by Faizan Docherty
Fri Feb 27, 2015 11:18 am
ipTRACKERonline.com wrote:Header Analysis Quick Report
Originating IP: 65.54.190.213
Originating ISP: Microsoft Hosting
City: Redmond
Country of Origin: United States
* For a complete report on this email header goto ipTRACKERonline
Delivered-To: <snipped>
Received: by 10.70.23.65 with SMTP id k1csp4061244pdf;
Fri, 27 Feb 2015 06:26:07 -0800 (PST)
X-Received: by 10.66.66.75 with SMTP id d11mr24298624pat.132.1425047167053;
Fri, 27 Feb 2015 06:26:07 -0800 (PST)
Return-Path: <[email protected]>
Received: from relay.mailchannels.net (ar-005-i179.relay.mailchannels.net. [162.253.144.64])
by mx.google.com with ESMTP id cr5si2710400pdb.146.2015.02.27.06.26.04
for <snipped>;
Fri, 27 Feb 2015 06:26:07 -0800 (PST)
Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 162.253.144.64 as permitted sender) client-ip=162.253.144.64;
Authentication-Results: mx.google.com;
spf=softfail (google.com: domain of transitioning [email protected] does not designate 162.253.144.64 as permitted sender) [email protected];
dmarc=fail (p=NONE dis=NONE) header.from=outlook.com
X-Sender-Id: _forwarded-from|65.54.190.201
Received: from r8-chicago.webserversystems.com (ip-10-229-11-165.us-west-2.compute.internal [10.229.11.165])
by relay.mailchannels.net (Postfix) with ESMTPA id A92DF502A
for <snipped>; Fri, 27 Feb 2015 14:26:03 +0000 (UTC)
X-Sender-Id: _forwarded-from|65.54.190.201
Received: from r8-chicago.webserversystems.com (r8-chicago.webserversystems.com [10.254.9.84])
(using TLSv1 with cipher DHE-RSA-AES256-SHA)
by 0.0.0.0:2500 (trex/5.4.6);
Fri, 27 Feb 2015 14:26:04 +0000
X-MC-Relay: Junk
X-MailChannels-SenderId: _forwarded-from|65.54.190.201
X-MailChannels-Auth-Id: wwwh
X-MC-Loop-Signature: 1425047163899:3106707822
X-MC-Ingress-Time: 1425047163898
Received: from bay004-omc4s11.hotmail.com ([65.54.190.213]:62858)
by r8-chicago.webserversystems.com with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.82)
(envelope-from <[email protected]>)
id 1YRLre-0003UX-3A
for <snipped>; Fri, 27 Feb 2015 08:26:02 -0600
Received: from BAY167-W96 ([65.54.190.201]) by BAY004-OMC4S11.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.22751);
Fri, 27 Feb 2015 06:26:01 -0800
X-TMN: [1h3HxG5nNbtYJzFfm8xyf2uTq10vpwVB]
X-Originating-Email: [[email protected]]
Message-ID: <[email protected]>
Content-Type: multipart/alternative;
boundary="_3b3851af-3e0e-44e0-90a4-99d05aac07da_"
Reply-To: <[email protected]>
From: Nelson ofori <[email protected]>
Date: Fri, 27 Feb 2015 14:26:00 +0000
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 27 Feb 2015 14:26:01.0125 (UTC) FILETIME=[4F83B550:01D05299]
X-Spam-Status: Yes, score=10.0
X-Spam-Score: 100
X-Spam-Bar: ++++++++++
X-Spam-Report: Spam detection software, running on the system "r8-chicago.webserversystems.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Sir, GOLD DUST/BARS FOR SALE. I am very sorry for the inconvenience
this mail might cause you. I am Luke Mensah, the son of late Chief Fredrick
Mensah. My late father, who happened to be one of the prominent chiefs from
Ashanti Kingdom in Ghana, has large quantities OF GOLD DUST/BARS in stock,
which was part of his monthly wages as a chieftaincy titled man of Ashanti
the Gold Mine home in Ghana West Africa. [...]
Content analysis details: (10.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.9 HK_SCAM_N1 BODY: HK_SCAM_N1
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(nelsonofori8[at]outlook.com)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[65.54.190.213 listed in list.dnswl.org]
1.5 SUBJ_ALL_CAPS Subject is all capitals
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (nelsonofori8[at]outlook.com)
1.0 MISSING_HEADERS Missing To: header
0.0 HTML_MESSAGE BODY: HTML included in message
2.7 MALFORMED_FREEMAIL Bad headers on message from free email service
1.6 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
X-Spam-Flag: YES
Subject: ***SPAM*** GOLD DUST/BARS FOR SALE.
X-AuthUser:
Sir,
GOLD DUST/BARS FOR SALE.
I am very sorry for the inconvenience this mail might cause you. I am Luke Mensah, the son of late Chief Fredrick Mensah. My late father, who happened to be one of the prominent chiefs from Ashanti Kingdom in Ghana, has large quantities OF GOLD DUST/BARS in stock, which was part of his monthly wages as a chieftaincy titled man of Ashanti the Gold Mine home in Ghana West Africa.
More so, I contacted you to know if you can buy our products. We are currently looking for serious buyers or people who can assist us to sell or ship the gold dust / bars to any country abroad. You can as well help us get a buyer if you are not interested in my proposal then, after selling, you will have your Commission. Our offer is not only competitive but also extremely moderate. Should you be interested, please contact me for full corporate offer via-email.
Thank you very much for your cooperation and understanding in advance as I await to hearing from you.
Kindest regards,
Luke Mensah.
Email: [email protected]
Please DO NOT tell a scammer that he has been posted here!
If you wish you can email me at
faizandocherty @ scamwarners [dot] com
How do I find email headers???
How to analyze an email header.
If you wish you can email me at
faizandocherty @ scamwarners [dot] com
How do I find email headers???
How to analyze an email header.
