by Faizan Docherty
Tue Nov 18, 2014 4:57 pm
ipTRACKERonline.com wrote:Header Analysis Quick Report
Originating IP: 116.202.100.2
Originating ISP: Mts
City: Bangalore
Country of Origin: India
* For a complete report on this email header goto ipTRACKERonline
Delivered-To: <snipped>
Received: by 10.70.50.233 with SMTP id f9csp53058pdo;
Sun, 16 Nov 2014 12:26:26 -0800 (PST)
X-Received: by 10.66.148.225 with SMTP id tv1mr24733920pab.17.1416169586011;
Sun, 16 Nov 2014 12:26:26 -0800 (PST)
Return-Path: <[email protected]>
Received: from relay.mailchannels.net (tkt-001-i374.relay.mailchannels.net. [174.136.5.177])
by mx.google.com with ESMTP id fa4si33251042pbc.238.2014.11.16.12.26.24
for <snipped>;
Sun, 16 Nov 2014 12:26:25 -0800 (PST)
Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 174.136.5.177 as permitted sender) client-ip=174.136.5.177;
Authentication-Results: mx.google.com;
spf=softfail (google.com: domain of transitioning [email protected] does not designate 174.136.5.177 as permitted sender) [email protected]
X-Sender-Id: wwwh|env-sender|[email protected]
Received: from r8-chicago.webserversystems.com (ip-10-220-9-73.us-west-2.compute.internal [10.220.9.73])
by relay.mailchannels.net (Postfix) with ESMTPA id D6F8D120326
for <snipped>; Sun, 16 Nov 2014 20:26:21 +0000 (UTC)
X-Sender-Id: wwwh|env-sender|[email protected]
Received: from r8-chicago.webserversystems.com (r8-chicago.webserversystems.com [10.224.1.53])
(using TLSv1 with cipher DHE-RSA-AES256-SHA)
by 0.0.0.0:2500 (trex/5.4.1);
Sun, 16 Nov 2014 20:26:22 GMT
X-MC-Relay: Neutral
X-MailChannels-SenderId: wwwh|env-sender|[email protected]
X-MailChannels-Auth-Id: wwwh
X-MC-Loop-Signature: 1416169582070:3915276351
X-MC-Ingress-Time: 1416169582069
Received: from [41.76.169.13] (port=51462 helo=treasury.go.ke)
by r8-chicago.webserversystems.com with esmtp (Exim 4.82)
(envelope-from <[email protected]>)
id 1Xq6Jn-0002yM-Jy
for <snipped>; Sun, 16 Nov 2014 14:21:10 -0600
Received: from localhost (localhost [127.0.0.1])
by treasury.go.ke (Postfix) with ESMTP id 38B55D4AD84;
Sun, 16 Nov 2014 20:23:22 +0300 (EAT)
Received: from treasury.go.ke ([127.0.0.1])
by localhost (treasury.go.ke [127.0.0.1]) (amavisd-new, port 10032)
with ESMTP id 9fhjtMiS7vrc; Sun, 16 Nov 2014 20:23:19 +0300 (EAT)
Received: from localhost (localhost [127.0.0.1])
by treasury.go.ke (Postfix) with ESMTP id 7D1A3D4AD86;
Sun, 16 Nov 2014 20:23:19 +0300 (EAT)
X-Virus-Scanned: amavisd-new at treasury.go.ke
Received: from treasury.go.ke ([127.0.0.1])
by localhost (treasury.go.ke [127.0.0.1]) (amavisd-new, port 10026)
with ESMTP id qqIdYiOJdHKL; Sun, 16 Nov 2014 20:23:19 +0300 (EAT)
Received: from treasury.go.ke (treasury.go.ke [10.101.6.41])
by treasury.go.ke (Postfix) with ESMTP id 94375D4AD84;
Sun, 16 Nov 2014 20:23:18 +0300 (EAT)
Date: Sun, 16 Nov 2014 20:23:18 +0300 (EAT)
From: AHMEND NASSER <[email protected]>
Reply-To: AHMEND NASSER <[email protected]>
Message-ID: <[email protected]>
Subject: عرض القرض
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: base64
X-Originating-IP: [116.202.100.2]
X-Mailer: Zimbra 8.0.7_GA_6021 (ZimbraWebClient - FF34 (Win)/8.0.7_GA_6021)
Thread-Topic: =?utf-8?B?2LnYsdi2INin2YTZgtix2LY=?=
Thread-Index: tHnhqCNi2HNp5rvIcQqQRpOzd91FAA==
X-Spam-Status: No, score=3.4
X-Spam-Score: 34
X-Spam-Bar: +++
X-Ham-Report: Spam detection software, running on the system "r8-chicago.webserversystems.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: ونØÙ† نقدم الØÙ„ المناسب لاØتياجاتك
المالية. Ù†ØÙ† نق٠وبصر٠النظر عن غيرها من
المقرضين لأننا نعتقد ÙÙŠ خدمة العملاء، ونبقى
معكم Øتى تØصل على النتائج التي تريدها. بشكل
عام Ù†ØÙ† نقدم القروض العقارية، وقروض السيارات،
والقروض الÙندق، والقروض التجارية، القروض
التجارية، الخ، ÙÙŠ انخÙاض سعر الÙائدة من
2٪، إذا كنت مهتما الاتصال بنا للØصول على مزيد
من التÙاصيل [...]
Content analysis details: (3.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 MISSING_HEADERS Missing To: header
1.6 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC
0.8 RDNS_NONE Delivered to internal network by a host with no rDNS
X-Spam-Flag: NO
X-AuthUser:
ونحن نقدم الحل المناسب لاحتياجاتك المالية. نحن نقف وبصرف النظر عن غيرها من المقرضين لأننا نعتقد في خدمة العملاء، ونبقى معكم حتى تحصل على النتائج التي تريدها. بشكل عام نحن نقدم القروض العقارية، وقروض السيارات، والقروض الفندق، والقروض التجارية، القروض التجارية، الخ، في انخفاض سعر الفائدة من 2٪، إذا كنت مهتما الاتصال بنا للحصول على مزيد من التفاصيل
Google translation:
We offer the right financial solution for your needs. We stand apart from other lenders because we believe in customer service, and we stay with you until you get the results you want. In general we offer home loans, car loans, hotel loans, commercial loans, commercial loans, etc., in a low interest rate of 2%, if you are interested contact us for more details
Please DO NOT tell a scammer that he has been posted here!
If you wish you can email me at
faizandocherty @ scamwarners [dot] com
How do I find email headers???
How to analyze an email header.
If you wish you can email me at
faizandocherty @ scamwarners [dot] com
How do I find email headers???
How to analyze an email header.