Ukrainian Wife Phishing from Vietnam

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Sat, 27 Aug 2022 08:01:00 -0600

Received: from [14.166.141.48] (port=53500 helo=static.vnpt.vn)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRwMa-00080I-Ai

for dave@nk.ca;

Sat, 27 Aug 2022 08:00:47 -0600

Message-ID: <054D89B7.260774@vnpt.vn>

List-Unsubscribe:

Date: Sat, 27 Aug 2022 21:00:35 +0700

From: Bettine S. Brueggemann

MIME-Version: 1.0

To: Dave

Subject: Find a perfect Ukrainian wife.

Content-Type: multipart/alternative;

boundary="7C4F0A708A0752151ED09CD010B2CF876"

X-Spam_score: 39.2

X-Spam_score_int: 392

X-Spam_bar: +++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Noone backcomb photosensitise because of poisonous overtrump,

no honors. By bus scarlet, as loggia?Take that sexy cat :-0My name is Bettine

from Moldova. I found you on facebook :)I am a simple woman [...]



Content analysis details: (39.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: life.my]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URIs: beautywoman.cn]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL

blocklist

[URIs: beautywoman.cn]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of

words

1.0 J_WEEDS_V FULL: Dec/Hex char Enc [Vv]

1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]

1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]

1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]

1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]

1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_J FULL: Dec/Hex char Enc [Jj]

1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]

1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]

1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]

1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]

1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]

1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

3.2 FOUND_YOU I found you...

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 T_REMOTE_IMAGE Message contains an external image

3.0 HTML_ENTITY_ASCII Obfuscated ASCII

Subject: {SPAM?} Find a perfect Ukrainian wife.



This is a multi-part message in MIME format.

--7C4F0A708A0752151ED09CD010B2CF876

Content-Type: text/plain; charset="UTF-8"; format=flowed

Content-Transfer-Encoding: quoted-printable



Noone backcomb photosensitise because of poisonous overtrump, no honors. =

By bus scarlet, as loggia?Take that sexy cat :-0My name is Bettine from =

Moldova. I found you on facebook :)I am a simple woman with a big dream =

to create a happy loving family and I will work hard for it. I am a very =

optimistic and positive person. I consider that every problem has a =

solution. I am a very easy going person, I love meeting people and just =

enjoying the simple things in life.my account is over there: =

http://BettineXX.beautywoman.cnIt is me-I hope you will find me there =

and we will become friends 8-) Call me!



--7C4F0A708A0752151ED09CD010B2CF876

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable








UTF-8">Noone backcomb photosensitise because of poisonous =<br /><br /> overtrump, no honors. By bus scarlet, as loggia?







Take that =

sexy cat
:-0


My name is =

Bettine from Moldova. I =

found you on faٗcebook =

:-)




I am a =

simp͝le woman with a =

big dream to create a =

happy loving =

famȉly aٟnd I will =

work hard for it. I ảm a =

very optimistiٝc and =

positiv֕e person. I =

consider that every =

problem has a =

s֭oluti̢onٍ. I am a =

very ea֥s͡y going =

pe֕rson, I lͅove =

meeti̿ng people =

anَd just enjoying =

the simple things in =

life.
















I hope you =

will find me ther֨e =

and we will become =

frie͜nds 8-) Call =

me!






--7C4F0A708A0752151ED09CD010B2CF876--

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA