85.208.66 listed in will-spam-for-food.eu.org]
[209.85.208.66 listed in will-spam-for-food.eu.org]
[209.85.208.66 listed in will-spam-for-food.eu.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.66 listed in wl.mailspike.net]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[devidedward876(at)gmail.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[devidedward876(at)gmail.com]
1.4 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
2.5 MILLION_USD BODY: Talks about millions of dollars
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
1.5 HK_NAME_FM_MR_MRS No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
0.0 XFER_LOTSA_MONEY Transfer a lot of money
3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs
0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases
1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
0.0 FORM_FRAUD_5 Fill a form and many fraud phrases
Subject: {SPAM?}
X-Antivirus: AVG (VPS 240429-8, 4/29/2024), Inbound message
X-Antivirus-Status: Clean
--0000000000007cf8aa06174a9317
Content-Type: text/plain; charset="UTF-8"
Greetings beloved,
I know this message might meet you in utmost surprise. However, it's just
my urgent need for a foreign partner. I would like to know if this proposal
will be worthwhile for your acceptance. I need your honest assistance to
actualize my humanitarian project. Sadly, I am critically down with
terminal sickness and on the verge of death. I want you to utilize my
inheritance funds, Three million one hundred and Fifty thousand united
states dollars ($3,150,000.00) for a charity purpose in your country as
soon as you receive these funds. It will be my greatest joy to conclude
this project with you before I die. Further details shall be provided to
you upon your response to my proposal.
Your positive response shall be appreciated. Contact my private email
address below for more details on (mariarodrigues33yt@gmail.com).
Your sister,
Mrs. Maria Rodrigues
--0000000000007cf8aa06174a9317
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Greetings beloved,
I know this message might meet y=
ou in utmost surprise. However, it's just my urgent need for a foreign =
partner. I would like to know if this proposal will be worthwhile for your =
acceptance. I need your honest assistance to actualize my humanitarian proj=
ect. Sadly, I am critically down with terminal sickness and on the verge of=
death. I want you to utilize my inheritance funds, Three million one hundr=
ed and Fifty thousand united states dollars ($3,150,000.00) for a charity p=
urpose in your country as soon as you receive these funds. It will be my gr=
eatest joy to conclude this project with you before I die. Further details =
shall be provided to you upon your response to my proposal.
Your pos=
itive response shall be appreciated. Contact my private email address below=
for more details on (maria=
rodrigues33yt@gmail.com).
=C2=A0Your sister,
Mrs. Maria R=
odrigues
I know this message might meet y=
ou in utmost surprise. However, it's just my urgent need for a foreign =
partner. I would like to know if this proposal will be worthwhile for your =
acceptance. I need your honest assistance to actualize my humanitarian proj=
ect. Sadly, I am critically down with terminal sickness and on the verge of=
death. I want you to utilize my inheritance funds, Three million one hundr=
ed and Fifty thousand united states dollars ($3,150,000.00) for a charity p=
urpose in your country as soon as you receive these funds. It will be my gr=
eatest joy to conclude this project with you before I die. Further details =
shall be provided to you upon your response to my proposal.
Your pos=
itive response shall be appreciated. Contact my private email address below=
for more details on (maria=
rodrigues33yt@gmail.com).
=C2=A0Your sister,
Mrs. Maria R=
odrigues
--0000000000007cf8aa06174a9317--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments