by Faizan Docherty
Mon Sep 01, 2014 3:25 pm
ipTRACKERonline.com wrote:Header Analysis Quick Report
Originating IP: 41.138.103.198
Originating ISP: Onatel/fasonet's
City: Ouagadougou
Country of Origin: Burkina Faso
* For a complete report on this email header goto ipTRACKERonline
Delivered-To: <snipped>
Received: by 10.70.80.134 with SMTP id r6csp113178pdx;
Fri, 29 Aug 2014 09:37:12 -0700 (PDT)
X-Received: by 10.70.131.101 with SMTP id ol5mr5295090pdb.77.1409330232277;
Fri, 29 Aug 2014 09:37:12 -0700 (PDT)
Return-Path: <[email protected]>
Received: from relay.mailchannels.net (aso-006-i402.relay.mailchannels.net. [143.95.81.31])
by mx.google.com with ESMTP id gt7si1069134pac.16.2014.08.29.09.37.11
for <snipped>;
Fri, 29 Aug 2014 09:37:12 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 143.95.81.31 as permitted sender) client-ip=143.95.81.31;
Authentication-Results: mx.google.com;
spf=softfail (google.com: domain of transitioning [email protected] does not designate 143.95.81.31 as permitted sender) [email protected]
Received: from r8-chicago.webserversystems.com (ip-10-213-14-133.us-west-2.compute.internal [10.213.14.133])
by relay.mailchannels.net (Postfix) with ESMTPA id F097060808
for <snipped>; Fri, 29 Aug 2014 16:37:08 +0000 (UTC)
Received: from r8-chicago.webserversystems.com ([UNAVAILABLE]. [10.252.32.37])
(using TLSv1 with cipher DHE-RSA-AES256-SHA)
by 0.0.0.0:2500 (trex/5.2.12);
Fri, 29 Aug 2014 16:37:09 GMT
Received: from mail2.tongli.com.tw ([59.120.34.23]:38966 helo=mail.tongli.com.tw)
by r8-chicago.webserversystems.com with esmtp (Exim 4.82)
(envelope-from <[email protected]>)
id 1XNPAa-0008uP-9z
for <snipped>; Fri, 29 Aug 2014 11:37:04 -0500
Received: from tongli.com.tw (localhost.localdomain [127.0.0.1])
by mail.tongli.com.tw (Postfix) with ESMTP id 7FBB42763C8;
Sat, 30 Aug 2014 00:36:02 +0800 (CST)
From: "michelle" <[email protected]>
To: [email protected]
Reply-To: [email protected]
Date: Sat, 30 Aug 2014 00:36:02 +0800
Message-Id: <[email protected]>
X-Mailer: Open WebMail 2.41 20040926
X-OriginatingIP: 41.138.103.198 (michelle)
MIME-Version: 1.0
Content-Type: text/plain;
charset=utf-8
X-yoursite-MailScanner-Information: Please contact the ISP for more information
X-yoursite-MailScanner-ID: 7FBB42763C8.AA46A
X-yoursite-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details
X-yoursite-MailScanner-SpamCheck: spam, SpamAssassin (cached, score=7.86,
required 5, ALL_TRUSTED -1.00, BAYES_50 0.80,
FREEMAIL_FORGED_REPLYTO 2.10, LOTS_OF_MONEY 0.00, MONEY_FRAUD_3 4.20,
T_SMF_FM_FORGED_REPLYTO 0.01, US_DOLLARS_3 1.75)
X-yoursite-MailScanner-SpamScore: sssssss
X-yoursite-MailScanner-From: [email protected]
X-Spam-Status: Yes
X-Spam-Status: Yes, score=11.7
X-Spam-Score: 117
X-Spam-Bar: +++++++++++
X-Spam-Report: Spam detection software, running on the system "r8-chicago.webserversystems.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Greetings Dearest Beloved, I am divinely touched to offer
my fortune to less privilege. I am a childless widow and as a result of my
present situation I have nothing in mind other than to help the poor according
to God direction and wishes. [...]
Content analysis details: (11.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[59.120.34.23 listed in bb.barracudacentral.org]
0.0 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
1.8 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.2 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
2.0 DCC_CHECK Detected as bulk mail by DCC (dcc-servers.net)
0.0 LOTS_OF_MONEY Huge... sums of money
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 T_SMF_FM_FORGED_REPLYTO Freemail in Reply-To, but not From
4.2 MONEY_FRAUD_3 Lots of money and several fraud phrases
X-Spam-Flag: YES
Subject: ***SPAM*** Greetings Dearest Beloved,
X-MC-Forward: <snipped>
X-AuthUser: @r8-chicago.webserversystems.com
Greetings Dearest Beloved, I am divinely touched to offer my fortune to less privilege.
I am a childless widow and as a result of my present situation I have nothing in mind
other than to help the poor according to God direction and wishes.
I reached you by the special grace of God through email because I can not speak to your
understanding on telephone due to my sickness. I am suffering from esophageal cancer for
years now and have undergone series of cancer treatments but no avail.
Recently my doctor declared that I have shorter days to live. Likewise from my daily
health report it is also clear to me that I have but little time to pass on, therefore I
wish to offer you my fortune US$6,200,000.00 to take care of charity work in favor of less
privileges in your country.
The money will go to the charity work. I have come up with a great confidence for your
trust conduct over this solemn work of God after many prayers. As soon as I receive your
reply I will give you the address of my bank and also instruct them for the release of the
money to you for the charity work.
But I only wished to have your assurance that you will utilize the money as I have said. I
have great interest for the welfare of the less privilege because I was once an orphan and
will not be happy if any thing comes contrary against the charity work. Please remember my
situation in your daily prayers.
Hoping to receive your reply soon. Here ([email protected])
Yours Sick Sister,
Mrs. Rosaline Spagnolo.
Please DO NOT tell a scammer that he has been posted here!
If you wish you can email me at
faizandocherty @ scamwarners [dot] com
How do I find email headers???
How to analyze an email header.
If you wish you can email me at
faizandocherty @ scamwarners [dot] com
How do I find email headers???
How to analyze an email header.