by buried under 419s
Wed Jul 10, 2013 11:45 am
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Wed, 10 Jul 2013 07:46:49 -0700
Received: from oms-da04.r1000.mx.aol.com ([205.188.92.208]:45791)
by = with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1UwvfM-0003xc-UL
for ; Wed, 10 Jul 2013 07:46:49 -0700
Received: from mtaout-ma01.r1000.mx.aol.com (mtaout-ma01.r1000.mx.aol.com [172.29.41.1])
by oms-da04.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTP id 2926638001DEB;
Wed, 10 Jul 2013 10:46:49 -0400 (EDT)
Received: from POCA-DC1.TivSchools.com (unknown [158.123.153.210])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(No client certificate requested)
by mtaout-ma01.r1000.mx.aol.com (MUA/Third Party Client Interface) with ESMTPSA id 72106E000348;
Wed, 10 Jul 2013 10:46:48 -0400 (EDT)
Content-Type: multipart/alternative; boundary="===============0978021062=="
MIME-Version: 1.0
Subject: Finally,
the United Nation has decided to build back the image of this great nation
by paying all genuine foreign contractors who got scammed in pursuit of
their contractual amount. Your name has been brought to us by our team of
auditors as amongst the Scam victims here in London ,
the rest of West Africa and parts of Europe . The total amount of $1.2M have
been set aside for each of you who are in this list as part payment of your
funds,
the rest will follow after your receipt of this first batch.Best Regards
Susan Rice.
To: Recipients <[email protected]>
From: "Susan Rice" <[email protected]>
Date: Wed, 10 Jul 2013 10:48:13 -0400
Reply-To: [email protected]
x-aol-global-disposition: S
X-SPAM-FLAG: YES
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mx.aol.com;
s=20121107; t=1373467609;
bh=xqR50mg2tHAeNimoyQ81iKLgXYO1uT/yTBd6w1f+bSg=;
h=From:To:Subject:Date:MIME-Version:Content-Type;
b=ut3Dp23Yz3oL/OP6yUM2zOczEHChXhgUrkVwO3G5KpvW2Lj4GnocQuXDas7N32+Pn
vMP1b2j4ikwuahzGOuwAGoZZpFm9pJys98rVkeF6TIxYEN+qLeM/ZCNF4Z5Ng6xjTJ
Pz6F2MvrBawtlSTejfBfj5DkIjeFZtscW9j3wEVQ=
X-AOL-SCOLL-SCORE: 0:2:128354832:93952408
X-AOL-SCOLL-URL_COUNT: 0
X-AOL-REROUTE: YES
x-aol-sid: 3039ac1d290151dd73d85dd8
X-AOL-IP: 158.123.153.210
X-Spam-Status: No, score=1.5
X-Spam-Score: 15
X-Spam-Bar: +
X-Ham-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: [...]
Content analysis details: (1.5 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(worshamwic[at]aol.com)
0.8 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
-0.7 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.4 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
0.0 HTML_MESSAGE BODY: HTML included in message
-0.5 BAYES_05 BODY: Bayes spam probability is 1 to 5%
[score: 0.0113]
0.5 MISSING_MID Missing Message-Id: header
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
X-Spam-Flag: NO
You will not see this in a MIME-aware mail reader.
--===============0978021062==
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
--===============0978021062==
Content-Type: text/html; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset=
=3Diso-8859-1"/></head></html>
--===============0978021062==--
[scam in subject line]
Envelope-to:
Delivery-date: Wed, 10 Jul 2013 07:46:49 -0700
Received: from oms-da04.r1000.mx.aol.com ([205.188.92.208]:45791)
by = with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1UwvfM-0003xc-UL
for ; Wed, 10 Jul 2013 07:46:49 -0700
Received: from mtaout-ma01.r1000.mx.aol.com (mtaout-ma01.r1000.mx.aol.com [172.29.41.1])
by oms-da04.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTP id 2926638001DEB;
Wed, 10 Jul 2013 10:46:49 -0400 (EDT)
Received: from POCA-DC1.TivSchools.com (unknown [158.123.153.210])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(No client certificate requested)
by mtaout-ma01.r1000.mx.aol.com (MUA/Third Party Client Interface) with ESMTPSA id 72106E000348;
Wed, 10 Jul 2013 10:46:48 -0400 (EDT)
Content-Type: multipart/alternative; boundary="===============0978021062=="
MIME-Version: 1.0
Subject: Finally,
the United Nation has decided to build back the image of this great nation
by paying all genuine foreign contractors who got scammed in pursuit of
their contractual amount. Your name has been brought to us by our team of
auditors as amongst the Scam victims here in London ,
the rest of West Africa and parts of Europe . The total amount of $1.2M have
been set aside for each of you who are in this list as part payment of your
funds,
the rest will follow after your receipt of this first batch.Best Regards
Susan Rice.
To: Recipients <[email protected]>
From: "Susan Rice" <[email protected]>
Date: Wed, 10 Jul 2013 10:48:13 -0400
Reply-To: [email protected]
x-aol-global-disposition: S
X-SPAM-FLAG: YES
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mx.aol.com;
s=20121107; t=1373467609;
bh=xqR50mg2tHAeNimoyQ81iKLgXYO1uT/yTBd6w1f+bSg=;
h=From:To:Subject:Date:MIME-Version:Content-Type;
b=ut3Dp23Yz3oL/OP6yUM2zOczEHChXhgUrkVwO3G5KpvW2Lj4GnocQuXDas7N32+Pn
vMP1b2j4ikwuahzGOuwAGoZZpFm9pJys98rVkeF6TIxYEN+qLeM/ZCNF4Z5Ng6xjTJ
Pz6F2MvrBawtlSTejfBfj5DkIjeFZtscW9j3wEVQ=
X-AOL-SCOLL-SCORE: 0:2:128354832:93952408
X-AOL-SCOLL-URL_COUNT: 0
X-AOL-REROUTE: YES
x-aol-sid: 3039ac1d290151dd73d85dd8
X-AOL-IP: 158.123.153.210
X-Spam-Status: No, score=1.5
X-Spam-Score: 15
X-Spam-Bar: +
X-Ham-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: [...]
Content analysis details: (1.5 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(worshamwic[at]aol.com)
0.8 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
-0.7 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.4 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
0.0 HTML_MESSAGE BODY: HTML included in message
-0.5 BAYES_05 BODY: Bayes spam probability is 1 to 5%
[score: 0.0113]
0.5 MISSING_MID Missing Message-Id: header
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
X-Spam-Flag: NO
You will not see this in a MIME-aware mail reader.
--===============0978021062==
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
--===============0978021062==
Content-Type: text/html; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset=
=3Diso-8859-1"/></head></html>
--===============0978021062==--
[scam in subject line]
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces