[email protected] Mr. Gonasegran Kuppen

[buried under 419s]

Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 02 Feb 2017 18:10:55 -0800
Received: from as.telkomsa.net ([196.25.211.37]:42296 helo=as2.telkomsa.net)
by with esmtps (TLSv1:ECDHE-RSA-AES256-SHA:256)
(Exim 4.87)
(envelope-from <[email protected]>)
id 1cZTKp-0005rO-R7
for ; Thu, 02 Feb 2017 18:10:54 -0800
Received: from unknown (HELO sargas.telkomsa.net) ([192.168.111.56])
by as2.telkomsa.net with ESMTP; 03 Feb 2017 04:10:01 +0200
Received: from mail8.telkomsa.net (unknown [192.168.16.221])
by sargas.telkomsa.net (Postfix) with ESMTP id 713F11B0003;
Fri, 3 Feb 2017 03:59:13 +0200 (SAST)
Date: Fri, 3 Feb 2017 03:59:03 +0200 (SAST)
From: [email protected]
Reply-To: "$$Standardbank......." <[email protected]>
Message-ID: <[email protected]>
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_Part_4141259_2102998813.1486087143063"
X-Originating-IP: [10.146.44.54]
X-Mailer: Zimbra 7.2.4_GA_2903 (ZimbraWebClient - GC55 (Win)/7.2.4_GA_2900)
To: undisclosed-recipients:;
X-Spam-Status: Yes, score=11.8
X-Spam-Score: 118
X-Spam-Bar: +++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.

Content preview: From: Mr. Gonasegran Kuppen JOHANNESBURG, SOUTH AFRICA. TEL:
+27-839474255 FROM MR. GONASENGRAN URGENT AND CONFIDENTIA, Please carefully
read the attachment. It's very Urgent. Best regards Email: [email protected]
[...]

Content analysis details: (11.8 points, 7.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[196.25.211.37 listed in psbl.surriel.com]
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
[196.25.211.37 listed in dnsbl.sorbs.net]
-1.1 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[196.25.211.37 listed in wl.mailspike.net]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?196.25.211.37>]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)
-0.0 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(mr.gonasegran23[at]gmail.com)
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
X-Spam-Flag: YES
Subject: ***SPAM*** RE...Chief Auditor...


From: Mr. Gonasegran Kuppen
JOHANNESBURG, SOUTH AFRICA.
TEL: +27-839474255

FROM MR. GONASENGRAN URGENT AND CONFIDENTIA,

Please carefully read the attachment. It's very Urgent.
Best regards
Email: [email protected]

Mr. Gonasegran Kuppen
Chief Auditor Standardbank of South Africa

[attachment is a graphic]