| Dir : /home/ithome/mail/new/ |
| Server: Linux host100322.itwesthosting.com 3.10.0-1160.144.1.el7.tuxcare.els4.x86_64 #1 SMP Tue Apr 7 08:40:40 UTC 2026 x86_64 IP: 144.91.64.173 |
| Dir : /home/ithome/mail/new/1772662727.M195081P26626.host100322.itwesthosting.com,S=7923,W=8056 |
Return-Path: <>
Delivered-To: ithome@host100322.itwesthosting.com
Received: from host100322.itwesthosting.com
by host100322.itwesthosting.com with LMTP
id PzMyC8evqGkCaAAAp0YrwQ
(envelope-from <>)
for <ithome@host100322.itwesthosting.com>; Wed, 04 Mar 2026 23:18:47 +0100
Return-path: <>
Envelope-to: bozidar.nizetic@h1telekom.hr
Delivery-date: Wed, 04 Mar 2026 23:18:47 +0100
Received: from 236.99.148.34.bc.googleusercontent.com ([34.148.99.236]:42114 helo=[10.88.0.3])
by host100322.itwesthosting.com with esmtp (Exim 4.96.2)
id 1vxuYI-0006vI-1r
for bozidar.nizetic@h1telekom.hr;
Wed, 04 Mar 2026 23:18:47 +0100
Content-Type: multipart/related; boundary="===============2013682445586547351=="
MIME-Version: 1.0
From: Mr Orientalina Goss <orientalinagossrtscl@gmail.com>
To: bozidar.nizetic@h1telekom.hr
X-Priority: 2
X-Spam-Status: Yes, score=22.3
X-Spam-Score: 223
X-Spam-Bar: ++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "host100322.itwesthosting.com",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: I am Mr Orientalina Goss, Deputy Chief of Mission of the U.S.
Embassy in London. With reference to your entitlement fund and inline with
the CHANGE OF BENEFICARY'S APPLICATION, signed by Mrs. Glenda F [...]
Content analysis details: (22.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel
letters
0.0 TVD_RCVD_IP Message was received from an IP address
0.5 SUBJ_ALL_CAPS Subject is all capitals
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[orientalinagossrtscl[at]gmail.com]
1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received'
headers
0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is
CUSTOM_MED
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: 1.bank]
4.7 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[34.148.99.236 listed in zen.spamhaus.org]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[34.148.99.236 listed in bl.score.senderscore.com]
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE:
The query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[34.148.99.236 listed in sa-accredit.habeas.com]
0.0 KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict
Alignment
0.0 HK_NAME_FM_MR_MRS No description available.
0.2 KAM_DMARC_NONE DKIM has Failed or SPF has failed on the message
and the domain has no DMARC policy
1.4 MISSING_DATE Missing Date: header
0.0 LOTS_OF_MONEY Huge... sums of money
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML
tag
0.0 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as
"accounts suspended", "account credited",
"account verification"
2.6 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
6.0 KAM_BENEFICIARYLOW Beneficiary scams (Lower Confidence)
1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing
list
0.0 SPOOFED_FREEMAIL No description available.
0.3 SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...
3.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** =?utf-8?q?ARE_YOU_DEAD_OR_ALIVE?=
X-From-Rewrite: unmodified, forwarded message
--===============2013682445586547351==
Content-Type: text/html; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
SSBhbSBNciBPcmllbnRhbGluYSBHb3NzLCBEZXB1dHkgQ2hpZWYgb2YgTWlzc2lvbiBvZiB0aGUg
VS5TLiBFbWJhc3N5CmluIExvbmRvbi4gV2l0aCByZWZlcmVuY2UgdG8geW91ciBlbnRpdGxlbWVu
dCBmdW5kIGFuZCBpbmxpbmUgd2l0aCB0aGUKQ0hBTkdFIE9GIEJFTkVGSUNBUlknUyBBUFBMSUNB
VElPTiwgc2lnbmVkIGJ5IE1ycy4gR2xlbmRhIEYuIFdhcmQgd2l0aAp5b3VyIHB1cnBvcnRlZCBh
dXRob3JpemF0aW9uLiBUaGlzIGNhc2UgaGFzIGJlZW4gY2FyZWZ1bGx5IGV4YW1pbmVkCmFuZCB3
ZSBoYXZlIGRlY2xpbmVkIE1ycy4gV2FyZCdzIGFwcGxpY2F0aW9uIGFuZCByZXBvcnRlZCB0byB0
aGUKc2VjdXJpdHkgZGVwYXJ0bWVudCBmb3IgYXBwcm9wcmlhdGUgYWN0aW9uLCBhcyB0aGUgYXBw
bGljYXRpb24gbGFja3MKcmVndWxhciBzaWduYXR1cmUuIEJ1dCBEaWQgeW91IGV2ZXIgaW5zdHJ1
Y3QgTXJzIEdsZW5kYSBGLiBXYXJkIHRvCmNsYWltIHlvdXIgZnVuZCB3b3J0aCBVUyQxMC41IE1p
bGxpb24/IEJlbG93IGlzIHRoZSBiYW5rIGFjY291bnQKaW5mb3JtYXRpb24gcHJvdmlkZWQgYnkg
TXJzIEdsZW5kYSBGLiBXYXJkIHNheWluZyB0aGF0IHlvdSBhdXRob3JpemVkCmhlciB0byBjbGFp
bSB5b3VyIGZ1bmQgdGhhdCB5b3UgYXJlIHRlcm1pbmFsbHkgaWxsLgoKMS5CQU5LIE5BTUU6IEJB
TksgT0YgQU1FUklDQQoyLkFDQ09VTlQgTkFNRTogR0xFTkRBIFdBUkQKMy5CQU5LIEFERFJFU1M6
IEtlcnJ2aWxsZSBUZXhhcyA3ODAyOCBVU0EKNC5BQ0NPVU5UICM6IDMyMDI2NTAKNS5ST1VUSU5H
ICM6IDExNDkyMjQ0MwoKSWYgeW91IGhhZCBub3QgYXV0aG9yaXplZCB0aGUgY2hhbmdlIG9mIHlv
dXIgYmFuayBhY2NvdW50IGluIHJlc3BlY3QKdG8geW91ciBvdXRzdGFuZGluZyBlbnRpdGxlbWVu
dCBQYXltZW50LCB0aGVyZWZvcmUgbm90aWZ5IG1lCmltbWVkaWF0ZWx5IGFzIHRoZSBub3RpZmlj
YXRpb24gLyBkZWNsYXJhdGlvbiB3YXMgc3VwcG9ydGVkIHdpdGggYQpzd29ybiBhZmZpZGF2aXQg
ZnJvbSBVbml0ZWQgS2luZ2RvbSBoaWdoIGNvdXJ0IHJlZjogaWxrIC9qai8yMDIvazIwMTUsCmRh
dGVkIDE3LzAzLzIwMjUgYW5kIHNpZ25lZCBieSBNcnMuIEdsZW5kYSBXYXJkIHdobyBjbGFpbSBh
bmQgc3RhdGVkCmluIHRoZSBzd29ybiBkZWNsYXJhdGlvbiB0aGF0IHlvdSBhdXRob3JpemVkIGhl
ciB0byBjbGFpbSB0aGUgc2FpZApmdW5kIG9uIHlvdXIgYmVoYWxmIHRvIGEgZGlmZmVyZW50IGJh
bmsgYWNjb3VudCBpbiB0aGUgVS5TLkEgYXMgc3RhdGVkCmFib3ZlIGJlY2F1c2UgeW91IHdlcmUg
dGVybWluYWxseSBpbGwgYW5kIHRoZSBEb2N0b3Igd2hvIGlzIGluY2hhcmdlCm9mIHlvdXIgY2Fz
ZSBzdGF0ZWQgdGhhdCB5b3Ugd2lsbCBub3Qgc3RheSBtb3JlIHRoYW4gb25lIE1vbnRoIGJlZm9y
ZQpwYXNzaW5nIGF3YXkuCgpUaGlzIGRldmVsb3BtZW50IGhhcyBjYXVzZWQgbG90cyBvZiBkaXNj
cmVwYW5jaWVzIGluIHlvdXIgcGF5bWVudCBmaWxlCnRoYXQgaXMgd2h5IHdlIGhhZCB0byBzdXNw
ZW5kIHlvdXIgcGF5bWVudCBhbmQgcHJvbXB0ZWQgdG8gY29udGFjdCB5b3UKZGlyZWN0bHkgYmVm
b3JlIHJlanV2ZW5hdGluZyB5b3VyIHBheW1lbnQuIFlvdSBoYXZlIHRvIGJlIHJlc3QgYXNzdXJl
ZAp0aGF0IEkgd2lsbCBkbyBldmVyeXRoaW5nIHdpdGhpbiBteSBjYXBhY2l0eSB0byBzdWNjZXNz
ZnVsbHkgYWN0dWFsaXplCnRoZSBxdWljayB0cmFuc2ZlciBvZiB5b3VyIGZ1bmQgdG8gYW55IG9m
IHlvdXIgbm9taW5hdGVkIGJhbmsgYWNjb3VudC4KCktpbmRseSBnZXQgYmFjayB0byBtZSBhcyBz
b29uIGFzIHBvc3NpYmxlIHNvIHRoYXQgSSB3aWxsIGRpcmVjdCB5b3Ugb24Kd2hhdCB0byBkby5J
IHdhaXQgdG8gaGVhciBmcm9tIHlvdSB1cmdlbnRseSBpZiB5b3UgYXJlIHN0aWxsIGFsaXZlIGFu
ZApJIHdpbGwgYXBwcmVjaWF0ZSBpZiB3ZSBjYW4ga2VlcCB0aGlzIGRlYWwgY29uZmlkZW50aWFs
LiBQbGVhc2UgZ2V0CmJhY2sgdG8gbWUgdmlhIG15IHByaXZhdGUgRW1haWw6KG9yaWVudGFsaW5h
Z29zc3J0c2NsQGdtYWlsLmNvbSkgZm9yCmZ1cnRoZXIgZGlyZWN0aXZlczoKCgpTaW5jZXJlbHkg
WW91cnMKCk9yaWVudGFsaW5hIEdvc3M=
--===============2013682445586547351==--