[npnog] Email from Nabilbank originating from Russia

[Indiver Badal]

Hi

Did anyone notice that the recent credit-card statement email received from Nabilbank had some interesting headers? Tried to open the attachment and it could not unzip. That lead me to explore into email headers and noticed there's a Russian IP address originating the email. Earlier emails would come from India - ecsmc.electra-card.com ([220.226.201.63]).

They recently changed/upgraded their card systems, and Compass Plus could be their provider but wanted to verify. 

Here's part of the header:

Received: from mail.nabilbank.com (mail.nabilbank.com. [202.52.237.133])
        by mx.google.com with ESMTP id r76si12758069pfr.248.2017.02.26.06.40.59
        for <XXXX at XXXXXer.com>;
        Sun, 26 Feb 2017 06:41:02 -0800 (PST)
Received-SPF: pass (google.com: best guess record for domain of card-statement at nabilbank.com designates 202.52.237.133 as permitted sender) client-ip=202.52.237.133;
Received: from VPC-TXNABIL1.pc.compassplus.ru ([91.227.244.48])
	by mail.nabilbank.com ([10.0.18.5])
	(MDaemon PRO v15.0.4) 
	with ESMTP id md50008951098.msg for <XXXX at XXXXXer.com>;
	Sun, 26 Feb 2017 20:25:51 +0545
X-Spam-Processed: mail.nabilbank.com, Sun, 26 Feb 2017 20:25:51 +0545
	(not processed: message from trusted or authenticated source)
X-MDRemoteIP: 91.227.244.48
X-MDHelo: VPC-TXNABIL1.pc.compassplus.ru
X-MDArrival-Date: Sun, 26 Feb 2017 20:25:51 +0545
X-Return-Path: card-statement at nabilbank.com
X-Envelope-From: card-statement at nabilbank.com
...
Subject: Credit Card Statement - 26/01/2017 to 25/02/2017 - XXXXXXXXXXXXYYYY


Can anyone in the list please verify that it is correct? Also, a friend of mine received his credit-card statement for a card he cancelled several years back (again originating from Russia). Did anyone else notice similar activities?


Thanks
Indiver