Loan phish
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 30 Oct 2022 05:15:25 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1op63S-000JHm-3A
for dave@doctor.nl2k.ab.ca;
Sun, 30 Oct 2022 05:00:38 -0600
Resent-From: The Doctor
Resent-Date: Sun, 30 Oct 2022 05:00:38 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from smtp1.noignv.it ([156.54.133.101]:43943 helo=uca-mx01.boxeduc.local)
by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))
id 1op0DN-000FTL-Kw
for doctor@nk.ca;
Sat, 29 Oct 2022 22:46:34 -0600
Received: from localhost (unknown [127.0.0.1])
by uca-mx01.boxeduc.local (MSG3smtpd) with ESMTP id 696BBC4AB;
Sun, 30 Oct 2022 03:26:45 +0000 (UTC)
X-Virus-Scanned: amavisd-new at local
Received: from uca-mx01.boxeduc.local ([127.0.0.1])
by localhost (uca-mx01.local [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 8GMGGfX1BbYi; Sun, 30 Oct 2022 04:26:36 +0100 (CET)
Received: from mail.noignv.it (unknown [156.54.86.138])
by uca-mx01.boxeduc.local (MSG3smtpd) with ESMTP id E0597DCCC;
Sun, 30 Oct 2022 04:26:31 +0100 (CET)
Received: from User (51.91.229.147) by UCA-EXC01.tiucc.local (156.54.86.138)
with Microsoft SMTP Server (TLS) id 15.0.1497.36; Sun, 30 Oct 2022 05:43:19
+0100
Reply-To:
From: Exclusive Loan Services
Subject: LOAN OFFER
Date: Sat, 29 Oct 2022 21:43:24 -0700
MIME-Version: 1.0
Content-Type: text/plain; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <00db4e8a0fa1446da9f47d2e85e1dcb1@UCA-EXC01.tiucc.local>
To: Undisclosed recipients:;
X-Originating-IP: [51.91.229.147]
X-ClientProxiedBy: UCA-EXC01.tiucc.local (156.54.86.138) To
UCA-EXC01.tiucc.local (156.54.86.138)
X-Spam_score: 17.1
X-Spam_score_int: 171
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings to you, We the Exclusive Loan Services On-line Services
offers secured & unsecured loan at a very low interest rate of 3%. We offer
Personal loans, Debt Consolidation Loan, Venture Capital, Business Loan,
Edu [...]
Content analysis details: (17.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[156.54.133.101 listed in bl.score.senderscore.com]
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
1.6 SUBJ_ALL_CAPS Subject is all capitals
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
1.7 BAD_CREDIT BODY: Eliminate Bad Credit
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 LOTS_OF_MONEY Huge... sums of money
0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.0 XPRIO Has X-Priority header
1.0 FROM_ADDR_WS Malformed From address
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} LOAN OFFER
Greetings to you,
We the Exclusive Loan Services On-line Services offers secured & unsecured loan at a very low interest rate of 3%. We offer Personal loans, Debt Consolidation Loan, Venture Capital, Business Loan, Education Loan, Home Loan or "Loan for any reason! Do you have bad credit? You can still apply.
Note: For Personal Loan Amount is a Minimum of $5,000 & Maximum of $500,000 while Business/Investment Loan Amount is Minimum of $50,000 & Maximum of
$100,000,000.
Contact us today for your applications!!!
Yours Truly,
Customer Service
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 30 Oct 2022 05:15:25 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1op63S-000JHm-3A
for dave@doctor.nl2k.ab.ca;
Sun, 30 Oct 2022 05:00:38 -0600
Resent-From: The Doctor
Resent-Date: Sun, 30 Oct 2022 05:00:38 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from smtp1.noignv.it ([156.54.133.101]:43943 helo=uca-mx01.boxeduc.local)
by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))
id 1op0DN-000FTL-Kw
for doctor@nk.ca;
Sat, 29 Oct 2022 22:46:34 -0600
Received: from localhost (unknown [127.0.0.1])
by uca-mx01.boxeduc.local (MSG3smtpd) with ESMTP id 696BBC4AB;
Sun, 30 Oct 2022 03:26:45 +0000 (UTC)
X-Virus-Scanned: amavisd-new at local
Received: from uca-mx01.boxeduc.local ([127.0.0.1])
by localhost (uca-mx01.local [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 8GMGGfX1BbYi; Sun, 30 Oct 2022 04:26:36 +0100 (CET)
Received: from mail.noignv.it (unknown [156.54.86.138])
by uca-mx01.boxeduc.local (MSG3smtpd) with ESMTP id E0597DCCC;
Sun, 30 Oct 2022 04:26:31 +0100 (CET)
Received: from User (51.91.229.147) by UCA-EXC01.tiucc.local (156.54.86.138)
with Microsoft SMTP Server (TLS) id 15.0.1497.36; Sun, 30 Oct 2022 05:43:19
+0100
Reply-To:
From: Exclusive Loan Services
Subject: LOAN OFFER
Date: Sat, 29 Oct 2022 21:43:24 -0700
MIME-Version: 1.0
Content-Type: text/plain; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <00db4e8a0fa1446da9f47d2e85e1dcb1@UCA-EXC01.tiucc.local>
To: Undisclosed recipients:;
X-Originating-IP: [51.91.229.147]
X-ClientProxiedBy: UCA-EXC01.tiucc.local (156.54.86.138) To
UCA-EXC01.tiucc.local (156.54.86.138)
X-Spam_score: 17.1
X-Spam_score_int: 171
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings to you, We the Exclusive Loan Services On-line Services
offers secured & unsecured loan at a very low interest rate of 3%. We offer
Personal loans, Debt Consolidation Loan, Venture Capital, Business Loan,
Edu [...]
Content analysis details: (17.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[156.54.133.101 listed in bl.score.senderscore.com]
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
1.6 SUBJ_ALL_CAPS Subject is all capitals
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
1.7 BAD_CREDIT BODY: Eliminate Bad Credit
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 LOTS_OF_MONEY Huge... sums of money
0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.0 XPRIO Has X-Priority header
1.0 FROM_ADDR_WS Malformed From address
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} LOAN OFFER
Greetings to you,
We the Exclusive Loan Services On-line Services offers secured & unsecured loan at a very low interest rate of 3%. We offer Personal loans, Debt Consolidation Loan, Venture Capital, Business Loan, Education Loan, Home Loan or "Loan for any reason! Do you have bad credit? You can still apply.
Note: For Personal Loan Amount is a Minimum of $5,000 & Maximum of $500,000 while Business/Investment Loan Amount is Minimum of $50,000 & Maximum of
$100,000,000.
Contact us today for your applications!!!
Yours Truly,
Customer Service
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments