by buried under 419s
Fri Jul 27, 2012 10:54 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Fri, 27 Jul 2012 18:17:51 -0700
Received: from mo-p03-ob.rzone.de ([81.169.146.172]:17736)
by with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.77)
(envelope-from <[email protected]>)
id 1SuvfC-0002Vr-4r
for ; Fri, 27 Jul 2012 18:17:51 -0700
X-RZG-AUTH: :OGQLYEegb9/G1KOlAscF9LdU1pmGz1Qx8ROM9ZSZtonY1IW8k1Pr2uQFc+LfGLcZ8fdpww==
Message-ID: <[email protected]>
X-RZG-CLASS-ID: mo00
Received: from User
(70-91-245-97-BusName-Illinois.hfc.comcastbusiness.net [70.91.245.97])
by smtp.strato.de (joses mo78) (RZmta 30.1 AUTH)
with ESMTPA id P0102bo6S0tnOv ; Sat, 28 Jul 2012 03:13:57 +0200 (CEST)
Reply-To: <[email protected]>
From: "Mr.Paulson Johnson"<[email protected]>
Date: Fri, 27 Jul 2012 20:14:19 -0500
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0094_01C2A9A6.220F4950"
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=17.7
X-Spam-Score: 177
X-Spam-Bar: +++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: [...]
Content analysis details: (17.7 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_XM_419 Old OE version in X-Mailer only seen in 419 spam
0.5 NSL_RCVD_FROM_USER Received from User
0.0 FSL_RCVD_USER FSL_RCVD_USER
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[81.169.146.172 listed in list.dnswl.org]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(<dippaulsonjohnson17[at]yahoo.com.pe>
)
1.0 MISSING_HEADERS Missing To: header
0.0 OBFU_TEXT_ATTACH BODY: Text attachment with non-text MIME type
0.0 FSL_UA FSL_UA
3.6 HK_NAME_MR_MRS HK_NAME_MR_MRS
1.6 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FROM_MISSP_NO_TO From misspaced, To missing
0.0 FSL_FREEMAIL_1 FSL_FREEMAIL_1
0.0 OBFU_ATTACH_MISSP Obfuscated attachment type and misspaced From
1.7 FSL_NEW_HELO_USER FSL_NEW_HELO_USER
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 AXB_XMAILER_MIMEOLE_OL_024C2
0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay
0.0 FSL_MISSP_REPLYTO Mis-spaced from and Reply-to
0.0 FROM_MISSP_USER From misspaced, from "User"
1.5 FAKE_REPLY_C FAKE_REPLY_C
0.0 FROM_MISSPACED From: missing whitespace
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
X-Spam-Flag: YES
Subject: ***SPAM*** RE: From Mr.Paulson Johnson...Open message below ...
This is a multi-part message in MIME format.
Attention,
My name is Mr.Paulson Johnson , The Un assigned diplomatic agent by the IMF/UN and Minister of Finance after the meeting held last month to deliver your fund worth (USD3.5 M) to you. I arrived at John F Kennedy International Airport New York this morning. I also want you to know that i have only 2 working days to deliver this money to you and go back to my country because i have other assignment to carry out.
I need you to reconfirm to me your full address, home delivery address name and address of airport near you including your ID passport where to have your fund delivered and your direct contact number to reach you.
Here is my direct number where to reach me 347-298-9261
Kindly reply via alternative email address below : [email protected]
I wait for your urgent response.
Regards,
Mr.Paulson Johnson
Envelope-to:
Delivery-date: Fri, 27 Jul 2012 18:17:51 -0700
Received: from mo-p03-ob.rzone.de ([81.169.146.172]:17736)
by with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.77)
(envelope-from <[email protected]>)
id 1SuvfC-0002Vr-4r
for ; Fri, 27 Jul 2012 18:17:51 -0700
X-RZG-AUTH: :OGQLYEegb9/G1KOlAscF9LdU1pmGz1Qx8ROM9ZSZtonY1IW8k1Pr2uQFc+LfGLcZ8fdpww==
Message-ID: <[email protected]>
X-RZG-CLASS-ID: mo00
Received: from User
(70-91-245-97-BusName-Illinois.hfc.comcastbusiness.net [70.91.245.97])
by smtp.strato.de (joses mo78) (RZmta 30.1 AUTH)
with ESMTPA id P0102bo6S0tnOv ; Sat, 28 Jul 2012 03:13:57 +0200 (CEST)
Reply-To: <[email protected]>
From: "Mr.Paulson Johnson"<[email protected]>
Date: Fri, 27 Jul 2012 20:14:19 -0500
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0094_01C2A9A6.220F4950"
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Spam-Status: Yes, score=17.7
X-Spam-Score: 177
X-Spam-Bar: +++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: [...]
Content analysis details: (17.7 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_XM_419 Old OE version in X-Mailer only seen in 419 spam
0.5 NSL_RCVD_FROM_USER Received from User
0.0 FSL_RCVD_USER FSL_RCVD_USER
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[81.169.146.172 listed in list.dnswl.org]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(<dippaulsonjohnson17[at]yahoo.com.pe>
)
1.0 MISSING_HEADERS Missing To: header
0.0 OBFU_TEXT_ATTACH BODY: Text attachment with non-text MIME type
0.0 FSL_UA FSL_UA
3.6 HK_NAME_MR_MRS HK_NAME_MR_MRS
1.6 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FROM_MISSP_NO_TO From misspaced, To missing
0.0 FSL_FREEMAIL_1 FSL_FREEMAIL_1
0.0 OBFU_ATTACH_MISSP Obfuscated attachment type and misspaced From
1.7 FSL_NEW_HELO_USER FSL_NEW_HELO_USER
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 AXB_XMAILER_MIMEOLE_OL_024C2
0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay
0.0 FSL_MISSP_REPLYTO Mis-spaced from and Reply-to
0.0 FROM_MISSP_USER From misspaced, from "User"
1.5 FAKE_REPLY_C FAKE_REPLY_C
0.0 FROM_MISSPACED From: missing whitespace
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
X-Spam-Flag: YES
Subject: ***SPAM*** RE: From Mr.Paulson Johnson...Open message below ...
This is a multi-part message in MIME format.
Attention,
My name is Mr.Paulson Johnson , The Un assigned diplomatic agent by the IMF/UN and Minister of Finance after the meeting held last month to deliver your fund worth (USD3.5 M) to you. I arrived at John F Kennedy International Airport New York this morning. I also want you to know that i have only 2 working days to deliver this money to you and go back to my country because i have other assignment to carry out.
I need you to reconfirm to me your full address, home delivery address name and address of airport near you including your ID passport where to have your fund delivered and your direct contact number to reach you.
Here is my direct number where to reach me 347-298-9261
Kindly reply via alternative email address below : [email protected]
I wait for your urgent response.
Regards,
Mr.Paulson Johnson
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces