Colin and Chris Weir <[email protected]>

Header Analysis Quick Report<br>Originating IP: 123.63.144.181<br>Originating ISP: Vodafone India<br> City: New Delhi<br>Country of Origin: India<br>* For a complete report on this email header goto ipTRACKERonline

Delivered-To: <snipped>
Received: by 10.220.177.2 with SMTP id bg2csp11816vcb;
Thu, 5 Dec 2013 04:42:45 -0800 (PST)
X-Received: by 10.180.208.4 with SMTP id ma4mr11908418wic.43.1386247364770;
Thu, 05 Dec 2013 04:42:44 -0800 (PST)
Return-Path: <[email protected]>
Received: from emea01-am1-obe.outbound.protection.outlook.com (emea01-am1-ndr.ptr.protection.outlook.com. [157.56.116.99])
by mx.google.com with ESMTPS id r4si34537349wjr.86.2013.12.05.04.42.38
for <multiple recipients>
(version=TLSv1 cipher=ECDHE-RSA-AES128-SHA bits=128/128);
Thu, 05 Dec 2013 04:42:44 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 157.56.116.99 as permitted sender) client-ip=157.56.116.99;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 157.56.116.99 as permitted sender) [email protected]
Received: from [10.216.122.54] (123.63.144.181) by
DB3PR01MB218.eurprd01.prod.exchangelabs.com (10.141.3.140) with Microsoft
SMTP Server (TLS) id 15.0.837.10; Thu, 5 Dec 2013 12:40:49 +0000
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: My wife and I(Colin and Chris Weir) has decieded to donate the sum of 750,
000.00GBP to you for more details us immediately
To: Recipients <[email protected]>
From: "Mr.&Mrs. weir" <[email protected]>
Date: Thu, 5 Dec 2013 18:10:21 +0530
Reply-To: <[email protected]>
Message-ID: <5750d01b-2fdf-4379-bea1-c0813cc12d12@DB3PR01MB218.eurprd01.prod.exchangelabs.com>
Return-Path: [email protected]
X-Originating-IP: [123.63.144.181]
X-ClientProxiedBy: HKNPR02CA022.apcprd02.prod.outlook.com (10.141.16.17) To
DB3PR01MB218.eurprd01.prod.exchangelabs.com (10.141.3.140)
X-Forefront-PRVS: 00514A2FE6
X-Forefront-Antispam-Report: SFV:SPM;SFS:(199002)(189002)(83322001)(81686001)(56776001)(47446002)(54316002)(56816005)(23756003)(74502001)(74706001)(81816001)(31686002)(90146001)(50466002)(42186004)(4396001)(49866001)(54356001)(87976001)(89136003)(77982001)(33646001)(77096001)(64872005)(76796001)(59766001)(76786001)(83072001)(85306002)(74662001)(43066001)(85852002)(558084003)(65816001)(555874004)(69226001)(80022001)(81542001)(76482001)(79102001)(53256004)(50986001)(81342001)(76176001)(47976001)(47736001)(51856001)(80976001)(66066001)(74366001)(63696002)(87266001)(47776003)(74316001)(46102001)(74876001)(62346010);DIR:OUT;SFP:1501;SCL:5;SRVR:DB3PR01MB218;H:[10.216.122.54];CLIP:123.63.144.181;FPR:;RD:InfoNoRecords;A:0;MX:1;LANG:en;
X-OriginatorOrg: weir209.onmicrosoft.com

my message...

Delivered-To: фыва@gmail.com
Received: by 10.96.130.102 with SMTP id od6csp186318qdb;
Tue, 3 Jun 2014 14:16:55 -0700 (PDT)
X-Received: by 10.236.94.43 with SMTP id m31mr9550952yhf.154.1401830215666;
Tue, 03 Jun 2014 14:16:55 -0700 (PDT)
Return-Path: <[email protected]>
Received: from smtp.fuse.net (smtpout.fuse.net. [64.8.71.14])
by mx.google.com with ESMTPS id x49si820605yhd.92.2014.06.03.14.16.55
for <фыва@gmail.com>
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Tue, 03 Jun 2014 14:16:55 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected]
designates 64.8.71.14 as permitted sender) client-ip=64.8.71.14;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected]
designates 64.8.71.14 as permitted sender)
[email protected]
Return-Path: <[email protected]>
X-Authed-Username: Y2Fyb2x5bi1ob21lQGZ1c2UubmV0
X_CMAE_Category: 0,0 Undefined,Undefined
X-CNFS-Analysis: v=2.1 cv=JpLI8qIC c=1 sm=0 tr=0
a=2I9OLylxt9QRvEjuFZXd7A==:117 a=K-v-2zaBAAAA:8 a=FKkrIqjQGGEA:10
a=vYbi2SD7W5AA:10 a=EhexjHeNWB0A:10 a=w1lZMHalAAAA:8
a=LwdU-67PYLgQC9Q_RPQA:9 a=r_wQlfq6HeKlUQvs:21 a=XSZeOdIcQuKPOCg4:21
a=QEXdDO2ut3YA:10 a=FDEfyXSZ6XAA:10 a=HI85NLhwbEUA:10
a=YI4ND8jKU2EA:10 a=EcGEOCVaWtMcNiqrRXcA:9 a=_W_S_7VecoQA:10
X-CM-Score: 0
X-Scanned-by: Cloudmark Authority Engine
Authentication-Results: smtp01.cincibell.synacor.com
[email protected]; sender-id=unknown
Authentication-Results: smtp01.cincibell.synacor.com
[email protected]; spf=unknown; sender-id=unknown
Received-SPF: error (smtp01.cincibell.synacor.com: 10.120.1.18 is
neither permitted nor denied by domain of fuse.net
Received: from [10.120.1.18] ([10.120.1.18:40750]
helo=md05.cincibell.synacor.com)
by smtp.fuse.net (envelope-from <[email protected]>)
(ecelerity 2.2.3.47 r(39787)) with ESMTP
id CD/17-07691-54B3E835; Tue, 03 Jun 2014 17:16:53 -0400
Date: Tue, 3 Jun 2014 17:16:52 -0400 (EDT)
From: Chris Colin Wier <[email protected]>
To: [email protected]
Message-ID: <2069410955.2306400.1401830212949.JavaMail.root@md05.cincibell.synacor.com>
Subject: Donation!!!
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_2306399_2090875488.1401830212948"
X-Originating-IP: [197.228.42.224]
X-Mailer: Zimbra 7.1.4_GA_2555 (ZimbraWebClient - GC35 (Win)/7.1.4_GA_2555)

------=_Part_2306399_2090875488.1401830212948
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit

My wife and i have donated the sum of $1.5m to you revert back with name
address mobile age from chris and colin Wie
------=_Part_2306399_2090875488.1401830212948
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<html><head><style type='text/css'>p { margin: 0;
}</style></head><body><div style='font-family: times new roman,new
york,times,serif; font-size: 12pt; color: #000000'><span style="color:
rgb(80, 0, 80); font-family: arial, sans-serif; font-size: 13px;
background-color: rgb(255, 255, 255);">My wife and i have donated the
sum of $1.5m to you revert back with name</span><br style="color:
rgb(80, 0, 80); font-family: arial, sans-serif; font-size: 13px;
background-color: rgb(255, 255, 255);"><span style="color: rgb(80, 0,
80); font-family: arial, sans-serif; font-size: 13px;
background-color: rgb(255, 255, 255);">address mobile age from chris
and colin Wie</span></div></body></html>
------=_Part_2306399_2090875488.1401830212948--