Advance fee loan scams and fraudulent loan sites.
by Faizan Docherty Sat May 30, 2015 9:47 pm
ipTRACKERonline.com wrote:Header Analysis Quick Report
Originating IP: 209.85.213.194
Originating ISP: Google
City: Mountain View
Country of Origin: United States
* For a complete report on this email header goto ipTRACKERonline


Delivered-To: <snipped>
Received: by 10.52.107.226 with SMTP id hf2csp473992vdb;
Fri, 29 May 2015 13:17:22 -0700 (PDT)
X-Received: by 10.66.66.33 with SMTP id c1mr17714230pat.63.1432930641857;
Fri, 29 May 2015 13:17:21 -0700 (PDT)
Return-Path: <[email protected]>
Received: from relay.mailchannels.net (ar-005-i200.relay.mailchannels.net. [162.253.144.82])
by mx.google.com with ESMTP id kr9si788656pab.127.2015.05.29.13.17.20
for <snipped>;
Fri, 29 May 2015 13:17:21 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 162.253.144.82 as permitted sender) client-ip=162.253.144.82;
Authentication-Results: mx.google.com;
spf=softfail (google.com: domain of transitioning [email protected] does not designate 162.253.144.82 as permitted sender) [email protected];
dkim=pass [email protected];
dmarc=pass (p=NONE dis=NONE) header.from=gmail.com
X-Sender-Id: _forwarded-from|209.85.213.194
Received: from r8-chicago.webserversystems.com (ip-10-237-13-110.us-west-2.compute.internal [10.237.13.110])
by relay.mailchannels.net (Postfix) with ESMTPA id 8EEBA5300
for <snipped>; Fri, 29 May 2015 20:17:18 +0000 (UTC)
X-Sender-Id: _forwarded-from|209.85.213.194
Received: from r8-chicago.webserversystems.com ([TEMPUNAVAIL]. [10.244.53.189])
(using TLSv1 with cipher DHE-RSA-AES256-SHA)
by 0.0.0.0:2500 (trex/5.4.8 );
Fri, 29 May 2015 20:17:18 +0000
X-MC-Relay: Junk
X-MailChannels-SenderId: _forwarded-from|209.85.213.194
X-MailChannels-Auth-Id: wwwh
X-MC-Loop-Signature: 1432930638751:870724055
X-MC-Ingress-Time: 1432930638750
Received: from mail-ig0-f194.google.com ([209.85.213.194]:33222)
by r8-chicago.webserversystems.com with esmtps (TLSv1:RC4-SHA:128)
(Exim 4.85)
(envelope-from <[email protected]>)
id 1YyQiN-0000wV-SN
for <snipped>; Fri, 29 May 2015 15:17:12 -0500
Received: by igdj8 with SMTP id j8so1026674igd.0
for <snipped>; Fri, 29 May 2015 13:17:11 -0700 (PDT)
DKIM-Signature: <snipped>
MIME-Version: 1.0
X-Received: by 10.42.187.65 with SMTP id cv1mr17581982icb.87.1432930631244;
Fri, 29 May 2015 13:17:11 -0700 (PDT)
Received: by 10.36.53.143 with HTTP; Fri, 29 May 2015 13:17:11 -0700 (PDT)
Reply-To: [email protected]
Date: Fri, 29 May 2015 21:17:11 +0100
Message-ID: <CAJzPkwAooiYwfjfL16Fjyn8zqgAjE0ri_L_0Lvt4TFTzEWfdVw@mail.gmail.com>
Subject: do you need an immediate loan?
From: MR ERIC LOAN HOME <[email protected]>
To: undisclosed-recipients:;
Content-Type: text/plain; charset=UTF-8
X-Spam-Status: No, score=3.6
X-Spam-Score: 36
X-Spam-Bar: +++
X-Ham-Report: Spam detection software, running on the system "r8-chicago.webserversystems.com",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.

Content preview: -- Dear Sir/Madam Do you need a personal or business loan
without stress and quick approval? not minding your credit history if bad
or good still contact us today as we are currently offering loans at superb
interest rate. Our loan is secured and safe,For more information and Application,
Please reply to this Email: [email protected] [...]

Content analysis details: (3.6 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low
trust
[209.85.213.194 listed in list.dnswl.org]
2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(dylankroelle[at]gmail.com)
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.213.194 listed in wl.mailspike.net]
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.5 HK_NAME_FM_MR_MRS No description available.
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
X-Spam-Flag: NO
X-AuthUser:


--
Dear Sir/Madam

Do you need a personal or business loan without stress and quick
approval? not minding your credit history if bad or good still contact
us today as we are currently offering loans at superb interest rate.
Our loan is secured and safe,For more information and Application,
Please reply to this Email: [email protected]

Sincerely,
MR ERIC

Please DO NOT tell a scammer that he has been posted here!

If you wish you can email me at
faizandocherty @ scamwarners [dot] com

How do I find email headers???

How to analyze an email header.
Advertisement

Who is online

Users browsing this forum: ClaudeBot and 3 guests