by buried under 419s
Mon Oct 15, 2012 12:51 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Mon, 15 Oct 2012 06:34:57 -0700
Received: from nm36-vm5.bullet.mail.bf1.yahoo.com ([72.30.238.141]:31738)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1TNkoo-0006mi-Jf
for ; Mon, 15 Oct 2012 06:34:56 -0700
Received: from [98.139.215.141] by nm36.bullet.mail.bf1.yahoo.com with NNFMP; 15 Oct 2012 13:34:52 -0000
Received: from [66.94.237.114] by tm12.bullet.mail.bf1.yahoo.com with NNFMP; 15 Oct 2012 13:34:52 -0000
Received: from [127.0.0.1] by omp1019.access.mail.mud.yahoo.com with NNFMP; 15 Oct 2012 13:34:52 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 29827 invoked by uid 60001); 15 Oct 2012 13:34:51 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1350308091; bh=4oVvDNfbX3kkc4/7FEb6VNYMbZya8Wb6H6AETSX6DEc=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=30lvpsa06gv/1Chlc6BJXOiOCE9BaJm9prP5bDskUdpnNmFAFQFD8DNpLv9wSajtbGFJ+yS+55E69j9+E1Pq1C92HtOQKyO85Un85pVDCW+GXv7dslCTsRC8cBjRoOex34tXmYadr3ypQU3T6peGKXGMUQPQkWbZ8SdhPzbpHSQ=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=att.net;
h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b=mG1snzKCVOpVZfmSL9PjZfcNQGcxwP99zVEPRj2nDhjFHHgfIt2HTVeZJEcvMValcMnTDXFFsd0nhbqMXGJn9hXg/w9CbPsN5LgwBoCJ6LF2R78pnjtXQB1o7cRXNLXUPcDW2Wz8SygfriJ0Lz8vYvrIe+ErEbmsAQjc92eN1nU=;
X-YMail-OSG: DwXhZzUVM1lBxAZJnv7H9qiSz9c.PyY41v1VRc004kLdgZd
x45LyLxoPnB3WjOmj.58fwenrZ7MMrb4_Zu9jzZMdl4XwtKH.FNkH5Udiet1
TKwJbm3HASIXYg.YCoE_bofN7ktqRIUU8n8vTv1WWxycgiSTcxqoztANb0Cu
IZlOK_uppeP_6euy1QC6EZyz6WNTcfxW2Q5foIphZ.TkUEZgw0NTXYGUChGz
bF6W8256Q0_l1MCh.RSRh_fewl9EYNZOwE_pGkrroyMFy6Rv5KYCa7pw.EHx
XtT7E8bwq4In2O8YDJg9pe4r8bBIgjvXVEYhmL06TwCsmzwycutUpqIu_6nu
kGdkFdEkjxKKQTOcdi50228chF0HpestrlcNI5_mJxF2kMA8WUoTDlEOEPr_
Rb74WFG5GiR6Zm.OBJ29wNTy2hq4x9BCDcoBnOvG91SjYIagACfmCLpf0ZBJ
Riw7p2a9R37LKLJrfyC962Z6jlXtbheO.MxSFsOfrvYguCxwhfvCvobGkQHW
qqpX0dg--
Received: from [208.116.46.88] by web181204.mail.ne1.yahoo.com via HTTP; Mon, 15 Oct 2012 06:34:51 PDT
X-Rocket-MIMEInfo: 001.001,DQoNCkRpZCB5b3UgaW5zdHJ1Y3QgRWxpemFiZXRoIFJvc2UgdG8gY2xhaW0geW91ciBmdW5kIG9mICQxMC41bT8BMAEBAQE-
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.123.450
Message-ID: <[email protected]>
Date: Mon, 15 Oct 2012 06:34:51 -0700 (PDT)
From: JAMES GOODMAN <[email protected]>
Reply-To: [email protected]
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="876660292-126889466-1350308091=:16785"
X-Spam-Status: Yes, score=7.4
X-Spam-Score: 74
X-Spam-Bar: +++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Did you instruct Elizabeth Rose to claim your fund of $10.5m?
Did you instruct Elizabeth Rose to claim your fund of $10.5m? [...]
Content analysis details: (7.4 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?208.116.46.88>]
1.0 HK_RANDOM_FROM From username looks random
0.0 HK_RANDOM_ENVFROM Envelope sender username looks random
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(webxxxxxxxx1957[at]att.net)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[72.30.238.141 listed in list.dnswl.org]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (webxxxxxxxx1957[at]att.net)
1.5 BAYES_60 BODY: Bayes spam probability is 60 to 80%
[score: 0.7727]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
2.8 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** Did you instruct Elizabeth Rose to claim your fund of $10.5m?
--876660292-126889466-1350308091=:16785
Content-Type: text/plain; charset=us-ascii
Did you instruct Elizabeth Rose to claim your fund of $10.5m?
Envelope-to:
Delivery-date: Mon, 15 Oct 2012 06:34:57 -0700
Received: from nm36-vm5.bullet.mail.bf1.yahoo.com ([72.30.238.141]:31738)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1TNkoo-0006mi-Jf
for ; Mon, 15 Oct 2012 06:34:56 -0700
Received: from [98.139.215.141] by nm36.bullet.mail.bf1.yahoo.com with NNFMP; 15 Oct 2012 13:34:52 -0000
Received: from [66.94.237.114] by tm12.bullet.mail.bf1.yahoo.com with NNFMP; 15 Oct 2012 13:34:52 -0000
Received: from [127.0.0.1] by omp1019.access.mail.mud.yahoo.com with NNFMP; 15 Oct 2012 13:34:52 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 29827 invoked by uid 60001); 15 Oct 2012 13:34:51 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1350308091; bh=4oVvDNfbX3kkc4/7FEb6VNYMbZya8Wb6H6AETSX6DEc=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=30lvpsa06gv/1Chlc6BJXOiOCE9BaJm9prP5bDskUdpnNmFAFQFD8DNpLv9wSajtbGFJ+yS+55E69j9+E1Pq1C92HtOQKyO85Un85pVDCW+GXv7dslCTsRC8cBjRoOex34tXmYadr3ypQU3T6peGKXGMUQPQkWbZ8SdhPzbpHSQ=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=att.net;
h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b=mG1snzKCVOpVZfmSL9PjZfcNQGcxwP99zVEPRj2nDhjFHHgfIt2HTVeZJEcvMValcMnTDXFFsd0nhbqMXGJn9hXg/w9CbPsN5LgwBoCJ6LF2R78pnjtXQB1o7cRXNLXUPcDW2Wz8SygfriJ0Lz8vYvrIe+ErEbmsAQjc92eN1nU=;
X-YMail-OSG: DwXhZzUVM1lBxAZJnv7H9qiSz9c.PyY41v1VRc004kLdgZd
x45LyLxoPnB3WjOmj.58fwenrZ7MMrb4_Zu9jzZMdl4XwtKH.FNkH5Udiet1
TKwJbm3HASIXYg.YCoE_bofN7ktqRIUU8n8vTv1WWxycgiSTcxqoztANb0Cu
IZlOK_uppeP_6euy1QC6EZyz6WNTcfxW2Q5foIphZ.TkUEZgw0NTXYGUChGz
bF6W8256Q0_l1MCh.RSRh_fewl9EYNZOwE_pGkrroyMFy6Rv5KYCa7pw.EHx
XtT7E8bwq4In2O8YDJg9pe4r8bBIgjvXVEYhmL06TwCsmzwycutUpqIu_6nu
kGdkFdEkjxKKQTOcdi50228chF0HpestrlcNI5_mJxF2kMA8WUoTDlEOEPr_
Rb74WFG5GiR6Zm.OBJ29wNTy2hq4x9BCDcoBnOvG91SjYIagACfmCLpf0ZBJ
Riw7p2a9R37LKLJrfyC962Z6jlXtbheO.MxSFsOfrvYguCxwhfvCvobGkQHW
qqpX0dg--
Received: from [208.116.46.88] by web181204.mail.ne1.yahoo.com via HTTP; Mon, 15 Oct 2012 06:34:51 PDT
X-Rocket-MIMEInfo: 001.001,DQoNCkRpZCB5b3UgaW5zdHJ1Y3QgRWxpemFiZXRoIFJvc2UgdG8gY2xhaW0geW91ciBmdW5kIG9mICQxMC41bT8BMAEBAQE-
X-Mailer: YahooMailClassic/15.0.8 YahooMailWebService/0.8.123.450
Message-ID: <[email protected]>
Date: Mon, 15 Oct 2012 06:34:51 -0700 (PDT)
From: JAMES GOODMAN <[email protected]>
Reply-To: [email protected]
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="876660292-126889466-1350308091=:16785"
X-Spam-Status: Yes, score=7.4
X-Spam-Score: 74
X-Spam-Bar: +++++++
X-Spam-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Did you instruct Elizabeth Rose to claim your fund of $10.5m?
Did you instruct Elizabeth Rose to claim your fund of $10.5m? [...]
Content analysis details: (7.4 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?208.116.46.88>]
1.0 HK_RANDOM_FROM From username looks random
0.0 HK_RANDOM_ENVFROM Envelope sender username looks random
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(webxxxxxxxx1957[at]att.net)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[72.30.238.141 listed in list.dnswl.org]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (webxxxxxxxx1957[at]att.net)
1.5 BAYES_60 BODY: Bayes spam probability is 60 to 80%
[score: 0.7727]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 LOTS_OF_MONEY Huge... sums of money
2.8 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Subject: ***SPAM*** Did you instruct Elizabeth Rose to claim your fund of $10.5m?
--876660292-126889466-1350308091=:16785
Content-Type: text/plain; charset=us-ascii
Did you instruct Elizabeth Rose to claim your fund of $10.5m?
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces