nigerian Spam from Outlook
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 11 Jan 2023 08:18:44 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pFcml-0000q8-1H
for dave@doctor.nl2k.ab.ca;
Wed, 11 Jan 2023 08:13:03 -0700
Resent-From: The Doctor
Resent-Date: Wed, 11 Jan 2023 08:13:03 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-db3eur04hn2230.outbound.protection.outlook.com ([52.100.17.230]:64640 helo=EUR04-DB3-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from)
id 1pFcBE-0005ei-1t
for doctor@nl2k.ab.ca;
Wed, 11 Jan 2023 07:34:20 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=UWCetK0QlCUzzaaJ2GBQWcHSIJX9FOl8K1XVAQDNH10kPfKsh/ZlJKNESRHWt5N6mYBTs2KtUfd8n+4uJRmUixcHr12AUIDplD0X3XbrEvftNLVjLP0DqrQ3vyKrL92ShDxlXzz7AseNKeyoc/oHLvtbg0vZ9KgXnq7goAoF+vfTz2X7tl4QBHO2eryTgHQI849YvqKbL/SSwPqtIHqbPHBOJbh+DlxwU7HqzAk1v499nIkubG3EcoZNzg149yuxBTfXd0olAk1x3rcwJkn26YqWzuGgafKXoSV+/4vOHNLi2tqawcgtKD12eh/EZePY4sNFwXk6sowNKeEobE0zeg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=H3U7zGxuCjHCIynXFPQwz/mr8dmCiUZmaInfUnpdMt4=;
b=a8wRZka9gIpFEX/IUzZSSKGKeCuaEOWIoOAohJG2+bAXPb5/P9EdbOrxJcfde8UjUcMHQEvPxBYrKjBg5MTrpo0ZJkl2tQ8CizuAofUQ8cYIGsiSf5WfNHDq6zn2Ybszz2UVPLQThqZrG9oWUBdNihkk6n/fT86DcFqM3WtHlygT11OGXlNxU5zZCpW59jaUe/eFs26e3MWP2NSIHPgzffKIAWoVG8ibgILWo/Sr+VJYUnPrRXkbG6YB25cqF5WjJNpxhnmPiFlscXHJPLBxFnmMu6XmoiC3UB0+2coUppVIicLjO90iFvHiDuSybRG4qwhpVjI6uIng1A3Nt5i4Nw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
20.101.204.124) smtp.rcpttodomain=aol.com
smtp.mailfrom=montalvamediadores.com; dmarc=none action=none
header.from=generali.priv; dkim=none (message not signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=generali.onmicrosoft.com; s=selector2-generali-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=H3U7zGxuCjHCIynXFPQwz/mr8dmCiUZmaInfUnpdMt4=;
b=lsX1/8/MM4SXf5YkYlqxCVme3iubnMHbiUXbuvTbKwNkImVl9TmyqZMeICPtSzGNV4bqKyISR1SdQ4MFPT7D3NHA65L07/JtU0/6W3coEZWDWAvX6bOgni0Z9sdwMgXdljbNfPul/N4U74CgQLS2/9AMPG2LW32qnU+ilp8sXjg=
Received: from DB6PR0402CA0004.eurprd04.prod.outlook.com (2603:10a6:4:91::14)
by PAWP189MB2328.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:334::19) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5986.18; Wed, 11 Jan
2023 14:11:20 +0000
Received: from DB5EUR01FT007.eop-EUR01.prod.protection.outlook.com
(2603:10a6:4:91:cafe::84) by DB6PR0402CA0004.outlook.office365.com
(2603:10a6:4:91::14) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5986.18 via Frontend
Transport; Wed, 11 Jan 2023 14:11:20 +0000
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 20.101.204.124)
smtp.mailfrom=montalvamediadores.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=generali.priv;
Received-SPF: Fail (protection.outlook.com: domain of montalvamediadores.com
does not designate 20.101.204.124 as permitted sender)
receiver=protection.outlook.com; client-ip=20.101.204.124;
helo=mail.generali.es;
Received: from mail.generali.es (20.101.204.124) by
DB5EUR01FT007.mail.protection.outlook.com (10.152.4.107) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.6002.12 via Frontend Transport; Wed, 11 Jan 2023 14:11:20 +0000
Received: from C20ACX0001.generali.priv (10.200.66.62) by
C20ACX0001.generali.priv (10.200.66.62) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id
15.1.2375.32; Wed, 11 Jan 2023 15:11:09 +0100
Received: from User (10.200.70.70) by C20ACX0001.generali.priv (10.200.66.62)
with Microsoft SMTP Server id 15.1.2375.32 via Frontend Transport; Wed, 11
Jan 2023 15:11:04 +0100
Reply-To:
From: Customer Service
Subject: Re:Please Respond soon as Possible,
Date: Wed, 11 Jan 2023 14:11:08 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <16b3f3c1-e4b1-4871-bee0-42200208aff4@C20ACX0001.generali.priv>
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DB5EUR01FT007:EE_|PAWP189MB2328:EE_
X-MS-Office365-Filtering-Correlation-Id: 40a89f5e-46ca-4428-0f5b-08daf3ddb68d
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?1Xm3WN756Y6e2LDi+3mAfGm2nmHda/qcwbTVGV2e3ag0jMZg2iM+Sw+z?=
=?windows-1251?Q?E8fFKcqUM/Jop/D7B+xJ46Y4mu+GnXm8B+GMoKfQiSJHAi/nGSdn9Qwy?=
=?windows-1251?Q?jIRHOisLLUh9FMu45/ycUkAOtYrCN2wlgXgu5GCk+IjXMqGThxrTauXS?=
=?windows-1251?Q?gHQuIPqUatelTUVhxDp4OErXe0oWJOfMzq9tSUgi7jBzuqiO2nu40oOF?=
=?windows-1251?Q?63yrPXxU7WbHQvLPxb354cQvpTR+dHPP9AHTqEX2z2ZSv+JNcYVDMsD+?=
=?windows-1251?Q?VtcsRWMy+tLDMvrhN1jqTr3irdV4Rtuz+Qrl9TN6qn9GBREqnZO/xHLQ?=
=?windows-1251?Q?moMasM+gZJyYIdmVsOjC/EdKjUQwfkTPrw3Kr3BL1acWs4ey13TXqDNV?=
=?windows-1251?Q?fJlBgs8EdpJh4Xt39TuFDeu/y+YcvxLPclCe8xRR5XW6o3x8M0oE9/Ad?=
=?windows-1251?Q?ztXVOWcaVsJMWzF8lcIK+qyTgRYiXB+LXh7KHNGHoM4DDrzZeEwDLxNR?=
=?windows-1251?Q?9piiKS5ThGhnS37HilBgYF+BC7iSC1a6r/b1eNjbsiqqUfx84T4tnhgJ?=
=?windows-1251?Q?9JYvVkisZb015c5/zVUdZzObU33HLc3zD0aCMwJ99QCB2Cm+LetI+zAm?=
=?windows-1251?Q?QJIxoW2f1DND2pAXAWi+76FRFBIf/OpL2Nokk0b8enWMGUftBJ8heq+Y?=
=?windows-1251?Q?1s0bXQzKNsLGIQ5NSEmybaTRq+8YwHxD38sAmGoK29USs8hx22zcBuX+?=
=?windows-1251?Q?RIBEIBH0jiSqy//g8SIxp4IpE/TitTnAzbdct37QtcPWfbimR06fXXWJ?=
=?windows-1251?Q?nspYuJm/rjSEPCuq9UNs9VR3XOzo9QGqNF8V/fw5nvrFsgntQFhQ8pQP?=
=?windows-1251?Q?7YA2Emm63CDqS0T5KeF7Qnwj03vLrPnqNO/ERIpQrKo9XkfMs8n4YEiF?=
=?windows-1251?Q?NJlaunrk0qA+YrRY3C8Qcuy4RgA/FrXSA7iWR+eEPnfaIxawMk4oVhfC?=
=?windows-1251?Q?wHb+M4pD9+nGGABWdw0mbYWT6Hzs2nimT2Jfn0iD7GE+fMxz4OcA4t2R?=
=?windows-1251?Q?sPpB0jB8X/aIw9S7jwlgmxkxkbGWAMoOUVNY9Jl2Kx7zjfZTCR2Xp9R2?=
=?windows-1251?Q?NcP6Zn72Iwc/4S1wpjMZvG/h8sLEmybNGg0fMnE44yTYOIcdlmCWz59n?=
=?windows-1251?Q?6HgAMiQzHJchnoiXsRHAbfvZcJIhUDqX?=
X-Forefront-Antispam-Report:
CIP:20.101.204.124;CTRY:NL;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:mail.generali.es;PTR:InfoDomainNonexistent;CAT:OSPM;SFS:(13230022)(4636009)(376002)(396003)(136003)(346002)(39860400002)(451199015)(109986013)(40470700004)(83380400001)(426003)(66899015)(31686004)(82310400005)(316002)(40480700001)(40460700003)(31696002)(356005)(32650700002)(81166007)(83170400001)(82740400003)(5660300002)(26005)(82960400001)(336012)(35950700001)(42882007)(4744005)(508600001)(2906002)(7366002)(7416002)(7406005)(8676002)(8936002)(41300700001)(70586007)(70206006)(2700400008);DIR:OUT;SFP:1501;
X-OriginatorOrg: generali.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Jan 2023 14:11:20.0335
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 40a89f5e-46ca-4428-0f5b-08daf3ddb68d
X-MS-Exchange-CrossTenant-Id: cbeb3ecc-6f45-4183-b5a8-088140deae5d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=cbeb3ecc-6f45-4183-b5a8-088140deae5d;Ip=[20.101.204.124];Helo=[mail.generali.es]
X-MS-Exchange-CrossTenant-AuthSource:
DB5EUR01FT007.eop-EUR01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAWP189MB2328
X-Spam_score: 12.3
X-Spam_score_int: 123
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Email User You have been selected to receive ($10.3 Million
dollars) Covid19 relief funds from world health organization empowerment,
Kindly contact Mr. Charles Bloom c-bloom@aliyun.com with your full names,
Ph [...]
Content analysis details: (12.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[52.100.17.230 listed in list.dnswl.org]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[charles.90(at)aliyun.com]
0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
1.0 DEAR_EMAIL_USER BODY: Dear Email User:
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 CTE_8BIT_MISMATCH Header says 7bits but body disagrees
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FAKE_REPLY_C No description available.
1.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.0 XPRIO Has X-Priority header
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
1.7 UNDISC_MONEY Undisclosed recipients + money/fraud signs
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[52.100.17.230 listed in wl.mailspike.net]
Subject: {SPAM?} Re:Please Respond soon as Possible,
Dear Email User
You have been selected to receive ($10.3 Million dollars) Covid19 relief funds from world health organization empowerment, Kindly contact Mr. Charles Bloom c-bloom@aliyun.com with your full names, Phone number and address for more information;
Regards,
Dr Tedros Adhanom Ghebreyesus
World health organization Endowment
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 11 Jan 2023 08:18:44 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pFcml-0000q8-1H
for dave@doctor.nl2k.ab.ca;
Wed, 11 Jan 2023 08:13:03 -0700
Resent-From: The Doctor
Resent-Date: Wed, 11 Jan 2023 08:13:03 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-db3eur04hn2230.outbound.protection.outlook.com ([52.100.17.230]:64640 helo=EUR04-DB3-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from
id 1pFcBE-0005ei-1t
for doctor@nl2k.ab.ca;
Wed, 11 Jan 2023 07:34:20 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=UWCetK0QlCUzzaaJ2GBQWcHSIJX9FOl8K1XVAQDNH10kPfKsh/ZlJKNESRHWt5N6mYBTs2KtUfd8n+4uJRmUixcHr12AUIDplD0X3XbrEvftNLVjLP0DqrQ3vyKrL92ShDxlXzz7AseNKeyoc/oHLvtbg0vZ9KgXnq7goAoF+vfTz2X7tl4QBHO2eryTgHQI849YvqKbL/SSwPqtIHqbPHBOJbh+DlxwU7HqzAk1v499nIkubG3EcoZNzg149yuxBTfXd0olAk1x3rcwJkn26YqWzuGgafKXoSV+/4vOHNLi2tqawcgtKD12eh/EZePY4sNFwXk6sowNKeEobE0zeg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=H3U7zGxuCjHCIynXFPQwz/mr8dmCiUZmaInfUnpdMt4=;
b=a8wRZka9gIpFEX/IUzZSSKGKeCuaEOWIoOAohJG2+bAXPb5/P9EdbOrxJcfde8UjUcMHQEvPxBYrKjBg5MTrpo0ZJkl2tQ8CizuAofUQ8cYIGsiSf5WfNHDq6zn2Ybszz2UVPLQThqZrG9oWUBdNihkk6n/fT86DcFqM3WtHlygT11OGXlNxU5zZCpW59jaUe/eFs26e3MWP2NSIHPgzffKIAWoVG8ibgILWo/Sr+VJYUnPrRXkbG6YB25cqF5WjJNpxhnmPiFlscXHJPLBxFnmMu6XmoiC3UB0+2coUppVIicLjO90iFvHiDuSybRG4qwhpVjI6uIng1A3Nt5i4Nw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
20.101.204.124) smtp.rcpttodomain=aol.com
smtp.mailfrom=montalvamediadores.com; dmarc=none action=none
header.from=generali.priv; dkim=none (message not signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=generali.onmicrosoft.com; s=selector2-generali-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=H3U7zGxuCjHCIynXFPQwz/mr8dmCiUZmaInfUnpdMt4=;
b=lsX1/8/MM4SXf5YkYlqxCVme3iubnMHbiUXbuvTbKwNkImVl9TmyqZMeICPtSzGNV4bqKyISR1SdQ4MFPT7D3NHA65L07/JtU0/6W3coEZWDWAvX6bOgni0Z9sdwMgXdljbNfPul/N4U74CgQLS2/9AMPG2LW32qnU+ilp8sXjg=
Received: from DB6PR0402CA0004.eurprd04.prod.outlook.com (2603:10a6:4:91::14)
by PAWP189MB2328.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:334::19) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5986.18; Wed, 11 Jan
2023 14:11:20 +0000
Received: from DB5EUR01FT007.eop-EUR01.prod.protection.outlook.com
(2603:10a6:4:91:cafe::84) by DB6PR0402CA0004.outlook.office365.com
(2603:10a6:4:91::14) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5986.18 via Frontend
Transport; Wed, 11 Jan 2023 14:11:20 +0000
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 20.101.204.124)
smtp.mailfrom=montalvamediadores.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=generali.priv;
Received-SPF: Fail (protection.outlook.com: domain of montalvamediadores.com
does not designate 20.101.204.124 as permitted sender)
receiver=protection.outlook.com; client-ip=20.101.204.124;
helo=mail.generali.es;
Received: from mail.generali.es (20.101.204.124) by
DB5EUR01FT007.mail.protection.outlook.com (10.152.4.107) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.6002.12 via Frontend Transport; Wed, 11 Jan 2023 14:11:20 +0000
Received: from C20ACX0001.generali.priv (10.200.66.62) by
C20ACX0001.generali.priv (10.200.66.62) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id
15.1.2375.32; Wed, 11 Jan 2023 15:11:09 +0100
Received: from User (10.200.70.70) by C20ACX0001.generali.priv (10.200.66.62)
with Microsoft SMTP Server id 15.1.2375.32 via Frontend Transport; Wed, 11
Jan 2023 15:11:04 +0100
Reply-To:
From: Customer Service
Subject: Re:Please Respond soon as Possible,
Date: Wed, 11 Jan 2023 14:11:08 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <16b3f3c1-e4b1-4871-bee0-42200208aff4@C20ACX0001.generali.priv>
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DB5EUR01FT007:EE_|PAWP189MB2328:EE_
X-MS-Office365-Filtering-Correlation-Id: 40a89f5e-46ca-4428-0f5b-08daf3ddb68d
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?1Xm3WN756Y6e2LDi+3mAfGm2nmHda/qcwbTVGV2e3ag0jMZg2iM+Sw+z?=
=?windows-1251?Q?E8fFKcqUM/Jop/D7B+xJ46Y4mu+GnXm8B+GMoKfQiSJHAi/nGSdn9Qwy?=
=?windows-1251?Q?jIRHOisLLUh9FMu45/ycUkAOtYrCN2wlgXgu5GCk+IjXMqGThxrTauXS?=
=?windows-1251?Q?gHQuIPqUatelTUVhxDp4OErXe0oWJOfMzq9tSUgi7jBzuqiO2nu40oOF?=
=?windows-1251?Q?63yrPXxU7WbHQvLPxb354cQvpTR+dHPP9AHTqEX2z2ZSv+JNcYVDMsD+?=
=?windows-1251?Q?VtcsRWMy+tLDMvrhN1jqTr3irdV4Rtuz+Qrl9TN6qn9GBREqnZO/xHLQ?=
=?windows-1251?Q?moMasM+gZJyYIdmVsOjC/EdKjUQwfkTPrw3Kr3BL1acWs4ey13TXqDNV?=
=?windows-1251?Q?fJlBgs8EdpJh4Xt39TuFDeu/y+YcvxLPclCe8xRR5XW6o3x8M0oE9/Ad?=
=?windows-1251?Q?ztXVOWcaVsJMWzF8lcIK+qyTgRYiXB+LXh7KHNGHoM4DDrzZeEwDLxNR?=
=?windows-1251?Q?9piiKS5ThGhnS37HilBgYF+BC7iSC1a6r/b1eNjbsiqqUfx84T4tnhgJ?=
=?windows-1251?Q?9JYvVkisZb015c5/zVUdZzObU33HLc3zD0aCMwJ99QCB2Cm+LetI+zAm?=
=?windows-1251?Q?QJIxoW2f1DND2pAXAWi+76FRFBIf/OpL2Nokk0b8enWMGUftBJ8heq+Y?=
=?windows-1251?Q?1s0bXQzKNsLGIQ5NSEmybaTRq+8YwHxD38sAmGoK29USs8hx22zcBuX+?=
=?windows-1251?Q?RIBEIBH0jiSqy//g8SIxp4IpE/TitTnAzbdct37QtcPWfbimR06fXXWJ?=
=?windows-1251?Q?nspYuJm/rjSEPCuq9UNs9VR3XOzo9QGqNF8V/fw5nvrFsgntQFhQ8pQP?=
=?windows-1251?Q?7YA2Emm63CDqS0T5KeF7Qnwj03vLrPnqNO/ERIpQrKo9XkfMs8n4YEiF?=
=?windows-1251?Q?NJlaunrk0qA+YrRY3C8Qcuy4RgA/FrXSA7iWR+eEPnfaIxawMk4oVhfC?=
=?windows-1251?Q?wHb+M4pD9+nGGABWdw0mbYWT6Hzs2nimT2Jfn0iD7GE+fMxz4OcA4t2R?=
=?windows-1251?Q?sPpB0jB8X/aIw9S7jwlgmxkxkbGWAMoOUVNY9Jl2Kx7zjfZTCR2Xp9R2?=
=?windows-1251?Q?NcP6Zn72Iwc/4S1wpjMZvG/h8sLEmybNGg0fMnE44yTYOIcdlmCWz59n?=
=?windows-1251?Q?6HgAMiQzHJchnoiXsRHAbfvZcJIhUDqX?=
X-Forefront-Antispam-Report:
CIP:20.101.204.124;CTRY:NL;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:mail.generali.es;PTR:InfoDomainNonexistent;CAT:OSPM;SFS:(13230022)(4636009)(376002)(396003)(136003)(346002)(39860400002)(451199015)(109986013)(40470700004)(83380400001)(426003)(66899015)(31686004)(82310400005)(316002)(40480700001)(40460700003)(31696002)(356005)(32650700002)(81166007)(83170400001)(82740400003)(5660300002)(26005)(82960400001)(336012)(35950700001)(42882007)(4744005)(508600001)(2906002)(7366002)(7416002)(7406005)(8676002)(8936002)(41300700001)(70586007)(70206006)(2700400008);DIR:OUT;SFP:1501;
X-OriginatorOrg: generali.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Jan 2023 14:11:20.0335
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 40a89f5e-46ca-4428-0f5b-08daf3ddb68d
X-MS-Exchange-CrossTenant-Id: cbeb3ecc-6f45-4183-b5a8-088140deae5d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=cbeb3ecc-6f45-4183-b5a8-088140deae5d;Ip=[20.101.204.124];Helo=[mail.generali.es]
X-MS-Exchange-CrossTenant-AuthSource:
DB5EUR01FT007.eop-EUR01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAWP189MB2328
X-Spam_score: 12.3
X-Spam_score_int: 123
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Email User You have been selected to receive ($10.3 Million
dollars) Covid19 relief funds from world health organization empowerment,
Kindly contact Mr. Charles Bloom c-bloom@aliyun.com with your full names,
Ph [...]
Content analysis details: (12.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[52.100.17.230 listed in list.dnswl.org]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[charles.90(at)aliyun.com]
0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
1.0 DEAR_EMAIL_USER BODY: Dear Email User:
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 CTE_8BIT_MISMATCH Header says 7bits but body disagrees
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FAKE_REPLY_C No description available.
1.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.0 XPRIO Has X-Priority header
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
1.7 UNDISC_MONEY Undisclosed recipients + money/fraud signs
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[52.100.17.230 listed in wl.mailspike.net]
Subject: {SPAM?} Re:Please Respond soon as Possible,
Dear Email User
You have been selected to receive ($10.3 Million dollars) Covid19 relief funds from world health organization empowerment, Kindly contact Mr. Charles Bloom c-bloom@aliyun.com with your full names, Phone number and address for more information;
Regards,
Dr Tedros Adhanom Ghebreyesus
World health organization Endowment