Nigerian funds spam from Outlook
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 26 Apr 2023 19:10:05 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1prq8O-000LPs-QZ
for dave@doctor.nl2k.ab.ca;
Wed, 26 Apr 2023 19:09:20 -0600
Resent-From: The Doctor
Resent-Date: Wed, 26 Apr 2023 19:09:20 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vi1eur05olkn2104.outbound.protection.outlook.com ([40.92.90.104]:42686 helo=EUR05-VI1-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1prmwp-0000xu-LE
for root@nk.ca;
Wed, 26 Apr 2023 15:45:15 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=A1iLqDXZn02TNNiSAtcRBafDWy4zvrgCKA9L6n5uKD+Y0zR0UzBSEVmR+tReho+dy4Swdj1HnNxd6G4JDD98KxRXtPpv+WARfEAH3pge/c9WXBELMKy9aJxJ30uu9TLhwFkQsCeQaLE38uM30SUFKjoX69ag/JMQMWvXKcaueLaLR/LB78+h1skvTVhLeoAA4rPYtybjHDBB9GRPDpLQ3BM3yuz6AciKaeoSJn8FshCfsAuMLjUYQuBufUmHHkgG7AcQryszValVK9ibTvdDoIqQhxm2Sli9MSLds+aEKeSV+0Nr9lJMBrfezQq+s6wjNgpi8cWEjUqyOcbNKJzCNg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=ElYp10CjljkK5cSUVCdTXWh7Nnc1RysvavSywhxpljE=;
b=RW+GESCDE3Ao3u232EfR7X45+64i4SUxBIiqpe+Zfued039xacvgU81wp6BvrIQCkr+g7XUC/DRdDgt/vyDY7aklrXYiDMYaurI9iKjL0XJb2W/kXtpCdl9Yi0mvXcY8QT4DxX3JlkKlgco567+KE47MlgRWVqUhgKgMXUPtqtv0aPpzesi2jQwN+JfEofMPPo09CVk8uWEisWTysnKsJIhzpWkCnyDnNMnP4Jwrh0AAnFzH/Ge+gCUa6/my09qRw3WXNHTLb0j2Mz7IS/6I7zEZuG1NqMimjrKSNU1bg9rZTRa0h8LNcnYxCENbq0/oxvd1oXeNAFLZdfi2ZamQZg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;
s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=ElYp10CjljkK5cSUVCdTXWh7Nnc1RysvavSywhxpljE=;
b=NKKuE4r6Hee90QMxggbmtEBLZE+n91vpikQVa8G2Toxv02xQA1syi57+NVKr/+ODaXcL1mkYd8efx5pedQn5AYkq4VHrrshlw0kJLI9YBDjK6nC3/qQCK/WeHU1OYU9l9onH3mmvpjkHMtjWuln+lrm5w8logLgZOSc14eyyVaV5hsOhfdD4pS0Q7bF4+AsUuOlGhht4PDUTilUzNW9KvqTVR9y/C2FXIAS2MYmsYvojglltW3aq1okTZTtUBOn6ga+4yxCYi7gHhL9k1+x77kaueoeg+Brxn0gbKnrDaq8SR96JPD5JU/tpkkf+aJipE3QrDr6/zBpu8UUZfLaqhw==
Received: from PAVPR10MB7419.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:102:30f::9)
by DB9PR10MB5907.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:39a::17) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6340.21; Wed, 26 Apr
2023 21:42:58 +0000
Received: from PAVPR10MB7419.EURPRD10.PROD.OUTLOOK.COM
([fe80::7922:d188:1e40:2628]) by PAVPR10MB7419.EURPRD10.PROD.OUTLOOK.COM
([fe80::7922:d188:1e40:2628%3]) with mapi id 15.20.6340.020; Wed, 26 Apr 2023
21:42:57 +0000
From: anath lotte
Subject: ENGINEER Xolani
Thread-Topic: ENGINEER Xolani
Thread-Index: AQHZeIgQWyboPhTRKUKSCC0vtdppLg==
Date: Wed, 26 Apr 2023 21:42:57 +0000
Message-ID:
Accept-Language: en-ZA, en-US
Content-Language: en-ZA
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
x-tmn: [OwRVa5as5+AfGmrhaAFySzdTMYXHhGt8]
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: PAVPR10MB7419:EE_|DB9PR10MB5907:EE_
x-ms-office365-filtering-correlation-id: a7f02904-cf43-49ae-2db3-08db469f3342
x-ms-exchange-slblob-mailprops:
ZRuQdVKRmYua/+882tIK+iVRzNeqqXiUxlO1muZ4qeWsYFh4/me5dC0+glr+GpEAWCJ8qHZt85Cixy+A+JUzRNfSHK5p/nSoVteFTJtvUXUBuo2ytZvMjHqZITSgOD3UmdsmBu0cMIRWrh6l9LtlaLMdWopVhh484GnEuyDno8fwKPFj3Z1o1IEsySKorSa87K/XTqDTBz5/f8w8tUpV9iatDfRhj3PdJzcNgMpI5faxUIcpXSgp45Iyu9uVTAtf/9r/1H5gmPDNUp/s8BqswQv1F3rUyDvnv+P5us8oxa9tsKmFAj5TbpRAAoRNt/wD6eYxWxSkULh94B+74QohVo8gmuQ7eQfE0tcI9sPn12A6247PTX4Ls4dEWM0c3aiyB0SS60t/vdWwLdJDmENUCkXHYEgYerT4c98QJ8p5r/IeD6mEEf9x497UbuoLT03yKKxv0074zY8zsqqKE9lJWhQAJGmp0uioOKarA8KaT2a1Qvnf7GJYrv6/bQdOlMt1crN8BHDwacWRczvTSOaS3LjtfsJ+ueF7dW8N7v4XH3/Ywpmu3kUzcvjD1GjrHm6YLA+wMGKrBvvczBCcbw7lXXxJUqEYLS7OENSU9lHMnmaOhtVz+HlBniKWL8VkV61R2F81kfk46HsiE0gjPwJPwh7TnFG29pPd1APilzeByS0TWFo3rdePE6u9pwWQg/VT/+CFfnrH1tyrioITElkn8Wk+MIv0Dpv9
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info:
pzbvqBQaxRpExPueG9XMafymfdchuCd65Do0rbopfzdoGn4L1wYX/CQoWKLZMzhH7JaucrVgVWeLg5Ml4bXG4fswzOJwJGv9qpWAiSmGfZ7gJdCYSU9vhBla1qvXXFFb69G0MUfiUDGjHij6jVbEk6jksNATQTq3bui23meODAa6iZL7shLWO8VuhJePMYakS3s5vQO+xZ7P1CBhYt8qS2o11jwet4ghnBRCzya533ePSqMVZV7hygIugBF0WOu2kVrBR/alRPCSrFF02Lb+5F7GxM67DzjGgoJHAv4U3qkZ9O5qCCD/m7yfi7vfjRVrGwHlPxxAOMNh1NpUjy27kR6vhHXSyWnyaIG27Atv3B9oQbSjrV5I89ugZ0oMhgrWNtVjzE9RrqkSab+l5A2xFsjV6wUt/uqsDHSQcTXzPH7B5ZhMWhkjx/6S6BnZeVPhHct/YDh2FQXpqKeH7ADOp6YmFixyd0mHvkPAikJXIeOvYvN95/lURPmqkgbG4PEocnPXBYGVxW8vKtVbVaf0rwah958ArvxYCopgAYI/dXKUL7oZJgfyX2Gs719IhOYL
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
=?iso-8859-1?Q?I3ugpphfEiaJvcW01vf7+K7P/Vl+xn9mqHXH8SJkUMQVt08CsL82prVh1A?=
=?iso-8859-1?Q?tWDvkQORjcOHGM0bE+MNgYw9oxmOFD/Q3sXFM2MUjehFv7OvcNkVjGOefp?=
=?iso-8859-1?Q?PCB81n/MzVl5jh6XTi499ALeXDLaqXH8k055hb+Ii2o9JxAB1/HOnLOksx?=
=?iso-8859-1?Q?EjWjph9GVSBlG+dqWy2c4C9hOkJ5Kt/qqjLScGtUxg3LSM0+YW+EHiz13H?=
=?iso-8859-1?Q?jV7jyad65oh9QQF1izDoWeYfn3xtgqm5hOmnBuV3QRIDUdyRyPI0S16CYa?=
=?iso-8859-1?Q?qsdqnvT500eB5SQDVCO06V7DLIZHsJR/AyA7VNY+pnqNrWDSCT7EOD4p9W?=
=?iso-8859-1?Q?Iy5Di+SYqu/QG94dT9Qp2XYX89ffWNKPj+QjX+F5R0DxwAfyyM6QYdXxPL?=
=?iso-8859-1?Q?dPWckGtlqVhgf+dhf9mOTUtKHiiJEsLWcmr7KjRtmVy1QehuiywwnJmZp3?=
=?iso-8859-1?Q?14h9arlgUjYZy13sGHwyeiskwNslvlyoXZeGGaQXNMgsT2NA9Vc0ToUhGh?=
=?iso-8859-1?Q?sm/0kUwW8rGXoabWca665yMGkG+M0Fm7kjYEVLvmqSbhiTLGGpPZAoBzTb?=
=?iso-8859-1?Q?ov/7LhwxVOtKoaek9IDaRhQ2e0rFourzYhKCWV9PTE1ZaJoBMnpKpsE4Mt?=
=?iso-8859-1?Q?vR4u8VvWVBGDb4bXFCK3P9sAjiGxixcNPh/BKNHXADylzpn8KGnEeZr7Mu?=
=?iso-8859-1?Q?ec5Dk3rNwJZN9LESCWwRbmZvGvbqbsHrC+jDN++KpDbSIUyzI+ARsH7ExG?=
=?iso-8859-1?Q?jrqln/o8LrjhRgibL2zSOa5gP6eQLtco9XvyGxXOcWvR0R+meww+92CkbU?=
=?iso-8859-1?Q?qoq+Qpfc2yAidlqU5e3LewvjJ4F7q4fjpgk4xucV4HNsIhuYfB7YhJPWIq?=
=?iso-8859-1?Q?H8x8fGvFhCwAFFzQy7ZlokUXM0tJcKDTuyYEvatLEYQ0lyEPJ40iUZte2r?=
=?iso-8859-1?Q?urhU4PThIW5kr7Hu9opqlyE8x4R7Vj63s35qjE80cHIWVPppOlKkRCPTIa?=
=?iso-8859-1?Q?l7S7XEQWJXx7Z24cqZL7DF1+RQnGng930fpFrOT2po2PgilAseQfiGfwzo?=
=?iso-8859-1?Q?EIVZMpq5T8dMRIixfgl8D3EqrbC3lo12+Xq3DQyyJHDk+3zSvhEZOyrDSh?=
=?iso-8859-1?Q?nPbNKBUDos/+cJS0E/CFoSQwZVxIJThgDo49DXxkuG0HmM6MJSvbkDicYk?=
=?iso-8859-1?Q?SaqHhPa8Dnd6V0KCZaoEx89JEwlZoUIOqYQjJi2qX6ieFTiWGWrrALmsbI?=
=?iso-8859-1?Q?K1x87syOlEfHUo3HFnGA=3D=3D?=
Content-Type: multipart/alternative;
boundary="_000_PAVPR10MB74194155E4B405581B891ABFD6659PAVPR10MB7419EURP_"
MIME-Version: 1.0
X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-6b909.templateTenant
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PAVPR10MB7419.EURPRD10.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: a7f02904-cf43-49ae-2db3-08db469f3342
X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Apr 2023 21:42:57.6497
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR10MB5907
X-Spam_score: 15.4
X-Spam_score_int: 154
X-Spam_bar: +++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Good day, my name is Mr. Xolani Ramses a cousin brother to
Mr. Jacob Zuma (former president of South Africa). I want to transfer the
amount of US$38,000,000.00 dollars (Thirty Eight Million United Sta [...]
Content analysis details: (15.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[anathlotte49(at)hotmail.com]
1.2 MISSING_HEADERS Missing To: header
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[anathlotte49(at)hotmail.com]
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
2.5 MILLION_USD BODY: Talks about millions of dollars
1.0 HK_SCAM_N15 BODY: No description available.
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[40.92.90.104 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.92.90.104 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
1.4 MALFORMED_FREEMAIL Bad headers on message from free email service
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLY From and body contain different freemails
2.0 HK_SCAM No description available.
0.0 T_MONEY_PERCENT X% of a lot of money for you
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} ENGINEER Xolani
--_000_PAVPR10MB74194155E4B405581B891ABFD6659PAVPR10MB7419EURP_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Good day, my name is Mr. Xolani Ramses a cousin brother to Mr. Jacob Zuma (=
former president of South Africa). I want to transfer the amount of US$38,=
000,000.00 dollars (Thirty Eight Million United States Dollars) into your a=
ccount overseas for investment purposes.
Please I need your assistance for investment in any good business in your c=
ountry, my interest is in Construction, Real Estate, Agriculture, Transport=
ation or any business you may have knowledge of.
If you are interested, kindly contact me. I have mapped out 30% of the tota=
l sum for you and 70% will be used for investment purposes.
kindly contact :xolaniramses@gmail.com
Tel: +27
Yours faithfully
ENGINEER Xolani
--_000_PAVPR10MB74194155E4B405581B891ABFD6659PAVPR10MB7419EURP_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
1">
: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof ContentPasted0">
Good day, my name is Mr. Xolani Ramses a cousin brother to Mr. Jacob Zum=
a (former president of South Africa). I want to transfer the amount o=
f US$38,000,000.00 dollars (Thirty Eight Million United States Dollars) int=
o your account overseas for investment
purposes.
ENGINEER Xolani
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 26 Apr 2023 19:10:05 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1prq8O-000LPs-QZ
for dave@doctor.nl2k.ab.ca;
Wed, 26 Apr 2023 19:09:20 -0600
Resent-From: The Doctor
Resent-Date: Wed, 26 Apr 2023 19:09:20 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vi1eur05olkn2104.outbound.protection.outlook.com ([40.92.90.104]:42686 helo=EUR05-VI1-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from
id 1prmwp-0000xu-LE
for root@nk.ca;
Wed, 26 Apr 2023 15:45:15 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=A1iLqDXZn02TNNiSAtcRBafDWy4zvrgCKA9L6n5uKD+Y0zR0UzBSEVmR+tReho+dy4Swdj1HnNxd6G4JDD98KxRXtPpv+WARfEAH3pge/c9WXBELMKy9aJxJ30uu9TLhwFkQsCeQaLE38uM30SUFKjoX69ag/JMQMWvXKcaueLaLR/LB78+h1skvTVhLeoAA4rPYtybjHDBB9GRPDpLQ3BM3yuz6AciKaeoSJn8FshCfsAuMLjUYQuBufUmHHkgG7AcQryszValVK9ibTvdDoIqQhxm2Sli9MSLds+aEKeSV+0Nr9lJMBrfezQq+s6wjNgpi8cWEjUqyOcbNKJzCNg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=ElYp10CjljkK5cSUVCdTXWh7Nnc1RysvavSywhxpljE=;
b=RW+GESCDE3Ao3u232EfR7X45+64i4SUxBIiqpe+Zfued039xacvgU81wp6BvrIQCkr+g7XUC/DRdDgt/vyDY7aklrXYiDMYaurI9iKjL0XJb2W/kXtpCdl9Yi0mvXcY8QT4DxX3JlkKlgco567+KE47MlgRWVqUhgKgMXUPtqtv0aPpzesi2jQwN+JfEofMPPo09CVk8uWEisWTysnKsJIhzpWkCnyDnNMnP4Jwrh0AAnFzH/Ge+gCUa6/my09qRw3WXNHTLb0j2Mz7IS/6I7zEZuG1NqMimjrKSNU1bg9rZTRa0h8LNcnYxCENbq0/oxvd1oXeNAFLZdfi2ZamQZg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;
s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=ElYp10CjljkK5cSUVCdTXWh7Nnc1RysvavSywhxpljE=;
b=NKKuE4r6Hee90QMxggbmtEBLZE+n91vpikQVa8G2Toxv02xQA1syi57+NVKr/+ODaXcL1mkYd8efx5pedQn5AYkq4VHrrshlw0kJLI9YBDjK6nC3/qQCK/WeHU1OYU9l9onH3mmvpjkHMtjWuln+lrm5w8logLgZOSc14eyyVaV5hsOhfdD4pS0Q7bF4+AsUuOlGhht4PDUTilUzNW9KvqTVR9y/C2FXIAS2MYmsYvojglltW3aq1okTZTtUBOn6ga+4yxCYi7gHhL9k1+x77kaueoeg+Brxn0gbKnrDaq8SR96JPD5JU/tpkkf+aJipE3QrDr6/zBpu8UUZfLaqhw==
Received: from PAVPR10MB7419.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:102:30f::9)
by DB9PR10MB5907.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:39a::17) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6340.21; Wed, 26 Apr
2023 21:42:58 +0000
Received: from PAVPR10MB7419.EURPRD10.PROD.OUTLOOK.COM
([fe80::7922:d188:1e40:2628]) by PAVPR10MB7419.EURPRD10.PROD.OUTLOOK.COM
([fe80::7922:d188:1e40:2628%3]) with mapi id 15.20.6340.020; Wed, 26 Apr 2023
21:42:57 +0000
From: anath lotte
Subject: ENGINEER Xolani
Thread-Topic: ENGINEER Xolani
Thread-Index: AQHZeIgQWyboPhTRKUKSCC0vtdppLg==
Date: Wed, 26 Apr 2023 21:42:57 +0000
Message-ID:
Accept-Language: en-ZA, en-US
Content-Language: en-ZA
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
x-tmn: [OwRVa5as5+AfGmrhaAFySzdTMYXHhGt8]
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: PAVPR10MB7419:EE_|DB9PR10MB5907:EE_
x-ms-office365-filtering-correlation-id: a7f02904-cf43-49ae-2db3-08db469f3342
x-ms-exchange-slblob-mailprops:
ZRuQdVKRmYua/+882tIK+iVRzNeqqXiUxlO1muZ4qeWsYFh4/me5dC0+glr+GpEAWCJ8qHZt85Cixy+A+JUzRNfSHK5p/nSoVteFTJtvUXUBuo2ytZvMjHqZITSgOD3UmdsmBu0cMIRWrh6l9LtlaLMdWopVhh484GnEuyDno8fwKPFj3Z1o1IEsySKorSa87K/XTqDTBz5/f8w8tUpV9iatDfRhj3PdJzcNgMpI5faxUIcpXSgp45Iyu9uVTAtf/9r/1H5gmPDNUp/s8BqswQv1F3rUyDvnv+P5us8oxa9tsKmFAj5TbpRAAoRNt/wD6eYxWxSkULh94B+74QohVo8gmuQ7eQfE0tcI9sPn12A6247PTX4Ls4dEWM0c3aiyB0SS60t/vdWwLdJDmENUCkXHYEgYerT4c98QJ8p5r/IeD6mEEf9x497UbuoLT03yKKxv0074zY8zsqqKE9lJWhQAJGmp0uioOKarA8KaT2a1Qvnf7GJYrv6/bQdOlMt1crN8BHDwacWRczvTSOaS3LjtfsJ+ueF7dW8N7v4XH3/Ywpmu3kUzcvjD1GjrHm6YLA+wMGKrBvvczBCcbw7lXXxJUqEYLS7OENSU9lHMnmaOhtVz+HlBniKWL8VkV61R2F81kfk46HsiE0gjPwJPwh7TnFG29pPd1APilzeByS0TWFo3rdePE6u9pwWQg/VT/+CFfnrH1tyrioITElkn8Wk+MIv0Dpv9
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info:
pzbvqBQaxRpExPueG9XMafymfdchuCd65Do0rbopfzdoGn4L1wYX/CQoWKLZMzhH7JaucrVgVWeLg5Ml4bXG4fswzOJwJGv9qpWAiSmGfZ7gJdCYSU9vhBla1qvXXFFb69G0MUfiUDGjHij6jVbEk6jksNATQTq3bui23meODAa6iZL7shLWO8VuhJePMYakS3s5vQO+xZ7P1CBhYt8qS2o11jwet4ghnBRCzya533ePSqMVZV7hygIugBF0WOu2kVrBR/alRPCSrFF02Lb+5F7GxM67DzjGgoJHAv4U3qkZ9O5qCCD/m7yfi7vfjRVrGwHlPxxAOMNh1NpUjy27kR6vhHXSyWnyaIG27Atv3B9oQbSjrV5I89ugZ0oMhgrWNtVjzE9RrqkSab+l5A2xFsjV6wUt/uqsDHSQcTXzPH7B5ZhMWhkjx/6S6BnZeVPhHct/YDh2FQXpqKeH7ADOp6YmFixyd0mHvkPAikJXIeOvYvN95/lURPmqkgbG4PEocnPXBYGVxW8vKtVbVaf0rwah958ArvxYCopgAYI/dXKUL7oZJgfyX2Gs719IhOYL
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
=?iso-8859-1?Q?I3ugpphfEiaJvcW01vf7+K7P/Vl+xn9mqHXH8SJkUMQVt08CsL82prVh1A?=
=?iso-8859-1?Q?tWDvkQORjcOHGM0bE+MNgYw9oxmOFD/Q3sXFM2MUjehFv7OvcNkVjGOefp?=
=?iso-8859-1?Q?PCB81n/MzVl5jh6XTi499ALeXDLaqXH8k055hb+Ii2o9JxAB1/HOnLOksx?=
=?iso-8859-1?Q?EjWjph9GVSBlG+dqWy2c4C9hOkJ5Kt/qqjLScGtUxg3LSM0+YW+EHiz13H?=
=?iso-8859-1?Q?jV7jyad65oh9QQF1izDoWeYfn3xtgqm5hOmnBuV3QRIDUdyRyPI0S16CYa?=
=?iso-8859-1?Q?qsdqnvT500eB5SQDVCO06V7DLIZHsJR/AyA7VNY+pnqNrWDSCT7EOD4p9W?=
=?iso-8859-1?Q?Iy5Di+SYqu/QG94dT9Qp2XYX89ffWNKPj+QjX+F5R0DxwAfyyM6QYdXxPL?=
=?iso-8859-1?Q?dPWckGtlqVhgf+dhf9mOTUtKHiiJEsLWcmr7KjRtmVy1QehuiywwnJmZp3?=
=?iso-8859-1?Q?14h9arlgUjYZy13sGHwyeiskwNslvlyoXZeGGaQXNMgsT2NA9Vc0ToUhGh?=
=?iso-8859-1?Q?sm/0kUwW8rGXoabWca665yMGkG+M0Fm7kjYEVLvmqSbhiTLGGpPZAoBzTb?=
=?iso-8859-1?Q?ov/7LhwxVOtKoaek9IDaRhQ2e0rFourzYhKCWV9PTE1ZaJoBMnpKpsE4Mt?=
=?iso-8859-1?Q?vR4u8VvWVBGDb4bXFCK3P9sAjiGxixcNPh/BKNHXADylzpn8KGnEeZr7Mu?=
=?iso-8859-1?Q?ec5Dk3rNwJZN9LESCWwRbmZvGvbqbsHrC+jDN++KpDbSIUyzI+ARsH7ExG?=
=?iso-8859-1?Q?jrqln/o8LrjhRgibL2zSOa5gP6eQLtco9XvyGxXOcWvR0R+meww+92CkbU?=
=?iso-8859-1?Q?qoq+Qpfc2yAidlqU5e3LewvjJ4F7q4fjpgk4xucV4HNsIhuYfB7YhJPWIq?=
=?iso-8859-1?Q?H8x8fGvFhCwAFFzQy7ZlokUXM0tJcKDTuyYEvatLEYQ0lyEPJ40iUZte2r?=
=?iso-8859-1?Q?urhU4PThIW5kr7Hu9opqlyE8x4R7Vj63s35qjE80cHIWVPppOlKkRCPTIa?=
=?iso-8859-1?Q?l7S7XEQWJXx7Z24cqZL7DF1+RQnGng930fpFrOT2po2PgilAseQfiGfwzo?=
=?iso-8859-1?Q?EIVZMpq5T8dMRIixfgl8D3EqrbC3lo12+Xq3DQyyJHDk+3zSvhEZOyrDSh?=
=?iso-8859-1?Q?nPbNKBUDos/+cJS0E/CFoSQwZVxIJThgDo49DXxkuG0HmM6MJSvbkDicYk?=
=?iso-8859-1?Q?SaqHhPa8Dnd6V0KCZaoEx89JEwlZoUIOqYQjJi2qX6ieFTiWGWrrALmsbI?=
=?iso-8859-1?Q?K1x87syOlEfHUo3HFnGA=3D=3D?=
Content-Type: multipart/alternative;
boundary="_000_PAVPR10MB74194155E4B405581B891ABFD6659PAVPR10MB7419EURP_"
MIME-Version: 1.0
X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-6b909.templateTenant
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PAVPR10MB7419.EURPRD10.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: a7f02904-cf43-49ae-2db3-08db469f3342
X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Apr 2023 21:42:57.6497
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR10MB5907
X-Spam_score: 15.4
X-Spam_score_int: 154
X-Spam_bar: +++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Good day, my name is Mr. Xolani Ramses a cousin brother to
Mr. Jacob Zuma (former president of South Africa). I want to transfer the
amount of US$38,000,000.00 dollars (Thirty Eight Million United Sta [...]
Content analysis details: (15.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[anathlotte49(at)hotmail.com]
1.2 MISSING_HEADERS Missing To: header
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[anathlotte49(at)hotmail.com]
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
2.5 MILLION_USD BODY: Talks about millions of dollars
1.0 HK_SCAM_N15 BODY: No description available.
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[40.92.90.104 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.92.90.104 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
1.4 MALFORMED_FREEMAIL Bad headers on message from free email service
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 FREEMAIL_REPLY From and body contain different freemails
2.0 HK_SCAM No description available.
0.0 T_MONEY_PERCENT X% of a lot of money for you
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} ENGINEER Xolani
--_000_PAVPR10MB74194155E4B405581B891ABFD6659PAVPR10MB7419EURP_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Good day, my name is Mr. Xolani Ramses a cousin brother to Mr. Jacob Zuma (=
former president of South Africa). I want to transfer the amount of US$38,=
000,000.00 dollars (Thirty Eight Million United States Dollars) into your a=
ccount overseas for investment purposes.
Please I need your assistance for investment in any good business in your c=
ountry, my interest is in Construction, Real Estate, Agriculture, Transport=
ation or any business you may have knowledge of.
If you are interested, kindly contact me. I have mapped out 30% of the tota=
l sum for you and 70% will be used for investment purposes.
kindly contact :xolaniramses@gmail.com
Tel: +27
Yours faithfully
ENGINEER Xolani
--_000_PAVPR10MB74194155E4B405581B891ABFD6659PAVPR10MB7419EURP_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
1">
: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof ContentPasted0">
Good day, my name is Mr. Xolani Ramses a cousin brother to Mr. Jacob Zum=
a (former president of South Africa). I want to transfer the amount o=
f US$38,000,000.00 dollars (Thirty Eight Million United States Dollars) int=
o your account overseas for investment
purposes.
Please I need your assistance for investme=
nt in any good business in your country, my interest is in Construction, Re=
al Estate, Agriculture, Transportation or any business you may have knowled=
ge of.
nt in any good business in your country, my interest is in Construction, Re=
al Estate, Agriculture, Transportation or any business you may have knowled=
ge of.
If you are interested, kindly contact me. =
I have mapped out 30% of the total sum for you and 70% will be used for inv=
estment purposes.
I have mapped out 30% of the total sum for you and 70% will be used for inv=
estment purposes.
kindly contact :xolaniramses@gmail.com=
Tel: +27 =
; &nb=
sp;
; &nb=
sp;
Yours faithfully &nbs=
p; &n=
bsp; =
p; &n=
bsp; =
ENGINEER Xolani
--_000_PAVPR10MB74194155E4B405581B891ABFD6659PAVPR10MB7419EURP_--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments