Subject: comprobante de transferencia bancaria. - [ id 259750913 ]

From: saldo fiscal <[email-masked]>
Date: Tue, 29 Sep 2020 21:11:04 -0700 (PDT)

Spam detection software, running on the system "mx2.eskimo.com",
has identified this incoming email as possible spam.  The original
message has been attached to this so you can view it or label
similar future email.  If you have any questions, see
the administrator of that system for details.

Content preview:  Comprobante Descargar todo como.zip archivos adjuntos ( 128
   kb) se anexa el seguiente comprobante de transferencia Remitente: Servicio
   de AdministraciÃ³n financiero. pago de reembolso relacionado con el impuesto
   sobre la renta: A quien corresponda SERIE Y FOLIO: [...] 

Content analysis details:   (11.3 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 0.8 BAYES_50               BODY: Bayes spam probability is 40 to 60%
                            [score: 0.5000]
 1.5 CK_HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname
                            (Split IP)
 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                            mail domains are different
 0.0 SPF_NONE               SPF: sender does not publish an SPF Record
 1.0 BOTNET                 Relay might be a spambot or virusbot
[botnet0.9,ip=134.0.116.64,rdns=134-0-116-64.ovz.vps.regruhosting.ru,maildomain=eskimo.com,client,ipinhostname]
 1.0 BOTNET_IPINHOSTNAME    Hostname contains its own IP address
[botnet_ipinhosntame,ip=134.0.116.64,rdns=134-0-116-64.ovz.vps.regruhosting.ru]
 1.0 BOTNET_CLIENT          Relay has a client-like hostname
[botnet_client,ip=134.0.116.64,rdns=134-0-116-64.ovz.vps.regruhosting.ru,ipinhostname]
 0.0 HTML_MESSAGE           BODY: HTML included in message
 0.1 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
 1.1 DCC_CHECK              Detected as bulk mail by DCC (dcc-servers.net)
 3.6 HELO_DYNAMIC_IPADDR2   Relay HELO'd using suspicious hostname (IP
                            addr 2)
 0.0 FSL_BULK_SIG           Bulk signature with no Unsubscribe
 1.0 RDNS_DYNAMIC           Delivered to internal network by host with
                            dynamic-looking rDNS

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam.  If you wish to view
it, it may be safer to save it to a file and open it with an editor.

Subject: comprobante de transferencia bancaria. - [ id 259750913 ]
From: saldo fiscal <[email-masked]>
To: [email-masked]
Date: Tue, 29 Sep 2020 21:11:04 -0700 (PDT)

Descargar todo como.zip  archivos adjuntos ( 128 kb)

se anexa el seguiente comprobante de transferencia
Remitente: Servicio de AdministraciÃ³n financiero.
pago de reembolso relacionado con el impuesto sobre la renta:

A quien corresponda

SERIE Y FOLIO:

2158945

FECHA DE EMISION:
21/09/2020

MONTO TOTAL:

5987.20

Servicio de AdministraciÃ³n Tributaria,

+34 1308 808 800 Capitales y Ã¡reas metropolitanas

30/09/2020 04:11:01