by buried under 419s
Thu Jul 18, 2013 8:39 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 18 Jul 2013 09:48:34 -0700
Received: from oms-ma03.r1000.mx.aol.com ([64.12.237.10]:59031)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1UzrNW-0006ui-BU
for ; Thu, 18 Jul 2013 09:48:34 -0700
Received: from mtaout-ma06.r1000.mx.aol.com (mtaout-ma06.r1000.mx.aol.com [172.29.41.6])
by oms-ma03.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTP id 6046B3800123E;
Thu, 18 Jul 2013 12:48:30 -0400 (EDT)
Received: from POCA-DC1.TivSchools.com (unknown [158.123.153.210])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(No client certificate requested)
by mtaout-ma06.r1000.mx.aol.com (MUA/Third Party Client Interface) with ESMTPSA id 844E7E0000A5;
Thu, 18 Jul 2013 12:48:29 -0400 (EDT)
Content-Type: multipart/alternative; boundary="===============2082364581=="
MIME-Version: 1.0
To: Recipients <[email protected]>
From: "Mr. Ray Collins" <[email protected]>
Date: Thu, 18 Jul 2013 12:50:07 -0400
Reply-To: [email protected]
x-aol-global-disposition: S
X-SPAM-FLAG: YES
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mx.aol.com;
s=20121107; t=1374166110;
bh=G3h6XuY9lgYcIjj0FjgjwG0B/eeWcX3QyivtfR2Q+UQ=;
h=From:To:Subject:Date:MIME-Version:Content-Type;
b=Qsn+akYIy5l8WYYvXxHN3BIUCgO5PUEgG04BUfqvUKmzDKYPwPx8r0HM+2+MQnDJy
nb52YAQPDapHPT2VdR5+dT7UZNWHpNFW46NOLpJR1BQjbVYfh6+FVXPQqqup+ZcNm8
o9V+rlDarMjINE4MqmhOtFlw1fyvVta3MFsWACFc=
X-AOL-SCOLL-SCORE: 0:2:139774544:93952408
X-AOL-SCOLL-URL_COUNT: 0
X-AOL-REROUTE: YES
x-aol-sid: 3039ac1d290651e81c5d047c
X-AOL-IP: 158.123.153.210
X-Spam-Status: Yes, score=11.8
X-Spam-Score: 118
X-Spam-Bar: +++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: [...]
Content analysis details: (11.8 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(mifortu[at]aol.com)
0.8 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
-0.7 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.0 T_LOTTO_URI URI: Claims Department
0.4 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5000]
0.5 MISSING_MID Missing Message-Id: header
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 UPPERCASE_75_100 message body is 75-100% uppercase
0.0 T_HK_NAME_FM_MR_MRS T_HK_NAME_FM_MR_MRS
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.8 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
3.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
3.4 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
1.4 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** WE HAPPILY ANNOUNCE TO YOU THE DRAW #988 OF THE SOUTH AFRICAN POWER BALL
LOTTERY,
ONLINE SWEEPSTAKES INTERNATIONAL PROGRAM HELD ON FRIDAY 4TH OF JULY,
2013. YOUR E-MAIL ADDRESS ATTACHED TO TICKET NUMBER: 56475600545 188 WITH
SERIAL NUMBER 5368/13 DREW THE LUCKY NUMBERS: 01-02-18-25-34-45 BONUS NO.31,
WHICH SUBSEQUENTLY WON YOU THE LOTTERY IN THE 2ND CATEGORY,
I.E MATCH 5 PLUS BONUS. YOU HAVE THEREFORE BEEN APPROVED TO CLAIM THE SUM OF
$3, 650,
000.00 IN CASH CREDITED TO FILE KTU/9023118308/13.SEND YOUR DETAILS FOR
CLAIM TO MR GEORGE PHILLIP EMAIL: [email protected]
TEL:+27 60 443 3568
You will not see this in a MIME-aware mail reader.
--===============2082364581==
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
[scam in subject line]
-
Envelope-to:
Delivery-date: Thu, 18 Jul 2013 09:48:34 -0700
Received: from oms-ma03.r1000.mx.aol.com ([64.12.237.10]:59031)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1UzrNW-0006ui-BU
for ; Thu, 18 Jul 2013 09:48:34 -0700
Received: from mtaout-ma06.r1000.mx.aol.com (mtaout-ma06.r1000.mx.aol.com [172.29.41.6])
by oms-ma03.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTP id 6046B3800123E;
Thu, 18 Jul 2013 12:48:30 -0400 (EDT)
Received: from POCA-DC1.TivSchools.com (unknown [158.123.153.210])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(No client certificate requested)
by mtaout-ma06.r1000.mx.aol.com (MUA/Third Party Client Interface) with ESMTPSA id 844E7E0000A5;
Thu, 18 Jul 2013 12:48:29 -0400 (EDT)
Content-Type: multipart/alternative; boundary="===============2082364581=="
MIME-Version: 1.0
To: Recipients <[email protected]>
From: "Mr. Ray Collins" <[email protected]>
Date: Thu, 18 Jul 2013 12:50:07 -0400
Reply-To: [email protected]
x-aol-global-disposition: S
X-SPAM-FLAG: YES
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mx.aol.com;
s=20121107; t=1374166110;
bh=G3h6XuY9lgYcIjj0FjgjwG0B/eeWcX3QyivtfR2Q+UQ=;
h=From:To:Subject:Date:MIME-Version:Content-Type;
b=Qsn+akYIy5l8WYYvXxHN3BIUCgO5PUEgG04BUfqvUKmzDKYPwPx8r0HM+2+MQnDJy
nb52YAQPDapHPT2VdR5+dT7UZNWHpNFW46NOLpJR1BQjbVYfh6+FVXPQqqup+ZcNm8
o9V+rlDarMjINE4MqmhOtFlw1fyvVta3MFsWACFc=
X-AOL-SCOLL-SCORE: 0:2:139774544:93952408
X-AOL-SCOLL-URL_COUNT: 0
X-AOL-REROUTE: YES
x-aol-sid: 3039ac1d290651e81c5d047c
X-AOL-IP: 158.123.153.210
X-Spam-Status: Yes, score=11.8
X-Spam-Score: 118
X-Spam-Bar: +++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: [...]
Content analysis details: (11.8 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(mifortu[at]aol.com)
0.8 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
-0.7 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.0 T_LOTTO_URI URI: Claims Department
0.4 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5000]
0.5 MISSING_MID Missing Message-Id: header
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 UPPERCASE_75_100 message body is 75-100% uppercase
0.0 T_HK_NAME_FM_MR_MRS T_HK_NAME_FM_MR_MRS
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.8 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
3.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
3.4 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
1.4 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** WE HAPPILY ANNOUNCE TO YOU THE DRAW #988 OF THE SOUTH AFRICAN POWER BALL
LOTTERY,
ONLINE SWEEPSTAKES INTERNATIONAL PROGRAM HELD ON FRIDAY 4TH OF JULY,
2013. YOUR E-MAIL ADDRESS ATTACHED TO TICKET NUMBER: 56475600545 188 WITH
SERIAL NUMBER 5368/13 DREW THE LUCKY NUMBERS: 01-02-18-25-34-45 BONUS NO.31,
WHICH SUBSEQUENTLY WON YOU THE LOTTERY IN THE 2ND CATEGORY,
I.E MATCH 5 PLUS BONUS. YOU HAVE THEREFORE BEEN APPROVED TO CLAIM THE SUM OF
$3, 650,
000.00 IN CASH CREDITED TO FILE KTU/9023118308/13.SEND YOUR DETAILS FOR
CLAIM TO MR GEORGE PHILLIP EMAIL: [email protected]
TEL:+27 60 443 3568
You will not see this in a MIME-aware mail reader.
--===============2082364581==
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
[scam in subject line]
-
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces