An
Email with the Subject "Business Partnership Required Urgently" was
received in one of Scamdex's honeypot email accounts on 06 Jul 2020 04:23:44 -0000
and has been classified as a Advance Fee Fraud/419 Scam Email.
The sender shows as "Saudi Aramco Crude Oil Company" <info@oilcompany.net>.
The email address was probably spoofed. Do not reply to or contact any persons or organizations referenced in
this email, or follow any URLs as you may expose yourself to scammers and, at the very least, you will be
added to their email address lists for spam purposes.
This a (redacted) view of the raw email headers of this scam email.
Personally Identifiable Information (PII) has been suppressed, but can be
supplied as received to appropriate investigating or law enforcement agencies on request.
EEEEEstdClass Object
(
[return-path:] =>
[delivered-to:] => Array
(
[0] => unknown
[1] => scamdex@gmail.com
)
[received:] => Array
(
[0] => from imap.gmail.com (74.125.195.108:993) by mail.scamalot.com with IMAP4-SSL; 06 Jul 2020 04:23:44 -0000
[1] => by 2002:a05:6638:24f:0:0:0:0 with SMTP id w15csp3406069jaq; Sat, 6 Jun 2020 12:37:28 -0700 (PDT)
[2] => from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id q13sor7196285wra.46.2020.06.06.12.37.28 for (Google Transport Security); Sat, 06 Jun 2020 12:37:28 -0700 (PDT)
[3] => from mail.arsia.com.np (mail.arsia.com.np. [103.75.149.101]) by gmr-mx.google.com with ESMTPS id f16si734249wrq.5.2020.06.06.12.37.28 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sat, 06 Jun 2020 12:37:28 -0700 (PDT)
[4] => from localhost (localhost [127.0.0.1]) by mail.arsia.com.np (Postfix) with ESMTP id C81B95010D0C; Sat, 6 Jun 2020 02:46:58 +0545 (+0545)
[5] => from mail.arsia.com.np ([127.0.0.1]) by localhost (mail.arsia.com.np [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id i_iaij-5YPKo; Sat, 6 Jun 2020 02:46:58 +0545 (+0545)
[6] => from localhost (localhost [127.0.0.1]) by mail.arsia.com.np (Postfix) with ESMTP id 248715010D0F; Fri, 5 Jun 2020 16:01:59 +0545 (+0545)
[7] => from mail.arsia.com.np ([127.0.0.1]) by localhost (mail.arsia.com.np [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id AsUSi5YBx4D1; Fri, 5 Jun 2020 16:01:59 +0545 (+0545)
[8] => from [103.99.2.7] (unknown [103.99.2.7]) by mail.arsia.com.np (Postfix) with ESMTPSA id E79435010D23; Fri, 5 Jun 2020 10:39:16 +0545 (+0545)
)
[x-received:] => Array
(
[0] => by 2002:a7b:c1d4:: with SMTP id a20mr8341848wmj.153.1591472248682; Sat, 06 Jun 2020 12:37:28 -0700 (PDT)
[1] => by 2002:a5d:4e81:: with SMTP id e1mr15722617wru.83.1591472248491; Sat, 06 Jun 2020 12:37:28 -0700 (PDT)
)
[arc-seal:] => Array
(
[0] => i=2; a=rsa-sha256; t=1591472248; cv=pass; d=google.com; s=arc-20160816; b=LtMvalgFQecj4i4LBfHILFwqyfdiPwFT/0gYX/z/l43TB/CB9jw/84h3L2jxNiSRsk 4iNlHfp/4JCMdRQZxLRdMDghoU1cP4ItdoNtWdEema0NNpMx+vxrbsfXve+HxDP7IJRI WPlVmbcibwbGup0tsKEzQCGhnPV9ij8uZWL1ok5k0nukmPshYfE52rtvXm8k8Q+Hbupb C8CPI+L5fIHKXhNX/tBuUS2zTmXATAQn5lg5W9J9if36qUciDXG6leqnQJ1IiCioBHkE BPIi42D3ezZ4Vv8EE0djQoZAlJ1rx7QG596STELRc+mbHcGSK0PYLQrFYyct/ho+Mwxw 9PYQ==
[1] => i=1; a=rsa-sha256; t=1591472248; cv=none; d=google.com; s=arc-20160816; b=tuhO1UCdB13E6Qur++fFesNh5mZdL602MzCKtCutu5KwAzQpdMfbA9+42yjw7+8Yw2 mtfQ10AsIn3xSZ7m4twrGwvgxg0CVI8E7HpPOdlCuE30eUPB9vOWluYy7civrykzdJTP gon8ovPVdaR9E3efNbEKu24R/OCNxn8oXC6mIA52EKUnzQlMlA2/WcR1DJjj4BF7pMBq RI6fbdEg2eMKE63/9B2nu1ILLV4jtE5fUaev6U32/pCVRw/R7RzzRUOc1lLF47tnkfRr S3f3LN2/wWNd0MS9oviWs7dc0a74PYkPLN9Db9bIoqBcPRDSm7E0gqX0VvRn6IiOG6rs O9Qw==
)
[arc-message-signature:] => Array
(
[0] => i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:reply-to:date:from:to:subject:mime-version; bh=qz4chdfWfPXgu7j6gVrADtmdfgemEBWGvxjDv+EJQXI=; b=TvXvhVMR/tY5zamx1vDLTB52xPWF8+wf3b0ZrMMgkSm6812wYeZ0digglVtaDkdZ1p ntYeD/MRHVyd8y/D20x3BompvDCETTZ+BfGhdJWibJg6ztPNosXlfqANszMEh/b62TVM ksHwvvRbmvz+MWPboovgxBqEewl3Hpcgx8nuxTlKnYFQv42IDDpyxBZGViGiZ5Uw9NYD olW5ZU8jn6dBRgW1WeHlGEOWKFSOLzcSv0N06Hi60u1yToe8aPWzO/h9Pp/jd9cXK2LP XTVBboC48l3hsLGXCk2H4I43PtXq6axPJ0O99XHSBcDVQEbgKLRPYcqzgbeQ3vRB/2UB AQSQ==
[1] => i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:reply-to:date:from:to:subject:mime-version; bh=qz4chdfWfPXgu7j6gVrADtmdfgemEBWGvxjDv+EJQXI=; b=L9GQJ3o4frk6aekSgtNFo+Q9QEsMyMbSSrAkUwhPvPdUgd4Krg9bki2fRdmXtRMNxJ kVwqJyiZ4UIC5D5+pfcYBdUof+ucdhpI9WT6SAyKGk5bmbibp0ST1kkRACxHFhopYh1T 1L78KqcAJxRWD3r0YDVg0+aGlD4/E70dzFvSe7dj/i98dPbMQD4I2mK/qzzxCIVupIJw bQ48egYav0N3mmE6T6PfkY12D5r6LGteinaFowTpryhErU7l1m/Yf8jWQuo3kiFTfqqf 2D3Q2MBpufWD7I6c+5O+YFj7voUSlvgwksyYeAR0dinJbuGmErz0kPgdP4LHPwNAzFem aTSA==
)
[arc-authentication-results:] => Array
(
[0] => i=2; mx.google.com; arc=pass (i=1); spf=softfail (google.com: domain of transitioning info@oilcompany.net does not designate 209.85.220.41 as permitted sender) smtp.mailfrom=info@oilcompany.net
[1] => i=1; gmr-mx.google.com; spf=softfail (google.com: domain of transitioning info@oilcompany.net does not designate 103.75.149.101 as permitted sender) smtp.mailfrom=info@oilcompany.net
)
[received-spf:] => Array
(
[0] => softfail (google.com: domain of transitioning info@oilcompany.net does not designate 209.85.220.41 as permitted sender) client-ip=209.85.220.41;
[1] => softfail (google.com: domain of transitioning info@oilcompany.net does not designate 103.75.149.101 as permitted sender) client-ip=103.75.149.101;
)
[authentication-results:] => mx.google.com; arc=pass (i=1); spf=softfail (google.com: domain of transitioning info@oilcompany.net does not designate 209.85.220.41 as permitted sender) smtp.mailfrom=info@oilcompany.net
[x-google-dkim-signature:] => v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:mime-version :subject:to:from:date:reply-to:message-id; bh=qz4chdfWfPXgu7j6gVrADtmdfgemEBWGvxjDv+EJQXI=; b=mj/UpISNHMJI3bEytD892P1zN+U/RkqODbURdiiXbX9S46QdGMGeuWFGN/WzMgHdpa iAmbdNi2DO9dZHcSuyxJTSYWLmpYB0ZGhDi0jrBlu5/H6MZ8KgNZP4oNMw3H7HI5N/cA wI2pzrYW5VuH/o4CsSPq3RbpziY4qIUkvxjiULCOF3nHziTrPYW+pNgEtw+jUom2UhUv gVqj9uuFNJ69VAtIWbMei2MTPwGJsBAUN8rT6V3peSYwFcWRu46/zfsT1PlL0z9RVzKy oDB9G4w8pOaG2gWU/rS8FLkV8PE6BACKa6DMI3AOjsdNYMpW6qW7vutQkMuJJEoYogVJ wzcw==
[x-original-authentication-results:] => gmr-mx.google.com; spf=softfail (google.com: domain of transitioning info@oilcompany.net does not designate 103.75.149.101 as permitted sender) smtp.mailfrom=info@oilcompany.net
[x-gm-message-state:] => AOAM5310q6f3aa8Rqf0VisxJqoMF2AmTRrxyXbBFGcOTsUWNx9A4rwWZ lI9VAfXrs9II/9mL2iPbj1c9HvSYaYkYo/stpg==
[x-google-smtp-source:] => ABdhPJwT3O1WOIwL4plkoLDsEZMdo7/NQ3e3mkYao5j99qlf+XjNenBC0egR/v2HLBmO297PzMeCiey8RTBvWl3NdPbc0X4qo40=
[x-virus-scanned:] => amavisd-new at mail.arsia.com.np
[content-type:] => multipart/alternative; boundary="===============0816534709=="
[mime-version:] => 1.0
[subject:] => Business Partnership Required Urgently
[to:] => Recipients
[from:] => "Saudi Aramco Crude Oil Company"
[date:] => Fri, 05 Jun 2020 21:47:29 +0100
[reply-to:] => reemn2214@gmail.com
[message-id:] => <20200605045417.E79435010D23@mail.arsia.com.np>
[x-getmail-retrieved-from-mailbox:] => =?utf-8?q?=5BGmail=5D/Spam?=
[x-gmail-thrid:] => =?utf-8?q?1668779604730305149?=
[x-gmail-msgid:] => =?utf-8?q?1668779604730305149?=
)
Domain Names used for collecting scam email ("Honeypot email accounts") have been obscured and replaced with the token 'HUN1P0T'
Community Action - SPAM/non-Scam Report
Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this
email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.
Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not
be in our database. Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or
SPAM, via unpublished 'Honeypot' email addresses.
Saudi Aramco Crude Oil Company.
P.O. Box 5000. Dhahran 31311,
Dhahran-Saudi Arabia.
Dear Friend,
I have a legit and genuine lucrative business deal to discuss with you.
Can i trust you to be a sincere partner to handle the business?
For more information reply back.
Mrs.Reem Nasser,
Sales/Marketing Manager
Saudi Aramco Crude Oil Company.
Email: reemn2214@gmail.com
Saudi Aramco Crude Oil Company.
P.O. Box 5000. Dhahran 31311,
Dhahran-Saudi Arabia.
Dear Friend,
I have a legit and genuine lucrative business deal to discuss with you.
Can i trust you to be a sincere partner to handle the business?
For more information reply back.
Mrs.Reem Nasser,
Sales/Marketing Manager
Saudi Aramco Crude Oil Company.
Email: reemn2214@gmail.com
