Urgent business proposition spam from Russia
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 10 Dec 2025 20:13:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vTX6B-0000000076h-29ap
for dave@doctor.nl2k.ab.ca;
Wed, 10 Dec 2025 20:12:11 -0700
Resent-From: The Doctor
Resent-Date: Wed, 10 Dec 2025 20:12:11 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail.sitrak-bts.ru ([90.154.1.42]:41584)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vTUVC-00000000LlC-1hNr
for sales@nk.ca;
Wed, 10 Dec 2025 17:26:00 -0700
Received: from DESKTOP-6Q4CECK.lan (_gateway [192.168.1.3])
by mail.sitrak-bts.ru (Postfix) with ESMTP id 3E20997AF3;
Thu, 11 Dec 2025 02:06:46 +0300 (MSK)
Content-Type: multipart/alternative; boundary="===============1304625373=="
MIME-Version: 1.0
Subject: URGENT BUSINESS PROPOSITION.
To: Recipients
From: normasher@yandex.com
Date: Thu, 11 Dec 2025 01:05:42 +0200
Message-Id: <20251210230646.3E20997AF3@mail.sitrak-bts.ru>
X-Spam_score: 16.0
X-Spam_score_int: 160
X-Spam_bar: ++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: FROM THE DESK OF:MR.NORM ASHER. ACCOUNTANT AND AUDITOR MANAGER
ABSA BANK OF REPUBLIC OF SOUTH AFRICA. TELEPHONE:+27 PRIVATE E-MAIL ADDRESS:
I work as the Accountant and Auditor Manager at Absa bank [...]
Content analysis details: (16.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[90.154.1.42 listed in will-spam-for-food.eu.org]
[90.154.1.42 listed in will-spam-for-food.eu.org]
[90.154.1.42 listed in will-spam-for-food.eu.org]
[90.154.1.42 listed in will-spam-for-food.eu.org]
[90.154.1.42 listed in will-spam-for-food.eu.org]
[90.154.1.42 listed in will-spam-for-food.eu.org]
[90.154.1.42 listed in will-spam-for-food.eu.org]
[90.154.1.42 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[90.154.1.42 listed in dnsbl.ahbl.org]
[90.154.1.42 listed in dnsbl.ahbl.org]
[90.154.1.42 listed in dnsbl.ahbl.org]
[90.154.1.42 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[90.154.1.42 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[90.154.1.42 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[90.154.1.42 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[90.154.1.42 listed in dnsbl.ahbl.org]
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[normasher(at)yandex.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.9 URG_BIZ BODY: Contains urgent matter
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 SPOOFED_FREEMAIL No description available.
1.0 XFER_LOTSA_MONEY Transfer a lot of money
2.0 MIXED_HREF_CASE Has href in mixed case
0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases
3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} URGENT BUSINESS PROPOSITION.
You will not see this in a MIME-aware mail reader.
--===============1304625373==
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
=
FROM THE DESK OF:MR.NORM ASHER.
ACCOUNTANT AND AUDITOR MANAGER =
ABSA BANK OF REPUBLIC OF SOUTH AFRICA.
TELEPHONE:+27 =
PRIVATE E-MAIL ADDRESS: n.asher@inbox.lv
ATTENTION:
I work as the Accountant and Auditor Manager at Absa bank Republic of South=
Africa. I have a very confidential business proposition for you.
There are unclaimed huge funds amounting to the sum of (USA$15 MILLION) lyi=
ng in our bank that belongs to a foreign customer who died of the covid-19 =
pandemic.
However, I am seeking for your good collaboration to transfer the funds to =
you as the immediate relative for our both benefit during these difficult t=
imes.
Kindly reply to me through my above E-Mail Address once you have read thi=
s letter and declare your interest to enable me to send to you more rel=
evant information for us to archive this transaction and meet in person to=
enable both of us share the funds accordingly.
Thank You.
Yours Sincerely.
Mr.Norm Asher.
=20
--===============1304625373==
Content-Type: text/html; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
=3Diso-8859-1"/>
FROM THE DESK OF:MR.NORM ASHER.
R>ACCOUNTANT AND AUDITOR MANAGER
ABSA BANK OF REPUBLIC OF SOUTH AFRICA.=
TELEPHONE:+27
PRIVATE E-MAIL ADDRESS:
:n.asher@inbox.lv">n.asher@inbox.lv
ATTENTION:
I work as the Acco=
untant and Auditor Manager at Absa bank Republic of South Africa. I have a =
very confidential business proposition for you.
There are unclaimed huge=
funds amounting to the sum of (USA$15 MILLION) lying in our bank that belo=
ngs to a foreign customer who died of the covid-19 pandemic.
However, I =
am seeking for your good collaboration to transfer the funds to you as the =
immediate relative for our both benefit during these difficult times.
Ki=
ndly reply to me through my above E-Mail Address once you have =
read this letter and declare your interest to enable me t=
o send to you more relevant information for us to archive this transa=
ction and meet in person to enable both of us share =
the funds accordingly.
Thank You.
Yours Sincerely.
Mr.Norm Asher.=
--===============1304625373==--