More investment spam
Posted by Dave Yadallee on
From - Sun Feb 23 06:17:28 2014
X-Account-Key: account2
X-UIDL: 00056f2c501fb806
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-path:
Envelope-to: aboo@doctor.nl2k.ab.ca
Delivery-date: Sun, 23 Feb 2014 06:16:05 -0700
Received: from root by doctor.nl2k.ab.ca with local (Exim 4.82)
(envelope-from)
id 1WHYVt-0001S1-CN; Sun, 23 Feb 2014 05:50:33 -0700
Resent-From: root@doctor.nl2k.ab.ca
Resent-Date: Sun, 23 Feb 2014 05:50:33 -0700
Resent-Message-ID: <20140223125033.GC4133@doctor.nl2k.ab.ca>
Resent-To: Dave Yadallee,
See root
Received: from sa11.bezeqint.net ([192.115.104.25])
by doctor.nl2k.ab.ca with esmtp (Exim 4.82)
(envelope-from)
id 1WHYUA-0001Du-RQ
for doctor@nl2k.ab.ca; Sun, 23 Feb 2014 05:49:18 -0700
Received: from User (bzq-84-109-70-103.red.bezeqint.net [84.109.70.103])
by sa11.bezeqint.net (Bezeq International SMTP out Mail Server) with SMTP id 289F525CDD8;
Sun, 23 Feb 2014 14:24:46 +0200 (IST)
Reply-To:
From: "Victor Ibe"
Subject: From Mr. Victor Ibe/Inheritance Proposal To You.
Date: Sun, 23 Feb 2014 14:24:44 +0200
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0043_01C2A9A6.24059D16"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam_score: 18.5
X-Spam_score_int: 185
X-Spam_bar: ++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "gallifrey.nk.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Kindly view attachment of my business proposal worth US$10.5
million and get back to me as soon as possible [...]
Content analysis details: (18.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[192.115.104.25 listed in psbl.surriel.com]
1.2 NSL_RCVD_FROM_USER Received from User
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see]
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.2 MISSING_HEADERS Missing To: header
0.4 OBFU_TEXT_ATTACH BODY: Text attachment with non-text MIME type
0.1 MISSING_MID Missing Message-Id: header
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FROM_MISSPACED From: missing whitespace
1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC
0.5 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.9 FROM_MISSP_NO_TO From misspaced, To missing
0.0 T_OBFU_ATTACH_MISSP Obfuscated attachment type and misspaced From
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
1.5 FROM_MISSP_USER From misspaced, from "User"
2.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
Subject: {SPAM?} From Mr. Victor Ibe/Inheritance Proposal To You.
This is a multi-part message in MIME format.
------=_NextPart_000_0043_01C2A9A6.24059D16
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
Kindly view attachment of my business proposal worth US$10.5 million and get back to me as soon as possible
------=_NextPart_000_0043_01C2A9A6.24059D16
Content-Type: application/octet-stream;
name="UBA.txt"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="UBA.txt"
QXR0bjoNCg0KSSBhbSBhIENoYXJ0ZXJlZCBBY2NvdW50YW50IHdpdGggdGhl
IFVOSVRFRCBCQU5LIEZPUiBBRlJJQ0EoVUJBKSwgTXkgbmFtZSBpcyBNci4g
VmljdG9yIEliZSwgSSBhbSB0aGUgcGVyc29uYWwgQWNjb3VudCBNYW5hZ2Vy
IHRvIExhdGUgRW5nLiBQZXRlciBXLiBhIGNvbnRyYWN0IHdhcyBhd2FyZGVk
IHRvIG91ciBjbGllbnRzIEJ5IE5OUEMgb2ZmaWNpYWxzIHRvIExhdGUgUGV0
ZXIuIFdobyBpcyBhIGNpdGl6ZW4gb2YgVW5pdGVkIFN0YXRlcyBvZiBBbWVy
aWNhIHdobyB1c2VkIHRvIHdvcmsgd2l0aCBhbiBPaWwgRGV2ZWxvcG1lbnQg
Y29tcGFueSBpbiBOaWdlcmlhPyBOTlBDIChOSUdFUklBIE5BVElPTkFMIFBF
VFJPTEVVTSBDT01QQU5ZKS4NCg0KSGVyZSBpbiBhZnRlciBzaGFsbCBiZSBy
ZWZlcnJlZCB0byBhcyBteSBjbGllbnQgT24gQXByaWwgMjEsIDIwMDIsIG15
IGNsaWVudCwgaGlzIHdpZmUsIGFuZCB0aGVpciB0aHJlZSBjaGlsZHJlbiB3
ZXJlIGludm9sdmVkIGluIGEgY2FyIGFjY2lkZW50IGFsb25nIFNhZ2FtdSBl
eHByZXNzIHdheS4gQWxsIG9jY3VwYW50cyBvZiB0aGUgdmVoaWNsZSB1bmZv
cnR1bmF0ZWx5IGxvc3QgdGhlaXIgbGl2ZXMuIFNpbmNlIHRoZW4sIEkgaGF2
ZSBtYWRlIHNldmVyYWwgZW5xdWlyaWVzIHRvIGhpcyBlbWJhc3N5IHRvIGxv
Y2F0ZSBhbnkgb2YgbXkgY2xpZW50cyBleHRlbmRlZCBSZWxhdGl2ZXMsIHRo
aXMgYWxzbyBwcm92ZWQgdW5zdWNjZXNzZnVsLiBBZnRlciB0aGVzZSBzZXZl
cmFsIHVuc3VjY2Vzc2Z1bCBhdHRlbXB0cywgSSBkZWNpZGVkIHRvIHRyYWNl
IGhpcyBsYXN0IG5hbWUgb3ZlciB0aGUgSW50ZXJuZXQgdG8gbG9jYXRlIGFu
eSBtZW1iZXIgb2YgaGlzIGZhbWlseSBidXQgYWxsIGluIHZhaW4uDQoNCkkg
aGF2ZSBjb250YWN0ZWQgeW91IHRvIGFzc2lzdCBpbiByZXBhdHJpYXRpbmcg
dGhlIG1vbmV5IGFuZCBwcm9wZXJ0eSBsZWZ0IGJlaGluZCBieSBteSBjbGll
bnQgYmVmb3JlIHRoZXkgR2V0IGNvbmZpc2NhdGVkIG9yIGRlY2xhcmVkIHVu
c2VydmljZWFibGUgYnkgdGhlIGJhbmsgd2hlcmUgdGhpcyBodWdlIGRlcG9z
aXRzIHdlcmUgbG9kZ2VkLCBwYXJ0aWN1bGFybHkgdGhlIFVOSVRFRCBCQU5L
IEZPUiBBRlJJQ0EgKFVCQSkgUExDLldoZXJlIHRoZSBkZWNlYXNlZCBoYWQg
YW4gYWNjb3VudCBWYWx1ZWQgYXQgYWJvdXQgKFVTRDEwLjUgTWlsbGlvbiBV
UyBkb2xsYXJzKSBoYXMgSXNzdWVkIG1lIGEgbm90aWNlIHRvIHByb3ZpZGUg
dGhlIG5leHQgb2Yga2luIG9yIGhhdmUgdGhlIGFjY291bnQgY29uZmlzY2F0
ZWQgd2l0aGluIHRoZSBuZXh0IHRlbiBvZmZpY2lhbCB3b3JraW5nIGRheXMu
DQoNClNpbmNlIEkgaGF2ZSBiZWVuIHVuc3VjY2Vzc2Z1bCBpbiBsb2NhdGlu
ZyB0aGUgcmVsYXRpdmVzIGZvciBvdmVyIDIgeWVhcnMgbm93LiBJIHNlZWsg
eW91ciBjb25zZW50IHRvIHByZXNlbnQgeW91IGFzIHRoZSBuZXh0IG9mIGtp
biBvZiB0aGUgZGVjZWFzZWQgc2luY2UgaSBjYW4gY29uZmlkZSBpbiB5b3Ug
c28gdGhhdCB0aGUgcHJvY2VlZHMgb2YgdGhpcyBhY2NvdW50IHZhbHVlZCBh
dCAoVVNEMTAuNSBtaWxsaW9uIFVTIGRvbGxhcnMpIGNhbiBiZSBwYWlkIHRv
IHlvdSBhbmQgdGhlbiBteXNlbGYgYW5kIHlvdSBjYW4gc2hhcmUgdGhlIG1v
bmV5LCA2MCUgdG8gbWUgYW5kIDQwJSB0byB5b3UuDQoNCkFuIGF0dG9ybmV5
IHdpbGwgYmUgY29udGFjdGVkIHRvIGhlbHAgcmV2YWxpZGF0ZSBhbmQgbm90
YXJpemUgYWxsIHRoZSBuZWNlc3NhcnkgbGVnYWwgZG9jdW1lbnRzIHRoYXQg
Y2FuIGJlIHVzZWQgdG8gYmFjayB1cCBhbnkgY2xhaW0gd2UgbWF5IG1ha2Uu
IEFsbCBJIHJlcXVpcmUgaXMgeW91ciBob25lc3QgY29vcGVyYXRpb24gdG8g
ZW5hYmxlIHVzIHNlZWluZyB0aGlzIGRlYWwgdGhyb3VnaC4gSSBndWFyYW50
ZWUgdGhhdCB0aGlzIHdpbGwgYmUgZXhlY3V0ZWQgdW5kZXIgbGVnaXRpbWF0
ZSBhcnJhbmdlbWVudCB0aGF0IHdpbGwgcHJvdGVjdCB5b3UgZnJvbSBhbnkg
YnJlYWNoIG9mIHRoZSBsYXcuIERvIGdldCBiYWNrIHRvIG1lIG9uIHRoaXMg
bXkgZW1haWwgYWRkcmVzcyAobXJ2aWN0b3JpYmVAcXEuY29tKQ0KDQpSZXNw
ZWN0ZnVsbHkgWW91cnMNCg0KTXIuIFZpY3RvciBJYmUu
------=_NextPart_000_0043_01C2A9A6.24059D16--
X-Account-Key: account2
X-UIDL: 00056f2c501fb806
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-path:
Envelope-to: aboo@doctor.nl2k.ab.ca
Delivery-date: Sun, 23 Feb 2014 06:16:05 -0700
Received: from root by doctor.nl2k.ab.ca with local (Exim 4.82)
(envelope-from
id 1WHYVt-0001S1-CN; Sun, 23 Feb 2014 05:50:33 -0700
Resent-From: root@doctor.nl2k.ab.ca
Resent-Date: Sun, 23 Feb 2014 05:50:33 -0700
Resent-Message-ID: <20140223125033.GC4133@doctor.nl2k.ab.ca>
Resent-To: Dave Yadallee
See root
Received: from sa11.bezeqint.net ([192.115.104.25])
by doctor.nl2k.ab.ca with esmtp (Exim 4.82)
(envelope-from
id 1WHYUA-0001Du-RQ
for doctor@nl2k.ab.ca; Sun, 23 Feb 2014 05:49:18 -0700
Received: from User (bzq-84-109-70-103.red.bezeqint.net [84.109.70.103])
by sa11.bezeqint.net (Bezeq International SMTP out Mail Server) with SMTP id 289F525CDD8;
Sun, 23 Feb 2014 14:24:46 +0200 (IST)
Reply-To:
From: "Victor Ibe"
Subject: From Mr. Victor Ibe/Inheritance Proposal To You.
Date: Sun, 23 Feb 2014 14:24:44 +0200
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0043_01C2A9A6.24059D16"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam_score: 18.5
X-Spam_score_int: 185
X-Spam_bar: ++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "gallifrey.nk.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Kindly view attachment of my business proposal worth US$10.5
million and get back to me as soon as possible [...]
Content analysis details: (18.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[192.115.104.25 listed in psbl.surriel.com]
1.2 NSL_RCVD_FROM_USER Received from User
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.2 MISSING_HEADERS Missing To: header
0.4 OBFU_TEXT_ATTACH BODY: Text attachment with non-text MIME type
0.1 MISSING_MID Missing Message-Id: header
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FROM_MISSPACED From: missing whitespace
1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC
0.5 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.9 FROM_MISSP_NO_TO From misspaced, To missing
0.0 T_OBFU_ATTACH_MISSP Obfuscated attachment type and misspaced From
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
1.5 FROM_MISSP_USER From misspaced, from "User"
2.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
Subject: {SPAM?} From Mr. Victor Ibe/Inheritance Proposal To You.
This is a multi-part message in MIME format.
------=_NextPart_000_0043_01C2A9A6.24059D16
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
Kindly view attachment of my business proposal worth US$10.5 million and get back to me as soon as possible
------=_NextPart_000_0043_01C2A9A6.24059D16
Content-Type: application/octet-stream;
name="UBA.txt"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="UBA.txt"
QXR0bjoNCg0KSSBhbSBhIENoYXJ0ZXJlZCBBY2NvdW50YW50IHdpdGggdGhl
IFVOSVRFRCBCQU5LIEZPUiBBRlJJQ0EoVUJBKSwgTXkgbmFtZSBpcyBNci4g
VmljdG9yIEliZSwgSSBhbSB0aGUgcGVyc29uYWwgQWNjb3VudCBNYW5hZ2Vy
IHRvIExhdGUgRW5nLiBQZXRlciBXLiBhIGNvbnRyYWN0IHdhcyBhd2FyZGVk
IHRvIG91ciBjbGllbnRzIEJ5IE5OUEMgb2ZmaWNpYWxzIHRvIExhdGUgUGV0
ZXIuIFdobyBpcyBhIGNpdGl6ZW4gb2YgVW5pdGVkIFN0YXRlcyBvZiBBbWVy
aWNhIHdobyB1c2VkIHRvIHdvcmsgd2l0aCBhbiBPaWwgRGV2ZWxvcG1lbnQg
Y29tcGFueSBpbiBOaWdlcmlhPyBOTlBDIChOSUdFUklBIE5BVElPTkFMIFBF
VFJPTEVVTSBDT01QQU5ZKS4NCg0KSGVyZSBpbiBhZnRlciBzaGFsbCBiZSBy
ZWZlcnJlZCB0byBhcyBteSBjbGllbnQgT24gQXByaWwgMjEsIDIwMDIsIG15
IGNsaWVudCwgaGlzIHdpZmUsIGFuZCB0aGVpciB0aHJlZSBjaGlsZHJlbiB3
ZXJlIGludm9sdmVkIGluIGEgY2FyIGFjY2lkZW50IGFsb25nIFNhZ2FtdSBl
eHByZXNzIHdheS4gQWxsIG9jY3VwYW50cyBvZiB0aGUgdmVoaWNsZSB1bmZv
cnR1bmF0ZWx5IGxvc3QgdGhlaXIgbGl2ZXMuIFNpbmNlIHRoZW4sIEkgaGF2
ZSBtYWRlIHNldmVyYWwgZW5xdWlyaWVzIHRvIGhpcyBlbWJhc3N5IHRvIGxv
Y2F0ZSBhbnkgb2YgbXkgY2xpZW50cyBleHRlbmRlZCBSZWxhdGl2ZXMsIHRo
aXMgYWxzbyBwcm92ZWQgdW5zdWNjZXNzZnVsLiBBZnRlciB0aGVzZSBzZXZl
cmFsIHVuc3VjY2Vzc2Z1bCBhdHRlbXB0cywgSSBkZWNpZGVkIHRvIHRyYWNl
IGhpcyBsYXN0IG5hbWUgb3ZlciB0aGUgSW50ZXJuZXQgdG8gbG9jYXRlIGFu
eSBtZW1iZXIgb2YgaGlzIGZhbWlseSBidXQgYWxsIGluIHZhaW4uDQoNCkkg
aGF2ZSBjb250YWN0ZWQgeW91IHRvIGFzc2lzdCBpbiByZXBhdHJpYXRpbmcg
dGhlIG1vbmV5IGFuZCBwcm9wZXJ0eSBsZWZ0IGJlaGluZCBieSBteSBjbGll
bnQgYmVmb3JlIHRoZXkgR2V0IGNvbmZpc2NhdGVkIG9yIGRlY2xhcmVkIHVu
c2VydmljZWFibGUgYnkgdGhlIGJhbmsgd2hlcmUgdGhpcyBodWdlIGRlcG9z
aXRzIHdlcmUgbG9kZ2VkLCBwYXJ0aWN1bGFybHkgdGhlIFVOSVRFRCBCQU5L
IEZPUiBBRlJJQ0EgKFVCQSkgUExDLldoZXJlIHRoZSBkZWNlYXNlZCBoYWQg
YW4gYWNjb3VudCBWYWx1ZWQgYXQgYWJvdXQgKFVTRDEwLjUgTWlsbGlvbiBV
UyBkb2xsYXJzKSBoYXMgSXNzdWVkIG1lIGEgbm90aWNlIHRvIHByb3ZpZGUg
dGhlIG5leHQgb2Yga2luIG9yIGhhdmUgdGhlIGFjY291bnQgY29uZmlzY2F0
ZWQgd2l0aGluIHRoZSBuZXh0IHRlbiBvZmZpY2lhbCB3b3JraW5nIGRheXMu
DQoNClNpbmNlIEkgaGF2ZSBiZWVuIHVuc3VjY2Vzc2Z1bCBpbiBsb2NhdGlu
ZyB0aGUgcmVsYXRpdmVzIGZvciBvdmVyIDIgeWVhcnMgbm93LiBJIHNlZWsg
eW91ciBjb25zZW50IHRvIHByZXNlbnQgeW91IGFzIHRoZSBuZXh0IG9mIGtp
biBvZiB0aGUgZGVjZWFzZWQgc2luY2UgaSBjYW4gY29uZmlkZSBpbiB5b3Ug
c28gdGhhdCB0aGUgcHJvY2VlZHMgb2YgdGhpcyBhY2NvdW50IHZhbHVlZCBh
dCAoVVNEMTAuNSBtaWxsaW9uIFVTIGRvbGxhcnMpIGNhbiBiZSBwYWlkIHRv
IHlvdSBhbmQgdGhlbiBteXNlbGYgYW5kIHlvdSBjYW4gc2hhcmUgdGhlIG1v
bmV5LCA2MCUgdG8gbWUgYW5kIDQwJSB0byB5b3UuDQoNCkFuIGF0dG9ybmV5
IHdpbGwgYmUgY29udGFjdGVkIHRvIGhlbHAgcmV2YWxpZGF0ZSBhbmQgbm90
YXJpemUgYWxsIHRoZSBuZWNlc3NhcnkgbGVnYWwgZG9jdW1lbnRzIHRoYXQg
Y2FuIGJlIHVzZWQgdG8gYmFjayB1cCBhbnkgY2xhaW0gd2UgbWF5IG1ha2Uu
IEFsbCBJIHJlcXVpcmUgaXMgeW91ciBob25lc3QgY29vcGVyYXRpb24gdG8g
ZW5hYmxlIHVzIHNlZWluZyB0aGlzIGRlYWwgdGhyb3VnaC4gSSBndWFyYW50
ZWUgdGhhdCB0aGlzIHdpbGwgYmUgZXhlY3V0ZWQgdW5kZXIgbGVnaXRpbWF0
ZSBhcnJhbmdlbWVudCB0aGF0IHdpbGwgcHJvdGVjdCB5b3UgZnJvbSBhbnkg
YnJlYWNoIG9mIHRoZSBsYXcuIERvIGdldCBiYWNrIHRvIG1lIG9uIHRoaXMg
bXkgZW1haWwgYWRkcmVzcyAobXJ2aWN0b3JpYmVAcXEuY29tKQ0KDQpSZXNw
ZWN0ZnVsbHkgWW91cnMNCg0KTXIuIFZpY3RvciBJYmUu
------=_NextPart_000_0043_01C2A9A6.24059D16--