Nigerian spam from Google Gmail
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 19 Apr 2025 16:55:00 -0600
Received: from mail-qt1-f180.google.com ([209.85.160.180]:56333)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1u6H5G-00000000FxC-1twR
for dave@doctor.nl2k.ab.ca;
Sat, 19 Apr 2025 16:54:59 -0600
Received: by mail-qt1-f180.google.com with SMTP id d75a77b69052e-476ac73c76fso30237731cf.0
for; Sat, 19 Apr 2025 15:52:55 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1745103169; x=1745707969; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=prIcKKUIeqCpjWBy7TdnMbssY3IDv7n9v5yqheRMmq0=;
b=WA2t7HK6WUg/GeYD+UWYLnsqi+GLQM/ta1rTeObL0+l+/LewnFbNCpzl3fFU4Raq/p
Y3aGd11kH99CB+GZH8/j8QWiRkmsaHYMb+k1eIdeBGl29hsqQY7bpvqgNAx4bgMDS/Ug
qrdnGcKhloDTpPlhgJ2e4FzStOTn58i0F7XGvm5t2EFlcIEAI7+hM+iV7oV/xqHvsfRU
0n1z5U53jkFYqmEVy81hTclMdPLkxJiDG02UPFn7mmKDqlsHCtkmydMWvHaa5MdiCMU9
3b8zlqsU/tr16kgZY1a8F7jwv+ijn0OtuHpJ6yT3gsruHncS3SfjkUB72F9uyocu/6o+
gFpQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1745103169; x=1745707969;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=prIcKKUIeqCpjWBy7TdnMbssY3IDv7n9v5yqheRMmq0=;
b=bIJfIYKzNfmrQQxHOF2dfeloxzWduYwfmR+x2UpfkgbJM6tfOk5FeRb9MHu6bbPoIc
NI0va3x2N2w6bC57YUxZi0OG4PfdW5cgaUGURhgaA5negtD+D9jzw65ow7zSRTD4DIOx
jc26MPtvJTl5V34iGKQaq4gbDvo1wfA/DuUO2O+7avYiB0E3CIvpDJQHgeXDBWu3Fr0M
9lCvCN+YSW9cYwopSvs0STWFHikTNmVj9HN3gu/Kz79WlFDYEI3FuE1+I9wWZbPKxUVY
qB6XwkCm6MkHBMFBdL91sVkzXaTNOxBazJVR2Tkjf+3uXAezEiVjhZZTdChJF0kURWIf
1VAg==
X-Forwarded-Encrypted: i=1; AJvYcCUtPbSv53jOi8U/Sd/gjK4wVYbeB2AQxpUFsXDaPCBwSQ9UVNyqOaXHp3IoRURZgdBhWe5l@doctor.nl2k.ab.ca
X-Gm-Message-State: AOJu0YyarPcGI/0PkzH8HLImVB/hdSz+xyb2WLhOEv8wu/Ta3fZ1Of84
ryPo2cWvy9fZeO9SpbSDlJi9JvsUub8Cliz5AYBVYqzM8HSaRaohMA5BA/UcqN5N3Iv85OAtvVC
ecsWezZlCi9deGHd8nNjRQcmKPBI=
X-Gm-Gg: ASbGnctDoTPVb11GYVJ+TYefEAkkj5WxpUv07WoTA9VdqcMZx1HfdzmwC4LRE8vSDZV
UB90Ns8Rc7dVCnFt0nuB9dbs5FYkF5mzzN2E2rsRLsj3ElBDJ84DU4l3jrB6fw3u1PzBYr/ltuT
OU64w/kURm8/Y/AbdgS8zhr5fam8ola3swOKd2mJQ8yjCT2ccSdyKi8g==
X-Google-Smtp-Source: AGHT+IEcDwVpi4sgruA5YdC1pubdb+Iu6neQaOpZCKzx3mUDkXpcGnfl0hivUB0jvAkBU3EfhsJJAf+hxYFma4Rk1U4=
X-Received: by 2002:a05:622a:180d:b0:477:e4e:9186 with SMTP id
d75a77b69052e-47aec350a9dmr149785661cf.11.1745103168903; Sat, 19 Apr 2025
15:52:48 -0700 (PDT)
MIME-Version: 1.0
Reply-To: aishifgad@gmail.com
From: Aisha Gaddafi
Date: Sat, 19 Apr 2025 22:52:39 +0000
X-Gm-Features: ATxdqUGbljVuS_N2uQrz7ZhqvEZ_mmpN2H5tKXEUgUClkwn96qx84c-8tkPHJCE
Message-ID:
Subject: Greetings to you.
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000007a9dfc0633297eca"
Bcc: dave@doctor.nl2k.ab.ca
X-Spam_score: 17.1
X-Spam_score_int: 171
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: My name is Aisha Gaddafi, the only biological Daughter of
Former President of Libya Muammar Al-Qaddafi. How are you today together with
your family? I hope all it's well? I am Aisha Al-Gaddafi, the only biological
daughter of former Libyan President Muammar Gaddafi. I am interested in your
help with an [...]
Content analysis details: (17.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.160.180 listed in dnsbl.ahbl.org]
[209.85.160.180 listed in dnsbl.ahbl.org]
[209.85.160.180 listed in dnsbl.ahbl.org]
[209.85.160.180 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.160.180 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.160.180 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.160.180 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.160.180 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.160.180 listed in will-spam-for-food.eu.org]
[209.85.160.180 listed in will-spam-for-food.eu.org]
[209.85.160.180 listed in will-spam-for-food.eu.org]
[209.85.160.180 listed in will-spam-for-food.eu.org]
[209.85.160.180 listed in will-spam-for-food.eu.org]
[209.85.160.180 listed in will-spam-for-food.eu.org]
[209.85.160.180 listed in will-spam-for-food.eu.org]
[209.85.160.180 listed in will-spam-for-food.eu.org]
-0.0 SPF_PASS SPF: sender matches SPF record
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.160.180 listed in list.dnswl.org]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[veronicaochoausarmy(at)gmail.com]
3.6 NA_DOLLARS BODY: Talks about a million North American dollars
0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.160.180 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.2 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Greetings to you.
--0000000000007a9dfc0633297eca
Content-Type: text/plain; charset="UTF-8"
My name is Aisha Gaddafi, the only biological Daughter of Former President
of Libya Muammar Al-Qaddafi.
How are you today together with your family? I hope all it's well? I am
Aisha Al-Gaddafi, the only biological daughter of former Libyan President
Muammar Gaddafi.
I am interested in your help with an investment project in your country. I
have investment funds worth twenty-seven million five hundred thousand US
dollars (27,500,000.00) and I need a trusted investment manager/partner due
to my status of refugee.
Maybe from there we can establish business relations in the near future. I
am willing to negotiate with you an investment/business profit sharing
ratio based on future investment profits. If you are interested, please
respond urgently for more details.
Sincerely Aisha.
--0000000000007a9dfc0633297eca
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--0000000000007a9dfc0633297eca--
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 19 Apr 2025 16:55:00 -0600
Received: from mail-qt1-f180.google.com ([209.85.160.180]:56333)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1u6H5G-00000000FxC-1twR
for dave@doctor.nl2k.ab.ca;
Sat, 19 Apr 2025 16:54:59 -0600
Received: by mail-qt1-f180.google.com with SMTP id d75a77b69052e-476ac73c76fso30237731cf.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1745103169; x=1745707969; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=prIcKKUIeqCpjWBy7TdnMbssY3IDv7n9v5yqheRMmq0=;
b=WA2t7HK6WUg/GeYD+UWYLnsqi+GLQM/ta1rTeObL0+l+/LewnFbNCpzl3fFU4Raq/p
Y3aGd11kH99CB+GZH8/j8QWiRkmsaHYMb+k1eIdeBGl29hsqQY7bpvqgNAx4bgMDS/Ug
qrdnGcKhloDTpPlhgJ2e4FzStOTn58i0F7XGvm5t2EFlcIEAI7+hM+iV7oV/xqHvsfRU
0n1z5U53jkFYqmEVy81hTclMdPLkxJiDG02UPFn7mmKDqlsHCtkmydMWvHaa5MdiCMU9
3b8zlqsU/tr16kgZY1a8F7jwv+ijn0OtuHpJ6yT3gsruHncS3SfjkUB72F9uyocu/6o+
gFpQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1745103169; x=1745707969;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=prIcKKUIeqCpjWBy7TdnMbssY3IDv7n9v5yqheRMmq0=;
b=bIJfIYKzNfmrQQxHOF2dfeloxzWduYwfmR+x2UpfkgbJM6tfOk5FeRb9MHu6bbPoIc
NI0va3x2N2w6bC57YUxZi0OG4PfdW5cgaUGURhgaA5negtD+D9jzw65ow7zSRTD4DIOx
jc26MPtvJTl5V34iGKQaq4gbDvo1wfA/DuUO2O+7avYiB0E3CIvpDJQHgeXDBWu3Fr0M
9lCvCN+YSW9cYwopSvs0STWFHikTNmVj9HN3gu/Kz79WlFDYEI3FuE1+I9wWZbPKxUVY
qB6XwkCm6MkHBMFBdL91sVkzXaTNOxBazJVR2Tkjf+3uXAezEiVjhZZTdChJF0kURWIf
1VAg==
X-Forwarded-Encrypted: i=1; AJvYcCUtPbSv53jOi8U/Sd/gjK4wVYbeB2AQxpUFsXDaPCBwSQ9UVNyqOaXHp3IoRURZgdBhWe5l@doctor.nl2k.ab.ca
X-Gm-Message-State: AOJu0YyarPcGI/0PkzH8HLImVB/hdSz+xyb2WLhOEv8wu/Ta3fZ1Of84
ryPo2cWvy9fZeO9SpbSDlJi9JvsUub8Cliz5AYBVYqzM8HSaRaohMA5BA/UcqN5N3Iv85OAtvVC
ecsWezZlCi9deGHd8nNjRQcmKPBI=
X-Gm-Gg: ASbGnctDoTPVb11GYVJ+TYefEAkkj5WxpUv07WoTA9VdqcMZx1HfdzmwC4LRE8vSDZV
UB90Ns8Rc7dVCnFt0nuB9dbs5FYkF5mzzN2E2rsRLsj3ElBDJ84DU4l3jrB6fw3u1PzBYr/ltuT
OU64w/kURm8/Y/AbdgS8zhr5fam8ola3swOKd2mJQ8yjCT2ccSdyKi8g==
X-Google-Smtp-Source: AGHT+IEcDwVpi4sgruA5YdC1pubdb+Iu6neQaOpZCKzx3mUDkXpcGnfl0hivUB0jvAkBU3EfhsJJAf+hxYFma4Rk1U4=
X-Received: by 2002:a05:622a:180d:b0:477:e4e:9186 with SMTP id
d75a77b69052e-47aec350a9dmr149785661cf.11.1745103168903; Sat, 19 Apr 2025
15:52:48 -0700 (PDT)
MIME-Version: 1.0
Reply-To: aishifgad@gmail.com
From: Aisha Gaddafi
Date: Sat, 19 Apr 2025 22:52:39 +0000
X-Gm-Features: ATxdqUGbljVuS_N2uQrz7ZhqvEZ_mmpN2H5tKXEUgUClkwn96qx84c-8tkPHJCE
Message-ID:
Subject: Greetings to you.
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="0000000000007a9dfc0633297eca"
Bcc: dave@doctor.nl2k.ab.ca
X-Spam_score: 17.1
X-Spam_score_int: 171
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: My name is Aisha Gaddafi, the only biological Daughter of
Former President of Libya Muammar Al-Qaddafi. How are you today together with
your family? I hope all it's well? I am Aisha Al-Gaddafi, the only biological
daughter of former Libyan President Muammar Gaddafi. I am interested in your
help with an [...]
Content analysis details: (17.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.160.180 listed in dnsbl.ahbl.org]
[209.85.160.180 listed in dnsbl.ahbl.org]
[209.85.160.180 listed in dnsbl.ahbl.org]
[209.85.160.180 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.160.180 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.160.180 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.160.180 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.160.180 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.160.180 listed in will-spam-for-food.eu.org]
[209.85.160.180 listed in will-spam-for-food.eu.org]
[209.85.160.180 listed in will-spam-for-food.eu.org]
[209.85.160.180 listed in will-spam-for-food.eu.org]
[209.85.160.180 listed in will-spam-for-food.eu.org]
[209.85.160.180 listed in will-spam-for-food.eu.org]
[209.85.160.180 listed in will-spam-for-food.eu.org]
[209.85.160.180 listed in will-spam-for-food.eu.org]
-0.0 SPF_PASS SPF: sender matches SPF record
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.160.180 listed in list.dnswl.org]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[veronicaochoausarmy(at)gmail.com]
3.6 NA_DOLLARS BODY: Talks about a million North American dollars
0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.160.180 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.2 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} Greetings to you.
--0000000000007a9dfc0633297eca
Content-Type: text/plain; charset="UTF-8"
My name is Aisha Gaddafi, the only biological Daughter of Former President
of Libya Muammar Al-Qaddafi.
How are you today together with your family? I hope all it's well? I am
Aisha Al-Gaddafi, the only biological daughter of former Libyan President
Muammar Gaddafi.
I am interested in your help with an investment project in your country. I
have investment funds worth twenty-seven million five hundred thousand US
dollars (27,500,000.00) and I need a trusted investment manager/partner due
to my status of refugee.
Maybe from there we can establish business relations in the near future. I
am willing to negotiate with you an investment/business profit sharing
ratio based on future investment profits. If you are interested, please
respond urgently for more details.
Sincerely Aisha.
--0000000000007a9dfc0633297eca
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
My name is Aisha Gaddafi, the only biological Daughter of =
Former President of Libya Muammar Al-Qaddafi.
How are you today toge=
ther with your family? I hope all it's well? I am Aisha Al-Gaddafi, the=
only biological daughter of former Libyan President Muammar Gaddafi.
I =
am interested in your help with an investment project in your country. I ha=
ve investment funds worth twenty-seven million five hundred thousand US dol=
lars (27,500,000.00) and I need a trusted investment manager/partner due to=
my status of refugee.
Maybe from there we can establish business re=
lations in the near future. I am willing to negotiate with you an investmen=
t/business profit sharing ratio based on future investment profits. If you =
are interested, please respond urgently for more details.
Sincerely =
Aisha.
Former President of Libya Muammar Al-Qaddafi.
How are you today toge=
ther with your family? I hope all it's well? I am Aisha Al-Gaddafi, the=
only biological daughter of former Libyan President Muammar Gaddafi.
I =
am interested in your help with an investment project in your country. I ha=
ve investment funds worth twenty-seven million five hundred thousand US dol=
lars (27,500,000.00) and I need a trusted investment manager/partner due to=
my status of refugee.
Maybe from there we can establish business re=
lations in the near future. I am willing to negotiate with you an investmen=
t/business profit sharing ratio based on future investment profits. If you =
are interested, please respond urgently for more details.
Sincerely =
Aisha.
--0000000000007a9dfc0633297eca--
