Mail server emitting advance fee fraud (‘419’) spam thanks to a compromised password.
mail.ip.ncnet.ru. 3600 IN A 77.37.254.238
==========================================================================
Return-Path: <info@emiliaceramica.com>
Received: from mail.ip.ncnet.ru (HELO mail.ip.ncnet.ru) (77.37.254.238)
by x (x) with ESMTP; Wed, 01 Dec 2021 xx:xx:xx +0000
Received: from [185.24.233.197] (account 111 HELO User)
by mail.ip.ncnet.ru (CommuniGate Pro SMTP 5.2.12)
with ESMTPA id x; Wed, 01 Dec 2021 xx:xx:xx +0400
Reply-To: mazinhussein289@gmail.com
From: Mazin Hussein <info@emiliaceramica.com>
Subject: Can you supply your company Products
Date: Wed, 1 Dec 2021 xx:xx:xx -0800
MIME-Version: 1.0
Content-Type: text/plain;
charset=»Windows-1251″
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <auto-x@mail.ip.ncnet.ru>
Dear Supplier,
I am contacting you to take part in the ongoing rebuilding of our great
country Iraq, after many years of conflicts by supplying your products here in Iraq.
We are determined to purchase your products in large quantities. A
consideration also is that your quotation must be CIF Port of Umm Qasr.
Get back to me with your products name and prices.
Regards,
Mazin Hussein