An
Email with the Subject "ATENCION" was
received in one of Scamdex's honeypot email accounts on Tue, 11 Aug 2020 03:39:45 -0700 (PDT)
and has been classified as a Generic Scam Email.
The sender shows as =?utf-8?B?c2FsZXNAb3VycXVja2J1bGNrLmxpdmU=?= <grayransom01@yahoo.com>.
The email address was probably spoofed. Do not reply to or contact any persons or organizations referenced in
this email, or follow any URLs as you may expose yourself to scammers and, at the very least, you will be
added to their email address lists for spam purposes.
This a (redacted) view of the raw email headers of this scam email.
Personally Identifiable Information (PII) has been suppressed, but can be
supplied as received to appropriate investigating or law enforcement agencies on request.
EEEEEstdClass Object
(
[delivered-to:] => scamdex@gmail.com
[received:] => Array
(
[0] => by 2002:a05:6638:3e9:0:0:0:0 with SMTP id s9csp334169jaq; Tue, 11 Aug 2020 03:39:45 -0700 (PDT)
[1] => from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id r18sor9904081ejf.54.2020.08.11.03.39.45 for (Google Transport Security); Tue, 11 Aug 2020 03:39:45 -0700 (PDT)
[2] => from imta-38.everyone.net (imta-35.everyone.net. [216.200.145.35]) by gmr-mx.google.com with ESMTPS id t30si653172edi.3.2020.08.11.03.39.44 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 11 Aug 2020 03:39:45 -0700 (PDT)
[3] => from pps.filterd (m0004961.ppops.net [127.0.0.1]) by imta-38.everyone.net (8.16.0.27/8.16.0.27) with SMTP id 07BAYYvZ003740; Tue, 11 Aug 2020 03:39:01 -0700
[4] => from ourquckbulck.live (ourquckbulck.live [106.75.133.14]) by m0117087.mta.everyone.net (EON-INBOUND) with ESMTP id m0117087.5ef25226.150032e for ; Tue, 11 Aug 2020 03:38:19 -0700
)
[x-received:] => Array
(
[0] => by 2002:a50:cbc3:: with SMTP id l3mr25464352edi.58.1597142385700; Tue, 11 Aug 2020 03:39:45 -0700 (PDT)
[1] => by 2002:a17:906:95d4:: with SMTP id n20mr27454469ejy.485.1597142385423; Tue, 11 Aug 2020 03:39:45 -0700 (PDT)
)
[arc-seal:] => Array
(
[0] => i=2; a=rsa-sha256; t=1597142385; cv=pass; d=google.com; s=arc-20160816; b=qUIoh7vxt92wYKx1HSacqBx7TVe9EG+YlpRNBbOSHrqia7pMPL94og2t9xfXELOy0g 07O9F9IXyDdPX1ZyOgJCAkJ3JL1dmgKMBfnySBNrp884q7Bq2AmzwJsjApymRgooXThQ BHQre7erSHpdFOpYG9rSjpF4qMnb0Ep4G8lfnDcrh0FPbY4fhU4X9sd8C6wmtsVY2iWJ VvXRh8yrtbjBttTv8PinR2GSD6YHdU02mKngTulEU7UgM49yR/sQmsMnWXte8cGzFw/s vVDeAhLkn0eeakvC/uOg0I/fZKxomKNq7cvs6yHDFqDKnhN6B+Hveft/2zM/p9jDQovg Xlzw==
[1] => i=1; a=rsa-sha256; t=1597142385; cv=none; d=google.com; s=arc-20160816; b=NV9X9kN0Y8pjlrTcziRq3LoS9XtnU6V79YRka3He5FQJg1eztxgtV8lNUVGc85Zo2S Tqg+Ci7vLXG5LyO6hTzFBQcKLaFZ1k3KWlEkDjf2W1J58lc7Nq4/j/YTtwQ9StNkPpru fzykD7UesIOT1o50JJ8RyDcNYgY+tb8rJNn+3FNq2jkfBBKj5DLvk27mLrJ0ktyAOkja 8K/DVXXTVMh64QuD4CgGvhX+8Sv7EpyQgq5iH6O6HGGZ3fl+zMQOw9nyw20p5T91JZYM gmnXvRiY1tI7jMQ9mZV9Y9a1DSL01k43js9yeAH7d50cn3wtU2gdm01TaxhS/qrZ//UO CVSg==
)
[arc-message-signature:] => Array
(
[0] => i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=date:message-id:mime-version:subject:to:reply-to:from; bh=AqWTKnoodN70grAmdfyak1vvH4Ut3t//B95GvrPTreo=; b=sCEUlwAF376N2fH/gHA0LwQbSA8vh/6969i1287vyBKF0pgxNRN0hyFJ2CqwSb8l8I PfD8fQHP8HALPfRAnGwakchxfTsFRC2W/3isHT6cLLHC51Nf1qNKyRt9ub2DerZgHMGM Ij+3gO2jnS1sO4UkFSkaQVwojK1KCY+h4b+d5qCNkWCtYKUO+P/cx5gLrtqaJZ8WyKl1 ggZtDY+5ntGf7j4ZxQNAhktIViSpTzbLUcvoy/C7olQ2WduU+M170oxlypTbQugWdWc/ IyyAybB0hNByWTWSPsYD8nsyCv/5gG0VldSyWobcQeX4WkZxRSH4Pq1jaxqnQ64xGmFL Ma2Q==
[1] => i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=date:message-id:mime-version:subject:to:reply-to:from; bh=AqWTKnoodN70grAmdfyak1vvH4Ut3t//B95GvrPTreo=; b=Yikc6ZxTlwgVG7rLpR5+Ks7/Av3s85+kF2nq0pPqLrNbfmCxk8fx7cf41eFPc+iBRY 7/6BExSxxfBtULxN2VhrpoK8PeGb2oj/H952JRmND8LfRBUFx1Zs5HcwFhcCpahsp02C +pxx446b5gSof9MCh3HZs+jVkscdsOwUGnwAyD6KsSNaejTCWZdxCVvoTQ3V1TAKulhk Z4dobwlgZnV3yksfdWqrP2mcditLjLJVBvP/TdVKRbIG744D3Xu4gmu5FaagVsEH4kcY EkAty7l3r6KnL6Au9NW+yxhI4mCvnkfY+bwVmVRWRc9ErNd/Vu0ObFCjR+/yc8o1xLnS 27FA==
)
[arc-authentication-results:] => Array
(
[0] => i=2; mx.google.com; arc=pass (i=1 spf=pass spfdomain=e1m.net); spf=neutral (google.com: 209.85.220.41 is neither permitted nor denied by domain of list-admin@e1m.net) smtp.mailfrom=list-admin@e1m.net; dmarc=fail (p=REJECT sp=REJECT dis=QUARANTINE) header.from=yahoo.com
[1] => i=1; gmr-mx.google.com; spf=pass (google.com: domain of list-admin@e1m.net designates 216.200.145.35 as permitted sender) smtp.mailfrom=list-admin@e1m.net; dmarc=fail (p=REJECT sp=REJECT dis=QUARANTINE) header.from=yahoo.com
)
[return-path:] => Array
(
[0] =>
[1] =>
)
[received-spf:] => Array
(
[0] => neutral (google.com: 209.85.220.41 is neither permitted nor denied by domain of list-admin@e1m.net) client-ip=209.85.220.41;
[1] => pass (google.com: domain of list-admin@e1m.net designates 216.200.145.35 as permitted sender) client-ip=216.200.145.35;
)
[authentication-results:] => mx.google.com; arc=pass (i=1 spf=pass spfdomain=e1m.net); spf=neutral (google.com: 209.85.220.41 is neither permitted nor denied by domain of list-admin@e1m.net) smtp.mailfrom=list-admin@e1m.net; dmarc=fail (p=REJECT sp=REJECT dis=QUARANTINE) header.from=yahoo.com
[x-google-dkim-signature:] => v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:from:reply-to :to:subject:mime-version:message-id:date; bh=AqWTKnoodN70grAmdfyak1vvH4Ut3t//B95GvrPTreo=; b=JRtHsRm5RfshkwvrxT6gnx4pBj5nk2KAdBCTZyeqphVXPpkTlz1VDdIIEPtw7rJV4A hE+O6zezITlVrVtF7MtObwIHJaioNEA+EIICuubcMLBtrQGeEwHSN4Vs7bpzS9MOGiNE 6X5PCAG8LX3gcgmZcZnBwBrSt9x5xtCBw03pKWPojRgH/LhsqaZsO6kR1ci/AnNceRts yM5/sjJhW/NVmni0WUxW4H8QtUIpOt+ZG2I5eZ3VEYa8+wBNWpA4fWEnlxOF2E42A4vk fqNLST8dSAaiz22vdClBGIhhoc1qC9KoDZR4c+Rm/fsK5JfARhfJR2irboczAAxHlnhp vh7w==
[x-original-authentication-results:] => gmr-mx.google.com; spf=pass (google.com: domain of list-admin@e1m.net designates 216.200.145.35 as permitted sender) smtp.mailfrom=list-admin@e1m.net; dmarc=fail (p=REJECT sp=REJECT dis=QUARANTINE) header.from=yahoo.com
[x-gm-message-state:] => AOAM533LO7fZc6zCYp7hoeHCWxH77gILP0L/87KpxVFV4gQeBQQH0zfM l4uLSfI+upfWVR46L53dOQsMrEv5sORMlspVIA==
[x-google-smtp-source:] => ABdhPJy4ldXeomIc14nU9oVXUWtn/lD7H3CtB4RRbI78A9LafKSMq+vV5liywSO36shYORSj9rMTNXRuB9A4UVpOxcFBd/zctSg=
[x-eon-delivered-to:] =>
[x-eon-originating-account:] => KlWuEZnZUJyyk7qytckWTJMh7E1XiEKgZ5g17ovP4etGTSmplerxwNSFAlDbNBQq
[x-eon-dm:] => m0117087.ppops.net
[from:] => =?utf-8?B?c2FsZXNAb3VycXVja2J1bGNrLmxpdmU=?=
[reply-to:] => grayransom01@yahoo.com
[to:] => advance@antihotmail.com
[subject:] => =?utf-8?B?QVRFTkNJT04=?=
[x-priority:] => 3
[x-mailer:] => yMailSender [version 2.0.3]
[mime-version:] => 1.0
[content-type:] => multipart/mixed; boundary="D94A6672B8D84AC290E5B0184A6D7DA6"
[message-id:] => <20200811033829.E2DC0004@m0117087.ppops.net>
[date:] => Tue, 11 Aug 2020 03:38:29 -0700
[x-eon-alias-sig:] => AQI82n9fMnVEoq6IRQEAAAAY,46c54658037c33c15529bb833eb9dbac
[x-proofpoint-virus-version:] => vendor=fsecure engine=2.50.10434:6.0.235,18.0.687 definitions=2020-08-11_11:2020-08-11,2020-08-11 signatures=0
[x-proofpoint-spam-details:] => rule=notspam policy=default score=16 priorityscore=1501 malwarescore=0 suspectscore=2 phishscore=88 bulkscore=0 spamscore=16 clxscore=1034 lowpriorityscore=0 mlxscore=16 impostorscore=0 mlxlogscore=73 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-2006250000 definitions=main-2008110072
)
Domain Names used for collecting scam email ("Honeypot email accounts") have been obscured and replaced with the token 'HUN1P0T'
Community Action - SPAM/non-Scam Report
Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this
email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.
Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not
be in our database. Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or
SPAM, via unpublished 'Honeypot' email addresses.
Oficina de las Naciones Unidas DirecciÃn: 3 Whitehall Court, Londres, SW1A 2EL Reino Unido. TelÃfono: +44-207-000-1381
AtenciÃn: beneficiario, Esto es para llamar su atenciÃn sobre el pago en efectivo de Â900,000.00 ha sido un pago de compensaciÃn por ser vÃctima de se ha emitido estafa de fraude en lÃnea/caritativo en su nombre y el El monto serà pagado por el Banco Natwest de Londres. Debe comunicarse con la oficina de nuestra agencia con su Detalles del personal para verificaciÃn/reactivaciÃn y pago inmediato.
Nombre completo: ................ PaÃs: .................. TelÃfono: .................... Sexo:....................... AÃos:....................... OcupaciÃn:................ copia de su documento de identidad: .........
Tras la verificaciÃn de sus datos, se le notificarà sobre el requisitos para la aprobaciÃn de su fondo. Por otro lado, se informà que el soporte que le costarà Â250 (Doscientas cincuenta libras) solo despuÃs de lo cual nuestra oficina central autorizarà al Banco Natwest de Londres para llevar a cabo el transferencia de su fondo a su cuenta bancaria designada.
ContÃctenos de inmediato para obtener mÃs aclaraciones sobre su pago.
Oficina de las Naciones Unidas DirecciÃn: 3 Whitehall Court, Londres, SW1A 2EL Reino Unido. TelÃfono: +44-207-000-1381
AtenciÃn: beneficiario, Esto es para llamar su atenciÃn sobre el pago en efectivo de Â900,000.00 ha sido un pago de compensaciÃn por ser vÃctima de se ha emitido estafa de fraude en lÃnea/caritativo en su nombre y el El monto serà pagado por el Banco Natwest de Londres. Debe comunicarse con la oficina de nuestra agencia con su Detalles del personal para verificaciÃn/reactivaciÃn y pago inmediato.
Nombre completo: ................ PaÃs: .................. TelÃfono: .................... Sexo:....................... AÃos:....................... OcupaciÃn:................ copia de su documento de identidad: .........
Tras la verificaciÃn de sus datos, se le notificarà sobre el requisitos para la aprobaciÃn de su fondo. Por otro lado, se informà que el soporte que le costarà Â250 (Doscientas cincuenta libras) solo despuÃs de lo cual nuestra oficina central autorizarà al Banco Natwest de Londres para llevar a cabo el transferencia de su fondo a su cuenta bancaria designada.
ContÃctenos de inmediato para obtener mÃs aclaraciones sobre su pago.
Sinceramente,
Dr.Gray Ransom
DirecciÃn de correo electrÃnico: grayransom01@yahoo.com
