Shukri Ghanem [email protected]

Return-Path: <[email protected]>
Received: from compute1.internal (compute1.nyi.mail.srv.osa [10.202.2.41])
by sloti14d5p3 (Cyrus git2.5+0-git-fastmail-7608) with LMTPA;
Sun, 08 Jan 2012 13:29:57 -0500
X-Sieve: CMU Sieve 2.4
X-Spam-charsets: html='utf-8'
X-Mail-from: [email protected]
Received: from mx3.nyi.mail.srv.osa ([10.202.2.202])
by compute1.internal (LMTPProxy); Sun, 08 Jan 2012 13:29:57 -0500
Received: from a4-salsa1.bol.com.br (a4-salsa1.bol.com.br [200.147.97.216])
by mx3.nyi.mail.srv.osa (Postfix) with ESMTP id EFC8E4C26D0
Sun, 8 Jan 2012 13:29:56 -0500 (EST)
Received: from localhost (localhost.localdomain [127.0.0.1])
by a4-salsa1.bol.com.br (Postfix) with ESMTP id 8085C380008E;
Sun, 8 Jan 2012 16:29:55 -0200 (BRST)
Received: from a4-salsa1.adm.intranet (localhost.localdomain [127.0.0.1])
by a4-salsa1.bol.com.br (Postfix) with ESMTP id 46E7B3800085;
Sun, 8 Jan 2012 16:27:48 -0200 (BRST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=zipmail.com.br;
s=afl; t=1326047395;
bh=Oz0YCWQbYCNmZCoI9Vrvb7DTw4kiFFkJqz+nEsweQ1U=;
h=Date:From:Message-Id:Subject:Mime-Version:Content-Type:To;
b=kqPSP5gNAySYEFEOWaa9y2twSAm+vjjLlroI4/hgMZ7LWt1cLEJgK4L7DoMbRRjuW
1I+uFt797vMzpkIDnnWd80VNVMLaOzCKVlHH2p64/1HllRpCwlbQAbD1SdpuQ4OJ9w
1WmRRdmAvNQtYqliaCTjr6UKYvVi109+eaRvvpbE=
Received: from zipmail.com.br (a4-winter2.host.intranet [10.131.133.128])
by a4-salsa1.adm.intranet (Postfix) with ESMTP id E0E333800084;
Sun, 8 Jan 2012 16:27:47 -0200 (BRST)
Date: Sun, 8 Jan 2012 16:27:47 -0200
From: Shukri Ghanem <[email protected]>
Message-Id: <[email protected]>
Subject: Shukri Ghanem
Mime-Version: 1.0
Content-Type: text/html; charset=utf-8
X-SenderIP: 201.83.137.178
To: undisclosed-recipients:;
X-SIG5: ec238b383038fc303efaa045e9353186
X-Truedomain-Domain: zipmail.com.br
X-Truedomain-SPF: Pass
X-Truedomain-DKIM: Pass
X-Truedomain-ID: C0AEACC3A85C23C5447E6906E68F561F
X-Truedomain: NeutralHi,

Greetings to you and your family, firstly I apologize for sending you this sensitive information via e-mail, instead of a Certified mail/Post-mail. This is due to the urgency and importance of the information.
My name is Shukri Ghanem, the Libyan oil minister and head of the National Oil Co-operation of Libya. I would like to use your relationship with me to pull my wealth out from our African continent. I was high-ranking Libyan official but I defected and fled the country on the May 17th 2011. I have huge amount of fund with Oilibya Petroleum Company in Ivory Coast I need help to divert this fund far from Africa .
Thank you
Shukri Ghanem

The same scam email is also being sent from [email protected] :

Delivered-To: XXXXXXXXXX
Received: by 10.223.14.75 with SMTP id f11cs39757faa;
Sun, 8 Jan 2012 10:43:28 -0800 (PST)
Received: by 10.236.183.52 with SMTP id p40mr16712629yhm.19.1326048206432;
Sun, 08 Jan 2012 10:43:26 -0800 (PST)
Return-Path: <[email protected]>
Received: from a4-salsa3.bol.com.br (a4-salsa3.bol.com.br. [200.147.97.218])
by mx.google.com with ESMTP id 24si62686082yhs.119.2012.01.08.10.43.25;
Sun, 08 Jan 2012 10:43:26 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 200.147.97.218 as permitted sender) client-ip=200.147.97.218;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 200.147.97.218 as permitted sender) [email protected]; dkim=pass (test mode) [email protected]
Received: from localhost (localhost.localdomain [127.0.0.1])
by a4-salsa3.bol.com.br (Postfix) with ESMTP id 9577E3800084;
Sun, 8 Jan 2012 16:43:25 -0200 (BRST)
Received: from a4-salsa3.adm.intranet (localhost.localdomain [127.0.0.1])
by a4-salsa3.bol.com.br (Postfix) with ESMTP id 6244B380008D;
Sun, 8 Jan 2012 16:41:42 -0200 (BRST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=zipmail.com.br;
s=afl; t=1326048205;
bh=Oz0YCWQbYCNmZCoI9Vrvb7DTw4kiFFkJqz+nEsweQ1U=;
h=Date:From:Message-Id:Subject:Mime-Version:Content-Type:To;
b=Mfiktj18rn9SsVkuVaaRTeoRbHldnguCkq2BhRQFYBywCPkzPj0gJBgWuRZMuJnTb
0RgULY3Whv8DsaXnHBpAMDJZ1DFmjQFIS4MRwWKgwzGac9OJcpyT9GIeXxZAe1btvb
McHuLTQ10NBrVgiDvmCMFzSv5nN6FYlPCnN15kGg=
Received: from zipmail.com.br (a4-winter18.host.intranet [10.131.133.145])
by a4-salsa3.adm.intranet (Postfix) with ESMTP id 3A0583800086;
Sun, 8 Jan 2012 16:41:42 -0200 (BRST)
Date: Sun, 8 Jan 2012 16:41:42 -0200
From: Shukri Ghanem <[email protected]>
Message-Id: <[email protected]>
Subject: Shukri Ghanem
Mime-Version: 1.0
Content-Type: text/html; charset=utf-8
X-SenderIP: 200.206.122.150
To: undisclosed-recipients:;
X-SIG5: ec238b383038fc303efaa045e9353186

Hi,
Greetings to you and your family, firstly I apologize for sending you this sensitive information via e-mail, instead of a Certified mail/Post-mail. This is due to the urgency and importance of the information.
My name is Shukri Ghanem, the Libyan oil minister and head of the National Oil Co-operation of Libya. I would like to use your relationship with me to pull my wealth out from our African continent. I was high-ranking Libyan official but I defected and fled the country on the May 17th 2011. I have huge amount of fund with Oilibya Petroleum Company in Ivory Coast I need help to divert this fund far from Africa .
Thank you