More investment spam

From - Sun Feb 23 06:17:28 2014

X-Account-Key: account2

X-UIDL: 00056f2c501fb806

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: aboo@doctor.nl2k.ab.ca

Delivery-date: Sun, 23 Feb 2014 06:16:05 -0700

Received: from root by doctor.nl2k.ab.ca with local (Exim 4.82)

(envelope-from )

id 1WHYVt-0001S1-CN; Sun, 23 Feb 2014 05:50:33 -0700

Resent-From: root@doctor.nl2k.ab.ca

Resent-Date: Sun, 23 Feb 2014 05:50:33 -0700

Resent-Message-ID: <20140223125033.GC4133@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee ,

See root

Received: from sa11.bezeqint.net ([192.115.104.25])

by doctor.nl2k.ab.ca with esmtp (Exim 4.82)

(envelope-from )

id 1WHYUA-0001Du-RQ

for doctor@nl2k.ab.ca; Sun, 23 Feb 2014 05:49:18 -0700

Received: from User (bzq-84-109-70-103.red.bezeqint.net [84.109.70.103])

by sa11.bezeqint.net (Bezeq International SMTP out Mail Server) with SMTP id 289F525CDD8;

Sun, 23 Feb 2014 14:24:46 +0200 (IST)

Reply-To:

From: "Victor Ibe"

Subject: From Mr. Victor Ibe/Inheritance Proposal To You.

Date: Sun, 23 Feb 2014 14:24:44 +0200

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_NextPart_000_0043_01C2A9A6.24059D16"

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

X-Spam_score: 18.5

X-Spam_score_int: 185

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "gallifrey.nk.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: Kindly view attachment of my business proposal worth US$10.5

million and get back to me as soon as possible [...]



Content analysis details: (18.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[192.115.104.25 listed in psbl.surriel.com]

1.2 NSL_RCVD_FROM_USER Received from User

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

1.2 MISSING_HEADERS Missing To: header

0.4 OBFU_TEXT_ATTACH BODY: Text attachment with non-text MIME type

0.1 MISSING_MID Missing Message-Id: header

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 FROM_MISSPACED From: missing whitespace

1.9 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC

0.5 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool

1.9 FROM_MISSP_NO_TO From misspaced, To missing

0.0 T_OBFU_ATTACH_MISSP Obfuscated attachment type and misspaced From

0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope

1.5 FROM_MISSP_USER From misspaced, from "User"

2.0 MONEY_FROM_MISSP Lots of money and misspaced From

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

Subject: {SPAM?} From Mr. Victor Ibe/Inheritance Proposal To You.



This is a multi-part message in MIME format.



------=_NextPart_000_0043_01C2A9A6.24059D16

Content-Type: text/plain;

charset="Windows-1251"

Content-Transfer-Encoding: 7bit



Kindly view attachment of my business proposal worth US$10.5 million and get back to me as soon as possible



------=_NextPart_000_0043_01C2A9A6.24059D16

Content-Type: application/octet-stream;

name="UBA.txt"

Content-Transfer-Encoding: base64

Content-Disposition: attachment;

filename="UBA.txt"



QXR0bjoNCg0KSSBhbSBhIENoYXJ0ZXJlZCBBY2NvdW50YW50IHdpdGggdGhl

IFVOSVRFRCBCQU5LIEZPUiBBRlJJQ0EoVUJBKSwgTXkgbmFtZSBpcyBNci4g

VmljdG9yIEliZSwgSSBhbSB0aGUgcGVyc29uYWwgQWNjb3VudCBNYW5hZ2Vy

IHRvIExhdGUgRW5nLiBQZXRlciBXLiBhIGNvbnRyYWN0IHdhcyBhd2FyZGVk

IHRvIG91ciBjbGllbnRzIEJ5IE5OUEMgb2ZmaWNpYWxzIHRvIExhdGUgUGV0

ZXIuIFdobyBpcyBhIGNpdGl6ZW4gb2YgVW5pdGVkIFN0YXRlcyBvZiBBbWVy

aWNhIHdobyB1c2VkIHRvIHdvcmsgd2l0aCBhbiBPaWwgRGV2ZWxvcG1lbnQg

Y29tcGFueSBpbiBOaWdlcmlhPyBOTlBDIChOSUdFUklBIE5BVElPTkFMIFBF

VFJPTEVVTSBDT01QQU5ZKS4NCg0KSGVyZSBpbiBhZnRlciBzaGFsbCBiZSBy

ZWZlcnJlZCB0byBhcyBteSBjbGllbnQgT24gQXByaWwgMjEsIDIwMDIsIG15

IGNsaWVudCwgaGlzIHdpZmUsIGFuZCB0aGVpciB0aHJlZSBjaGlsZHJlbiB3

ZXJlIGludm9sdmVkIGluIGEgY2FyIGFjY2lkZW50IGFsb25nIFNhZ2FtdSBl

eHByZXNzIHdheS4gQWxsIG9jY3VwYW50cyBvZiB0aGUgdmVoaWNsZSB1bmZv

cnR1bmF0ZWx5IGxvc3QgdGhlaXIgbGl2ZXMuIFNpbmNlIHRoZW4sIEkgaGF2

ZSBtYWRlIHNldmVyYWwgZW5xdWlyaWVzIHRvIGhpcyBlbWJhc3N5IHRvIGxv

Y2F0ZSBhbnkgb2YgbXkgY2xpZW50cyBleHRlbmRlZCBSZWxhdGl2ZXMsIHRo

aXMgYWxzbyBwcm92ZWQgdW5zdWNjZXNzZnVsLiBBZnRlciB0aGVzZSBzZXZl

cmFsIHVuc3VjY2Vzc2Z1bCBhdHRlbXB0cywgSSBkZWNpZGVkIHRvIHRyYWNl

IGhpcyBsYXN0IG5hbWUgb3ZlciB0aGUgSW50ZXJuZXQgdG8gbG9jYXRlIGFu

eSBtZW1iZXIgb2YgaGlzIGZhbWlseSBidXQgYWxsIGluIHZhaW4uDQoNCkkg

aGF2ZSBjb250YWN0ZWQgeW91IHRvIGFzc2lzdCBpbiByZXBhdHJpYXRpbmcg

dGhlIG1vbmV5IGFuZCBwcm9wZXJ0eSBsZWZ0IGJlaGluZCBieSBteSBjbGll

bnQgYmVmb3JlIHRoZXkgR2V0IGNvbmZpc2NhdGVkIG9yIGRlY2xhcmVkIHVu

c2VydmljZWFibGUgYnkgdGhlIGJhbmsgd2hlcmUgdGhpcyBodWdlIGRlcG9z

aXRzIHdlcmUgbG9kZ2VkLCBwYXJ0aWN1bGFybHkgdGhlIFVOSVRFRCBCQU5L

IEZPUiBBRlJJQ0EgKFVCQSkgUExDLldoZXJlIHRoZSBkZWNlYXNlZCBoYWQg

YW4gYWNjb3VudCBWYWx1ZWQgYXQgYWJvdXQgKFVTRDEwLjUgTWlsbGlvbiBV

UyBkb2xsYXJzKSBoYXMgSXNzdWVkIG1lIGEgbm90aWNlIHRvIHByb3ZpZGUg

dGhlIG5leHQgb2Yga2luIG9yIGhhdmUgdGhlIGFjY291bnQgY29uZmlzY2F0

ZWQgd2l0aGluIHRoZSBuZXh0IHRlbiBvZmZpY2lhbCB3b3JraW5nIGRheXMu

DQoNClNpbmNlIEkgaGF2ZSBiZWVuIHVuc3VjY2Vzc2Z1bCBpbiBsb2NhdGlu

ZyB0aGUgcmVsYXRpdmVzIGZvciBvdmVyIDIgeWVhcnMgbm93LiBJIHNlZWsg

eW91ciBjb25zZW50IHRvIHByZXNlbnQgeW91IGFzIHRoZSBuZXh0IG9mIGtp

biBvZiB0aGUgZGVjZWFzZWQgc2luY2UgaSBjYW4gY29uZmlkZSBpbiB5b3Ug

c28gdGhhdCB0aGUgcHJvY2VlZHMgb2YgdGhpcyBhY2NvdW50IHZhbHVlZCBh

dCAoVVNEMTAuNSBtaWxsaW9uIFVTIGRvbGxhcnMpIGNhbiBiZSBwYWlkIHRv

IHlvdSBhbmQgdGhlbiBteXNlbGYgYW5kIHlvdSBjYW4gc2hhcmUgdGhlIG1v

bmV5LCA2MCUgdG8gbWUgYW5kIDQwJSB0byB5b3UuDQoNCkFuIGF0dG9ybmV5

IHdpbGwgYmUgY29udGFjdGVkIHRvIGhlbHAgcmV2YWxpZGF0ZSBhbmQgbm90

YXJpemUgYWxsIHRoZSBuZWNlc3NhcnkgbGVnYWwgZG9jdW1lbnRzIHRoYXQg

Y2FuIGJlIHVzZWQgdG8gYmFjayB1cCBhbnkgY2xhaW0gd2UgbWF5IG1ha2Uu

IEFsbCBJIHJlcXVpcmUgaXMgeW91ciBob25lc3QgY29vcGVyYXRpb24gdG8g

ZW5hYmxlIHVzIHNlZWluZyB0aGlzIGRlYWwgdGhyb3VnaC4gSSBndWFyYW50

ZWUgdGhhdCB0aGlzIHdpbGwgYmUgZXhlY3V0ZWQgdW5kZXIgbGVnaXRpbWF0

ZSBhcnJhbmdlbWVudCB0aGF0IHdpbGwgcHJvdGVjdCB5b3UgZnJvbSBhbnkg

YnJlYWNoIG9mIHRoZSBsYXcuIERvIGdldCBiYWNrIHRvIG1lIG9uIHRoaXMg

bXkgZW1haWwgYWRkcmVzcyAobXJ2aWN0b3JpYmVAcXEuY29tKQ0KDQpSZXNw

ZWN0ZnVsbHkgWW91cnMNCg0KTXIuIFZpY3RvciBJYmUu



------=_NextPart_000_0043_01C2A9A6.24059D16--



Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA