by buried under 419s
Sun Jul 29, 2012 7:28 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sun, 29 Jul 2012 15:10:25 -0700
Received: from [210.51.52.136] (port=53039 helo=www.shengyijie.com.cn)
by with esmtp (Exim 4.77)
(envelope-from <[email protected]>)
id 1Svbgr-0007Fj-09
for ; Sun, 29 Jul 2012 15:10:25 -0700
Received: from User (unknown [61.177.248.202])
by www.shengyijie.com.cn (Postfix) with SMTP id BBE6111718A;
Mon, 30 Jul 2012 05:48:33 +0800 (CST)
Reply-To: <[email protected]>
From: "Planned Financial Services"<[email protected]>
Date: Mon, 30 Jul 2012 05:57:03 +0800
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
To: undisclosed-recipients:;
X-Spam-Status: Yes, score=17.1
X-Spam-Score: 171
X-Spam-Bar: +++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: For all your personal loans, project financing, auto loans
and mortgages. An American Financial Company in partnership with UNCDF is
here to help. Contact: [email protected] [...]
Content analysis details: (17.1 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 FSL_XM_419 Old OE version in X-Mailer only seen in 419 spam
0.5 NSL_RCVD_FROM_USER Received from User
0.0 FSL_RCVD_USER FSL_RCVD_USER
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(lpu.pfs[at]gmail.com)
2.2 RCVD_IN_NJABL_PROXY RBL: NJABL: sender is an open proxy
[61.177.248.202 listed in combined.njabl.org]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?61.177.248.202>]
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[210.51.52.136 listed in bb.barracudacentral.org]
0.8 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server
[61.177.248.202 listed in dnsbl.sorbs.net]
0.8 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5412]
0.0 FSL_UA FSL_UA
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.8 RDNS_NONE Delivered to internal network by a host with no rDNS
1.7 FSL_NEW_HELO_USER FSL_NEW_HELO_USER
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 AXB_XMAILER_MIMEOLE_OL_024C2
2.6 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE
0.0 FROM_MISSP_TO_UNDISC From misspaced, To undisclosed
0.0 FSL_MISSP_REPLYTO Mis-spaced from and Reply-to
0.0 FROM_MISSP_USER From misspaced, from "User"
0.0 FROM_MISSPACED From: missing whitespace
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 FROM_MISSP_URI From misspaced, has URI
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.2 FROM_MISSP_FREEMAIL From misspaced + freemail provider
X-Spam-Flag: YES
Subject: ***SPAM*** Important Notice (Loan and Funding)
For all your personal loans, project financing, auto loans and mortgages. An American Financial Company in partnership with UNCDF is here to help. Contact: [email protected]
Envelope-to:
Delivery-date: Sun, 29 Jul 2012 15:10:25 -0700
Received: from [210.51.52.136] (port=53039 helo=www.shengyijie.com.cn)
by with esmtp (Exim 4.77)
(envelope-from <[email protected]>)
id 1Svbgr-0007Fj-09
for ; Sun, 29 Jul 2012 15:10:25 -0700
Received: from User (unknown [61.177.248.202])
by www.shengyijie.com.cn (Postfix) with SMTP id BBE6111718A;
Mon, 30 Jul 2012 05:48:33 +0800 (CST)
Reply-To: <[email protected]>
From: "Planned Financial Services"<[email protected]>
Date: Mon, 30 Jul 2012 05:57:03 +0800
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
To: undisclosed-recipients:;
X-Spam-Status: Yes, score=17.1
X-Spam-Score: 171
X-Spam-Bar: +++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: For all your personal loans, project financing, auto loans
and mortgages. An American Financial Company in partnership with UNCDF is
here to help. Contact: [email protected] [...]
Content analysis details: (17.1 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 FSL_XM_419 Old OE version in X-Mailer only seen in 419 spam
0.5 NSL_RCVD_FROM_USER Received from User
0.0 FSL_RCVD_USER FSL_RCVD_USER
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(lpu.pfs[at]gmail.com)
2.2 RCVD_IN_NJABL_PROXY RBL: NJABL: sender is an open proxy
[61.177.248.202 listed in combined.njabl.org]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?61.177.248.202>]
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[210.51.52.136 listed in bb.barracudacentral.org]
0.8 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server
[61.177.248.202 listed in dnsbl.sorbs.net]
0.8 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5412]
0.0 FSL_UA FSL_UA
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.8 RDNS_NONE Delivered to internal network by a host with no rDNS
1.7 FSL_NEW_HELO_USER FSL_NEW_HELO_USER
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 AXB_XMAILER_MIMEOLE_OL_024C2
2.6 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE
0.0 FROM_MISSP_TO_UNDISC From misspaced, To undisclosed
0.0 FSL_MISSP_REPLYTO Mis-spaced from and Reply-to
0.0 FROM_MISSP_USER From misspaced, from "User"
0.0 FROM_MISSPACED From: missing whitespace
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 FROM_MISSP_URI From misspaced, has URI
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.2 FROM_MISSP_FREEMAIL From misspaced + freemail provider
X-Spam-Flag: YES
Subject: ***SPAM*** Important Notice (Loan and Funding)
For all your personal loans, project financing, auto loans and mortgages. An American Financial Company in partnership with UNCDF is here to help. Contact: [email protected]
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces