by buried under 419s
Thu Jul 11, 2013 8:01 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 11 Jul 2013 14:43:17 -0700
Received: from oms-da03.r1000.mx.aol.com ([205.188.92.206]:40976)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1UxOdv-000110-Tk
for ; Thu, 11 Jul 2013 14:43:17 -0700
Received: from mtaout-mb02.r1000.mx.aol.com (mtaout-mb02.r1000.mx.aol.com [172.29.41.66])
by oms-da03.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTP id 0B87D38000DAF;
Thu, 11 Jul 2013 17:43:16 -0400 (EDT)
Received: from CASATELLI-SRV.casatelli.local (unknown [75.99.217.190])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(No client certificate requested)
by mtaout-mb02.r1000.mx.aol.com (MUA/Third Party Client Interface) with ESMTPSA id 25BA7E0000D2;
Thu, 11 Jul 2013 17:43:15 -0400 (EDT)
Content-Type: multipart/alternative; boundary="===============0694080467=="
MIME-Version: 1.0
To: Recipients <[email protected]>
From: "Dr.Kingsley MoghaluI " <[email protected]>
Date: Thu, 11 Jul 2013 17:29:52 -0400
Reply-To: [email protected]
x-aol-global-disposition: S
X-SPAM-FLAG: YES
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mx.aol.com;
s=20121107; t=1373578995;
bh=CHDyTyTKM/1aVEReNq24tPyPd3zTrBJGbPTeJM/DWSc=;
h=From:To:Subject:Date:MIME-Version:Content-Type;
b=lKKpkd1jEJ4PK+kYfo19K3lmekuglopzx/WOdbGA18krwQrDAj/aQxkez7NTRHLpy
P+gEZGWaflMZMS+dOhj5UR3bcpCFztnUWdT3KWU+iGo3s9pubgWnKr88qZZTHcQQoH
fvma5YXGdhMTvDOhcjvK7si1GbDOhioAExMz2PN4=
X-AOL-SCOLL-SCORE: 0:2:154912944:93952408
X-AOL-SCOLL-URL_COUNT: 0
X-AOL-REROUTE: YES
x-aol-sid: 3039ac1d294251df26f323d6
X-AOL-IP: 75.99.217.190
X-Spam-Status: Yes, score=14.8
X-Spam-Score: 148
X-Spam-Bar: ++++++++++++++
X-Spam-Report: Spam detection software, running on the system "m", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: [...]
Content analysis details: (14.8 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(worshamwic[at]aol.com)
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[205.188.92.206 listed in psbl.surriel.com]
0.8 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(rj9136[at]aol.com
)
-0.7 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.4 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5000]
0.5 MISSING_MID Missing Message-Id: header
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 UPPERCASE_75_100 message body is 75-100% uppercase
0.0 T_HK_NAME_FM_DR T_HK_NAME_FM_DR
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.8 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
3.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
3.4 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
1.4 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** FROM THE EXECUTIVE GOVERNOR,
CENTRAL BANK OF NIGERIA .SANUSI LAMIDO OFFICE +234-8063248443. MR. GARY
WALTER THE DIPLOMAT I SEND TO YOU HAVE ARRIVED WITH YOUR TWO INHERITANCE
CASH TRUNK BOXES WORTH $8.3M IN ROGUE VALLEY INTERNATIONAL - MEDFORD
AIRPORT CANYONVILLE OREGON,
UNITED STATES AS THEIR TRANSIT. I WANT YOU TO KNOW THAT YOU HAVE 24 HOURS TO
CALL MR. GARY WALTER WITH THIS LINE (214) 613 9962 OR EMAIL:
[email protected] FOR YOUR INFORMATION,
THE DELIVERYMAN WITH YOUR PACKAGE IS NOT AWARE OF THE CONTENT OF THE BOXES
FOR SECURITY PURPOSE.ALSO RECONFIRM YOUR DETAILS TO ENABLE HIM DELIVER YOUR
CASH CONSIGNMENT BOXES TO YOUR HOUSE WITHOUT ANY FURTHER DELAY OR MISTAKE
You will not see this in a MIME-aware mail reader.
--===============0694080467==
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
[scam in subject line]
Envelope-to:
Delivery-date: Thu, 11 Jul 2013 14:43:17 -0700
Received: from oms-da03.r1000.mx.aol.com ([205.188.92.206]:40976)
by with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.80)
(envelope-from <[email protected]>)
id 1UxOdv-000110-Tk
for ; Thu, 11 Jul 2013 14:43:17 -0700
Received: from mtaout-mb02.r1000.mx.aol.com (mtaout-mb02.r1000.mx.aol.com [172.29.41.66])
by oms-da03.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTP id 0B87D38000DAF;
Thu, 11 Jul 2013 17:43:16 -0400 (EDT)
Received: from CASATELLI-SRV.casatelli.local (unknown [75.99.217.190])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(No client certificate requested)
by mtaout-mb02.r1000.mx.aol.com (MUA/Third Party Client Interface) with ESMTPSA id 25BA7E0000D2;
Thu, 11 Jul 2013 17:43:15 -0400 (EDT)
Content-Type: multipart/alternative; boundary="===============0694080467=="
MIME-Version: 1.0
To: Recipients <[email protected]>
From: "Dr.Kingsley MoghaluI " <[email protected]>
Date: Thu, 11 Jul 2013 17:29:52 -0400
Reply-To: [email protected]
x-aol-global-disposition: S
X-SPAM-FLAG: YES
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mx.aol.com;
s=20121107; t=1373578995;
bh=CHDyTyTKM/1aVEReNq24tPyPd3zTrBJGbPTeJM/DWSc=;
h=From:To:Subject:Date:MIME-Version:Content-Type;
b=lKKpkd1jEJ4PK+kYfo19K3lmekuglopzx/WOdbGA18krwQrDAj/aQxkez7NTRHLpy
P+gEZGWaflMZMS+dOhj5UR3bcpCFztnUWdT3KWU+iGo3s9pubgWnKr88qZZTHcQQoH
fvma5YXGdhMTvDOhcjvK7si1GbDOhioAExMz2PN4=
X-AOL-SCOLL-SCORE: 0:2:154912944:93952408
X-AOL-SCOLL-URL_COUNT: 0
X-AOL-REROUTE: YES
x-aol-sid: 3039ac1d294251df26f323d6
X-AOL-IP: 75.99.217.190
X-Spam-Status: Yes, score=14.8
X-Spam-Score: 148
X-Spam-Bar: ++++++++++++++
X-Spam-Report: Spam detection software, running on the system "m", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: [...]
Content analysis details: (14.8 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(worshamwic[at]aol.com)
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[205.188.92.206 listed in psbl.surriel.com]
0.8 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(rj9136[at]aol.com
)
-0.7 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.4 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5000]
0.5 MISSING_MID Missing Message-Id: header
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 UPPERCASE_75_100 message body is 75-100% uppercase
0.0 T_HK_NAME_FM_DR T_HK_NAME_FM_DR
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.8 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
3.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
3.4 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
0.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
1.4 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** FROM THE EXECUTIVE GOVERNOR,
CENTRAL BANK OF NIGERIA .SANUSI LAMIDO OFFICE +234-8063248443. MR. GARY
WALTER THE DIPLOMAT I SEND TO YOU HAVE ARRIVED WITH YOUR TWO INHERITANCE
CASH TRUNK BOXES WORTH $8.3M IN ROGUE VALLEY INTERNATIONAL - MEDFORD
AIRPORT CANYONVILLE OREGON,
UNITED STATES AS THEIR TRANSIT. I WANT YOU TO KNOW THAT YOU HAVE 24 HOURS TO
CALL MR. GARY WALTER WITH THIS LINE (214) 613 9962 OR EMAIL:
[email protected] FOR YOUR INFORMATION,
THE DELIVERYMAN WITH YOUR PACKAGE IS NOT AWARE OF THE CONTENT OF THE BOXES
FOR SECURITY PURPOSE.ALSO RECONFIRM YOUR DETAILS TO ENABLE HIM DELIVER YOUR
CASH CONSIGNMENT BOXES TO YOUR HOUSE WITHOUT ANY FURTHER DELAY OR MISTAKE
You will not see this in a MIME-aware mail reader.
--===============0694080467==
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
[scam in subject line]
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces